Industrial robotics procurement guide. Last reviewed:
Procuring industrial robots or physical AI is mostly a contract problem about who is responsible when people and machines share a floor. Before price, settle five things in writing: who carries the safety responsibility across the vendor, the integrator and you, which edition of the robot safety standard applies, who owns the operational data and trained models, how software and security updates are handled, and what happens at exit. This guide sets out what to ask for. It is procurement guidance, not a safety assessment, and a competent engineer must still carry out the risk assessment.
Who is responsible for safety when a robot is bought from one party and installed by another?
Usually three parties are involved: the robot manufacturer, a system integrator who builds the cell, and the organisation that operates it. Responsibility for the finished system often sits with the integrator and the operator, not the manufacturer of the arm alone. Under the model WHS laws, a person conducting a business or undertaking has a primary duty to ensure, so far as is reasonably practicable, the health and safety of workers at the workplace, and that duty is technology-neutral. In many cases a robot is treated as plant. See the Safe Work Australia plant duties and the model code of practice for managing risks of plant.
In the contract, name who performs the risk assessment, who signs off the safeguarding, who trains operators, and who holds liability for each. Silence on any of these defaults to the operator.
Which robot safety standard applies?
The ISO 10218 series for industrial robots was revised in 2025, its first major revision since 2011. The revision integrates the requirements of ISO/TS 15066 on collaborative robot applications, and makes functional safety requirements more explicit (A3 FAQ on the updated standard, The Robot Report). Ask each vendor and integrator which edition they design and certify to, and whether the cell you are buying meets the 2025 requirements or an earlier edition. A system built to the earlier edition is not automatically wrong, but you should know which you are buying.
What should the contract say?
| Topic | What to require | Why it matters |
|---|---|---|
| Safety responsibility | A written allocation across vendor, integrator and operator, with named sign-off for the risk assessment and safeguarding | Gaps default to the operator |
| Standards and evidence | Edition of ISO 10218 and related safety standards, test reports, and the safety function performance level | Shows what was actually verified |
| Training and documentation | Operator and maintenance training, manuals, and updates when the system changes | Training gaps are a common incident cause |
| Incident response | Who is notified, response times, root-cause reporting, and cooperation with a regulator | Accountability across partners |
| Data and models | Ownership of operational data, trained models, calibration and process settings, with export and deletion on exit | Prevents lock-in to a vendor platform |
| Software and security | Update cadence, patch windows, remote access controls, and security obligations | Connected robots are part of your OT attack surface |
| Support and spares | Service levels, spare parts availability and end-of-life notice | Downtime costs more than the licence |
| Exit | Transition help, handover of configuration and documentation | Without it the supplier controls the price at renewal |
How is physical AI different from a conventional robot?
A conventional robot repeats programmed motions inside a fixed safeguarding design. A system that learns or adapts changes behaviour after delivery, which creates three procurement questions. Who validates a change, and who is responsible if a retrained model alters the robot’s behaviour? Does retraining use your operational data, and who owns the resulting model? Can you freeze a validated version while updates are tested? Treat these as contract terms, and ask the vendor how it keeps a safety-validated configuration separate from a learning one.
How should you compare providers?
- Fix the requirements first, ranked with MoSCoW, including the safety and data terms above.
- Ask every provider and integrator for the same evidence: standards edition, test reports, references at a similar site, and sample contract terms.
- Run a site assessment or pilot with a pass mark agreed in advance.
- Compare total cost over the term, including integration, training, support, spares and updates.
- Keep the final decision with the organisation that carries the operational risk.
The structured comparison methods and vendor evaluation steps guides cover the scoring mechanics.
Where do cybersecurity and OT risk fit in?
Connected robots and their controllers are operational technology. Ask about network segmentation, remote support access, patching responsibility and monitoring. The OT and ICS security procurement guide covers the contract terms in more detail.
What is CYBORIUM’s role?
CYBORIUM structures the procurement: requirements, a whole-of-market scan, evidence-based scoring, normalised pricing and the contract position. The client chooses and contracts directly with the provider. CYBORIUM does not perform safety assessments or certification, which need a qualified engineer. The provider selected pays CYBORIUM a capped, success-based fee, and the rate is disclosed on request. See how that works.
Automation is a contract and governance decision as much as an engineering one. The Commonwealth Procurement Rules make value for money the core test and expect decisions to be documented, and the ANAO has repeatedly found documentation, not price, is where entities fall short. Writing the safety allocation and data ownership into the contract before signing is the cheapest control available.
Sources
- Updated ISO 10218: Answers to Frequently Asked Questions, Association for Advancing Automation.
- ISO 10218 industrial robot safety standard receives major overhaul, The Robot Report.
- WHS duties for plant, Safe Work Australia.
- Model code of practice: Managing the risks of plant in the workplace, Safe Work Australia.
- Commonwealth Procurement Rules, Department of Finance.
- Procurement and contract management, Australian National Audit Office.
Where to read more
- COO strategic sourcing
- OT and ICS security procurement
- MoSCoW prioritisation
- How to compare procurement advisers
Industrial robotics procurement in short
Industrial robotics procurement is a contract exercise as much as an engineering one. Start industrial robotics procurement with the safety questions: settle who carries safety responsibility, which ISO 10218 edition applies and who owns the data and trained models before you sign. Good industrial robotics procurement also fixes how software and security updates are handled and what happens at exit. Use this guide as a starting checklist for industrial robotics procurement.
Want this applied to your own shortlist? Get the Procurement Readiness Brief or tell us about your project. The client pays CYBORIUM nothing and chooses the provider.
Frequently asked questions
Who is responsible for robot safety in Australia?
Responsibility is usually shared across the manufacturer, the system integrator and the operator, and the finished system often sits with the integrator and operator. Under the model WHS laws a person conducting a business or undertaking has a primary duty to ensure worker health and safety so far as is reasonably practicable. The contract should allocate each task in writing.
What changed in the ISO 10218 robot safety standard?
It was revised in 2025, its first major revision since 2011. The revision integrates ISO/TS 15066 on collaborative robot applications and makes functional safety requirements more explicit. Ask which edition a system is designed and certified to.
What should a robotics contract cover?
Safety responsibility, the standards edition and test evidence, training and documentation, incident response, ownership of operational data and trained models, software and security updates, support and spares, and exit terms.
How is buying physical AI different from buying a conventional robot?
A learning system can change behaviour after delivery. Contracts should say who validates a change, who owns the retrained model and the data behind it, and whether a validated version can be frozen while updates are tested.
Does CYBORIUM assess robot safety?
No. CYBORIUM structures the procurement and records the evidence. Safety assessment and certification need a qualified engineer, and the client makes the final decision.
