Short answer
EU buyers of robotics training data face two separate questions: whether personal data in the recordings has a lawful basis and meets GDPR duties, and whether the AI system built from the data falls under the AI Act's documentation obligations. Neither is answered by the supplier's license alone. Ask for provenance, personal-data inventories and documentation early. This is not legal advice.
Two regimes, two separate tests
The GDPR regulates the processing of personal data, whatever technology uses it. The AI Act regulates AI systems and general-purpose AI models according to their role and risk. A robotics dataset can touch both: workplace video of identifiable workers is likely to be personal data, and a model trained on it may sit inside an AI Act category. They ask different questions and may point to different parties.
This page lists diligence questions for EU-based buyers, and for non-EU buyers who serve EU users. It is not legal advice, and it does not tell you which provisions apply to your system; that needs counsel. For the underlying consent and identification issues, see worker consent and identifiable people in workplace recordings, and for the wider contract picture see licensing terms for robotics training data.
What the two instruments are
Regulation (EU) 2016/679, the General Data Protection Regulation, was adopted on 27 April 2016, published in the Official Journal as L 119 of 4.5.2016, and applies from 25 May 2018 (GDPR). Three points matter for robotics data:
- Art. 4(14) defines biometric data, and Art. 9(1) lists special categories of data, including biometric data processed for the purpose of uniquely identifying a natural person.
- Art. 88(1) lets Member States set more specific rules, by law or collective agreement, for processing employees' personal data in the employment context. Workplace recordings of employees may therefore be governed by national rules and works-council agreements in addition to the Regulation itself.
- Confirm against the source, with counsel, how the Regulation treats video, audio and gait or pose data derived from people.
Regulation (EU) 2024/1689, the Artificial Intelligence Act, was adopted on 13 June 2024, published in the Official Journal in July 2024 and entered into force on 1 August 2024. It includes specific rules for general-purpose AI models, including those with systemic risk. It excludes AI systems used exclusively for national security and systems developed solely for scientific research and development (AI Act). Which obligations apply to which actors, and from what date, are questions for counsel; this page does not state them.
How the issues map to a dataset
| Dataset feature | GDPR question | AI Act-related question |
|---|---|---|
| Workers visible or audible | Lawful basis, notice, purpose, employee context under national rules | Does your system or model fall into a category with documentation duties? |
| Face, voice, gait or pose features | Whether processing is for uniquely identifying a person (biometric data) | Whether any use of such features changes the system's category |
| Supplier outside the EU | Transfer mechanism and who is controller or processor | Who is provider and who is deployer |
| Labels and annotator notes | Whether they identify individuals | Whether label quality is documented |
| Dataset provenance | Record of origin and purpose | Ability to document where training data came from |
| Redaction or blurring | Whether data remains personal data after processing | Effect on data representativeness |
Pseudonymization and blurring do not by themselves resolve legal questions. Ask counsel whether the processed data can still be linked to individuals, which is a legal and technical assessment, not a label a supplier can apply.
Why robotics data differs from text and image data
Much public discussion of AI training data centers on web-scale text and images. Robotics collections have features that change the analysis:
- Continuous capture. Video of a work shift can record many people incidentally, not just the demonstrators.
- Employment context. Check how any employee consent or notice was obtained, and which national employment rules apply.
- Derived data. Pose, hand-tracking and gaze streams describe individuals' bodies and behavior even when faces are hidden.
- Site data. Footage can record customers, third parties and confidential business information; see third-party content in workplace recordings and biometric privacy and workplace video.
- Model relationships. Put the question of how trained models relate to personal data in the training set to counsel, and see model weights, derivatives and redistribution.
What documentation to request
Buyers preparing for either regime benefit from the same underlying records:
- Origin and purpose. Who recorded, when, under what notice and for what stated purpose (provenance and chain of custody; see provenance and chain of custody).
- Personal-data inventory. Which streams and labels contain or derive from information about people.
- Legal basis records. The basis the supplier relied on for the original recording, and whether it extends to licensing for AI training.
- Role allocation. Who is the controller and who the processor at each stage.
- Processing history. What redaction, pseudonymization and filtering were applied, with versions.
- Retention and deletion. What deletion mechanisms exist and how they flow to derived data; see retention, deletion and audit rights.
- Datasheet or data card. A structured description of composition and collection; see datasheets and data cards for robotics datasets.
Illustrative documentation pack for an EU-bound purchase
# Illustrative only - synthetic values; counsel decides what is required
dataset_id: workplace_task_video_v0
origin:
recorded_by: site_017 (synthetic), 2024-03 to 2024-09
stated_purpose_at_recording: process_training (not AI training)
personal_data_inventory:
video: faces and bodies of staff, incidental visitors
audio: removed
derived: hand_pose tracks, no face embeddings
legal_basis_record: supplier statement and notice text attached
roles: supplier_controller; buyer_processor_or_controller: to be settled
processing: faces blurred v3; pseudonymous operator IDs
transfers: location and mechanism stated
retention_and_deletion: process and contact stated
data_card: attached
A statement that the original purpose was process training and not AI development is the kind of fact that makes counsel's job possible, and may require the supplier to revisit the original notice.
Limitations
- Documentation does not establish compliance. It makes review possible.
- Some datasets may not be suitable for EU use: if no basis exists for the original recordings, ask counsel whether anything done later can address that; do not assume redaction will.
- Whether the AI Act applies to a research or development effort depends on its scope exclusions and the eventual use; do not assume an exclusion without advice.
- National employment rules and works-council agreements vary by Member State.
- Rules continue to develop, so check current guidance for the date of purchase.
Questions to ask suppliers
- Under which legal basis were the recordings made, and does it cover licensing for AI training?
- Which fields, streams and labels contain or derive from personal data?
- Were employee representatives or works councils consulted where relevant?
- Is any biometric processing, such as face recognition or voiceprints, applied or possible?
- Who is controller and who is processor for each stage, in writing?
- Where is the data stored, and what transfers occur?
- Can the supplier produce a datasheet or data card describing origin, composition and processing?
- How are deletion or objection requests handled, including in derived datasets?
- What audit access can the buyer have to verify these answers?
Discuss your requirements
If you need data suitable for EU use, describe the geography, de-identification and licensing requirements to SourceX. SourceX looks for US businesses that hold suitable material, checks the data and the supplier's licensing permissions, and coordinates the license and delivery. Buyers can be anywhere; suppliers are US businesses. A request does not guarantee a match; SourceX follows up about potential sources. See the humanoid training data guide and the procurement hub.
Discuss your humanoid training-data requirements with SourceX
Sources
- Regulation (EU) 2016/679 (General Data Protection Regulation) — GDPR adoption and application dates; Art. 4(14), Art. 9(1) biometric data; Art. 88(1) employment-context rules.
- Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) — AI Act adoption, entry into force, general-purpose model rules and scope exclusions.