AG-838
Robot-Fleet Coordination and OTA-Update Governance
EU AI Act
NIST AI RMF
ISO 42001
AGS Embodied AI (Group L) | Embodied AI, Humanoids & Robot Fleets | Version 3.0
Robot-Fleet Coordination and OTA-Update Governance governs the safety of operating many physical agents together — inter-robot collision avoidance and traffic management — and the controlled delivery of over-the-air (OTA) updates to physical agents as a safety-relevant change, together with physical-harm incident reporting and liability attribution across a fleet.
A single update or a coordination failure can affect every robot in a fleet at once. This dimension governs the fleet-scale and update-lifecycle risks that individual-robot safety controls do not cover.
In scope: fleet-level collision avoidance and traffic management; governed OTA updates (staged rollout, validation, rollback) as a safety function; physical-harm incident reporting; liability attribution across manufacturer/integrator/operator for fleet agents.
Out of scope: single-agent force/fail-safe controls (AG-835/836) and validation (AG-837). This dimension governs *fleet-scale coordination and the update lifecycle*.
When physical agents operate as a fleet, risks compound: robots can collide with each other, congest shared space, or — most dangerously — all receive a flawed OTA update that changes safety-relevant behaviour simultaneously across the fleet. A bad update or an uncoordinated fleet can turn a local issue into a mass physical-safety event. Governing coordination and the update lifecycle keeps fleet-scale deployments safe and accountable.
Test 6.1: Staged, Reversible Update
Test 6.2: Inter-Robot Collision Avoidance
Test 6.3: Fleet Halt & Update Integrity
| Score | Criteria |
|---|---|
| 0 | Fleet operates with no inter-robot coordination or OTA-update governance |
| 1 | Collision avoidance and pre-release update validation but no staging/rollback or fleet halt |
| 2 | Traffic management, staged/reversible signed OTA, fleet-wide safe-state, incident reporting |
| 3 | Rollback triggers, liability-attribution records, fleet event logging, agent-isolated update config |
Scenario A — Fleet-Wide Bad Update: A flawed OTA update changing motion behaviour is pushed to an entire humanoid fleet at once; many robots act unsafely simultaneously. Staged rollout with a rollback trigger would have caught it after the first cohort.
Scenario B — Robot-on-Robot Collision: Two AMRs route into the same corridor without traffic management and collide, blocking an exit. Fleet coordination would have deconflicted their paths.
Scenario C — Compromised Update Channel: An unauthenticated update is accepted, altering safety behaviour across the fleet. Signed, integrity-verified updates would have rejected it.
| Requirement | EU AI Act | NIST AI RMF | ISO 42001 |
|---|---|---|---|
| R1: Inter-robot collision avoidance | Art. 15 — Safety, robustness | MEASURE 2.6 — Safety evaluation | Clause 8.1 — Operational control |
| R2: Staged, reversible safety-relevant OTA | Art. 15 — Robustness | MANAGE 4.1 — Post-deployment monitoring | Clause 8.1 — Operational control |
| R3: No instant fleet-wide safety change | Art. 9 — Risk management | MANAGE 1.3 — High-priority response | Clause 8.1 — Operational control |
| R4: Update integrity/authenticity | Art. 15 — Cybersecurity | MEASURE 2.7 — Security and resilience | A.6 — AI system lifecycle |
| R5: Fleet-wide safe-state/halt | Art. 14 — Human oversight (stop) | MANAGE 2.4 — Deactivation | Clause 8.1 — Operational control |
| R6: Incident reporting + liability records | Art. 73 — Serious-incident reporting | MANAGE 4.3 — Incident communication | Clause 9.1 — Monitoring and measurement |
| R7: Fleet event logging | Art. 12 — Record-keeping | MEASURE 2.4 — Production monitoring | Clause 8.1 — Operational control |
| R8: Agent-isolated update config | Art. 15 — Integrity | MANAGE 2.4 — Integrity of controls | A.6 — AI system lifecycle |
> Standards note: align fleet coordination to ISO 3691-4 (multi-vehicle traffic management); treat OTA updates as safety-relevant change under ISO 10218-2:2025 cybersecurity-as-safety provisions; map physical-harm liability to the EU Product Liability Directive (Dir. (EU) 2024/2853) and serious-incident reporting to EU AI Act Art. 73.
Article 15 (robustness, cybersecurity, safety) covers fleet coordination and the integrity of the update channel; Article 73 (serious-incident reporting) covers physical-harm events. AG-838 applies both at fleet scale.
MANAGE 4.1 (post-deployment monitoring and response, including updates) and MEASURE 2.7 (security and resilience) cover governed OTA updates and fleet-coordination safety.
Clause 8.1 (operational control) and Annex A.6 (lifecycle) require controlled fleet operation and change management for physical AI systems.