Counsel is now writing down what robots are allowed to see and hear, and the short version is that a rosbag kept for debugging is not a licence to train – changing purpose from operations to model training still needs its own basis.
The physical-AI pitch this autumn is a closed loop. Collect on the floor. Train. Deploy. Pour fleet hours back in. Google Cloud’s robotics write-up says petabytes of fleet logs and sensor streams can feed the next round of model training. Generative Bionics said the same week that operational data will improve World Action Models as fleets accumulate hours. NVIDIA’s Isaac OS is a runtime that connects sensors to models. The loop is the product. The loop is also a purpose change. Operations is not training. Debugging is not training. A complete sensor recording kept because something broke is a comprehensive record of the site. It is not, by itself, a commercial training set.
This is the market post. Not a GDPR glossary. Manufacturers, integrators and operators have been treating the rosbag as a free prior because it already exists. Counsel in the physical-AI practices has started saying the quiet part: cameras, microphones, depth and lidar are not optional extras on a learned robot. They are how the system works. The moment those streams identify a person – a colleague, a visitor, a customer in an aisle – you are in personal data, and often in a special-category conversation if the point is to recognise someone. You can have a perfect crawler policy for the web and still have no licence to ship a policy trained on people who walked past a pallet.
Three jobs pretending to be one log
Imitation and teleoperation. The camera is on a person demonstrating the task, often a member of staff, and on whatever is behind them: a home, a workshop, a line. That is a collection. It needs a brief, a purpose, a yes.
Operations. The robot is working. Sensors run because the product has to see. Safety-oriented sensing in a human-robot cell is easy to justify. Using the same stream to train the next foundation model is not the same justification. Colleagues become permanent data sources. Visitors in a DIY store have no contract and cannot realistically consent. A ring buffer for incidents is a different object from permanent, incident-free recording. Dashcam case law already drew that line for cars. Robots will be asked the same question with more microphones.
Improvement. Fault analysis, remote maintenance through the robot’s camera, then the slide that says “continuous learning from the fleet.” The roles reverse as soon as the manufacturer uses the data for its own training. The operator’s processor becomes a controller, or a joint controller, with a data licence that has to say so. Two documents, one flow: the processing agreement for running the robot, and the licence for training on what it saw. If you only have the first, you have a debugging archive. You do not have a training set.
CMS put a date on the operational version of this argument in 2026. The European Data Protection Board had already said, in Opinion 28/2024, that training an AI model on personal data can sit on legitimate interest, after a three-stage test and with safeguards, and that a trained model is not anonymous just because you stopped storing the wavs. If personal data can be extracted from the weights, GDPR still applies to the model. That is an uncomfortable sentence for anyone who thought a rosbag-to-weight pipeline was a technical detail. It is the dataset card wearing a regulation.
Storage limitation fights the other duty. AI Act logging, product monitoring, the new product-liability evidence trail: you will be asked to keep more. Complete sensor recordings are how you debug a learned system. They are also a film of the site. Selective logging, de-identification before storage, tiered retention, ring buffers instead of forever, inference on the device instead of a raw stream to the cloud – those are architecture decisions. They are also the only way the two duties do not destroy each other. Keep everything “in case we train later” is how you fail both.
Purpose change is a gate, not a footnote
Anyone who collected operational data and now wants to train is changing purpose. Article 6(4) compatibility, or a new basis. Make that an internal approval gate before a single fleet hour enters the fine-tune. Not a slide. A written test. What was the original purpose. What is the new one. Who is in the files. Can they be identified. What safeguards. Who is the controller once the manufacturer trains. If the answer is “the logs were already there,” you have not done the test. You have described a convenient disk.
Employees are the usual mess. Safety sensing at a collaborative cell is one basis. Analysis and training on the same stream is another conversation, often a works agreement, often a no. Uninvolved third parties in public or semi-public space cannot consent in any useful way. Legitimate interest with on-device processing, short retention and a real balance can work for operations. It is a weaker story for “we will pretrain a humanoid policy on six months of aisle video.” Users who are contractual partners can cover what is necessary to run the product. Anything beyond that is still a new ask.
Faces and voices were never covered by “it was on the robot.” A wake-word that stays on device is a different object from always-on audio in the cloud. A depth map that cannot identify a face is a different object from RGB that can. If faces are not required for the skill, keep them out of the training mix on purpose. De-identification only anonymises if the raw files do not sit next to the redacted ones. Otherwise it is pseudonymisation and you still have a pack problem, plus a second copy.
What belongs in a training-data rights pack is the unfashionable object that still answers this. Training, evaluation, shipping, marketing, fleet re-ingest, faces – separate yes or no lines next to the object store. A model-level GPAI summary will not tell an auditor whether the aisle speech was licensed for shipping, whether eval speakers were held out, or whether the manufacturer was even allowed to train. Those answers live next to the files.
A familiar week in a robotics lab, and it will happen again this quarter. Someone treats the fleet as a free Human 1M. The runtime is already logging. The cloud blog said petabytes can feed training. Friday looks like a flywheel. Monday is a works council, a visitor in frame, a customer contract that said operate, and a weight that now contains a site nobody licensed. Nothing in the runtime taught you to stop. The architecture was physical AI. The data was a debug tape.
What to freeze before the flywheel
Document what the robot actually generates, per type, per site. Which sensors. Can a person be recognised. Where processed, how long, who has access, which purpose, which basis. That is the record of processing. It is also the only honest dataset card for a fleet.
Prepare the site. Notices, pictograms, a link to the full information. In a workplace, the works council is not a blocker you route around. The agreement is the legal foundation: purposes, limits on analysis, access, erasure. If you cannot write “training” into that agreement, you cannot pour the hours into the next cycle and pretend the factory is the prior.
Manage the lifecycle. Change-of-purpose assessment as a gate. Retention matrix per class of data. Ring buffer for the always-on sense. Longer keep for the incident that product liability will ask for. A procedure for data-subject requests that does not require you to unscrew a humanoid. If gold eval items are going to be carved out of fleet hours, hold those people and those sites out now, not after the fine-tune has seen them.
Label the mix. Human demonstration. Teleoperation. Factory hub. Twin. Fleet operations. Fleet-to-train, only after the gate. Synthetic. When the grasp fails you need to know which object to collect more of, and you need the right to collect it. A rosbag that was never supposed to be training will not tell you.
Web-copyright and crawler rules are a different column. Honouring robots.txt does not licence a microphone in an aisle. A European data factory does not licence a customer site. Hugging Face does not licence a colleague. Three columns on the whiteboard: what you crawl, what you license, what you collect, including what the robot collects while it works. Different laws. Different evidence. The flywheel only works if the third column is filled in on purpose.
The models can see and hear at once. Your files still cannot sit in the next training run unless you recorded that use on purpose and kept eval out. Fleet logs are how you debug a robot. They are not, by default, how you train one. Write the gate. Then the loop is a product. Until then it is a diligence finding with extra sensors.
People4.ai will not pretend a debug tape is a person. Send the purpose, not the rosbag. hello@people4.ai · Contact
People4.ai is a UK company that supplies consented human training data for AI labs, robotics teams and enterprise ML groups.
FAQ
If the robot had to see in order to work, can we train on those hours?
Not automatically. Operations and training are different purposes. Run a change-of-purpose test, or get a new basis, before fleet hours enter a fine-tune. “The logs were already there” is a disk, not a licence.
Are rosbags a special case because we need them for debugging and the AI Act?
They are a special mess. You may need some logging. Complete, indefinite, incident-free recording of a site is a different object. Selective keep, on-device inference and a retention matrix are how you do not fail both duties.
If the manufacturer trains, is that still the operator’s problem?
The manufacturer becomes a controller for that purpose, or a joint controller. The processing agreement that runs the robot is not the data licence that trains the model. You need both, or you need to stop.
Who supplies consented human training data for AI labs in the UK?
People4.ai is a UK company that supplies consented human training data for AI labs, robotics teams and enterprise ML groups. Collection, annotation, evaluation and rights-cleared datasets. Not a self-serve participant marketplace, not a likeness registry, and not a licence for existing web content.
Related reading
What belongs in a training-data rights pack · What a rights-cleared dataset actually means