The Model Hardware Standard collapses weeks of instrument integration into hours. Regulation (EU) 2023/1230, which applies from 20 January 2027, has a name for whoever does that to a machine - but only if the limit lives in a sentence rather than in code, and only if the machine's maker never blessed the install.
Tips, corrections, or questions? support@omniscient.media
Get this every weekday.
The Omniscient Bulletin: consequential AI, explained and evaluated. 5 to 7 items a day with the take, not the recap.
Sign in to join the discussion.
On August 27, Anthropic opened a research preview of the Model Hardware Standard, which it describes as "a shared specification for AI agents to safely operate physical devices."[1] The pitch is an integration one. Setting up lab or factory hardware "typically takes a lab or manufacturing facility weeks, if not months," because "most devices don't communicate with each other," and MHS "reduces this integration work to hours or minutes."[1]
That is a claim about engineering time. It is also, in Europe, a claim with a legal shape, because the way MHS saves those weeks is by converting hardware integration into a software change. From 20 January 2027, when Regulation (EU) 2023/1230 replaces the Machinery Directive, a software change to a machine's safety behavior is one of the specific things that can transfer manufacturer status - and a mandatory third-party assessment - to whoever made it.[2]
Whether that happens on any particular MHS installation is, at the moment, impossible to determine from outside the preview, and that is not a rhetorical hedge, because it turns on a technical detail Anthropic has not published. The argument below is mostly an attempt to say precisely which detail, and precisely who would be holding the liability if it falls one way rather than the other.
The design is straightforward: MHS reduces any instrument to standardized drivers built on simple primitives - commands like "read," for example "get temperature," and "write."[1] On top of that sits the interesting part: "the MHS driver contains tags that let the user write this information directly in natural language," capturing the operating knowledge that normally lives in a PDF manual.[1] The driver then generates a reference file describing what a device can measure, "what can be adjusted, and what safety limits will be enforced," and Anthropic says "this file gives the agent everything it needs to know to operate the device."[1]
Agents reach all of this through the Model Context Protocol, a command line, or code APIs, with shared memory letting multiple instruments coordinate in real time. It is model-agnostic: "any agent harness can access it using standard protocols."[1]
Note the word "enforced." It is not marketing drift, and a partner is already relying on it. A researcher at HHMI Janelia is quoted saying that because "MHS enforces device-level safety limits, I don't need to worry about the agent accidentally using excess laser power."[1] That is a scientist describing a safety property he no longer has to think about.
So where does the enforcement actually happen? There are two possibilities and they are not close to equivalent. A limit might be clamped in the driver code, in which case the deployed artifact is deterministic software that refuses out-of-range commands regardless of what any model asks for. Or a limit might live in one of those natural-language tags, read by the model before it acts, in which case the thing doing the enforcing is a language model exercising judgment.
The public record doesn't say which: modelhardwarestandard.com is a landing page with an application form, carrying no specification, no schema, no driver format, no tag syntax, and no repository.[3] The standard is open to selected labs and manufacturers, and Anthropic says the open-source release will follow once safety evaluations and best practices are developed.[1] We flagged that ambiguity the week the preview opened;[13] this piece is about which of the two answers puts a lab in front of a notified body. Until the specification is published that question stays open, and most of what follows depends on the answer.
Regulation 2023/1230 was adopted in June 2023 and applies from 20 January 2027, and four of its provisions matter here in sequence.[2]
Article 3(16) defines a "substantial modification" as a modification "by physical or digital means after that machinery or related product has been placed on the market or put into service, which is not foreseen or planned by the manufacturer, and which affects the safety of that machinery or related product, by creating a new hazard, or by increasing an existing risk."[2] The phrase "or digital" is doing real work; software is explicitly in.
Article 18 says what follows. "A natural or legal person that carries out a substantial modification of machinery or a related product shall be considered to be a manufacturer for the purposes of this Regulation and shall be subject to the obligations of the manufacturer set out in Article 10." That person must "ensure and declare on its sole responsibility" that the result conforms.[2]
Article 25 then sets the assessment route, and it binds "the manufacturer or the natural or legal person referred to in Article 18" - the substantial modifier is named directly in the conformity obligation. For categories in Annex I Part A, the available procedures are EU type-examination followed by conformity to type, full quality assurance, or unit verification - every one of which involves a notified body.[2] Internal production control, the self-assessment route, appears only in Article 25(3), which governs Part B.[2] That contrast is what people mean when they say self-declaration stops being enough, and TNW, which raised the Machinery Regulation angle on MHS before anyone else I can find, put it exactly that way.[4]
Which brings us to Annex I Part A, whose fifth entry reads: "Safety components with fully or partially self-evolving behaviour using machine learning approaches ensuring safety functions." The sixth covers machinery with such systems embedded, "that have not been placed independently on the market, in respect only of those systems."[2]
There is a wrinkle that cuts one way before it cuts back. The identical category appears a second time, in Part B at item 19, word for word - and Part B is the list that allows self-assessment. But Article 25(3) attaches a condition to it: internal production control is available only where the product was "designed and constructed in accordance with the harmonised standards or common specifications specific to that category of machinery or related product covering all the relevant essential health and safety requirements." Where it was not, the manufacturer, "including a natural or legal person referred to in Article 18," must fall back to type-examination, full quality assurance or unit verification.[2] No such standards exist yet, which is the subject of a later section. Until they do, both lists end at a notified body.
One caveat on novelty, because a compliance reader will raise it otherwise. Retrofit liability is not an invention of 2027; the notion that modifying a machine can make you its manufacturer already exists in practice under the outgoing Directive. What is new is the explicit inclusion of digital means in 3(16), the two machine-learning entries in Annex I Part A, and the removal of the self-assessment option for them.
Now run the fork from the second section through Annex I Part A, because the subsumption is where this argument is weakest and it deserves to be stated that way.
Suppose the limits are clamped in driver code. Then the artifact sitting on the instrument is deterministic generated code. It may have been written by a model, but code generated by machine learning is not code that behaves "using machine learning approaches." Item 5 asks about the behavior of the safety component itself, and item 6 about an embedded system's behaviour. On this reading neither entry is engaged, neither Annex I list applies, and a notified body never enters the picture.
Now suppose the limits are tags the model reads at runtime. The thing ensuring the safety function is then a model, usually a hosted one reached over MCP. It is not embedded in the machinery, so item 6 is a poor fit. And it is a service rather than a product placed on the market, which sits awkwardly with item 5 and with Article 3(3)'s definition of a safety component as "a physical or digital component, including software… which is designed or intended to fulfil a safety function and which is independently placed on the market."[2] European product legislation is built around products, and a remote model is not obviously one.
It would be tidy to say that items 5 and 6 between them cover both the standalone and the embedded case, leaving no way to package around them, but that reading has a gap precisely where MHS lives - machine learning that is neither independently marketed nor embedded, but remote.
The strongest bridge I can construct runs through regeneration. A driver an agent can rewrite when the hardware or the task changes is arguably a system with partially self-evolving behaviour, even if any given snapshot of it is deterministic. That is an argument rather than a holding, and I would not want to make it to a notified body without a lawyer.
There is a further problem underneath all of this, which is that "self-evolving behaviour" is nowhere defined in the Regulation. Pierrick Balaire, a global business director at Intertek, has argued for a capability-based reading under which "a system trained before deployment but designed with the inherent capability to adapt its behaviour based on that learning would still be considered to have 'self-evolving behaviour'" - which would pull frozen models into scope.[5] He also concedes the underlying problem, that the Regulation "does not provide an explicit technical definition of 'self-evolving behaviour,' leaving industry professionals to navigate a complex interpretive landscape."[5] That is one certification body's interpretation of an undefined term, and it addresses a different gap than the two above: it speaks to whether a frozen model counts, not to whether there is any model in the artifact at all, or whether a remote service is a product.
Even where the subsumption holds, Article 3(16) narrows the opening considerably, in three ways worth separating.
First, the definition does not stop at "affects safety." It continues: the modification must create a hazard or increase a risk "which requires: (a) the addition of guards or protective devices to that machinery or related product the processing of which necessitates the modification of the existing safety control system; or (b) the adoption of additional protective measures to ensure the stability or mechanical strength of that machinery or related product."[2] There is no third limb. Installing a driver on a liquid handler plausibly satisfies neither, and the live question is whether granting an agent write access to a machine's actuator limits amounts to modifying its existing safety control system. I think that is genuinely arguable in both directions.
Second, and easy to miss, Article 3(16) applies only to modifications "not foreseen or planned by the manufacturer."[2] Anthropic's announcement lists hardware vendors adding MHS support, among them Automata, Danaher, Doosan Robotics, MBF Bioscience, QIAGEN, Tecan and Universal Robots.[1] For an instrument whose maker ships or documents MHS support, the integration is foreseen by definition, and Article 18 simply never engages.
Third, Article 2(2)(m) excludes from the Regulation entirely "machinery or related products specially designed and constructed for research purposes for temporary use in laboratories."[2] This looks at first like it removes the whole subject, since MHS is being trialled in laboratories. Read the words, though: specially designed and constructed, for temporary use. That describes a bespoke rig built for one experiment, not a catalog liquid handler or a commercial robot arm in continuous service.
Put the three together and the exposure moves somewhere unexpected. It is thinnest at the research institutions Anthropic showcases - the University of Washington labs, Carnegie Mellon, Janelia - whose custom instruments have the best claim on the Article 2 exclusion, and thickest in advanced manufacturing and in commercial laboratories running standard catalog hardware, which is precisely the market the standard is aimed at.
So the chain can fire, though nothing about installing MHS makes it fire by itself.
Suppose the chain does fire: an integration that clears Article 3(16), performed on an instrument whose maker never anticipated it, landing in Annex I Part A, so that the lab now needs a notified body. What does that body check the driver against?
Annex III carries the essential health and safety requirements, and Article 20 grants a presumption of conformity to products built to harmonised standards whose references have been published in the Official Journal.[2] Those standards are late: writing in February 2026, Intertek - a certification body with a direct commercial interest in being ready for this - reported that none had yet been published under the Regulation, the Commission having received the first phase of drafts on 20 January 2026.[6] Nothing had changed by early September: the Commission's own list of harmonised standards for machinery still cites only Directive 2006/42/EC.[14] That absence also keeps the Part B self-assessment route shut, because Article 25(3) opens internal production control only to products built to category-specific harmonised standards.
The deeper problem is that Annex III does not yet contain requirements written for machine learning at all, and the fix is already scheduled. In July 2026 the Digital Omnibus on AI, Regulation (EU) 2026/1744, inserted a new paragraph into Article 8 requiring the Commission to "adopt delegated acts… to amend Annex III… by adding health and safety requirements in respect of Artificial Intelligence (AI) systems that are classified as high-risk," where those systems are a safety component in, or are themselves, a product covered by the Regulation. Those requirements must reflect Chapter III Section 2 and Articles 17, 19, 72 and 73 of the AI Act. The paragraph then sets its own clock: "Those delegated acts shall apply by 2 August 2028."[2]
So mandatory third-party assessment begins on 20 January 2027, and the AI-specific criteria that assessment is eventually meant to apply arrive by 2 August 2028, eighteen months later. Mati Melchior laid this window out on Physical AI Safety in August, and I think the reading is correct.[7]
It is worth being precise about what that does and does not mean. A notified body can still assess a machine in the interim against Annex III as it currently stands, and a competent one will. What is absent is the AI-specific yardstick, and the presumption of conformity a published harmonised standard would supply, which are together what make a conformity assessment predictable rather than a negotiation.
Set that beside Article 18 and the two compound. The party carrying the obligation during those eighteen months need not be the company that built the machine. It can be the laboratory that installed a driver, which would then be responsible for certifying conformity against AI criteria the Commission has not yet adopted.
There is a reflex, when a large AI company announces a hardware standard, to say the industry already had several. It did, and dismissing them is the wrong move, because the reason they did not solve this problem is the interesting part.
SiLA is not a failed project: its own organization claims "over 1700 members from all over the world" and describes SiLA 2 as "recognized as the best established and most commonly used laboratory communication standard in the world" - a self-description on its own website, and worth reading as such, but not the profile of something abandoned.[8] OPC UA LADS completed version 1.0 on 14 December 2023 and lists twenty-eight sponsoring companies, including Agilent, Waters, Shimadzu and Eppendorf.[9] These are serious efforts with serious backing.
And yet Anthropic can still credibly tell a lab that integration takes weeks, and labs recognize the description. The gap between having a standard and having interoperability is per-device implementation work: somebody has to write and maintain the driver for each instrument, and that somebody has historically been a human. Tecan understood this well enough to build and give away tooling for it, publishing an open-source, royalty-free SDK for SiLA 2 in SLAS Technology in 2023,[10] and Tecan now appears on Anthropic's MHS vendor list too.[1]
This is the strongest argument for MHS and it deserves stating plainly: if an agent can write the driver, the per-device cost that has throttled every previous standard drops toward zero, and the coordination problem that comes with it - everyone must invest at once, nobody benefits from going first - stops binding. Anthropic's partner results are consistent with that: Carnegie Mellon reportedly integrated instruments with fundamentally incompatible interfaces in eight hours rather than several weeks.[1]
There is a live technical objection that MHS routes around ROS 2, the robotics middleware that industrial and academic robotics already runs on, in the same way MCP was accused of routing around prior protocol design. I record it without adjudicating it; the answer depends on the specification, which is not public.
The Article 18 exposure exists only for instruments whose manufacturers have not blessed the integration. Every vendor that adds official MHS support converts an unforeseen modification into a foreseen one and extinguishes the exposure for its own hardware. The legal risk is therefore transitional, largest in the gap between a standard arriving and the machine builders adopting it, and it shrinks as MHS succeeds.
The exposure does not disappear, though; it moves. A vendor that ships a machine whose safety function runs on a self-evolving model is an ordinary manufacturer rather than a substantial modifier, and Annex I Part A reaches it directly through Article 25(2).[2] Blessing the integration retires the lab's Article 18 problem by taking on the vendor's own, and that second exposure grows as MHS spreads.
It would be reasonable to assume that giving MHS away as open source puts Anthropic outside all of this. The Regulation does not obviously agree.
Article 3(11) defines "making available on the market" as "any supply of a product within the scope of this Regulation for distribution or use on the Union market in the course of a commercial activity, whether in return for payment or free of charge," and Article 3(12) makes "placing on the market" the first such supply.[2] The operative test is commercial activity: charging nothing is explicitly not a defense, and unlike the AI Act, the Cyber Resilience Act and the revised Product Liability Directive, this Regulation contains no free-and-open-source carve-out anywhere, including in its scope article.[2]
Two questions follow, and I want to pose rather than answer them. Is a distributed MHS driver "a product within the scope of this Regulation"? A bare specification almost certainly is not; a shipped driver that fulfils a safety function is arguable. And is a commercial AI laboratory's release of a standard that drives demand for its own models supplied "in the course of a commercial activity"? That phrase has been read broadly in EU product law.
What I would not do is reach for the obvious cynical reading, that MHS is a landgrab dressed as a gift. The MCP precedent cuts against it: in December 2025 Anthropic donated the Model Context Protocol to the Agentic AI Foundation, a Linux Foundation body it co-founded with Block and OpenAI, with support from Google, Microsoft, AWS, Cloudflare and Bloomberg.[11]
Anthropic is candid about the limits here, noting that "as a large language model, Claude learns about the physical world through text and images, meaning its spatial and physical reasoning have limitations that still require expert oversight," and that running agents over long monitoring windows carries compute costs to weigh against researcher time saved.[1] When we looked at Ginkgo's autonomous lab in May, the conclusion was that AI had removed the bench as the bottleneck and left governance as the binding constraint.[12] MHS is the plumbing for that shift, and the first external body scheduled to grade any of it is a machinery regulator.
The most instructive number in the announcement is QuEra's, and it is Anthropic's account of a partner's run rather than an independent result. An agent loop rewrote a laser relock routine as a decision tree overnight, and by morning recovery was taking about six seconds and working 96 percent of the time, against the 150 seconds and 58 percent it started from. The finished script was then tested against the same randomized disturbances with no agent involved: across 700 trials it recovered the correct lock 695 times, a 99.3 percent success rate, the hardest cases taking ten to fourteen seconds against the five to ten minutes a human at the bench would need. What Anthropic ended up with, in its own words, was "a deterministic, fully inspectable script capable of running in production without an AI agent controlling it."[1] That answers both of Anthropic's stated objections at once, since a deterministic artifact needs no physical intuition at runtime and costs nothing to monitor.
It also produces the only version of this system a notified body could realistically assess: a checkable artifact with limits you can read, test and sign off. And by the argument in the fourth section, that same artifact is probably the one that never needs assessing, because deterministic generated code has no self-evolving behaviour to regulate.
So the open-source release is worth reading closely, and there is one question to read it for. If MHS drivers turn out to clamp their safety limits in code, most of the legal uncertainty here dissolves and the engineering gets better at the same time. If those limits are sentences a model is trusted to honor, then somewhere in Europe, sometime after 20 January 2027, a commercial lab is going to install a driver on a catalog instrument and become its manufacturer without anyone in the building knowing it happened.
…27, 2026 We’re opening a research preview of the Model Hardware Standard (MHS), a shared specification for AI agents to safely operate physical devices, to a first group of scientific research labs and advanced manufacturers.…
…It typically takes a lab or manufacturing facility weeks, if not months, to set up and integrate their hardware.…
…device’s general characteristics, such as what it can measure, what can be adjusted, and what safety limits will be enforced.…
…And because MHS enforces device-level safety limits, I don’t need to worry about the agent accidentally using excess laser power, for example, which risks bleaching the fluorescent molecules and degrading the…
…This took about eight hours, versus the several weeks a vendor-built setup typically takes.…
…Across 700 trials, it recovered the correct lock 695 times, a 99.3% success rate.…
…The end product was a deterministic, fully inspectable script capable of running in production without an AI agent controlling it.…
…evaluations and develop best practices for AI systems operating physical equipment, ahead of making the standard open source.…
…As a large language model, Claude learns about the physical world through text and images, meaning its spatial and physical reasoning have limitations that still require expert…
…Safety components with fully or partially self-evolving behaviour using machine learning approaches ensuring safety functions.…
…machinery or related product has been placed on the market or put into service, which is not foreseen or planned by the manufacturer, and which affects the safety of that machinery or related product, by creating a new hazard, or…
…for military or police purposes; (m) machinery or related products specially designed and constructed for research purposes for temporary use in laboratories; (n) mine winding gear; (o) machinery or related products intended to move…
…of manufacturers apply to importers and distributors An importer or distributor shall be considered to be a manufacturer for the purposes of this Regulation, and shall be subject to the obligations of the manufacturer set out in Articles…
…Those delegated acts shall apply by 2 August 2028.…
…the scope of this Regulation for distribution or use on the Union market in the course of a commercial activity, whether in return for payment or free of charge; (12) ‘placing on the market’ means the first making available of a product…
…I, Part B, and the machinery or related product was not designed and constructed in accordance with the harmonised standards or common specifications specific to that category of machinery or related product covering all the relevant…
…constrains a robot arm’s speed and angles is performing a safety function, and for high-risk categories self-declaration of conformity stops being enough.…
…The Regulatory Gray Area The Machinery Regulation does not provide an explicit technical definition of "self-evolving behaviour," leaving industry professionals to navigate a complex interpretive…
…does not provide an explicit technical definition of "self-evolving behaviour," leaving industry professionals to navigate a complex interpretive landscape.…
…Under this framework, a system trained before deployment but designed with the inherent capability to adapt its behaviour based on that learning would still be considered to have "self-evolving behaviour."…
…In practical terms, by 20 January 2026, CEN and CENELEC were required to submit their initial package of draft harmonized standards to the European Commission.…
…standard is confirmed to meet the requirements of the Machinery Regulation will the Commission publish its reference in the Official Journal of the European Union.…
…Regulation (EU) 2023/1230 replaces Machinery Directive 2006/42/EC.…
…OJ L 169 on 4 July 2023 replaced fourteen dates throughout the act, including that one, moving the date of application to 20 January 2027 .…
…SiLA currently counts over 1700 members from all over the world that contribute to the success of SiLA.…
…SiLA 2 is recognized as the best established and most commonly used laboratory communication standard in the world.…
…our partners Thanks to the support of our Platinum, Gold, Silver, and Bronze sponsors, Version 1.0 of LADS OPC UA was completed on December 14, 2023, and is now available to everyone!…
…the Agentic AI Foundation (AAIF), a directed fund under the Linux Foundation , co-founded by Anthropic, Block and OpenAI, with support from Google, Microsoft, Amazon Web Services (AWS), Cloudflare, and Bloomberg.…
…A new collaboration between OpenAI and Ginkgo Bioworks challenges that picture at its core.…
…Buried in the documentation is a single word, "enforced," and it never says whether that means code or a sentence.…
…(MD) Machinery (MD) Directive 2006/42/EC Short name Machinery (MD) Base Directive 2006/42/EC of the European Parliament and of the Council of 17 May 2006 on machinery, and amending Directive 95/16/EC (recast) OJ No L 157, 9 June 2006…