15. Safety, Ethics, Governance and Future Directions

Introduction and Context

Robotics and automation have moved from isolated production cells into warehouses, hospitals, laboratories, farms, transport systems, and increasingly interconnected factories. This expansion creates a strategic challenge. A robot is not safe merely because its mechanical design is sound, nor is an automated system ethically acceptable merely because it increases productivity. Safety, accountability, privacy, cybersecurity, labour conditions, environmental sustainability, and social legitimacy must be designed into the complete socio-technical system.

For postgraduate engineers, this means moving beyond component-level thinking. A robot arm, autonomous mobile robot, vision system, cloud platform, and human operator form an integrated system whose risks may arise from their interaction. A technically successful deployment can still fail if responsibility is unclear, safety validation is incomplete, data are misused, or workers are excluded from the transition. Governance therefore becomes an engineering concern as well as a managerial and legal one.

This chapter examines functional safety and risk assessment, major standards and regulatory ideas, ethical and governance questions, cybersecurity, workforce and environmental implications, and emerging directions such as soft robotics, swarm systems, humanoids, autonomous factories, and embodied artificial intelligence.

Learning Objectives

After studying this chapter, the student should be able to:

1. Explain the relationship between hazard, risk, safety integrity, and functional safety in robotic systems.

2. Apply a structured risk-assessment process to robot cells and collaborative applications.

3. Interpret the purpose of major robot-safety standards without treating compliance as a substitute for engineering judgement.

4. Analyse accountability, privacy, bias, cybersecurity, workforce, and environmental issues in automation.

5. Develop governance and assurance measures for data-driven and autonomous robotic systems.

6. Critically evaluate emerging robotic technologies and their strategic implications.

Safety as a Systems Property

Safety is the absence of unacceptable risk, not the absence of all risk. Risk is commonly understood through two dimensions: the severity of possible harm and the probability that the harm will occur. A crushing injury caused by an industrial manipulator may have high severity even if its probability is low. A repetitive ergonomic strain may have lower immediate severity but significant cumulative probability and societal cost.

A useful distinction is between hazard, risk, and harm. A hazard is a potential source of harm, such as an exposed pinch point, unexpected motion, stored pneumatic energy, or a misleading machine-learning classification. Risk is the combination of the likelihood and consequence of that harm. Harm is the injury, damage, or loss that actually results. This distinction prevents a common mistake: assuming that a dangerous machine is acceptable simply because no accident has yet occurred.

Robotic hazards are mechanical, electrical, thermal, pneumatic, hydraulic, chemical, ergonomic, software-related, and organizational. Mechanical hazards include impact, crushing, shearing, entanglement, and ejection of workpieces. Control-system hazards include command corruption, sensor failure, loss of communication, inappropriate restart, and unsafe changes to software or production recipes. In collaborative systems, the key question is not whether a robot is labelled “collaborative,” but whether the complete application—including tooling, payload, speed, workspace, and human task—has been assessed.

Safety must also be considered across the life cycle: concept, design, procurement, installation, commissioning, operation, maintenance, modification, decommissioning, and disposal. A cell that is safe during normal production may become dangerous during troubleshooting or recovery from a fault. Consequently, procedures, competence, access control, inspection, and change management are part of the safety system.

Functional Safety and Risk Reduction

Functional safety concerns the ability of safety-related control systems to achieve or maintain a safe state when hazardous conditions arise. Examples include emergency-stop circuits, guard interlocks, enabling devices, safe limited speed, safe torque off, light curtains, laser scanners, and monitored protective stops. These functions do not eliminate the hazard; they reduce the probability or severity of harm by controlling the machine’s response.

Risk reduction normally follows a hierarchy. First, hazards should be eliminated through inherently safer design—for example, reducing stored energy, selecting a less hazardous process, or redesigning a fixture to remove a pinch point. Second, engineering safeguards such as fixed guards, interlocked doors, presence-sensing devices, and safety-rated monitoring should be used. Third, information for use, training, personal protective equipment, and administrative procedures should address residual risk. Reliance on warnings and operator attention alone is a weak control because human performance varies under fatigue, time pressure, and abnormal conditions.

Risk assessment is an iterative process rather than a document prepared once. A practical sequence is:

• define the machine, intended use, reasonably foreseeable misuse, users, environment, and life-cycle phases;
• identify hazards and hazardous situations;
• estimate risk using severity, exposure, and possibility of avoidance;
• determine whether risk reduction is required;
• select protective measures according to the hierarchy of controls;
• verify that each measure performs as intended;
• validate the complete application under normal, abnormal, maintenance, and foreseeable misuse conditions; and
• document assumptions, residual risks, instructions, and future review requirements.

Risk matrices are useful for communication but should not create false precision. A numerical score does not become objective merely because it is displayed in a table. Engineering judgement, evidence from testing, incident history, and consultation with operators remain essential.

Safety-related control performance may be expressed through concepts such as Performance Level and Safety Integrity Level. These concepts address the probability that a safety function will perform when demanded, taking account of architecture, diagnostic coverage, component reliability, and common-cause failures. They do not describe the overall safety of a machine. A high-performance emergency-stop circuit cannot compensate for a poorly designed gripper, an unsafe maintenance procedure, or an incorrect risk assessment.

Verification asks whether the design satisfies specified requirements; validation asks whether the complete system achieves the intended risk reduction in its real application. Both are necessary. For example, a safety scanner may be correctly wired and tested, yet still fail to protect a worker if its field is obstructed by a fixture or if the stopping distance exceeds the protected distance.

Standards, Regulation and Professional Responsibility

International and national standards provide a common vocabulary and a structured basis for design and assessment. Standards frequently associated with industrial robots include ISO 10218 for industrial robot safety requirements and ISO/TS 15066 for collaborative robot applications. ISO 12100 provides principles for machinery risk assessment and risk reduction. IEC 61508 establishes a broader framework for functional safety of electrical, electronic, and programmable electronic safety-related systems. Other standards may address machinery control systems, protective devices, electrical installations, cybersecurity, or sector-specific requirements.

These standards should be treated as engineering frameworks rather than checklists. Their application depends on jurisdiction, machine type, intended use, and the relationship between manufacturer, integrator, employer, and user. A robot manufacturer may supply a partly completed machine; the system integrator may create the final cell; and the employer may alter the cell or introduce a new task. Safety responsibility therefore follows the configuration and use of the system, not simply the brand name on the robot.

A sound compliance strategy includes requirements traceability. Each identified hazard should be linked to a protective measure, a design requirement, a verification activity, a validation result, and operating or maintenance instructions. Records should be controlled so that modifications to software, tooling, payload, speed, layout, or network infrastructure trigger an appropriate review.

Compliance also has an ethical dimension. An organization may meet the minimum legal requirement while exposing workers to avoidable stress, poor ergonomics, surveillance, or excessive production pressure. Professional engineering responsibility requires attention to foreseeable consequences, transparent communication of residual risk, and willingness to stop or redesign a system when evidence indicates unacceptable danger.

Collaborative Robotics: Promise and Boundaries

Collaborative robotics aims to permit meaningful interaction between people and robots. Four broad interaction strategies are often distinguished: safety-rated monitored stop, hand guiding, speed and separation monitoring, and power-and-force limiting. These strategies differ in sensors, assumptions, allowable motion, and residual hazards.

Power-and-force limiting, for instance, may reduce injury potential during contact, but the assessment must consider body region, contact geometry, sharp edges, payload, velocity, and transient energy. A rounded robot flange may be acceptable in one task while a sharp tool or heated workpiece makes the same robot unsafe. Similarly, speed-and-separation monitoring depends on reliable detection, predictable human movement, and sufficient stopping distance.

Collaboration should therefore be designed around the task, not marketed as a property of the robot. Operators need clear information about operating modes, safe distances, recovery procedures, and the meaning of alarms. Frequent nuisance stops can lead workers to defeat safeguards, creating a latent organizational hazard. Usability is consequently part of safety engineering.

Ethics, Accountability and Governance

Automation distributes decision-making across engineers, managers, software developers, operators, suppliers, and machines. When an autonomous system makes an unsafe decision, responsibility cannot be assigned vaguely to “the algorithm.” Accountability must be allocated before deployment.

A governance framework should specify who is responsible for system requirements, data quality, model approval, safety validation, cybersecurity, maintenance, incident reporting, and decommissioning. It should also define escalation routes and authority to interrupt autonomous operation. Human oversight is meaningful only when the human has sufficient information, time, competence, and authority to intervene. A nominal emergency-stop button does not constitute effective oversight if the operator cannot understand the system state or if intervention is penalized by production targets.

Data governance is especially important in intelligent factories. Robots may collect video, voice, location, biometric, productivity, and behavioural data. Organizations should establish a legitimate purpose, collect only necessary data, restrict access, define retention periods, protect data in transit and at rest, and inform affected workers. Privacy impact assessments are appropriate where monitoring can influence employment, evaluation, or disciplinary action.

Algorithmic bias can enter through unrepresentative training data, unequal sensor performance, inappropriate labels, or objectives that favour throughput over fairness. A vision system used for worker recognition may perform differently across lighting conditions, clothing, body positions, or demographic groups. Testing should therefore include representative conditions and meaningful performance measures, not only average accuracy. Where an automated decision affects employment, access, safety, or discipline, affected persons should have a route to explanation, review, and appeal.

Governance also requires explainability proportionate to risk. A simple deterministic interlock can be verified through logic and testing. A learned perception model may require dataset documentation, performance bounds, uncertainty handling, scenario testing, and monitoring for distribution shift. No model should be granted authority beyond the evidence supporting its reliability.

Cybersecurity of Robotic Systems

Connectivity improves diagnostics, coordination, and analytics but expands the attack surface. Threats include unauthorized access, ransomware, manipulation of motion commands, theft of production data, denial of service, malicious firmware, compromised engineering workstations, and attacks through suppliers or remote-maintenance channels. A cyber incident can become a physical safety incident when it changes speed, path, tooling, interlocks, or operating mode.

Cybersecurity should be managed through defence in depth. Important measures include asset inventories, network segmentation, least-privilege access, strong authentication, secure configuration, patch management, backup and recovery, logging, vulnerability management, secure remote access, and incident-response exercises. Safety and security teams must collaborate because a security control can affect availability, while a safety function may require predictable behaviour during a cyber event.

The goal is not merely to prevent intrusion. Systems should also fail safely, preserve evidence, recover in a controlled manner, and communicate degraded status. Security testing must be planned so that it does not create uncontrolled motion or invalidate safety functions. Suppliers should provide vulnerability disclosure processes, software bills of materials where appropriate, update policies, and support for the operational life of the equipment.

Workforce, Organizational and Environmental Impacts

Automation changes tasks before it changes occupations. It can remove dangerous, monotonous, and physically demanding work, while increasing demand for programming, maintenance, systems integration, data analysis, supervision, and safety competence. The strategic issue is therefore not simply job replacement but the distribution of work, authority, skill, income, and risk.

A responsible transition includes early worker participation, training pathways, redesign of job roles, and evaluation of psychosocial effects. Workers may experience deskilling when they lose control over process knowledge, or intensification when automated systems set relentless production rates. Performance monitoring can damage trust if it is opaque or used without proportionality. Participatory design often identifies practical hazards that are invisible to external integrators.

Environmental assessment should cover the complete life cycle. Robotics may reduce scrap, energy use, and exposure to hazardous processes, but may also increase electricity demand, electronic waste, rare-material dependence, standby consumption, and replacement of serviceable equipment. Useful measures include energy per unit produced, material efficiency, repairability, expected service life, recyclability, and emissions associated with manufacturing and logistics. Autonomous optimization should not pursue throughput while ignoring water, energy, maintenance, or community impacts.

A Governance Framework for Autonomous Factories

An autonomous factory should be governed as a controlled socio-technical ecosystem. A practical framework has six linked elements.

Purpose and boundaries. Define the operational objective, affected people, environments, acceptable autonomy, and prohibited actions. Distinguish optimization targets from non-negotiable constraints such as safety, privacy, and legal compliance.

Assurance case. Construct a structured argument supported by evidence that the system is acceptably safe, secure, reliable, and fit for purpose. Evidence may include hazard analyses, test results, simulation, formal verification of selected functions, cybersecurity assessments, operator trials, and incident records.

Human control. Define when autonomy is permitted, when confirmation is required, how intervention occurs, and who has authority to suspend operation. Operators need calibrated trust: neither blind reliance nor constant distrust.

Data and model management. Control data provenance, labelling, access, retention, model versions, validation datasets, performance thresholds, and change approval. Monitor for drift after deployment.

Operational resilience. Plan for sensor failure, communication loss, cyberattack, power interruption, unexpected objects, uncertain perception, and degraded staffing. Safe degradation is preferable to silent failure.

Review and accountability. Audit performance, near misses, complaints, environmental indicators, and workforce outcomes. Governance must continue after commissioning because real operating conditions evolve.

Applied Case: Introducing Autonomous Mobile Robots in a Mixed-Use Warehouse

Background

The following illustrative case concerns a distribution company introducing autonomous mobile robots (AMRs) to transport totes between storage, picking, and packing areas. The warehouse remains occupied by workers and includes temporary pallets, pedestrian crossings, charging stations, and visitors.

Situation and Problem

A pilot system reduced walking time but produced frequent emergency stops near a blind intersection. Managers proposed increasing robot speed and reducing scanner sensitivity to recover productivity. Workers reported that the robots sometimes approached silently, while maintenance staff used a shared administrative password to change maps. Cameras also captured identifiable worker movements, but no retention policy existed.

Analysis

The risk assessment identified collision, trapping between a robot and a fixed object, falling loads, battery and charging hazards, unexpected restart, and cyber manipulation. The proposed speed increase would increase stopping distance and kinetic energy. Reducing scanner sensitivity would address a productivity symptom by weakening a protective measure. The shared password created poor accountability and enabled unauthorized changes. The camera system created privacy and workforce-governance concerns.

The team also recognized an organizational hazard: repeated nuisance stops were encouraging workers to step into restricted areas or request informal bypasses. The problem was therefore not only sensor tuning but layout, traffic rules, visibility, robot signalling, and operational pressure.

Approach and Solution

The company redesigned the traffic plan, removed the blind intersection where feasible, installed additional warning lights and audible signals, and established a conservative speed zone near crossings. Robot routes were separated from pedestrian routes using physical and visual controls. Protective fields were validated using measured stopping times and realistic load conditions. A controlled recovery procedure was introduced for blocked robots and lost localization.

Cybersecurity measures included unique accounts, role-based permissions, network segmentation, logs for map changes, secure remote access, and backups of validated configurations. Cameras were reconfigured to minimize unnecessary identification; access and retention rules were documented, and workers were informed about the purpose of data collection. Operators and maintenance personnel participated in trials and were empowered to stop the system without production penalty.

Outcome

The intervention initially reduced nominal throughput because of lower speeds and additional controls. After layout improvements and route optimization, productivity recovered without weakening safeguards. Near misses declined, maintenance changes became traceable, and workers reported greater confidence in the system. The company also gained a repeatable approval process for future software and map updates.

Learning Points

The case demonstrates that safety is a property of the complete application. Productivity problems should not be solved by weakening protective measures before investigating layout and process causes. Cybersecurity, privacy, usability, and worker participation are integral to dependable automation. Finally, governance is not a barrier added after engineering; it is a mechanism for sustaining safe performance as the system changes.

Emerging Directions and Critical Evaluation

Soft robotics uses compliant materials, deformable structures, and flexible actuation to handle delicate objects and interact more safely with people. Its challenges include modelling nonlinear deformation, achieving precise repeatability, controlling durability, and integrating reliable sensing. Softness reduces some contact hazards but does not automatically eliminate entanglement, pinch, or process risks.

Swarm robotics coordinates many relatively simple agents through distributed rules. Swarms may be valuable in inspection, search, agriculture, and logistics because they can scale and tolerate individual failures. However, emergent behaviour is difficult to predict, and verification becomes more complex as the number of agents and interactions increases. Governance must define collective boundaries, communication security, and safe behaviour under partial failure.

Humanoid robots seek to operate in environments designed for people. Their potential advantage is compatibility with existing tools and spaces, but their mechanical complexity, energy demand, balance problems, maintenance burden, and safety requirements remain substantial. Human-like appearance may also create unrealistic expectations about competence and responsibility.

Autonomous factories integrate robots, digital twins, industrial networks, optimization algorithms, and adaptive scheduling. Their value lies in coordinated decisions rather than isolated automation. Yet tightly coupled systems can amplify errors and create single points of systemic failure. Resilience requires modularity, graceful degradation, human-readable status, and recovery procedures.

Embodied artificial intelligence combines perception, learning, language, planning, and physical action. It may enable robots to generalize across tasks, but open-ended learning creates assurance difficulties. A system trained in simulation may encounter unmodelled friction, lighting, clutter, human behaviour, or rare hazards in the physical world. Deployment should therefore use bounded autonomy, staged testing, uncertainty-aware policies, runtime monitoring, and explicit constraints.

Research frontiers include formal methods for learning-enabled control, safe reinforcement learning, tactile intelligence, energy-efficient computation, human–robot team cognition, privacy-preserving learning, recyclable robot architectures, and standards for autonomous-system assurance. The central research problem is not simply making robots more capable; it is making their capability measurable, interpretable, controllable, and socially legitimate.

Common Mistakes and Best Practices

Common mistakes include treating certification as proof of overall safety, assessing only normal production, ignoring maintenance and foreseeable misuse, assuming collaborative labels remove hazards, weakening safeguards to improve throughput, using opaque performance monitoring, leaving software changes uncontrolled, and assigning responsibility to an undefined “AI.”

Best practice begins with early multidisciplinary risk assessment involving designers, controls engineers, cybersecurity specialists, operators, maintenance staff, managers, and where relevant, legal and environmental experts. Requirements should be traceable to tests. Safety functions should be independently verified where appropriate. Changes should undergo impact assessment. Near misses and unsafe-condition reports should be valued as learning evidence rather than concealed. Autonomous systems should be introduced gradually, with clear operating envelopes, fallback modes, training, audit trails, and periodic reassessment.

Strategically, organizations should evaluate automation using a balanced scorecard: safety performance, quality, availability, energy and material use, workforce development, cybersecurity resilience, privacy compliance, and social acceptance. The most valuable system is not necessarily the one with the highest theoretical autonomy, but the one that creates dependable performance within acceptable human, environmental, and institutional boundaries.

Chapter Summary

Safe and responsible robotics requires a life-cycle, systems-oriented approach. Hazard identification, risk estimation, inherent design measures, safeguarding, information for use, verification, and validation form the foundation of functional safety. Robot standards provide structured requirements, but compliance does not replace application-specific engineering judgement.

Collaborative robots must be assessed as complete applications rather than as inherently safe products. Autonomous and connected systems introduce accountability, privacy, bias, cybersecurity, and data-governance challenges. Human oversight is effective only when supported by competence, information, authority, and practical intervention mechanisms. Workforce participation, reskilling, psychosocial conditions, life-cycle environmental effects, and organizational resilience are strategic concerns.

Soft robots, swarms, humanoids, autonomous factories, and embodied AI offer significant opportunities but also create assurance and governance problems. Future progress will depend on bounded autonomy, evidence-based validation, secure architectures, transparent accountability, sustainable design, and continuous review after deployment.

Key Terms

Hazard: A potential source of harm.

Risk: A combination of the likelihood and consequence of harm.

Functional safety: The part of overall safety concerned with safety-related control functions responding correctly to hazardous conditions.

Safety function: A control function intended to reduce risk, such as emergency stop or safe limited speed.

Performance Level: A measure used to express the reliability of a safety-related control function.

Safety Integrity Level: A graded measure of the reliability requirements for electrical, electronic, or programmable safety functions.

Verification: Confirmation that specified design requirements have been satisfied.

Validation: Confirmation that the complete system achieves its intended safety performance in its application.

Residual risk: Risk remaining after protective measures have been applied.

Collaborative robot: A robot designed and assessed for applications involving intentional human–robot interaction.

Safety case: A structured argument, supported by evidence, that a system is acceptably safe for a defined use.

Accountability: The assignment of responsibility for decisions, actions, outcomes, and corrective measures.

Algorithmic bias: Systematic and unjustified differences in automated outcomes caused by data, design, or deployment conditions.

Data minimization: Collection and retention of only the data necessary for a legitimate purpose.

Defence in depth: Use of multiple independent or complementary protective layers.

Digital twin: A computational representation of a physical system used for analysis, monitoring, or control.

Swarm robotics: Coordinated behaviour produced by multiple relatively simple robotic agents.

Embodied AI: Artificial intelligence integrated with sensing and physical action in the real world.

Safe degradation: Transition to a controlled and acceptably safe state when normal operation is not possible.

Review Questions

Short Answer Questions

1. Distinguish between a hazard, risk, and harm in a robotic application.

2. Why are verification and validation both required for a robot safety function?

3. What is meant by meaningful human oversight in an autonomous factory?

4. Identify two ways in which a cyber incident can become a physical safety incident.

5. Why does a collaborative robot label not guarantee that an application is safe?

Long Answer Questions

1. Explain the life-cycle process of risk assessment and risk reduction for an industrial robot cell.

2. Discuss the relationship between functional safety, Performance Level, and Safety Integrity Level.

3. Analyse the ethical and governance issues associated with collecting worker data through factory vision systems.

4. Explain how workforce participation and environmental assessment influence responsible automation strategy.

5. Critically evaluate the opportunities and assurance challenges of embodied artificial intelligence in robotics.

Analytical / Application Questions

1. A robot cell has a correctly wired emergency stop, but its tool can eject sharp components during automatic restart. Analyse the residual risks and propose additional controls.

2. An AMR fleet experiences frequent stops at pedestrian crossings. Managers want to reduce scanner sensitivity. Using the chapter’s framework, recommend a safer investigation and improvement strategy.

3. Design a governance framework for a learning-enabled robot that sorts products and records operator performance data. Include accountability, privacy, cybersecurity, validation, and review measures.

22. Multiple Choice Questions with Answers

Question 1

Which statement best describes functional safety in a robotic system?

A. It eliminates every hazard through mechanical redesign.

B. It ensures that safety-related control functions respond correctly to hazardous conditions.

C. It guarantees that an operator will never enter a restricted area.

D. It replaces the need for risk assessment when certified components are used.

Correct Answer: B. It ensures that safety-related control functions respond correctly to hazardous conditions.

Question 2

A light curtain is correctly wired, but its protected distance is shorter than the robot’s stopping distance. What does this primarily demonstrate?

A. Successful validation but failed verification

B. That cybersecurity is the dominant risk

C. That component testing alone does not validate the complete application

D. That the light curtain should be replaced by personal protective equipment

Correct Answer: C. That component testing alone does not validate the complete application

Question 3

Which measure belongs highest in the hierarchy of risk reduction?

A. Warning labels

B. Operator training

C. Personal protective equipment

D. Inherently safer design that eliminates the hazard

Correct Answer: D. Inherently safer design that eliminates the hazard

Question 4

Why is a collaborative robot not automatically safe in every application?

A. Collaboration applies only to software robots.

B. The tooling, payload, speed, geometry, and task determine the actual risk.

C. Collaborative robots cannot use safety-rated controls.

D. Collaborative robots are intended to operate without human supervision.

Correct Answer: B. The tooling, payload, speed, geometry, and task determine the actual risk.

Question 5

Which practice most directly improves accountability for robotic software changes?

A. Allowing all maintenance staff to use one shared password

B. Disabling logs to improve system performance

C. Using unique accounts, role-based access, and controlled version records

D. Permitting changes without retesting if production increases

Correct Answer: C. Using unique accounts, role-based access, and controlled version records

Question 6

A factory vision system performs poorly for workers wearing certain clothing and under particular lighting conditions. This is primarily an example of what concern?

A. Algorithmic bias or performance variation caused by deployment conditions

B. Inherent energy efficiency

C. Safe degradation

D. Mechanical fatigue

Correct Answer: A. Algorithmic bias or performance variation caused by deployment conditions

Question 7

Which statement best reflects meaningful human oversight?

A. A human is nominally listed as responsible, regardless of access or competence.

B. The operator can understand system status and has authority and time to intervene.

C. The system automatically sends a report after an accident.

D. The robot asks for approval only after completing a hazardous action.

Correct Answer: B. The operator can understand system status and has authority and time to intervene.

Question 8

In the illustrative AMR case, why was reducing scanner sensitivity an inappropriate first response?

A. It would weaken a protective measure without addressing layout and process causes.

B. It would always increase robot energy consumption.

C. It would prevent all software updates.

D. It would make cameras legally unusable.

Correct Answer: A. It would weaken a protective measure without addressing layout and process causes.

Question 9

Which characteristic creates a major assurance challenge for swarm robotics?

A. Each agent must always be physically identical.

B. Collective behaviour may emerge from interactions and become difficult to predict.

C. Swarms cannot communicate with one another.

D. Swarm systems eliminate the need for cybersecurity.

Correct Answer: B. Collective behaviour may emerge from interactions and become difficult to predict.

Question 10

What is the most appropriate strategic approach to learning-enabled autonomous robots?

A. Deploy unrestricted autonomy immediately because learning systems improve with use.

B. Rely solely on average accuracy measured in a laboratory.

C. Use bounded autonomy, staged testing, uncertainty monitoring, and explicit constraints.

D. Remove human intervention to avoid biased decisions.

Correct Answer: C. Use bounded autonomy, staged testing, uncertainty monitoring, and explicit constraints.