HU-Codex – A methodology initiative for classifying smart robotic systems
A methodological bracket spanning two structurally parallel pillars: HU-RAC (data and resilience) and HU-RSC (physical safety). Explicitly intended as an orientation tool, not a certification scheme.
A shared language for smart robotics
Smart robotic systems are built today from tightly interwoven layers: hardware, control software, AI components, cloud back-ends, update mechanics. They are placed on the market under regulatory regimes that overlap rather than align — GDPR, the Machinery Regulation, the AI Act, the Cyber Resilience Act, product liability, product safety, and a growing list of ISO and IEC standards.
HU-Codex is not another standard and not a certification. HU-Codex is an orientation tool that does not replace these regulatory regimes but overlays them: a single tier model that helps buyers, service providers and the entities placing products on the market evaluate a robotic system together, before procurement — preparing for the assessments those regimes themselves require, not circumventing them.
HU-Codex bundles two structurally parallel pillars under one roof: HU-RAC for digital sovereignty and provider resilience, HU-RSC for physical safety with respect to people. Both pillars use the same tier scale 1–5, the same six-axis logic and the same aggregation principle — they are methodologically readable side by side.
What both pillars share
One scale in both pillars
HU-RAC and HU-RSC use the same five-step tier scale. Tier 1 means minimal residual risk in the respective dimension, Tier 5 critical residual risk. The tier number is not interchangeable across pillars — HU-RAC 4 and HU-RSC 4 measure different things.
Six assessment axes per pillar
Each pillar applies six axes — HU-RAC tailored to data categories, key authority, tenant isolation, jurisdictional access; HU-RSC to deployment environment, kinetic harm potential, harm types, degree of autonomy, safety architecture and exposed persons.
Weakest-link principle
Both pillars aggregate across axes by the same rule: the most heavily loaded axis sets the overall tier. A single axis at Tier 4 lifts the product to Tier 4 — even if all other axes sit lower.
Reclassification upon change
Both pillars are dynamic: substantial modifications to the product — different tools, a different deployment field, a new AI component, a new sub-processor — trigger a fresh assessment. The originally accepted tier does not expire silently.
HU-RAC and HU-RSC
HU-RAC
Humanide Robotics Assurance Class — data sovereignty and resilience of networked robotic systems. Overlays GDPR, the AI Act, the Machinery Regulation and the Cyber Resilience Act as a domain-specific grid. Current impulse paper v0.3.1.
HU-RSC
Humanide Robotics Safety Class — physical safety of smart robotic systems. Six axes, five tiers, expectation matrices for procurement and supplier dialogue. Current discussion paper v0.2 rev9.
“This product reaches HU-RAC X / HU-RSC Y”
Both pillars are quoted together in external communication — as a double tier tuple. An example: “This lawn-mower reaches HU-RAC 3 / HU-RSC 3.” The statement says that the system meets moderate requirements in the data and resilience dimension and carries an elevated but technically manageable residual risk in the physical safety dimension.
The double quotation is deliberate: a single tier number would be misleading, because the two pillars measure different things. A data system with high digital sovereignty (HU-RAC 4) need not be physically dangerous; a physically uncritical desk-top robot (HU-RSC 1) tells you nothing about its cloud connection.
A tier classification must not be represented as a certification to suppliers or end customers. It is a procurement and comparison heuristic of the Humanide GmbH; binding conformity assessments remain the responsibility of the competent parties — those placing products on the market, notified bodies, qualified experts and supervisory authorities.
Treating jurisdictional risks symmetrically
HU-Codex treats jurisdictional access risks symmetrically. US law and Chinese law are examined under the same assessment logic — the CLOUD Act and the Connected Vehicle Security Act of 2026 on the US side, the Cybersecurity Law and Articles 7, 28 and 35 PIPL on the Chinese side. Other third countries without an adequacy decision are treated under the same logic.
Symmetry does not mean equation; it means no reflexive preference for one jurisdiction over another, but a fact-based evaluation of the concrete access risk in the specific ownership and hosting chain.
The Humanide GmbH’s own sovereignty gaps, and those of European providers, are named openly in HU-Codex material — not glossed over. A methodological orientation tool that only sees risks on “the other side” would be useless.
Humanide GmbH
HU-Codex is the methodology initiative of Humanide GmbH, Cologne (HRB 115169). More about the company: humanide.com.
Feedback and discussion
Humanide GmbH
Dittmar Müller, Managing Director
Mauritiussteinweg 11, 50676 Cologne, Germany
Email: info@humanide.com
Phone: +49 221 922840
Imprint
Information pursuant to Section 5 of the German Telemedia Act (TMG).
Provider
Humanide GmbH
Mauritiussteinweg 11
50676 Cologne
Germany
Warehouse and delivery address
Mauritiussteinweg 11
50676 Cologne
Germany
Represented by
Dittmar Müller
Managing Director
Contact
Phone: +49 221 922840
Email: info@humanide.com
Commercial Register
Local Court of Cologne (Amtsgericht Köln)
Registration number: HRB 115169
Registered office: Cologne
VAT Identification Number
VAT ID under § 27a UStG:
DE362951755
Dispute Resolution
The European Commission provides a platform for online dispute resolution (ODR): https://ec.europa.eu/consumers/odr. You can find our email address above in this legal notice. We are neither willing nor obliged to participate in dispute resolution proceedings before a consumer arbitration board.
Liability for Content
As a service provider, we are responsible for our own content on these pages in accordance with Section 7 (1) of the German Telemedia Act (TMG) and general legislation. However, pursuant to Sections 8 to 10 TMG, we are not obliged to monitor transmitted or stored third-party information or to investigate circumstances that indicate illegal activity. Obligations to remove or block the use of information under general laws remain unaffected. Liability in this respect is only possible from the time we become aware of a specific legal violation. Upon becoming aware of such violations, we will remove the content immediately.
Liability for Links
Our website contains links to external third-party websites over whose content we have no influence. Therefore, we cannot assume any liability for this external content. The respective provider or operator of the linked pages is always responsible for their content. The linked pages were checked for possible legal violations at the time of linking. Illegal content was not recognisable at the time of linking. However, permanent monitoring of the content of linked pages is not reasonable without concrete indications of a legal violation. If we become aware of any legal violations, we will remove such links immediately.
Copyright
The content and works created by the website operators on these pages are subject to German copyright law. Duplication, editing, distribution, and any form of exploitation outside the limits of copyright law require the written consent of the respective author or creator. Downloads and copies of this site are permitted for private, non-commercial use only. Insofar as the content on this site was not created by the operator, the copyrights of third parties are respected. In particular, third-party content is identified as such. Should you nevertheless become aware of a copyright infringement, please notify us accordingly. Upon becoming aware of legal violations, we will remove such content immediately.
Source of Legal Notice Template
eRecht24
Data Protection
Information on the processing of personal data on this website is provided in the Privacy Notice below.
Privacy Notice
Information pursuant to Art. 13 GDPR on the processing of personal data on this website. Last updated: 30 April 2026.
1. Controller
The controller responsible for the processing of personal data on this website within the meaning of Art. 4 (7) GDPR is:
Humanide GmbH
Mauritiussteinweg 11, 50676 Cologne, Germany
Phone: +49 221 922840
Email: info@humanide.com
2. Data Protection Officer
Humanide GmbH has not appointed a Data Protection Officer, as the conditions of Art. 37 GDPR and Section 38 BDSG (German Federal Data Protection Act) are not met. For data protection inquiries, please contact the controller using the details above.
3. Nature of this Website
This website is a static technical publication. It does not use cookies, tracking technologies, web analytics, social media plugins, embedded videos, externally loaded fonts, or any other third-party services. No personal data is collected through forms, registration or comments — none of these features exist on this site.
4. Server Log Files
When you access this website, our hosting provider (IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany — acting as processor under Art. 28 GDPR pursuant to a data processing agreement) automatically records the following information in server log files:
- IP address of the requesting device
- Date and time of the access
- URL of the accessed resource
- HTTP status code and transferred data volume
- User agent (browser and operating system identifier)
- Referring URL (if transmitted by the browser)
These data are stored for a maximum of 8 weeks and are processed exclusively for ensuring the technical security and stability of the website (defence against attacks, troubleshooting). The legal basis is Art. 6 (1) lit. f GDPR (legitimate interest in operating a secure and stable website). The data are not merged with other data sources and are not used for the creation of usage profiles.
5. SSL/TLS Encryption
This website uses SSL/TLS encryption for the transmission of all content. You can recognise an encrypted connection by the "https://" prefix and the lock symbol in your browser.
6. External Links
This website contains links to external resources (e.g. www.humanide.com, hurac.eu, hursc.eu, ec.europa.eu). When you click such a link, you leave this website and enter the data protection regime of the respective external operator. We have no influence on, and accept no responsibility for, the data processing on these external pages.
7. Your Rights as a Data Subject
Under the GDPR, you have the following rights regarding personal data concerning you:
- Right of access (Art. 15 GDPR)
- Right to rectification (Art. 16 GDPR)
- Right to erasure (Art. 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR)
- Right to object (Art. 21 GDPR)
- Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)
The competent supervisory authority for Humanide GmbH is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestr. 2–4, 40213 Düsseldorf, Germany. To exercise your rights, please contact the controller using the details above.
8. Changes to this Privacy Notice
We may update this Privacy Notice to reflect changes in our processing activities or legal requirements. The current version, identified by the "last updated" date above, applies to all visits to this website.
Frequently asked questions
Why is HU-Codex needed in addition to existing standards and laws?
HU-Codex translates complex technical, legal and organisational requirements into an early, procurement-oriented classification model. It makes robotic systems comparable before any detailed assessment, structures risk questions early on and focuses supplier dialogue. HU-Codex replaces neither standards nor law — it puts them in relation to each other.
What is HU-Codex?
HU-Codex is a methodology initiative by Humanide GmbH for classifying smart robotic systems. It bundles two structurally parallel pillars: HU-RAC assesses data sovereignty and provider resilience, while HU-RSC assesses physical safety with respect to people. Both pillars use the same five-step tier scale, the same six assessment axes and the same aggregation principle.
For which decisions is HU-Codex useful?
HU-Codex supports the pre-screening and shortlisting of robotics vendors, tender and specification criteria, supplier dialogue and risk documentation. It also helps to identify when deeper technical, legal or safety assessments become necessary — and which ones.
What is the difference between HU-RAC and HU-RSC?
HU-RAC assesses digital risks: data categories, key authority, jurisdictional access, cybersecurity, tenant isolation and data-protection-relevant assessment points. HU-RSC assesses physical risks: deployment environment, kinetic harm potential, harm types, degree of autonomy, safety architecture and exposed persons. The two pillars work nominally independently of each other but are asymmetrically coupled (see HU-RSC FAQ on the coupling rule).
What does the aggregation principle "strongest burden" mean?
If a robotic system reaches Tier 4 on one axis and Tier 2 on the remaining axes, the overall tier is 4 — not the average. The most critical burden dimension defines the overall level. This prevents a high residual risk on a single axis from being diluted by favourable values on other axes.
What does the external communication formula "HU-RAC X / HU-RSC Y" mean?
In external communication both pillars are stated together — as a double tier tuple, for example: "This lawn-mower reaches HU-RAC 3 / HU-RSC 3". This dual statement is deliberate: a single tier number would be misleading because HU-RAC and HU-RSC measure different things. A data system with high digital sovereignty (HU-RAC 4) need not be physically dangerous; a physically uncritical desktop robot (HU-RSC 1) tells you nothing about its cloud connection.
Who can apply HU-Codex? Who are the addressees?
HU-Codex is addressed to Humanide GmbH internally, to its service providers, suppliers and manufacturers, and to procurement functions at buyer organisations. It is an orientation tool for procurement and supplier dialogue that offers a common mental model for very different robotics applications. Adoption is voluntary.
How does HU-Codex relate to EU law and standards?
HU-Codex does not replace EU law or harmonised standards. It is a methodological orientation grid for robotics procurement and supplier dialogue. It positions risks in relation to the Machinery Regulation (EU) 2023/1230, the AI Act (EU) 2024/1689, the Cyber Resilience Act (EU) 2024/2847, the GPSR, the Product Liability Directive 2024/2853 and the relevant ISO/IEC standards. HU-Codex is designed to be aligned with harmonised standards and, where appropriate, to be replaced or supplemented by them once these become available.
Is HU-Codex a certification?
No. HU-Codex is explicitly intended as an orientation tool, not a certification scheme. An HU-RAC or HU-RSC tier classification is neither a scientific publication nor a legal opinion nor a binding conformity assessment. It does not replace a risk assessment to ISO 12100 nor a conformity assessment under the Machinery Regulation.