Auditing a Robotic System for the AI Act

Auditing of AI systems has emerged as a mechanism for assessing compliance with regulatory requirements, evaluating the performance and impact of systems to promote accountability and transparency. Despite its increased relevance to operationalise legal requirements, AI auditing lacks established standards, accredited certifications, as well as guidance on good practices, particularly for embodied systems that rely on reinforcement learning (RL) for autonomous control. In this paper, we present a framework to operationalise the AI Act requirements for a robotic system. We validate our framework on a real-world use case: the deployment of robots for cleaning ventilation systems in hospitals in the European Union. Our framework explicitly accounts for the challenges of auditing embodied RL systems in a safety-critical deployment context, including the Sim2Real gap, policy opacity, and distributed responsibility between stakeholders, as well as the regulatory complexity arising from the intersection of the AI Act, the EU Machinery Regulation, and domain-specific requirements. We demonstrate how legal obligations under the AI Act, such as risk management, human oversight, and post-market monitoring, can be translated into concrete audit criteria and governance practices across the lifecycle. Our findings show that auditing supports compliance and system improvement when embedded early in the lifecycle, but also reveal that existing audit methodologies, designed primarily for software-based AI and supervised learning systems, are insufficient for robotic systems whose compliance evidence generated in simulation does not guarantee real-world safety. We highlight the importance of moving beyond one-size-fits-all compliance approaches toward context-sensitive auditing practices, providing a practical bridge for resource-constrained organisations navigating legal uncertainty in the absence of harmonised standards.