A new legal study argues that the growing wave of physical harm caused by embodied intelligence should not be forced into a single liability track. Instead, the study proposes a dual-liability framework that combines product liability with highly dangerous liability, using the source of risk as the primary dividing line. The research focuses on embodied intelligence as a technology that is both a product and a hazard source: it can be defect-free as a product, yet still pose a continuous threat to people and property when it operates autonomously in open environments.
The study examines how current judicial practice handles damage caused by embodied intelligence and finds sharp disagreements. Some courts treat the harm as an ordinary negligence issue and rely on safety-obligation rules. Other courts begin with product liability but fail to complete the analysis because defect proof is difficult or impossible. In still other cases, courts reject claims by emphasizing technical limitations and driver responsibility, leaving the operational risk of embodied intelligence largely unexamined. The proposed dual-liability framework seeks to close that gap by recognizing two no-fault paths already present in the Civil Code: product liability and highly dangerous liability.
The research is particularly concerned with embodied intelligence because it has moved out of closed industrial cages and into shared physical space. In restaurants, shopping malls, hospitals, roads, and factories, embodied intelligence systems increasingly work alongside human beings. As embodied intelligence becomes more autonomous, more interactive, and more adaptive, the legal question is no longer whether such systems can cause harm, but how the law should allocate the costs of that harm when the product itself may be fully compliant and the operator may not be at fault in any ordinary sense.
1. Embodied Intelligence Moves from Laboratories into Shared Physical Space
The study places embodied intelligence within a longer history of artificial intelligence. It traces the concept to early agent-based ideas in computing and describes embodied intelligence as a third stage after industrial automation and algorithmic automated decision-making. What distinguishes embodied intelligence from earlier systems is its active engagement with the physical world. Instead of passively receiving data, embodied intelligence uses multimodal sensors to explore its environment, generates behavior through its physical form, and learns through interaction.
This shift has been accompanied by policy attention. In 2025, embodied intelligence was included for the first time in the Government Work Report, making it part of the national future-industry layout. Before that, the Ministry of Industry and Information Technology identified humanoid robots as a disruptive product following computers, smartphones, and new energy vehicles. In late 2025, the Standing Committee of the Hangzhou People’s Congress approved a local regulation on promoting the embodied intelligence robotics industry. By early 2026, legal scholars had begun to systematically explore the rule-of-law guarantees needed for embodied intelligence development.
The study stresses that embodied intelligence differs from closed-environment automation. In the vision of Industry 5.0, human-robot collaboration has become a basic form of smart manufacturing, and robots have left their fences to work on the same line as human workers. In consumer and service sectors, delivery robots, shopping guides, and care robots have entered restaurants, malls, and hospital corridors. Intelligent machines sharing physical space with humans has moved from exception to norm. As a result, harm caused by intelligent machines has shifted from theoretical imagination to actual litigation, making the issue urgent.
Yet existing judgments reveal significant divergence. In one case, a child in a restaurant was knocked down and injured by a delivery robot. The court applied negligence liability and safety-obligation rules, found that the restaurant had failed to fulfill its safety obligations, and ordered it to pay 50 percent of the damages. The question of whether the robot itself had a defect never entered the judicial analysis. In another case involving a smart balancing scooter that caused a death, the victim’s family pursued product liability against the manufacturer and the sales platform. The appraisal institution terminated the appraisal because it could not complete a safety performance test. The court then found that both the producer and the driver had some fault and divided the loss equally.
A third case sharpens the problem. A vehicle equipped with an intelligent pilot system, which combined radar and multimodal video controllers to continuously perform longitudinal and lateral motion control, failed on an open road to identify a stationary sprinkler truck. The system did not warn or brake and slowly accelerated into a rear-end collision, destroying the vehicle. The victim claimed that the assisted driving system was defective. The court rejected the claim, reasoning that technical limitations do not automatically constitute a defect and that the driver is the first person responsible for vehicle safety. In all three cases, the operational-side risk of embodied intelligence received insufficient normative attention.
2. Two No-Fault Liability Paths Already Exist but Their Relationship Is Unclear
The study observes that the tort liability part of the Civil Code already reserves two no-fault liability paths for damage caused by embodied intelligence. The first is product liability under Article 1202. It is based on defect, imposes no-fault liability on the producer, and allows the producer to invoke the development-risk defense under Article 41 of the Product Quality Law. The second is highly dangerous liability under Article 1236. It is based on control over danger, imposes no-fault liability on the operator, and permits only strictly limited exemptions and reductions.
These two paths differ significantly, and neither explicitly names embodied intelligence as its object. The victim’s choice of path can substantially affect the outcome. If the victim chooses product liability, the victim faces the difficulty of proving a defect. If the victim chooses highly dangerous liability, the victim must argue that the operation of embodied intelligence can be subsumed under the category of highly dangerous activity. The research therefore breaks the problem into three levels. First, the justification question: why does embodied intelligence damage require two parallel no-fault liability paths? Second, the demarcation question: how should the boundary between the two paths be drawn? Third, the linkage question: after demarcation, how should the two paths be coordinated in external claims, internal recourse, and proof rules?
| Dimension | Product Liability | Highly Dangerous Liability |
|---|---|---|
| Legal basis | Civil Code Article 1202; Product Quality Law Article 41 | Civil Code Article 1236 |
| Risk side | Product-side risk, including design, manufacturing, warning, update, and post-market defects | Operation-side risk, including autonomous operation in open or semi-open environments |
| Responsibility bearer | Producer, with possible liability for sellers in certain situations | Operator or keeper who opens, maintains, and benefits from the dangerous activity |
| Fault requirement | No-fault liability | No-fault liability |
| Core trigger | Defect | Highly dangerous operation |
| Main defense | Development-risk defense under Product Quality Law Article 41 | Strictly limited exemptions and reductions, such as victim intent or force majeure |
| Typical embodied intelligence scenario | Hardware failure, embedded software defect, defective online update, failure to warn | High-autonomy embodied intelligence operating in open public space |
3. Review of Existing Approaches Reveals Gaps
The study reviews four major approaches in existing research: product liability monism, typological coordination, rule reshaping, and systemic governance. Each has strengths, but each also leaves important questions unresolved for embodied intelligence.
- Product liability monism. This approach argues that embodied intelligence is a product, that producers should bear no-fault liability under Article 1202, and that development-risk defenses, post-market observation duties, and compulsory liability insurance can complete the framework. The study acknowledges that this approach minimizes legislative cost and provides a starting point for the dual-liability framework. However, it fails in three defect-free scenarios. First, compliant design may still create inherent risks in open environments, such as the collision energy carried by a humanoid robot moving through a crowd. Second, a victim or third party may trigger a reasonable reaction by the robot, leaving the harm unattributable to any defect. Third, development risks that cannot be discovered at the time of circulation may still cause harm. In these situations, product liability cannot easily apply.
- Typological coordination. This approach identifies the autonomous decision-making capacity of embodied intelligence and classifies damage into product-defect-only, user-fault-only, joint, and causally intertwined forms. It then allocates product liability and fault liability accordingly. The study agrees with the methodological direction but identifies four shortcomings. Highly dangerous liability is omitted. The criterion of autonomous decision-making still requires technical appraisal, so the appraisal dilemma remains. Behavioral control and least-cost avoidance do not always point to the same party. Finally, the causally intertwined category still depends on joint tort or separate tort rules that may not fit the separation of human and machine causation.
- Rule reshaping. This approach proposes limited legal personality, machine fault, and black-box causality solutions, sometimes combined with compulsory insurance or reserve funds. The study argues that the system cost is too high. Civil subjecthood rests on human dignity and rational will. Machine fault is conceptually paradoxical because fault presupposes free will. Guardianship analogies are circular because they already assume the machine’s subjecthood. Moreover, the legislative timetable cannot match the urgent need for adjudication. Even a functional-deviation standard for machine fault fails when emergent behavior has no preset function to compare against.
- Systemic governance. This approach integrates regulation, technical standards, insurance, and liability rules. The study recognizes its value but notes that it remains a governance framework rather than a direct adjudicative norm. Judges cannot directly invoke insurance, regulation, or standards as the basis of a tort judgment. The Hand formula is also difficult to apply to personal injury because the pricing of life and health is ethically and technically problematic. A compulsory insurance priority also presupposes a statutory insurance system that does not yet exist.
The study concludes that existing research shows three biases. Some work sees only the product and not the hazard source, leaving defect-free operational risk without a remedy. Some work improves typology and risk grading but does not complete the doctrinal elaboration of highly dangerous liability. Some work turns to legislative reform outside the Civil Code and gives up on interpreting existing legal norms. The relationship between Article 1202 and Article 1236 has not been deeply discussed, and this is the research gap the study seeks to fill.
4. Justification for Dual Liability
The study argues that the core problem is not a lack of legal norms but an unclear relationship between two no-fault liability paths. Before drawing boundaries and building linkages, it is necessary to answer a preliminary question: why does embodied intelligence damage require two no-fault liability paths in parallel? The justification proceeds in three layers. First, embodied intelligence has a dual attribute as both a product and a hazard source. Second, product liability can capture product-side risk, while highly dangerous liability can capture operation-side risk. Third, the motor vehicle precedent and comparative law confirm the systemic coherence of dual liability.
4.1 The Physical Danger of Autonomous Operation
The key difference between embodied intelligence and traditional products or purely software-based artificial intelligence lies in operation. Embodied intelligence is characterized by autonomy and incomplete predictability. Although advances in cognition give humanoid robots greater autonomy and environmental adaptability, their intelligence remains far below that of humans, and there is an inherent boundary to predictability. Embodied intelligence training relies heavily on simulation environments, and the transfer from simulation to reality creates systemic performance gaps. The same action can produce different results in engineering practice. This incomplete predictability is an endogenous property of the technical route.
The physical harm capacity of the machine itself also matters. Dynamic balance in bipedal walking has long been a core challenge in humanoid robotics. A walking humanoid robot combines considerable mass, speed, and falling kinetic energy, making its body a potential hazard source. At the same time, human-robot coexistence has become normal. Multi-robot collaboration is used to replace human work in dangerous environments, and human-robot co-line work has become a basic form of smart manufacturing. Research on human-robot interaction shows that a robot’s approach can trigger human stress responses, and the probability of physical contact rises as shared space expands.
From a legal perspective, the damage risk of embodied intelligence has a composite structure: qualified product plus high-risk operation. As a product, embodied intelligence can be entirely free of defects. As a hazard source, it continuously threatens its surroundings. The technical features of embodiment, interaction, and emergence form the factual basis of this dual attribute. The paradox that greater autonomy makes safety harder to guarantee is a new expression of this composite structure in the intelligent era.
The study also distinguishes embodied intelligence from two neighboring categories. Traditional automation devices repeat actions according to fixed programs in structured environments. Their danger can be controlled through physical isolation and shutdown mechanisms, making them a typical product issue. Embodied intelligence, by contrast, features autonomous learning and real-time interaction, and its incomplete predictability exceeds the product framework. Purely virtual artificial intelligence, such as search engines with erroneous rankings, recommendation algorithms with improper pushes, or generative artificial intelligence with false content, can also cause harm, but the damage is purely economic loss or personality-rights infringement. There is no physical danger to person or property, so dangerous liability is not applicable. The debate over generative artificial intelligence liability focuses on intangible information damage, which is a different problem from the physical harm caused by embodied intelligence.
4.2 Product Liability Captures Product-Side Risk
Embodied intelligence is designed, manufactured, sold, and put into circulation. In physical form, it is tangible movable property and satisfies the traditional features of a product, including mass production, scale sale, and movable property status. This provides the normative basis for applying product liability under Article 1202 to the product-side risk of embodied intelligence. Although the product status of software and algorithms is disputed, software delivered together with hardware and continuously evolving through online updates can be evaluated as a component of the product without interpretive difficulty. The European Union’s revised Product Liability Directive of 2024 explicitly includes software in the product concept, offering a comparative reference.
Product liability provides a no-fault path for embodied intelligence damage on three grounds. First, danger prevention: the producer has the greatest knowledge and control over product dangers, so no-fault liability encourages internalization of safety costs. Second, proof convenience: the victim need not prove producer fault, but only defect, damage, and causation, which alleviates information asymmetry between victim and producer. Third, loss spreading: the producer can spread compensation costs through pricing mechanisms and liability insurance. These three grounds make product liability the primary regulatory path for embodied intelligence damage.
Comparative law shows that the no-fault character of product liability is itself a response to product danger. In the United States, the Greenman case established strict liability for defective products, and the Restatement (Second) of Torts Section 402A codified it. The rationale was that defective products pose dangers to the public and that producers are best positioned to spread losses. In Europe, Council Directive 85/374/EEC made producers liable for defective products and extended strict product liability across the continent. In China, the legislative line from Article 122 of the General Principles of Civil Law, through Chapter 5 of the Tort Liability Law, to Article 1202 of the Civil Code has been consistent. The study argues that no-fault liability can gradually expand as specific types of danger change. From defective products to high-speed transport tools and then to various highly dangerous operations, the same logic applies. The operational danger of embodied intelligence can be brought into this expansion through dangerous liability without breaking the existing legal framework.
4.3 Highly Dangerous Liability Captures Operation-Side Risk
The justification for highly dangerous liability is usually explained through three principles: the danger-creation principle, the danger-control principle, and the benefit principle. The danger-creation principle holds that the person who opens a danger should be responsible for harm caused by that danger. The danger-control principle holds that the person best able to control the danger should avoid harm at the least cost. The benefit principle holds that the person who profits from a dangerous activity should bear the risk cost, so that benefit and risk remain aligned. Taken together, dangerous liability does not require wrongful conduct. Its basis is control over and benefit from danger.
When applied to embodied intelligence, the operator’s use of the robot opens interaction with public space and creates danger. The operator has control over the operating scenario, operating hours, and safety settings, and the operational danger lies within the operator’s control sphere. The operator obtains efficiency and convenience from the robot’s operation, and the benefit belongs to the operator.
At the normative level, Article 1236 of the Civil Code serves as a general clause for highly dangerous liability. It uses an open formulation: a person who engages in highly dangerous operations and causes harm to another shall bear tort liability. The key elements are the magnitude of danger and the difficulty of avoiding it. The magnitude element means that once harm occurs, it will cause serious personal or property damage. The difficulty element means that under current technology and industrial levels, even if the actor exercises a high degree of care, the danger cannot be completely avoided. The incomplete predictability of embodied intelligence behavior fits the difficulty element and does not exceed the literal scope of the clause.
In systemic position, if a dangerous activity is already regulated by a specific enumerated clause, that special provision applies. Motor vehicle traffic accidents are an example. If a new type of dangerous activity is not enumerated, the general clause applies. Since embodied intelligence has no special chapter, applying highly dangerous liability through Article 1236 meets doctrinal requirements. On responsibility allocation, Article 1244 provides that compensation limits are set only by law. Current law has not set a compensation limit for embodied intelligence damage. Therefore, highly dangerous liability through the general clause is full liability, and the victim’s remedy is not affected by the type of liability.
The study addresses a possible objection. Article 1166 of the Civil Code establishes the statutory principle of no-fault liability: where a person causes harm to another’s civil rights and interests, tort liability is imposed only according to legal provisions. Does bringing embodied intelligence into highly dangerous liability violate that statutory principle? The study answers no. Article 1236 is itself a legal provision. The legislative function of a general clause is precisely to authorize courts to bring new, unenumerated dangerous activities into its scope. Applying no-fault liability through the general clause satisfies the statutory principle. If the statutory principle were read to require the legislature to enact a separate law for every new danger, the general clause would lose its meaning.
As for the method of identifying highly dangerous activity, the study recommends analogical reasoning. The activity under consideration should be compared with the dangerous activities listed in the statutory provisions, examining whether the severity of danger and the scope of impact are comparable. For example, a delivery robot autonomously moving on a public road may create danger comparable to a low-speed new energy vehicle because of its mass, speed, and unpredictability. A service robot placed in a family living room is closer in danger to a home elevator or household appliance. This kind of comparison gives the highly dangerous judgment an operable reference frame, helps unify standards in similar cases, and avoids inconsistent judgments.
4.4 Motor Vehicle Precedent and Comparative Law
The motor vehicle is a typical example of the dual attribute of product plus hazard source. For damage caused by operation, Article 76 of the Road Traffic Safety Law and Article 1208 of the Civil Code apply no-fault liability between a motor vehicle and non-motor vehicle drivers or pedestrians. Even if the motor vehicle side is not at fault, it may still bear no more than 10 percent of compensation. Between motor vehicles, fault liability applies. For damage caused by defects, Article 1202 of the Civil Code applies product liability. The two paths operate in parallel. Article 9 of the judicial interpretation explicitly recognizes the victim’s choice: if a motor vehicle has a product defect that causes a traffic accident, and the party requests the producer or seller to bear compensation liability under product liability rules, the people’s court shall support the request. Academic analysis of autonomous vehicle damage also proceeds from the separation of operational liability and product liability.
The study argues that when legislators faced the situation of a qualified product operating at high risk, they did not regulate everything through product liability. Instead, they chose two paths for separate application to better resolve real problems. Dual attributes and two paths have thus become an internal logic of the Civil Code in handling modern technological risk. Embodied intelligence and motor vehicles are highly similar in normative structure, and there is no reason to treat them differently. Comparative law confirms this. Under Article 7(1) of the German Road Traffic Act, the keeper of a motor vehicle bears no-fault dangerous liability. Article 7(3) distinguishes use situations: a person who uses the vehicle without the keeper’s knowledge and consent is responsible, while the keeper is liable only if at fault regarding the use of the vehicle.
Looking further, the two paths differ in their object of imputation: product liability addresses the thing, while highly dangerous liability addresses the act. Product liability is liability for a thing. Its normative object is the defective state existing when the product was put into circulation. Imputation rests on the objective attribute of the product and does not ask whether the producer’s conduct was blameworthy. Highly dangerous liability is liability for an act. Its normative object is the opening and maintenance of a dangerous activity. The basis of imputation is that the keeper created and controlled the danger. Embodied intelligence falls in both dimensions at once. As a technical object designed, manufactured, and put into circulation, its defective state is evaluated by product liability. As a hazard source operating autonomously in an open environment, its operational behavior is evaluated by highly dangerous liability. The thing dimension and the act dimension each have their own normative purpose and elements. Any single-track approach can cover only one dimension, which is precisely why product liability monism is insufficient. The two paths guard their own domains according to risk source and are linked by concurrence and recourse rules, jointly completing the full evaluation of embodied intelligence damage.
The study also insists that highly dangerous liability must be limited. Bringing all embodied intelligence into highly dangerous operations would not satisfy the requirement of comparable danger. The danger of an ordinary home service robot is hardly comparable to civil nuclear facilities or high-speed transport tools. It would also impose excessive liability burdens that could be transmitted to industry through prices and insurance rates and suppress innovation. Scholars have already pointed out that holding producers continuously responsible for autonomous system behavior they cannot control may inhibit industrial innovation. The principle of balancing development and safety also requires restraint in liability allocation. The correct approach is to maintain dual tracks and not replace product liability with highly dangerous liability. Product liability covers product-side defect risk, while highly dangerous liability covers operation-side highly dangerous risk, each with its own scope. The next question is how to draw the applicable boundary.
5. Demarcation by Risk Source
Whether the dual-liability framework can work effectively depends on whether the boundary between the two paths can be clearly drawn. The study develops the demarcation in four steps. First, it establishes risk source as the primary criterion. Second, it proposes a two-factor test for operation-side highly dangerous activity. Third, it introduces dynamic systems theory as the method of demarcation. Fourth, it tests the standard through typical scenarios and three cases.
5.1 Risk Source as the Primary Criterion
The two paths should be divided according to risk source. If damage comes from product-side risk, including design defects, manufacturing defects, warning defects, defects introduced by software updates or continuous learning, and post-market defects that should have been discovered under the Article 1206 post-market observation duty, product liability applies. If damage comes from operation-side risk, meaning the keeper’s use of a highly dangerous autonomous system in a specific scenario, then highly dangerous liability applies even if the product is entirely free of defects.
The operability of the risk-source standard can be tested through risk control. In the causal chain of damage, the question is which party has the closest and most economical control over the risk source. This transforms the Hand formula used by some scholars to allocate responsibility, as well as the criteria of behavioral control and least-cost avoidance, into tools for path demarcation. The Hand formula suggests the direction of comparing prevention costs. The location of risk control determines the location of risk, and the location of risk determines the choice of liability path. This transformation preserves the analytical power of existing theory while avoiding the risk of using an economic formula to directly adjudicate personal injury.
When applied to the technical composition of embodied intelligence, hardware, pre-installed software, and later autonomous learning can all be regulated within the dual framework. At the hardware level, defects in the body, sensors, and actuators are typical design and manufacturing defects and are directly governed by product liability. At the pre-installed software level, the operating system and control algorithms delivered with the hardware should be evaluated as components of the product. Their defects also fall within product liability. At the later autonomous learning level, two situations must be distinguished. Defects introduced by online updates and continuous learning, including post-market defects that should have been discovered under Article 1206, remain product-side risk and are governed by product liability. Emergent behavior of a compliant product operating autonomously in an open environment, even if entirely free of defects, creates danger controlled and benefited by the operator, making it operation-side risk governed by highly dangerous liability.
Thus, regardless of the technical layer where risk arises, it can be assigned to the corresponding liability path according to risk source. The dual-liability framework can cover all damage risks of embodied intelligence. Product liability covers defect risk throughout the formation and development cycle of the thing. Highly dangerous liability covers defect-free danger during the operation of the act. The two are closely connected and leave no regulatory gap. This full-layer normative coverage of the technical composition is the systemic advantage of the dual structure over single-track approaches.
The risk-source standard can also be explained through result imputation theory. In tort law, imputation is essentially a judgment about whether damage is the realization of a danger condemned by a specific norm. Product liability condemns the realization of defective danger. Highly dangerous liability condemns the realization of operational danger. If a defect has been repaired but damage still occurs, the damage is not the realization of defective danger, and product liability should no longer apply. If the product is entirely free of defects but operational danger becomes reality, that is the realization of operational danger, and highly dangerous liability should apply. Reconstructing the path boundary through the realization of danger avoids over-expanding the concept of defect and keeps product liability tied to its normative purpose. It also allows flexible application of the two paths in different scenarios, overcoming the rigidity of past choices. This approach of dividing responsibility domains by danger type is not invented from nothing. Product liability and motor vehicle traffic accident liability are precedents in the Civil Code for separate liability paths.
The risk-source standard can further produce three operational rules. First, when the risk source is unclear, the victim should be allowed to assert both paths, and the defendant should bear the burden of proving the risk source. The party controlling risk evidence should bear the risk of an unclear source. Otherwise, the victim’s remedy would again be constrained by the algorithmic black box. Second, when risks concur, the two paths apply separately to damage within their respective causal ranges. Internal relations are handled according to the recourse rules discussed below, while the victim may still claim all damage from any responsible party. Third, the time for judging risk source should be the dangerous state at the time of damage. If a defect is introduced after circulation through an update, it remains product-side risk. If the keeper changes operating parameters at the time of damage, it is operation-side risk. Clarifying the judgment time prevents producers and keepers from shifting responsibility to each other based on the timing of risk formation.
| Technical Layer | Risk Source | Applicable Path | Example Involving Embodied Intelligence |
|---|---|---|---|
| Hardware layer | Body, sensor, actuator design and manufacturing defects | Product liability | A humanoid robot’s joint fails due to a manufacturing defect |
| Pre-installed software layer | Operating system and control algorithm defects delivered with hardware | Product liability | A delivery robot’s obstacle-avoidance algorithm contains a coding error |
| Online update and continuous learning layer | Defects introduced after circulation, including post-market observation failures | Product liability | An update changes navigation behavior and introduces a safety flaw |
| Autonomous emergent behavior layer | Defect-free operation in an open environment | Highly dangerous liability | A compliant embodied intelligence system makes an unpredictable movement in a crowd |
5.2 Two-Factor Test for Operation-Side Highly Dangerous Activity
Whether operation-side risk reaches the level of highly dangerous activity should be tested through two factors. The first factor is the openness of the operating scenario. In a closed and structured environment, risk can be internalized through physical isolation and technical standards. Collaborative robot safety standards already control the harm of human-robot collision within tolerable thresholds through power and force limits. The 2025 revision of the ISO 10218 industrial robot safety standard further incorporates collaborative applications into unified safety requirements. Damage caused by robots in such scenarios, such as inside factory fences or at certified collaborative workstations, can be handled by product liability, and dangerous liability need not apply.
In semi-open environments such as restaurants, shopping malls, and hospital corridors, unspecified members of the public share space with robots. The degree of risk spillover is intermediate. Whether it constitutes highly dangerous activity must be judged together with the second factor. In open environments such as road delivery or public-space operations, humanoid robots spread risk to an unspecified majority, and the danger is comparable to high-speed transport tools. Such operations should be recognized as highly dangerous.
The second factor is the level of autonomy. Reference can be made to the classification of automated driving and to theoretical exploration of humanoid robot intelligence grading. The higher the autonomy level, the weaker the immediate human control, and the greater the possibility that behavior will deviate from expectations. The stronger the justification for dangerous liability. The preliminary rule combining the two factors is as follows. Embodied intelligence with a high autonomy level in an open environment should be recognized as highly dangerous operation under Article 1236. A low-autonomy system in a closed environment is governed by product liability. Semi-open scenarios are judged dynamically according to the sufficiency of the elements.
A semi-open scenario can demonstrate dynamic judgment. A restaurant delivery robot usually moves at less than one meter per second, is lightweight, and follows a preset path. The openness of the scenario is moderate, while autonomy and physical harm capacity are low. The elements are limited in sufficiency, so product liability and safety-obligation frameworks are sufficient. If the keeper removes speed limits for efficiency, or if the robot autonomously plans paths through dense crowds during peak hours, autonomy and physical harm capacity rise significantly. The interaction of the elements may reach the threshold of highly dangerous activity, and the keeper should bear no-fault liability. The same technical object may fall into different liability tracks because of different operating parameters and scenario configurations. This shows that the object of highly dangerous judgment is operation in a specific scenario, not an abstract robot category predetermined by type. This is also the key difference between dynamic systems theory and one-time categorization.
5.3 Dynamic Systems Theory as the Method
The study recommends dynamic systems theory. The basic evaluation elements are scenario openness, autonomy level, physical harm capacity including mass, speed, and kinetic energy, and controllability and avoidability. The judgment should be based on the sufficiency of each element and their interaction. A deficiency in one element may be supplemented by the particular sufficiency of another. The core of dynamic systems theory is replacing rigid elements with the interaction of factors. It fits the judgment of degree-based elements in new rights and new activities.
This kind of dynamic balancing technique is not isolated within the Civil Code. Article 998, when determining civil liability for infringement of personality rights, requires comprehensive consideration of factors such as the occupations of the actor and the victim, the scope of influence, the degree of fault, and the purpose, manner, and consequences of the act. This provides an internal example of the method. The study emphasizes that dynamic balancing is not arbitrary discretion. The weight order of the elements should be gradually fixed through judicial interpretation or guiding cases. A stable judgment framework should first be formed through typological case groups, and dynamic balancing should then occur within that framework. There are two feasible paths for fixation. First, the Supreme People’s Court may clarify the main factors and their usual weights through judicial interpretation based on accumulated case experience. Second, guiding cases may be issued step by step to publish judgment conclusions for typical scenarios, which scholars may then integrate into a theoretical system. If dynamic systems theory is separated from typological constraints, it does carry a risk of free discretion. A sequence of typology first and dynamic balancing second can prevent that risk.
It should also be noted that dynamic balancing does not exceed the literal scope of Article 1236. Highly dangerous is itself a degree-based expression. By limiting danger with the word highly, the legislature has already presupposed comparison and measurement of danger levels. Article 1173 on comparative fault and Article 1186 on fair sharing of loss also adopt comprehensive factor measurement. Dynamic systems theory satisfies systematic and literal interpretation requirements.
5.4 Typical Scenarios and Case Review
The standards and methods can be tested through the cases mentioned earlier. In the Chaozhou case, the court handled a low-speed delivery robot injury through safety-obligation rules. Under a low-danger assumption, this was relatively prudent, but the judgment completely failed to examine whether the robot itself had a defect, which is doctrinally deficient. In the Suzhou case, the victim could not obtain compensation through product liability because defect proof failed, and the victim was also burdened by the finding that the driver was at fault. Under the proposed framework, a balancing scooter traveling on a public road is an open scenario, and the victim could have chosen the highly dangerous liability path. The existence of concurrence of claims could have prevented the failure of remedy.
The Yubei intelligent pilot case can also be evaluated within this framework. The intelligent pilot system in that case combined multimodal sensing and autonomous decision-making and continuously performed longitudinal and lateral motion control on an open road. Its autonomy level and operating speed were significantly higher than those of a low-speed service robot, and its operation-side danger was more obvious. The victim’s remedy should not have been trapped in the proof difficulty of whether technical limitations constitute a defect. Whether the limits of the system’s perception and decision-making capability constitute a warning defect or design defect is a product-side risk issue. How to allocate the operational danger of open-road driving under human-machine co-driving is an operation-side risk issue. The two paths should be examined separately and applied to different aspects so that the source of damage can be fully evaluated. The judgment treated the driver as the first person responsible for safety and failed to fully examine system-side risk. In substance, this was an expedient response under an unclear relationship between the two paths, not a necessary normative conclusion.
Industrial human-robot collaboration can be handled by the same logic. A robotic arm working on the same line as workers at a collaborative workstation has its collision risk internalized and controlled by safety standards, so product liability generally applies. Unauthorized modification without safety certification, or operation beyond rated load and speed, removes the safety internalization mechanism and should be regulated through highly dangerous liability. In summary, scenario attribution should always take whether the safety mechanism is sufficient to internalize risk as the substantive criterion.
| Case Scenario | Current Judicial Emphasis | Product-Side Risk Question | Operation-Side Risk Question | Dual-Liability Evaluation |
|---|---|---|---|---|
| Restaurant delivery robot injures child | Safety obligation and negligence | Was there a design, manufacturing, or warning defect? | Was the restaurant a semi-open scenario with elevated operational risk? | Product liability should be examined, and safety obligation remains relevant for lower-risk operation |
| Smart balancing scooter causes death | Product liability claim, terminated appraisal, equal fault sharing | Could the defect be proved without complete safety testing? | Was public-road operation an open scenario with comparable danger? | Victim should have access to highly dangerous liability and concurrence of claims |
| Intelligent pilot system rear-end collision | Technical limitations and driver responsibility | Did perception or warning limits constitute a defect? | How should open-road operational danger under human-machine co-driving be allocated? | Both product-side defect and operation-side danger should be separately assessed |
6. System Linkage After Demarcation
Path demarcation resolves the external division of labor between the two paths. On that basis, the study addresses system linkage. In individual cases involving embodied intelligence, defect risk and operational risk often intertwine. Without specific linkage rules, responsible parties may shift blame to one another. The study handles three issues in sequence. First, in external relations, concurrence of claims and the victim’s choice and its limits. Second, in internal relations, recourse between the keeper and the producer based on risk control. Third, at the procedural level, operation data disclosure duties and alleviation of the proof burden.
6.1 Concurrence of Claims and the Victim’s Choice
When the same damage satisfies the elements of both paths, such as a defective product operating with high autonomy in an open environment, concurrence of claims exists, and the victim may choose either path. The key to handling concurrence lies in coordinating the exemption structures of the two paths. If the victim chooses highly dangerous liability, the keeper cannot invoke the development-risk defense. The basis of dangerous liability is not defect but the opening and control of danger. Even if the danger cannot be avoided under existing technology, liability is not affected. The keeper may seek reduction or exemption based on victim intent, force majeure, and similar grounds. Specific rules can be determined through systematic interpretation with reference to the exemption and reduction structure of Articles 1237 to 1244 of the Civil Code, combined with the general provisions of Articles 1173 and 1174.
If the victim chooses product liability, the producer may invoke the development-risk defense under Article 41 of the Product Quality Law. The defense should be strictly limited to property damage, and the level of scientific and technological development should be judged by the safest existing technology. A producer that violates the post-market observation duty cannot invoke the defense. The exemption structures of the two paths thus form a systemic division of labor. Dangerous liability leans toward the victim, justified by imposing stricter liability on high-risk activities. Product liability maintains a balance between prevention incentives and technological innovation. The victim may choose the most favorable path according to the evidence and the defendant’s defensive capacity. When defect evidence is available, product liability is sufficient. When defect is difficult to prove but operational danger is evident, highly dangerous liability provides a fallback guarantee. The two paths cooperate to fully protect the victim’s lawful rights and interests.
The victim’s choice in claim concurrence has ample normative and theoretical support. Article 186 of the Civil Code, regarding concurrence of contract and tort liability, explicitly grants the injured party a choice, establishing a choice model for handling concurrence. The coexistence of operational liability and product liability in motor vehicle traffic accidents is also confirmed by Article 9 of the judicial interpretation, which starts the imputation process through the victim’s request. The essence of the victim’s choice is to assign the benefit of path selection to the bearer of risk. As for the specific form of concurrence, the study favors the theory of mutual influence of claims. If the victim chooses one path and obtains full satisfaction, the other claim is extinguished. If one claim is partially obstructed by a defense, the victim may exercise the other claim for the unsatisfied portion, but double recovery is not allowed. Both paths share the same three-year ordinary limitation period, and the starting point of limitation is the same, so path choice does not create improper procedural advantages or disadvantages.
6.2 Internal Recourse Based on Risk Control
After external liability is determined, internal allocation between the keeper and the producer depends on the true source of risk. If the keeper pays under highly dangerous liability and it is later found that the damage arose from product-side risk, the keeper may seek recourse against the producer. The normative basis can be analogized from Article 1203(2) and Article 1204 of the Civil Code. The keeper under highly dangerous liability is similar in status to a seller who pays externally under product liability. Both are in an intermediate position of unified external responsibility and internal recourse according to risk source. This simultaneously achieves convenience for the victim and fair internal allocation.
Conversely, if the producer pays under product liability, the producer may seek recourse against the keeper for the portion caused by improper operation, such as unauthorized modification, removal of safety limits, or operation beyond the expressly permitted use scenario. The internal allocation criterion remains risk control. The party with the closest and most economical control over the risk source bears the internal responsibility. The recourse share can be determined through a double measurement of causal force and control. First, compare the causal force of product-side defect and operation-side danger on the damage. Second, adjust based on which party is closer to the risk source and better able to prevent damage at the least cost. If neither causal force nor control can be determined, the keeper and producer share equally. If either side consists of multiple persons, their internal relations are handled separately under joint liability share rules. They bear external liability jointly and internally share according to their respective risk contributions. If shares are unclear or difficult to determine, they share equally.
This conclusion aligns with the core of typological coordination and chain responsibility approaches. Research that allocates responsibility along the value chain according to control at each stage, and research that distinguishes external liability establishment from internal responsibility division, share the same direction as the recourse rules above.
A further question is how recourse proceedings should operate when product design and operational state are highly intertwined and causal force is technically difficult to distinguish. First, there is the allocation of proof burden. The operation logs, algorithm versions, and sensor data needed to identify causal force are controlled by the producer and keeper. Under Article 112 of the judicial interpretation on civil procedure, concerning orders to produce documentary evidence and spoliation rules, if the party controlling the evidence refuses to provide it without justification, the court may find that the recourse claimant’s assertion about risk source is established. This means that proof difficulties in recourse litigation should be resolved by imposing disclosure duties on data controllers, rather than being transformed into the recourse claimant’s risk of losing.
Second, there is the question of prior technical appraisal. Chinese civil procedure does not have a mandatory pre-litigation appraisal procedure, and evidentiary appraisal is not a necessary stage of litigation. In scenarios involving highly specialized algorithmic attribution, the court may commission an appraisal upon party application or ex officio, and may draw on the technical investigator system used in intellectual property litigation or the system of persons with specialized knowledge under Article 79 of the Civil Procedure Law to assist judges in ascertaining technical facts. If an appraisal institution cannot fully distinguish causes under existing technical conditions, it should explain the causal range of each risk source rather than simply terminating the appraisal procedure.
Third, there is fallback protection when appraisal is impossible. If causal force still cannot be distinguished after the above procedures, the equal-sharing rule applies. Its justification lies not in precision of shares, but in the fact that the internal parties who created and controlled the risk should bear the adverse consequences of proof failure, rather than externalizing that consequence to the victim. A progressive structure of data disclosure, technical ascertainment, and equal sharing ensures that the technical reality of indistinguishable causal force does not undermine the normal operation of recourse rules.
6.3 Operation Data Disclosure and Alleviation of the Proof Burden
Whichever path is followed, the algorithmic black box is a common obstacle to proof. The opacity of algorithmic decision-making and its obstruction of rights remedies have been repeatedly highlighted in digital-age legal research. If the dual-liability framework lacks procedural support, it will fall again into the appraisal failure seen in the Suzhou case. The study proposes three feasible measures.
First, producers and keepers should have duties to preserve and disclose operation data. Embodied intelligence should continuously record operation logs, algorithm versions and update records, and safety assessment reports. When a dispute arises, these materials should be provided to the court. If a party refuses to provide them or cannot provide them without justification, the existence of a defect or dangerous operation is presumed. Lowering the proof standard for tort facts and using information disclosure duties to resolve black-box difficulties also has support in existing scholarship. The operation data disclosure duty has theoretical justification. Under Chinese evidence law, if a party controlling evidence refuses to submit it without justified reason, and the party bearing the burden of proof on the fact to be proved claims that the evidence is unfavorable to the controller, the people’s court may find that claim established. Operation logs and algorithm version records of embodied intelligence are controlled by producers and keepers, making them a typical application scenario for spoliation rules. No special legislation is needed for the rule to operate.
Second, under the product liability path, defect determination should be objectified. The consumer expectation standard and the risk-utility standard can be combined. The former uses ordinary consumers’ reasonable expectations of product safety as the benchmark. The latter compares product risk with social utility. Both are judged based on external product information and do not require reviewing the internal logic of the algorithm.
Third, under the highly dangerous liability path, causal proof should be alleviated. The victim’s proof of operation, damage, and causation should meet the high probability standard, while the defendant bears the burden of proving exemption or reduction grounds. Scholarship has proposed drawing on causal presumption rules in food and drug torts, lowering the plaintiff’s proof standard, and clarifying the defendant’s rebuttal duty. This direction is consistent with the above approach. This combination of factual presumption and reversed burden of proof has precedents in the Civil Code, such as the fault presumption rule in Article 1222 on medical damage liability. Patients face an information advantage held by medical institutions, and the legislature uses a fault presumption rule to alleviate the patient’s proof difficulty. The situation of victims of embodied intelligence is similar. It should also be noted that if the victim is at fault in causing the damage, liability may be reduced under Article 1173 regardless of the path chosen, so no evaluative contradiction arises from path selection.
7. Conclusion and Research Agenda
The study concludes that the regulation of damage caused by embodied intelligence already has a normative foundation in current law. What is lacking is a clear explanation of the relationship between the two no-fault liability paths, which is the source of divergent judicial practice. Starting from the dual attribute of embodied intelligence as both product and hazard source, the study establishes a dual-liability framework with risk source as the demarcation criterion and dynamic systems theory as the measurement method. Product liability is the principle and covers product-side defect risk. Highly dangerous liability is the supplement and covers the operation-side risk of high-autonomy systems in open environments.
In external relations, the framework recognizes concurrence of claims and the victim’s right to choose. In internal relations, it uses risk control as the basis for recourse. At the procedural level, it provides supporting measures through operation data disclosure duties and alleviation of the proof burden. Product liability and highly dangerous liability together form an institutional whole in the Civil Code for responding to technological risk. The parallel operation of motor vehicle traffic accident liability and product liability already provides a systemic precedent for reference.
The study calls for further research. Future work should enrich the case groups for the factors used to measure highly dangerous activity. The operational rules for recourse shares need testing in judicial practice. Privacy infringement and data rights issues related to embodied intelligence, as well as the coordination of insurance actuarial science, regulatory standards, and liability structure, are also directions for next-step research. For embodied intelligence to move safely from laboratories into shared physical space, the law must not only identify defects but also account for the distinctive operational dangers that arise when embodied intelligence acts autonomously in a human world.
Ultimately, the dual-liability framework offers a way to avoid two extremes. One extreme is to treat every harm involving embodied intelligence as an ordinary product defect problem, which leaves defect-free operational risk without a remedy. The other extreme is to treat every embodied intelligence system as a legal person or as an inherently ultra-dangerous activity, which would impose excessive costs on innovation and blur the basic categories of private law. By distinguishing product-side risk from operation-side risk, the framework keeps product liability tied to defect and keeps highly dangerous liability tied to danger creation, control, and benefit. It gives victims access to no-fault remedies, gives courts a structured method for evaluating embodied intelligence cases, and gives industry a clearer sense of where responsibility lies as embodied intelligence becomes more autonomous, more interactive, and more deeply embedded in everyday life.