whirrwork
Insights

The robot buyer's due diligence checklist: licences, insurance, references, uptime, data and exit

A practical, printable checklist for vetting a drone or robot supplier before you sign, with the official places to verify licences and the standards that actually apply.

By The Whirrwork team8 min read
  • due diligence
  • buyer checklist
  • Part 107
  • EASA
  • ISO 10218
  • insurance
  • procurement
  • vendor vetting

The short version

  • Check five things before you sign: permission to operate, insurance, a track record you can verify, a defined uptime remedy, and a clean exit.
  • Many licences can be checked yourself in two minutes on a government website. Do it. "Fully licensed" in a sales deck is not a licence.
  • For robots on the ground, ask which safety standard the system was assessed against, and by whom. "Designed in line with" is weaker than "certified to".
  • At the end there's a copy-and-paste checklist. This isn't legal advice; for big contracts, get a lawyer and your insurer to read along.

Most robot purchases don't go wrong because the robot is bad. They go wrong because nobody checked the boring stuff. Here's the boring stuff, in the order we'd check it.

Step 0: Do you need a robot at all?

Run the Ladder Test first. Could a competent person with a ladder do this safely in an afternoon? Then hire the person, and skip the rest of this page. You're welcome.

Step 1: Permission to operate

Drones: verify, don't trust

WhereWhat a commercial operator typically needsHow you can check
United StatesA Part 107 remote pilot certificate; each drone registered; Remote ID broadcast (FAA)Search the pilot on the FAA Airmen Inquiry
US, drone showsA waiver, because Part 107 says one pilot can't fly more than one drone at a time (§107.35) (FAA)Search the company on FAA Part 107 Waivers Issued
US, crop sprayingA Part 137 agricultural aircraft operator certificate (FAA); drones over 55 lb also need a Section 44807 exemption (UF/IFAS); states such as Texas require an aerial category on the pesticide licence (Texas Dept. of Agriculture)Ask for the Part 137 certificate and the state licence number
EUOperator registration; for anything outside the low-risk "open" category, an operational authorisation from the national authority (EASA)Ask for the authorisation and check the issuing authority
UKOperator ID and Flyer ID, plus an operational authorisation for higher-risk work (UK CAA)Ask for the Operator ID and authorisation
AustraliaRegistration and accreditation for small commercial drones; RePL and ReOC above the excluded category (CASA)Ask for ReOC number
IndiaDrone registered with a UIN on Digital Sky; remote pilot certificate (PIB)Ask for UIN and RPC
UAEUnmanned Aircraft Operator Authorisation, a permission per activity in restricted zones, and security clearance if a camera is used (GCAA)Ask for the UOA and the permission for your date

Rules change, and this is a summary. Our drone rules around the world piece has more detail and official links.

The two-minute test: if a supplier can't tell you their certificate or authorisation number on the first call, that's your answer.

Ground robots: which standard, assessed by whom?

There's no single "robot licence". What you're looking for is evidence that the system was risk-assessed against a recognised safety standard:

  • Industrial robot arms and cells: ISO 10218-1 and -2, revised in 2025. Collaborative-robot ("cobot") requirements that used to live in ISO/TS 15066 are now folded into Part 2 (ISO 10218-2:2025; A3 FAQ).
  • Autonomous mobile robots and driverless forklifts: ISO 3691-4 covers driverless industrial trucks, including AMRs (ISO 3691-4:2023); in the US, ANSI/A3 R15.08 covers industrial mobile robots (ANSI).
  • Personal care robots (mobile servants, person carriers, physical assistance): ISO 13482 (ISO).
  • Humanoids and other balancing robots: there's no finished standard yet. ISO 25785-1 for dynamically stable industrial mobile robots was still at committee-draft stage in 2026 (ISO). So ask for the supplier's own risk assessment, and plan to keep people out of reach.

Three phrases, three levels of comfort:

They sayWhat it usually means
"Certified to ISO X by [named test lab]"Best. Ask for the certificate.
"Conforms to ISO X" (self-declared)OK. Ask for the risk assessment document.
"Designed with ISO X in mind"Marketing. Ask the question again.

In the EU, robots placed on the market will fall under the new Machinery Regulation from 20 January 2027, which explicitly covers autonomous mobile machinery (EU-OSHA). If you're buying for EU sites after that date, ask about compliance now.

Step 2: Insurance

Ask for a certificate of insurance showing public/third-party liability, the limit, the policy dates, and ideally naming you as an additional insured.

Whether insurance is legally required depends on where you are:

  • UK: commercial drone operators must carry third-party insurance meeting EC 785/2004 (UK CAA).
  • EU: mandatory above 20 kg; EASA notes "most" member states also require it for lighter drones (EASA).
  • US: Part 107 doesn't require insurance; contracts, venues and some local permits often do (FAA Part 107 summary).
  • India: the Drone Rules require third-party insurance except for nano drones (Legal 500 summary).

Required or not, you want it. More in liability and insurance.

Step 3: A track record you can verify

  • Three references from jobs like yours. Same robot, similar site, ideally in the last 12 months. Call them. Ask: what went wrong, and what did the supplier do about it? If the answer is "nothing ever went wrong", the reference is being polite.
  • Incident history. Ask for the last three years and what changed after each one. Our field guide to failures shows why the answer matters. In Orlando in 2024, the NTSB found the drone show operator had no formal independent check of critical show settings before launch (NTSB).
  • The checklist itself. Ask to see the pre-operation checklist. Good operators are proud of theirs.

Step 4: Uptime, defined properly

"99% uptime" means nothing until you know:

  1. Measured how? Hours the robot was available or hours it was doing the job?
  2. Over what period? Monthly? Annually? (A robot that's down for your busiest week can still hit 99% a year.)
  3. What happens when it's missed? Money, not apologies.

A good example of a remedy: when a Knightscope security robot fell into a fountain in 2017, the company said a replacement was on site within 48 hours and the client was credited a month's subscription (Security.World). Ask for something that concrete.

Step 5: Data ownership

Robots collect maps of your building, video of your car park, images of your roof and performance data. Before you sign, get answers to:

  • Who owns it? Who can access it, including the supplier's staff and subcontractors?
  • Where is it stored, for how long, and how is it deleted?
  • Can you export it in a usable format?

In the EU, the Data Act has given users of connected products a right to access the data those products generate since 12 September 2025 (European Commission). Elsewhere, you'll need to put it in the contract. See privacy, data and cameras.

Step 6: The exit

Plan the breakup before the wedding:

  • Term and notice: minimum term, renewal, notice period.
  • Removal: who removes the robots and chargers, at whose cost?
  • If they go bust: what still works? When the Moxie robot's maker shut down in 2024, owners were told the cloud-dependent robot would stop working, with no refunds (Ars Technica). For business deployments, ask about software escrow and an offline mode.

Our RaaS contract red flags covers clauses in more detail.

Bot or Not?

Go ahead when…Walk away (or keep looking) when…
Licence numbers arrive on the first call"We're fully licensed" but no numbers
They show you a checklist and an incident log"We've never had a problem"
Uptime has a definition and a money remedyUptime is a percentage on a slide
You can export your data and leaveData and exit are "standard terms" they won't share

The checklist (copy and paste into your RFQ)

  1. Licence/certificate/authorisation numbers for the operator and pilots, and for this specific job.
  2. Safety standard(s) the system was assessed against, by whom, and the risk assessment.
  3. Certificate of insurance: type, limit, dates, us as additional insured.
  4. Three references from similar jobs in the last 12 months.
  5. Incident history for three years and changes made.
  6. Pre-operation checklist and who signs it.
  7. Weather/site limits and cancellation terms.
  8. Uptime definition, measurement period and service credits.
  9. Replacement/repair time.
  10. Data: ownership, access, storage location, retention, export format, deletion.
  11. Software updates: testing, release notes, ability to defer.
  12. Term, renewal, notice, removal and costs.
  13. What happens if the supplier stops trading.
  14. All-in price for our volume, with every fee listed.

Put this in your request and you'll get a real answer instead of a brochure. Request quotes, and we'll include the checklist for you.

This isn't legal or insurance advice. Rules differ by country and change often; check with the regulator, your lawyer and your insurer.

Sources

All accessed October 2026.

More Insights