Exoskeleton Standards and Regulation: What Buyers and Suppliers Need to Know in 2026

Exoskeleton regulation is determined less by what a product is called than by what the manufacturer says it is intended to do, who will use it, where it will be used and which risks it creates. A passive shoulder-support device for overhead work, a powered rehabilitation robot and a consumer mobility product may all be described as exoskeletons, yet they can follow different legal pathways and require different evidence. Buyers and suppliers therefore need to separate regulation, voluntary standards, conformity assessment, test methods and commercial claims before treating any certificate or marking as proof of suitability.

Why exoskeleton regulation is easy to misunderstand

The exoskeleton sector sits across several established fields: occupational equipment, machinery, robotics, medical devices, orthotics, software, batteries, wireless communications, consumer products and workplace safety. Product architecture also varies widely. Some devices are passive mechanical systems with no software or battery. Others contain powered joints, sensors, adaptive control, cloud connectivity and medical software.

That diversity explains why buyers encounter apparently conflicting statements. A supplier may correctly say that an industrial device is not a medical device, while another supplier markets a visually similar powered system under a medical-device pathway. A product may comply with several electrical or machinery standards without being certified for the buyer’s exact task. A manufacturer may use ASTM test methods voluntarily while still having separate obligations under national law.

For medical devices in the European Union, intended purpose is defined by the information supplied on the label, instructions for use, promotional or sales materials and clinical evaluation. Classification is governed by that intended purpose, and where several rules apply, the strictest rule leading to the higher class applies.^[15] The same commercial discipline is useful outside medicine: claims made on a website, sales deck or distributor page can materially affect how regulators, customers and insurers understand the product.

Regulation, standards, certification and test reports are different

These terms are often used interchangeably in sales conversations, but they do different jobs.

This distinction is central to procurement. A supplier may truthfully report that a device was tested according to ASTM F3580 for stairs, for example, but the buyer still needs the laboratory, report, configuration, user sample, conditions, results and limitations. The existence of the standard number alone does not establish that the current commercial model passed, that the result was independently verified or that the buyer’s staircase and task are equivalent.

Regulatory position at a glance

The following table is a decision map, not a substitute for jurisdiction-specific legal analysis.

Industrial exoskeletons in the United States

The United States does not currently have one exoskeleton-specific federal market-authorisation pathway for occupational products comparable to the FDA route for medical powered lower-extremity exoskeletons. That does not make industrial deployment unregulated or risk-free. Employers remain subject to applicable OSHA standards and the General Duty Clause, which requires employment and a workplace free from recognised hazards that are causing or likely to cause death or serious physical harm.^[10]

NIOSH has repeatedly emphasised that industrial exoskeletons can create benefits and risks, and that most early studies used small samples in laboratory settings. Potential concerns include load transfer to other body regions, altered movement, skin effects, thermal risk, stability and battery hazards. NIOSH also noted that it remains important to determine how exoskeletons relate to personal protective equipment and to advance consensus standards for safety.^[11]

For buyers, this means voluntary ASTM standards can become important evidence of reasonable design and evaluation practice, but they do not replace the employer’s task-specific hazard assessment. OSHA has explained in other contexts that consensus standards may be evidence of industry recognition and feasible means of controlling a hazard, even when they are not themselves incorporated into an OSHA rule.^[10]

Industrial and non-medical exoskeletons in the European Union

There is no single EU legal category called “industrial exoskeleton”. Depending on design and intended use, an exoskeleton may fall within machinery, electrical equipment, electromagnetic compatibility, radio equipment, batteries, chemicals, personal protective equipment, general product safety, data-protection or other legislation. More than one act can apply to the same product.

As of 30 July 2026, the Machinery Regulation (EU) 2023/1230 has entered into force but its main application date is 20 January 2027, when it will repeal and replace the Machinery Directive 2006/42/EC. Suppliers preparing products for the EU market must therefore manage a live transition rather than presenting the 2027 framework as already fully applicable.^[18]

Consumer-oriented exoskeleton products may also fall within the General Product Safety Regulation (EU) 2023/988, which has applied since 13 December 2024. The GPSR provides a general safety framework for consumer products, while more specific Union legislation continues to govern the aspects it covers.^[19]

CE marking is required only where applicable sector legislation requires it. The Commission warns that not all products must carry CE marking and that CE marking does not mean an EU authority approved the product as safe.^[17] For an exoskeleton, the useful question is therefore not simply “Does it have CE?” but:

• Which EU legal acts are listed in the declaration of conformity?
• Which harmonised standards or other technical specifications were applied?
• Was a notified body involved, and was involvement legally required?
• What exact model, accessories, software and intended purpose are covered?
• Who is the manufacturer, importer and authorised representative?
• What residual risks and prohibited uses appear in the instructions?

A declaration that lists only generic directives without explaining product classification, risk assessment and technical evidence should not be accepted at face value.

Medical exoskeletons in the United States

FDA’s current product classification defines a powered lower-extremity exoskeleton as a prescription device composed of an external powered motorised orthosis placed over paralysed or weakened lower extremities for medical purposes. It is Class II under product code PHL and regulation number 21 CFR 890.3480, with 510(k) as the submission type. The category is not exempt from good manufacturing practice requirements.^[12]

FDA lists IEC 80601-2-78 and ISO 10328 among recognised consensus standards associated with the category. IEC 80601-2-78 covers basic safety and essential performance of medical robots that physically interact with patients with impairments for rehabilitation, assessment, compensation or alleviation of movement functions.^[13]

A 510(k) is a clearance, not a PMA approval. FDA describes it as a comparative process in which the manufacturer demonstrates substantial equivalence to a legally marketed predicate. The manufacturer may market the device after receiving an order finding it substantially equivalent.^[14]

The distinction matters in commercial language. Suppliers should use “FDA cleared” for a 510(k)-cleared device and should not imply that FDA approved the device under the PMA standard. Buyers should verify the 510(k) number, decision date, device name, indications for use, contraindications, training requirements and whether the model offered matches the cleared configuration.

The Atalante X, for example, received a substantially equivalent decision under K250904 on 24 October 2025 for product code PHL. The public database also identifies associated clinical trials.^[14] This does not make the device interchangeable with every other powered exoskeleton or authorise uses outside its cleared labelling.

Medical and rehabilitation exoskeletons in the European Union

Under the EU Medical Device Regulation, a product is a medical device when the manufacturer intends it for one or more specified medical purposes, including treatment or alleviation of disease, or treatment, alleviation or compensation for injury or disability. The intended purpose is established through labelling, instructions, promotional statements and clinical evaluation.^[15]

There is no safe shortcut from the word “exoskeleton” to one MDR class. Classification requires applying Annex VIII to the actual intended purpose, duration, active functions and risk. The European Commission published a revised MDCG 2021-24 classification guide in April 2026, reinforcing that classification remains a rule-based, product-specific exercise.^[16]

Manufacturers must establish the applicable conformity-assessment route, technical documentation, risk management, clinical evaluation, labelling, quality controls and post-market system. The Commission describes the MDR as more stringent than the former directives, with stronger emphasis on risk classes, notified-body oversight, clinical data and life-cycle post-market monitoring.^[22]

EUDAMED also changed materially in 2026. The Commission states that actor registration, UDI/device registration, notified bodies and certificates, and market-surveillance modules became mandatory on 28 May 2026 following the required transition period. The clinical-investigation and vigilance/post-market modules remain on a separate development path.^[20]

Post-market surveillance is not an administrative afterthought. The Commission issued MDCG 2025-10 in December 2025 to support implementation of PMS requirements, while the MDR framework assigns distinct responsibilities to manufacturers, authorised representatives, importers and distributors.^[21]

What an EU medical buyer should verify

The buyer should review the entire regulatory identity of the product rather than accepting a CE logo or certificate image.

Great Britain and Northern Ireland require separate checks

The United Kingdom does not operate one uniform medical-device pathway across all four nations. Great Britain covers England, Scotland and Wales under the UK Medical Devices Regulations 2002 as amended, while Northern Ireland continues to require CE or CE UKNI arrangements under the applicable EU framework.^[23]

Current Great Britain transitional provisions accept certain CE-marked medical devices until deadlines that depend on the legislation and device type. Devices compliant with the EU MDR can currently be placed on the GB market until 30 June 2030 under the published transition arrangements, while earlier directive-based pathways have earlier or certificate-dependent deadlines.^[24]

MHRA guidance updated in July 2026 states that most external prosthetic and orthotic devices are Class I, custom-made devices or systems composed of marked devices, but manufacturers must still determine whether their product meets the UK medical-device definition. That general statement should not be applied automatically to every powered exoskeleton.^[25]

For non-medical products, the UK published updated UKCA and CE market guidance in 2026. Suppliers must identify the correct product rules and market because recognition of CE requirements and designated standards varies by sector.^[26]

The ASTM F48 standards landscape in 2026

ASTM Committee F48 was formed in 2017 to develop voluntary consensus standards for exoskeletons and exosuits. Its scope spans safety, quality, performance, ergonomics, terminology, maintenance, disposal, security and information technology across industrial, emergency-response, medical, military and consumer applications.^[2] ASTM maintains a public index of the committee’s subcommittees, active standards and work items, which should be checked for later revisions before publication or procurement.^[30]

The portfolio has expanded quickly. By mid-2026, the human-factors and ergonomics subcommittee listed 15 active standards, while task performance and environmental considerations listed 19 active standards. Design and manufacturing and maintenance and disposal each listed one active standard. Security/IT and the dedicated risk-management subcommittee had proposed work but no active standards under their own jurisdictions at the time checked.^{[3][4][5][6][7][8]}

Foundational ASTM standards

F3323-24 is the active terminology standard under F48.91.^[9] F3358-20 is currently the only active standard listed under design and manufacturing, while F3392-20 is the active standard listed under maintenance and disposal.^[5][6]

Human factors, fit and risk

The F48.02 portfolio includes F3474-25 for functional ergonomic parameters, F3518-21(2025)e1 for quantitative measures, F3527-24 for contextual risk assessment, F3540-21 for design hazards, F3578-22 for stumble-related fall risk, F3579-24 for return-to-work deployment, F3585-25ae1 for cognitive fit, perceived safety and acceptance, F3661-24 for fit accommodation, F3688-25 for ergonomic risks, F3771-25 for digital human modelling, F3773-25 for back-loading assessment, F3794-25 for multivariate fit and F3795-25 for risk-management application.^[3]

This is a meaningful portfolio, but the standard type matters. A guide offers recommended approaches. A practice defines an accepted procedure. A test method specifies how to generate a result. A specification can set requirements. Buyers should not treat every ASTM number as a pass/fail safety threshold.

Task and environmental testing

The F48.03 portfolio includes methods and practices for environmental documentation, load handling, movement, gait, stairs, hurdles, gaps, beams, obstacle avoidance, crawling, inclined planes, ladders and logistics and tool-handling assessments.^[4]

These methods help standardise testing, but they remain sensitive to configuration and conditions. A gait result obtained with one user range, surface, speed and assistance setting may not represent a buyer’s shift pattern, PPE, floor contamination, vehicle access or emergency movement.

Published standards and work items must not be confused

ASTM work items identify standards under development. They are important signals of where the field is moving, but they are not published standards and cannot be presented as completed compliance.

In 2026, notable proposed work included WK97750 on exoskeleton structural safety and WK96094 on securing data residing in exoskeletons. The structural-safety item aims to establish requirements for integrity, mechanical safety and load-bearing capacity, while the security item addresses data at rest. Both reflect real gaps in the current landscape, but their work-item status must be disclosed.^[31][32]

The absence of an active F48 cybersecurity standard under F48.05 does not mean connected exoskeletons have no cybersecurity obligations. Medical devices may be subject to medical-device cybersecurity expectations, while industrial products may fall under contractual, privacy, product-security or sector-specific rules. Suppliers should use established cybersecurity engineering practices rather than waiting for a dedicated exoskeleton document.

ISO 25563: important, but still under development

ISO/CD 25563 is one of the most important emerging documents for organisational adoption. Its scope is the process for integrating wearable physical-assistance devices into work situations, including expression of needs, selection, design, assessment and deployment. It is intended for user organisations, designers, manufacturers and integrators across sectors and organisation sizes.^[1]

Its exclusions are equally important. The draft does not apply to medical, rehabilitation, games, sport or leisure exoskeletons. It does not address design-stage quality control and does not provide certification information. As of 30 July 2026, ISO lists it as a Committee Draft under development, not an International Standard.^[1]

Buyers can use the draft’s direction as a signal that the market is moving toward a structured integration process. Suppliers should not advertise “ISO 25563 certified” while no published certification scheme exists.

Medical exoskeletons also rely on broader medical-device standards

Exoskeleton-specific standards do not replace the broader medical-device framework. Depending on the product, suppliers may need to address quality management, risk management, electrical safety, essential performance, software lifecycle, usability, biocompatibility, cybersecurity and clinical evidence.

ISO 13485 establishes requirements for a medical-device quality-management system, while ISO 14971 establishes a process for identifying hazards, estimating and evaluating risk, controlling risk and monitoring controls across the device lifecycle.^[27][28] IEC 62304 defines software lifecycle processes, and IEC 80601-2-78 specifically addresses medical robots physically interacting with patients for movement-related rehabilitation, assessment, compensation or alleviation.^[29][13]

A supplier’s standards matrix should explain why each standard applies, which edition was used, whether testing covered the full system and which requirements were not applicable. A generic list copied from another device is not sufficient.

How buyers should interpret common commercial claims

Terms such as “certified”, “approved”, “compliant” and “validated” are incomplete without an object and scope. A credible claim identifies the authority or standard, exact device, edition, market, intended use and evidence.

Supplier regulatory file: what serious buyers should request

The correct package differs by product, but buyers should expect a coherent file rather than disconnected certificates.

For all exoskeleton categories

• Legal manufacturer, manufacturing sites and responsible economic operators.
• Exact model, generation, serial range, accessories, software and battery configuration.
• Intended use, user population, environment, limitations and prohibited uses.
• Risk-management summary and residual-risk communication.
• Applicable laws, standards and standard editions.
• Test reports tied to the supplied configuration.
• Instructions, training, inspection, cleaning, maintenance and emergency procedures.
• Complaint, incident, recall and field-corrective-action process.
• Warranty, service coverage, spare parts and end-of-life plan.
• Cybersecurity, software-update and data-governance information where connected.

Additional medical-device evidence

Medical buyers should also request the marketing-authorisation or conformity evidence, indications, contraindications, clinical evaluation, post-market plan, vigilance contact, UDI/device identity and quality-system information. The buyer should verify records through the relevant regulator or database rather than relying only on documents supplied by the sales team.

Regulatory responsibilities continue after purchase

Market access is not the end of compliance. Manufacturers must manage change, complaints, corrective actions, software updates and post-market evidence. Importers and distributors may have verification and traceability duties. Employers and healthcare organisations must deploy the product within its intended use, train users, maintain it and manage task-specific risks.

A material product change can also affect regulatory status. New assistance settings, software, accessories, patient groups, work tasks or marketing claims may move beyond the evidence or authorisation originally obtained. Buyers should require a change-notification clause in the contract and maintain configuration records.

For connected devices, an update that changes control behaviour or cybersecurity can be safety-relevant. The organisation should know who authorises updates, how rollback works, whether support has an end date and how vulnerabilities are communicated.

Red flags in standards and regulatory documentation

Other warning signs include a declaration of conformity that does not match the product name, a notified-body certificate outside the device scope, a test report without configuration details, marketing claims broader than the instructions for use, or a quality-management certificate presented as proof of product performance.

A supplier may have a legitimate reason for confidential technical details, but confidentiality should not prevent a buyer from verifying legal status, certificate validity, claims, safety limitations and the evidence necessary for responsible deployment.

What changed or became especially important in 2026

Several developments make 2026 a transition year rather than a stable endpoint:

• ISO 25563 progressed to Committee Draft but remains under development and non-certifying.^[1]
• The EU published revised medical-device classification guidance in April 2026.^[16]
• Four EUDAMED modules became mandatory on 28 May 2026.^[20]
• The EU Machinery Regulation is approaching its 20 January 2027 application date.^[18]
• ASTM’s portfolio added 2025 editions covering logistics, tool handling, ladders, fit, risk management and back-loading assessment.^[3][4]
• ASTM work began on structural safety and exoskeleton data-at-rest security, but those items were not yet active standards when reviewed.^[31][32]
• Great Britain continued to operate transitional CE acceptance while consulting on future recognition arrangements.^[24]

Suppliers should maintain a controlled regulatory watch rather than embedding dates and standards permanently in sales material. Buyers should include a “last verified” date in the procurement file and recheck the product before contract renewal, expansion to another site or use in another jurisdiction.

Practical due-diligence sequence

A serious review can be organised into six steps.

Conclusion

Exoskeleton standards and regulation are becoming more mature, but the market still lacks one universal approval or certification system. The correct pathway depends on intended purpose, claims, product architecture, user group, environment and jurisdiction.

For suppliers, the strongest strategy is to define the product clearly, control claims, map every applicable market requirement, use current standards deliberately, preserve configuration traceability and maintain evidence across the lifecycle. For buyers, the strongest strategy is to verify the exact model and scope, distinguish voluntary testing from legal authorisation, review residual risks and ensure that workplace or clinical deployment remains within the documented intended use.

A credible regulatory claim is specific. It names the authority or standard, exact edition, product version, intended purpose, market and evidence. Anything broader should be treated as a starting point for due diligence, not as proof.

Methodology and limitations

This guide was prepared from official regulator, standards-body and government sources reviewed up to 30 July 2026. It prioritises ISO, ASTM, IEC, FDA, European Commission, EUR-Lex, OSHA, NIOSH and MHRA materials. The guide focuses on the United States, European Union/EEA and United Kingdom because these markets have accessible and comparatively developed public frameworks relevant to exoskeletons.

It is not an exhaustive global legal survey. Requirements in Canada, Japan, South Korea, Australia, China, the Middle East, Latin America and other markets must be assessed separately. Product classification can depend on facts that are not publicly visible, and standards, guidance, certificates and transition dates can change after publication.

Explore related Exoskeleton Index resources

References

1. International Organization for Standardization. ISO/CD 25563: Ergonomics — Process for the integration of wearable physical assistive devices (exoskeletons) — Expression of needs, selection, design, assessment and deployment. Committee Draft, under development. Official project page.
2. ASTM International. Committee F48 on Exoskeletons and Exosuits. Official committee page.
3. ASTM International. Subcommittee F48.02 on Human Factors and Ergonomics. Active standards and work items. Official portfolio.
4. ASTM International. Subcommittee F48.03 on Task Performance and Environmental Considerations. Active standards and work items. Official portfolio.
5. ASTM International. Subcommittee F48.01 on Design and Manufacturing. Official portfolio.
6. ASTM International. Subcommittee F48.04 on Maintenance and Disposal. Official portfolio.
7. ASTM International. Subcommittee F48.05 on Security and Information Technology. Official portfolio.
8. ASTM International. Subcommittee F48.06 on Risk Management. Official portfolio.
9. ASTM International. Subcommittee F48.91 on Terminology; F3323-24 Standard Terminology for Exoskeletons and Exosuits. Official portfolio.
10. Occupational Safety and Health Administration. OSH Act Section 5: Duties and General Duty Clause. Official text.
11. Howard J, Murashov V, Lowe B, Lu J. Industrial Exoskeletons. NIOSH Science Bulletin. 2020. CDC/NIOSH.
12. U.S. Food and Drug Administration. Powered lower extremity exoskeleton, product code PHL, 21 CFR 890.3480. Updated 2026. Product Classification Database.
13. International Electrotechnical Commission. IEC 80601-2-78:2019+A1:2024 — Particular requirements for basic safety and essential performance of medical robots for rehabilitation, assessment, compensation or alleviation. Official standard page.
14. U.S. Food and Drug Administration. Premarket Notification 510(k): K250904, Atalante X. Decision 24 October 2025. FDA database. See also FDA 510(k) overview.
15. European Union. Regulation (EU) 2017/745 on medical devices. EUR-Lex.
16. Medical Device Coordination Group. MDCG 2021-24 rev.1: Guidance on classification of medical devices. April 2026. European Commission.
17. European Commission. CE marking. Official guidance.
18. European Union. Regulation (EU) 2023/1230 on machinery. Application from 20 January 2027. EUR-Lex summary.
19. European Union. Regulation (EU) 2023/988 on general product safety. Applicable from 13 December 2024. EUR-Lex summary.
20. European Commission. EUDAMED overview and implementation status. Updated 2026. Official overview.
21. Medical Device Coordination Group. MDCG 2025-10: Guidance on post-market surveillance of medical devices and in vitro diagnostic medical devices. December 2025. European Commission.
22. European Commission. Manufacturers of medical devices under the MDR. Official guidance.
23. Medicines and Healthcare products Regulatory Agency. Medical devices: conformity assessment and the UKCA mark. Updated May 2026. GOV.UK.
24. Medicines and Healthcare products Regulatory Agency. Timelines for acceptance of CE marked medical devices in Great Britain. February 2026. GOV.UK.
25. Medicines and Healthcare products Regulatory Agency. Legal requirements for specific medical devices: prosthetic and orthotic devices. Updated 20 July 2026. GOV.UK.
26. Department for Business and Trade. Placing UKCA or CE marked products on the market in Great Britain. Updated April 2026. GOV.UK.
27. International Organization for Standardization. ISO 13485:2016 — Medical devices — Quality management systems — Requirements for regulatory purposes. Official standard page.
28. International Organization for Standardization. ISO 14971:2019 — Medical devices — Application of risk management to medical devices. Official standard page.
29. International Electrotechnical Commission. IEC 62304:2006+A1:2015 — Medical device software — Software life cycle processes. Official standard page.
30. ASTM International. Committee F48 subcommittees and standards. Official index.
31. ASTM International. WK97750: New Specification for Exoskeleton Structural Safety. Work item initiated January 2026. Official work item.
32. ASTM International. WK96094: New Practice for Securing Data Residing in Exoskeletons. Work item. Official work item.