Companion Robot Incident Response Checklist: 18 Safety, Evidence and Account Steps
What to do after unexpected movement, sensor access, account compromise, overheating or a privacy incident involving a connected companion robot.
Quick answer
After a companion-robot incident, protect people first: use the documented emergency stop or safe power isolation, keep clear of moving parts and avoid handling a hot, swollen or damaged battery. Preserve the scene and minimal logs without copying intimate content, record the exact time and symptoms, secure affected accounts from a trusted device, and notify the manufacturer or relevant authority. Do not reset, update or repeatedly restart the robot until evidence and safety needs are decided.
General consumer safety and privacy information; follow model-specific manufacturer instructions and relevant authorities.
1. Protect people before protecting evidence
Move people and pets outside the robot’s movement envelope and use the documented emergency stop when it is safe to reach. Call emergency services for injury, fire or immediate danger. Do not stand in front of moving joints or attempt to restrain a heavy machine by hand. Evidence matters, but no screenshot justifies continued exposure to heat, smoke, unexpected motion, exposed wiring or an unknown remote operator.
2. Identify the incident category
Record whether the event involved motion, collision, overheating, charging, account takeover, unexpected recording, data disclosure, remote access, harassment, payment or software failure. More than one category may apply. Avoid deciding the cause too early; “the AI did it” is not a technical finding. A precise symptom list guides the right response and prevents a privacy event from being treated solely as mechanical failure, or vice versa.
3. Stabilize power without improvisation
Follow the model’s emergency shutdown procedure. If a battery is hot, swollen, leaking, smoking or damaged, do not recharge, puncture, cool with household liquids or move it unnecessarily. CPSC materials document serious lithium-ion hazards. Keep people away and follow manufacturer, fire-service or hazardous-waste directions. Pulling a plug may not stop an internal battery, while opening the enclosure can remove safeguards and destroy useful evidence.
4. Preserve the scene and timeline
Write down the first observed time, location, people present, network state, charging state, commands, lights, sounds and motion. Photograph the surrounding area and visible indicators from a safe distance. Do not stage a reenactment. Preserve damaged objects and packaging when relevant. A contemporaneous timeline is more reliable than a later narrative and helps separate the initial event from changes caused during recovery.
5. Collect minimal technical evidence
Export only the logs, alerts, version numbers and session records needed to understand the incident. Keep original files read-only and record how they were obtained. Avoid broad downloads of conversations, images or biometric data. If intimate material is involved, restrict access and document custody. Evidence collection should reduce uncertainty without creating a larger privacy breach or distributing material to people who do not need it.
6. Do not reset or update reflexively
A factory reset, firmware update or repeated reboot can erase logs, change behavior and destroy the ability to reproduce a fault. Freeze nonessential changes until the responsible person decides what evidence must be retained. If continued operation is unsafe, isolate the device instead. Record every unavoidable action and its time. Troubleshooting advice that begins with “reset everything” may be inappropriate after injury, account compromise or disputed remote control.
7. Secure accounts from a trusted device
Use a separate known-good phone or computer to change the owner password, strengthen recovery methods, enable multi-factor authentication and revoke unknown sessions. Check paired devices, delegated users, API tokens and support access. Do not type new credentials into the robot until its integrity is understood. The FTC recommends unique passwords, two-factor authentication and regular updates for connected devices; account containment can proceed without restarting suspect hardware.
8. Contain network access
Block the robot at the router or move it to an isolated segment if that can be done without unsafe physical interaction. Preserve relevant router and firewall logs first. Do not disconnect the entire household indefinitely or reset the router without a plan. CISA guidance emphasizes evaluating settings and reducing unnecessary exposure. Containment should stop remote commands and data transfer while preserving unrelated services and the evidence needed to understand the path.
9. Check for unauthorized remote control
Review vendor dashboards, paired phones, web sessions, remote-support history and teleoperation records. Record unfamiliar IP addresses or times without assuming they identify a person. Ask the vendor to preserve server-side logs under a case number. A machine that appears autonomous may be following a schedule, local software, cloud inference or a human operator. The evidence must distinguish these possibilities before blame or public claims.
10. Separate safety facts from vendor claims
Record what was directly observed, what the device interface reported and what support staff said. Those are different evidence layers. A green health indicator does not disprove a collision, and a support assurance does not verify cloud deletion. NIST’s IoT documentation work highlights the need for clear capability and lifecycle information. Request model-specific explanations rather than accepting generic marketing language about privacy, intelligence or safety.
11. Preserve privacy and consent
Identify whose voices, images, profiles or conversations may have been captured. Limit access to the smallest necessary group and avoid sending raw intimate material through ordinary email or chat. Record whether indicators were visible and whether affected people had a meaningful way to decline. If deletion is requested, first determine whether legal, insurance or safety evidence must be preserved; then document scope, authority and completion.
12. Notify the correct organization
Open a manufacturer support case with model, serial, versions, symptoms and a safe summary. For injury or hazardous products, follow local reporting channels; in the United States, CPSC provides product-safety reporting. For account or privacy breaches, follow applicable regulator and contractual routes. Do not mass-post allegations before facts are established. A concise, reproducible report is more likely to reach engineering and create a durable case record.
13. Evaluate recalls and known issues
Check the manufacturer and official safety authorities for recalls, service bulletins and security notices covering the exact model, battery and software. Save the notice and retrieval date. Do not infer coverage from a similar-looking product. If the device is recalled, follow the official remedy rather than experimenting. If no notice exists, record that search as a bounded check; absence of a recall does not prove the event is isolated or the product safe.
14. Plan controlled technical testing
Only after immediate safety and evidence needs are resolved, define one hypothesis and one bounded test at a time. Use an isolated network, clear movement area, emergency stop and responsible observer. Begin with passive inspection and low-energy functions. Do not recreate dangerous motion, overheating or unauthorized access. Record expected and actual results. Stop on any new anomaly and return the device to quarantine rather than escalating experiments.
15. Decide repair, replacement or retirement
Compare the verified cause, residual risk, support response, parts availability, warranty and data exposure. A repair is not complete until emergency stop, battery health, movement, account control and privacy indicators are retested. If support cannot explain the incident or the product is out of support, restricted use or retirement may be safer. Disclose unresolved defects in any lawful transfer and follow electronics and battery disposal rules.
16. Create an incident decision record
Summarize facts, unknowns, actions, evidence locations, support cases, responsible people and deadlines. Mark every control pass, fail, not applicable or unknown. Keep passwords and intimate content outside the record. State a narrow release decision, such as supervised offline testing only. This prevents a successful reboot or reassuring email from being mistaken for closure and gives a second reviewer enough information to challenge assumptions.
17. Review downstream accounts and devices
Check smart-home controllers, voice assistants, calendars, messaging, payment methods and other services the robot could reach. Revoke tokens and rotate credentials only where exposure is plausible; indiscriminate changes can destroy useful logs. Verify that former integrations cannot still issue commands. A companion robot sits inside a wider ecosystem, so containment is incomplete if the hardware is isolated but a compromised app retains cloud access.
18. Run a post-incident lessons review
After closure, identify which warning, indicator, permission, training or physical safeguard failed. Update household rules, network segmentation, retention, support contacts and inspection schedules. Share only sanitized lessons with people who need them. Set a future review date because vendor software and policies change. The goal is not to prove faultlessness; it is to reduce recurrence, improve detection and make the next response faster and safer.
How to record the result
Use a dated worksheet and mark each check pass, fail, not applicable or unknown. Include the exact model, hardware revision, software version, source links, support case numbers and the person responsible for every unresolved item. Keep passwords, access tokens and intimate recordings outside the worksheet. Unknown is not pass, and a successful reboot does not prove battery safety, account integrity or cloud deletion.
Ask a second person to reproduce the most important checks before unrestricted use, transfer or disposal. The final decision should be narrower than the evidence: for example, approved for supervised local testing on an isolated network. Reopen the checklist after repair, account transfer, major update, battery event, household change or vendor-policy change.