Warehouse robotics succeeds when a site ships accurate orders with less hazardous travel and fewer repetitive tasks. It fails when a throughput target pushes people into robot lanes, inventory errors propagate at machine speed or staff cannot stop the system safely. A pilot must therefore prove the complete work cell—people, layout, stock, software and recovery—not just the robot’s advertised moves per hour.
This guide is current to 31 July 2026 and focuses on retail fulfilment in Great Britain. Product-supply and workplace rules differ in Northern Ireland, and a specific installation may involve PUWER, LOLER, electrical, fire, building and other duties. A competent machinery and health-and-safety assessment is required. This is not engineering or legal advice.
Choose one bounded material flow
Start with a stable, observable route such as totes from pick face to packing, replenishment between two zones or completed parcels to sortation. Avoid automating the entire fulfilment centre in the first proof.
Map the unit load, start, destination, route, hand-off, exception and safe state:
| Flow | Suitable pilot? | Required evidence | Principal hazard |
|---|---|---|---|
| --- | ---: | --- | --- |
| Closed tote between fixed stations | High | Weight, dimensions and scan identity | Collision or wrong destination |
| Mixed pallet movement | Medium | Load stability and route separation | Crushing or dropped load |
| Robot-assisted each picking | Medium | Item and location accuracy | Human–robot interaction |
| Mezzanine movement | Low initially | Structural, edge and fire review | Fall and evacuation |
| Autonomous fork movement in shared aisle | High consequence | Full competent risk assessment | Vehicle–pedestrian impact |
Define the robot’s authority. It may accept a transport mission from the warehouse execution system; it may not change inventory ownership, substitute a product or decide that a blocked fire route is passable.
Design the site before optimising routes
HSE’s Warehousing and storage guide, HSG76, covers mechanical handling, workplace transport, working at height, manual handling and emergency arrangements. Use a current site-specific risk assessment rather than assuming the robot’s sensors make shared traffic safe.
Create a scaled movement plan containing:
- pedestrians, manual trucks, lift trucks and robot routes;
- crossings, doors, blind corners and pinch points;
- charging, maintenance and recovery zones;
- storage, dropped-load and obstruction envelopes;
- emergency exits, fire equipment and assembly paths;
- wireless coverage and localisation markers;
- floor condition, gradients and loading;
- safe speed by zone and operating mode; and
- temporary routes during peak or building work.
Prefer physical separation, engineered crossings and controlled access over warnings alone. Place screens and pick faces so workers do not step backward into a travel path. Test with the actual lighting, reflective wrap, dark clothing, low loads and seasonal congestion.
HSE’s mobile work equipment guidance confirms that remote-controlled and self-propelled equipment creates specific mobility risks in addition to general work-equipment duties. A vendor demonstration in an empty aisle is not a workplace validation.
Apply machinery duties across the lifecycle
PUWER covers starting, stopping, programming, transporting, repairing, modifying, maintaining, servicing and cleaning—not only normal operation. HSE’s PUWER overview requires suitable equipment, safe maintenance, inspection, trained users and appropriate controls such as guarding, isolation and emergency stops.
Keep an equipment file with:
- intended use and foreseeable misuse;
- conformity declaration and instructions;
- site acceptance tests;
- safety functions and validated limits;
- inspection and preventive-maintenance plan;
- authorised software, map and firmware versions;
- modification and change assessment;
- competence by role;
- defect, near-miss and incident history; and
- decommissioning and battery-disposal plan.
New machinery placed on the GB market may use applicable UKCA or recognised CE routes under current rules. The Department for Business and Trade’s March 2026 GB product-marking guidance explains market, economic-operator, conformity and documentation responsibilities. A mark does not replace the employer’s assessment of safe use in its installation.
Where an operation genuinely involves lifting equipment, LOLER may require proper planning, supervision, thorough examination and records. Many conveyors and simple pallet trucks are instead covered by PUWER alone; classify the actual equipment rather than applying a generic “robotics compliance” label.
Treat the safety system as independent
Route optimisation and collision-avoidance safety are not the same function. Safety-rated scanners, brakes, protective fields, emergency stops and control architecture must meet the required integrity independently of an AI productivity model.
Document safe states for:
- lost localisation;
- blocked route;
- person or object inside the protective field;
- dropped or shifted load;
- low battery or charging fault;
- wireless or server outage;
- fire alarm and evacuation;
- emergency-stop activation;
- manual recovery; and
- conflicting mission or map version.
Nobody should enter a hazard zone merely because a dashboard says the fleet is stopped. Provide isolation, lock-off and verification appropriate to the equipment. Train contractors, cleaners and temporary staff, not just robot operators.
HSE’s 2025 review of machinery standards and emerging technology specifically considered autonomous mobile robots and potential AI safety use. HSE announced in June 2026 that it was developing joint collaborative-robotics guidance. At this cutoff, that forthcoming work should not be represented as a completed approval route.
Protect inventory truth
The physical item, location and system record can diverge. Every mission should carry unique robot, container, source, destination, item or order reference and timestamp. Use barcode, RFID, vision or weight checks appropriate to the product, but preserve a defined reconciliation point.
Separate four events:
- mission created;
- load physically acquired;
- destination hand-off confirmed; and
- inventory or order status posted.
Do not mark inventory moved because the robot accepted a task. If a tote is removed manually, damaged or deposited at a recovery station, create an exception rather than force-completing the mission.
Measure:
- location and quantity accuracy;
- wrong-item and wrong-destination rate;
- unscanned manual interventions;
- mission completion and recovery time;
- orders held by robot or integration failure;
- pick and pack accuracy;
- damage and dropped-load events; and
- reconciliation labour.
Test duplicate messages, out-of-order events, clock drift, reused container labels and partial ERP or WMS outages. An idempotent integration should not create a second stock movement when a response is retried.
Keep people out of productivity scoring
Robot data can reveal worker location, pace, breaks, errors and interactions. The ICO’s guidance on monitoring workers through tracking and other technologies requires lawful, fair, transparent and proportionate use and recommends a DPIA where likely high risk exists.
Define operational telemetry separately from employee performance data. A robot needs to detect a person for safe stopping; the business does not automatically need to identify that person, retain a movement history or rank their speed.
Before deployment:
- consult workers and representatives;
- explain sensors, purpose and retention;
- mask or aggregate identities where possible;
- prohibit automated disciplinary action;
- provide a route to correct misattributed events;
- restrict access to video and location history;
- set rules for safety investigation use; and
- measure ergonomic and workload effects.
Do not turn saved walking into an unattainable pick-rate increase. Observe whether workers perform more twisting, static standing, screen monitoring or hurried exception recovery.
Secure robots, chargers and orchestration
Segment robot, safety, corporate and guest networks. Use device identities, signed software and map updates, least-privilege APIs, multi-factor authentication for administrators and controlled vendor remote access. Inventory robots, controllers, chargers, gateways, firmware, certificates and support status.
Follow the NCSC’s secure AI system-development guidance and test:
- a forged WMS mission;
- a compromised vendor credential;
- map or speed-zone tampering;
- replayed completion messages;
- malicious barcode or item description input;
- fleet-manager outage;
- expired device certificate;
- cross-site command leakage; and
- unavailable security updates after contract end.
Cyber loss of the productivity layer must lead to a safe physical state. Recovery requires reconciling in-flight loads and inventory, not simply rebooting the fleet.
Baseline the complete operation
Record at least four representative weeks, including peak congestion if safe. Measure orders, lines, units, travel distance, labour minutes, queue time, stock errors, equipment downtime, near misses, manual-handling concerns, energy and missed cut-offs.
Use percentile performance by hour and product class. Average moves per hour can hide blocked aisles and dangerous recovery peaks. Count upstream replenishment and downstream packing: making one cell faster may only move the queue.
Calculate full cost: site works, guarding, charging, network, integration, licences, spares, inspections, maintenance, training, lost space, support and decommissioning. Include a realistic availability assumption and manual fallback capacity.
Observe peak changeovers and end-of-shift conditions separately. Empty packaging, returns, damaged stock and battery queues often appear outside the vendor’s ideal demonstration window. Record the number of people required to recover a stranded unit, the time that an aisle remains unavailable and whether recovery creates new manual-handling exposure. A labour saving that depends on an unplanned technician call-out is not available capacity.
Check energy at the system boundary as well as at the charger. Include heating or cooling changes, server and wireless infrastructure, idle draw and the extra conveyor or packing equipment needed to exploit higher flow. Do not claim a sustainability benefit from travel distance alone.
Gate the first 90 days
| Period | Work | Gate |
|---|---|---|
| Days 1–20 | Select flow, baseline, consult workers, map hazards and legal duties | Competent owner accepts design boundary |
| Days 21–40 | Configure isolated cell, interfaces, safety functions and maintenance | Site acceptance and safe-state tests pass |
| Days 41–60 | Run non-production and supervised shadow missions | Zero unexplained inventory or safety event |
| Days 61–78 | Limited live operation by trained shift and product class | Workload and exception capacity remain safe |
| Days 79–90 | Compare service, accuracy, safety, people and total cost | Scale, modify or stop |
Pause after any injury or dangerous occurrence, protective-device bypass, unexpected motion, lost load, fire-route obstruction, unresolved inventory divergence, unauthorised command, severe worker-data misuse or inability to isolate equipment. Preserve logs and physical evidence, follow the site incident process and assess whether RIDDOR reporting applies.
Release requires trained coverage, verified emergency stops and protective fields, no deterioration in near misses, inventory accuracy at or above baseline, sustainable exception load and a demonstrated recovery from orchestration outage. Throughput alone cannot pass the gate.
Related archive guides cover AI warehouse [automation](/blog/logistics-ai-warehouse-automation-supply-chain-uk), retail smart stores and SME robotics.
Scale the work cell, not the promise
Extend to a similar zone only after rechecking layout, loads, people and interfaces. Revalidate every map, firmware, safety-field, product mix or workflow change. Review near misses with workers and maintainers, not only vendor telemetry.
A good robotics programme makes safe work more predictable and fulfilment more accurate. If people must improvise around the robot, the stock record cannot explain where a tote went or the site cannot stop operations cleanly, the pilot is not ready to become infrastructure.
