Model language for legislators and regulators
Status: draft, 2026-10-04. Clauses that a legislator, regulator or program can adapt. They are written to match what the standard actually does; they are not legal advice and each jurisdiction's drafters will need to fit them to local law and terminology.
A. Food donation: data protection for rescue programs #
A.1 Purpose. To enable the rescue of surplus food while protecting the people served from identification, profiling and harm.
A.2 No personal data. Records of surplus offers, claims, custody transfers and distributions created under this [Act / regulation / program rule] shall identify organizations only. They shall not contain the name, telephone number, address, national, refugee or biometric identifier, health status, disability, religion or nationality of any person, nor the location of any household.
A.3 Aggregates and small numbers. Counts of people served shall be recorded in aggregate by site and day. Any count below ten shall be published or shared as "fewer than ten"; internal records kept for audit are not affected.
A.4 Cold-chain record. Each transfer of custody of rescued food shall record the time, the transferring and receiving organizations, the quantity accepted and rejected with a reason, and at least one temperature reading for chilled, frozen or hot-held items, taken by a trained person.
A.5 Retention. Each organization shall state its retention period for these records and delete them when it expires.
A.6 Rules of acceptance. Programs shall apply written food-safety rules to every handover and menu, derived from [national food code] and reviewed by a qualified food-safety professional, and shall record the rules applied and the findings.
A.7 Open format. Records shall be kept in an open, royalty-free, machine-readable format that permits exchange between programs without licence fees. [The Cookwala Humanitarian Profile is one such format.]
A.8 Donor protection. A donor acting in good faith, who records the offer and custody transfer under A.4 and whose food met the acceptance rules at transfer, shall not be liable for harm arising after custody passed, except in cases of gross negligence or intentional misconduct, and without prejudice to recall and notification duties. [Fit to existing good-faith donor laws.]
B. Cooking machines: safety functions a connected cooking appliance or robot must have #
B.1 Refusal before operation. A cooking appliance or robot that executes recipes shall check, before applying heat or operating a blade, that it can verify each step's end condition with a sensor, a logged estimate, a time limit or a present person, as the step's definition requires, and shall refuse the recipe with a stated reason when it cannot.
B.2 Local safety limits. Limits on temperature, pressure, unattended operation, allergen blocking and minimum cooking temperatures shall be enforced by the appliance itself and shall not be raised or disabled by any recipe, remote instruction, software agent, extension or operating mode. A maker may change a default limit only through a documented safety case and a signed firmware release. A stricter limit shall always prevail.
B.3 Local stop. A stop control on the appliance shall stop motion and cut heat within the latencies in the technical schedule (the standard specifies 0.5 s and 1 s), with or without a network connection.
B.4 Text is data. An appliance or agent shall conform to the standard's untrusted-text requirement (free text in recipes, listings and messages is data, never instructions), as tested by the conformance suite referenced in B.9.
B.5 Agents under mandate. A software agent that starts, stops or orders on a person's behalf shall act only under a mandate recorded by that person, with scopes, spending limits, an expiry and a list of actions that require the person's confirmation; irreversible actions and safety overrides shall always require confirmation.
B.6 Records. Recipes, device capabilities, recalls and execution records shall be verifiable by hash and signature; records of what was cooked shall contain no personal data and shall leave the appliance only with the user's consent.
B.7 Recalls. Publishers of machine-executable recipes distributed to appliances, and makers of appliances, shall operate a signed recall feed; appliances shall check it when connected and refuse recalled items.
B.8 Incident reporting. Makers shall provide a means of anonymous incident and near-miss reporting and shall share incident categories with other makers.
B.9 Conformance. A claim that an appliance meets these requirements shall be supported by a published conformance report naming the test vectors run, the tool and the date, and shall be independently verified before any mark is used.
C. Household data held by domestic robots #
C.1 Facts about a household that a domestic robot holds (occupancy and schedules, layout, children, health, religion, income) shall be stored on the device, erasable by the household within a stated period, and shall leave the device only as derived constraints necessary for a specific service, or with the household's explicit, withdrawable consent.
C.2 A robot shall not produce or store a behavioural score of any person in the household, and shall not infer a household's economic status.
C.3 Facts inferred by the robot shall not be the sole basis of a safety decision.
D. Procurement language for school-meal and relief programs #
"The supplier shall record offers, custody transfers and distributions in an open, royalty-free, machine-readable format with no personal data, apply food-safety and nutrition rules reviewed by a qualified professional, and report kilograms rescued, meals served, nutrition pass rate, cost per meal and safety incidents with the method of measurement for each."
Notes for drafters #
- Thresholds (0.5 s, 1 s, ten) come from the standard and public guidance and belong in a technical schedule, not in statute text; cite the national source where one exists.
- "Open, royalty-free format" avoids naming a product in law; the standard can be named in guidance.
- Section C is deliberately short; data-protection law already covers much of it, and the clauses name what is specific to robots in homes.