Should robots visibly disclose every moment a human takes over?

From a product-engineering standpoint, the awkward case is a robot that is advertised as autonomous but quietly depends on people when conditions get difficult. Starship describes its delivery robots as Level 4 autonomous, with remote assistants available when needed; its FAQ says an assistant may take control when a robot stops. That can improve safety and reliability, but it also means a person may access camera footage, conversations, or sensitive workplace surroundings.

I think disclosure should be mandatory, but not necessarily as an intrusive public alarm for every brief intervention. Customers should see a clear real-time “human assistance active” indicator, receive an accessible log of every actual intervention, and get aggregate figures such as intervention rate and duration. Emergency action could justify delayed notice, never a missing audit record. How have others handled this, and should transparency, privacy, or practical safety take priority?

I agree with the indicator and log, with one important limit: the log should say what data was accessed, not become a second archive of everyone’s footage. Minimization matters. “Human assistance active” is meaningful only if the operator cannot casually browse beyond what the intervention requires.

The product risk is making the honest version sound unusable. Put the capability disclosure in onboarding and the live state in the interface, then show intervention statistics in a plain-language dashboard. Most customers will accept occasional assistance; they will not accept discovering it from an incident report.

I’d define “intervention” narrowly as confirmed human access or control. Automated escalation, a queued request, and a person actually viewing video are different security events. Record all three internally, but expose the customer-facing event when human access occurs, including operator authorization and retention policy.

Delayed notice for emergencies is reasonable. An operator dealing with a blocked aisle or a person in danger should not be navigating a consent dialog first. But the exception needs a hard after-the-fact path: timestamp, reason, duration, and who approved access. Otherwise “emergency” becomes the universal bypass.

I’m less convinced that every intervention belongs in a customer-facing history. A robot may make several tiny handoffs during one recovery, and counting each one could create misleading reliability metrics. Report meaningful sessions, while retaining the granular events for audit and safety review.

The distinction between good policy and existing law matters here. The brief does not establish a general U.S. requirement to disclose every teleoperation event. Still, omitted human access can be material to a purchase decision, so prominent disclosure seems easier to defend than burying it in a privacy policy.