AI agents and robots change the threat model for elevator maintenance by adding software that can read, decide and sometimes act on equipment. The new risk is not a smarter attacker. It is a new trusted actor with credentials, tools and input from untrusted places. Redraw your model around what that actor can read, write and command.
We found no public source for elevator-specific cyber requirements, so we cite no elevator safety code. Check the codes in your jurisdiction with your safety engineers. We also describe no incidents, because we did not find a verifiable one to cite.
Where do lifts fit in the standards we can cite?
NIST SP 800-82 Revision 3 is guidance on operational technology, meaning programmable systems that interact with the physical environment. Its listed examples include building automation systems and transportation systems. The ISA/IEC 62443 series covers industrial automation and control systems, lists building automation among the sectors it serves, and divides responsibility among asset owners, product suppliers, integrators and service suppliers. A maintenance firm often sits in that last group.
ISO 10218-1:2025 covers safety requirements for industrial robots. Whether a given inspection or service robot falls under it depends on the machine, so ask the manufacturer which safety standard applies. Do not assume this one does.
Five questions to redraw the model
1. What can the agent read? A maintenance assistant may read fault codes, usage logs, photos from technicians and building records. Each source can carry hostile text if someone else can write to it, such as a ticket field a tenant can edit. OWASP describes indirect prompt injection as a way to push an agent into unintended actions through content it reads. Treat every free-text field the agent sees as untrusted.
2. What can the agent write? Opening a work order is low impact. Changing a parameter, resetting a fault or pushing firmware is not. OWASP's excessive agency entry names three root causes: excessive functionality, excessive permissions and excessive autonomy. Give a maintenance agent the work-order tool and not the controller.
3. What identity does it use? If the agent reaches building systems with a shared service account, one manipulated session reaches every site. Give it a per-site, least-privilege identity that expires, and log each call.
4. Where is the human? For anything that can move a car, open a door or disable a safety circuit, put a qualified person in the loop, with the approval step outside the model's control. That is our recommendation, not a quotation from a standard. NIST's OT guidance stresses the safety and reliability requirements that make OT different from office IT.
5. How is safety kept separate? Keep safety functions independent of AI components, so a model failure cannot disable a protective function. Ask your supplier to show where the boundary sits and how it is tested.
What changes with robots?
A robot adds physical reach and its own software supply chain: firmware, a navigation stack, a remote support channel. Ask the supplier for a bill of materials for that software, how updates are signed, and who can open a remote session. IEC 62443 part 4-1 covers secure product development lifecycle requirements for suppliers, and part 2-4 covers service providers, so you can use them as a basis for supplier questions.
What breaks the usual playbook?
Traditional OT security assumes humans and fixed scripts operate the equipment. An agent is neither. It is decision logic driven by text, and its inputs change every day. So controls like allowlisting tools, approval gates and per-task limits matter more than blocking known-bad strings.
Software supply chain basics still apply to the code around the agent: inventory its packages, scan them and pin versions. Safeguard can generate SBOMs and scan dependencies for the software you control, and an MCP server connection for an agent can be switched off by a tenant admin. None of that secures a lift controller you do not own.
What to do
- List every system the maintenance agent can read from and write to.
- Mark every free-text input as untrusted.
- Strip write access to controllers from the agent's identity.
- Give each site a separate, expiring credential.
- Require qualified human approval for any action that can affect motion or safety circuits.
- Ask suppliers where safety functions are isolated from AI components.
- Request a software bill of materials and update signing details for any robot or gateway.
- Rehearse a kill switch that cuts the agent off in minutes.
Quick check
Does ISO 10218 apply to elevator robots?
ISO 10218-1:2025 covers industrial robots. Whether a specific service robot falls under it depends on the machine. Ask the manufacturer.
Should an AI agent be able to reset an elevator fault?
Our view is no, unless a qualified person approves each action outside the model. Start with read access and work orders.
Sources
- NIST SP 800-82 Rev. 3, Guide to Operational Technology Security
- ISA/IEC 62443 series of standards
- ISO 10218-1:2025, Industrial robots safety requirements (archived ISO page)
- OWASP GenAI: LLM06:2025 Excessive Agency
Last reviewed: 18 October 2026.
