Humanoid SDKs and Software

Levels of access and what they allow

A humanoid SDK can expose several layers. A high-level interface lets you call ready-made behaviours such as walking to a point or waving. A middle layer gives joint positions and sensor streams. The lowest layer passes torque or current commands straight to the motors, which research and new controllers need but which also lets a coding error damage the robot. Ask which layers your edition opens, whether you can run code on the robot's own computer, and whether the maker publishes a simulation model that matches the real machine. A faithful simulation model lets you test risky code before it reaches the hardware, which saves both repairs and lab time.

ROS 2 and the tools you already use

If your team builds on ROS 2, ask whether the maker supplies official ROS 2 packages, which distribution they target and how quickly they follow new releases. Community wrappers can help but may lag behind firmware updates. Check which programming languages the SDK supports, whether the examples run without changes, and whether documentation exists in a language your team reads well. Ask for the SDK's version history: frequent breaking changes cost developer time, while a long silence may mean the SDK is no longer maintained. Before you buy, download the SDK if the maker allows it and run its examples in simulation, which tells you more than any feature list.

Licences, source code and what you can ship

Read the SDK licence before you write code against it. Check whether commercial use is allowed, whether you may distribute applications to other owners of the same robot, and who owns the code and trained models you create. Ask for a list of the open-source components inside the SDK and the robot's software, with their licences. ISO/IEC 5962:2021, the SPDX specification, defines a standard format for exchanging that kind of software package information, so asking for an SPDX document is a precise way to make the request. A clear list helps your legal team spot licence terms that would clash with your own product before you have built on them.

Security updates and support periods

Regulation (EU) 2024/2847, the Cyber Resilience Act, sets cybersecurity requirements for products with digital elements, including how manufacturers handle vulnerabilities and provide security updates over a support period. Most of its obligations apply from 11 December 2027, so ask makers now how they plan to meet them for robots sold in the EU. Wherever you are, ask how long the SDK and firmware will receive security fixes, how fixes are announced, and whether you can take a security patch without also taking feature changes that break your code. Ask, too, whether the robot's connection back to the maker can be disabled without losing access to the SDK.

Sources and further reading

• ISO/IEC 5962:2021 Information technology – SPDX® Specification V2.2.1 — International Organization for Standardization / International Electrotechnical Commission.
  Standard format for listing the software packages and licences inside a product, handy when requesting an SBOM.
• Regulation (EU) 2024/2847 (Cyber Resilience Act) — EUR-Lex, Publications Office of the European Union.
  EU cybersecurity rules for products with digital elements, including vulnerability handling and security updates.

Common questions

Do all humanoid robots come with an SDK?

No. Some are sold as finished products with an app or a fixed set of behaviours, while others are built as development platforms. If you plan to program the robot, confirm in writing which SDK, which access level and which licence come with your order.

Can I run my own AI models on a humanoid?

Often, if the SDK lets you run code on the robot or stream sensor data to your own computer and send commands back. Check the onboard computing capacity, network delay and any terms that restrict which models or cloud services you may connect.