Grounding the case for a European approach to the regulation of automated driving: the technology-selection effect of liability rules

Abstract

In the current paper, we discuss the need for regulation at EU level of Connected and Automated Driving solutions (henceforth CAD) based on multiple considerations, namely (i) the need for uniformity of criteria across European Member States, and (ii) the impact that regulation—or the absence of it—has on the proliferation of specific technological solutions. The analysis is grounded on legal and economic considerations of possible interactions between vehicles with different levels of automation, and shows how the existing framework delays innovation. A Risk-Management Approach, identifying one sole responsible party ex ante (one-stop-shop), liable under all circumstances—pursuant to a strict, if not absolute liability rule—is to be preferred. We analyse the solution adopted by some Member States in light of those considerations and conclude that none truly corresponds to a RMA approach, and differences will also cause market fragmentation. We conclude that because legal rules determine what kind of technological application is favoured over others—and thence they are not technology-neutral—uniformity across MSs is of essential relevance, and discuss possible policy approaches to be adopted at European level.

1 Introduction

The paper discusses how liability rules influence the kind of technology that ultimately emerges and prevails and, based on the critical analysis of the existing legal framework at European level, concludes that, in the field of autonomous driving, reform is needed, and that it should be grounded on a Risk-Management Approach, overcoming the need of an exact apportionment of liability through complex litigation.

Such an approach would favour market penetration of increasingly autonomous vehicles—to be deemed beneficial in an economic and social (in terms of accident reduction) perspective—so long as it was implemented at European level, to avoid divergence among Member States (henceforth MSs), that would instead cause market fragmentation.

To do so, it starts by acknowledging how at least two types of automation are possible: Type-1, where the user is free to choose to activate the self-driving function of the car, and Type-2, where the human being is radically excluded from any involvement in the driving task (Sect. 2).

It then discusses what incentives existing liability rules at European level provide to the uptake of increasingly autonomous vehicles (Sects. 4–13). In such a perspective, it takes into account how transition towards higher levels of automation will occur over time, thence allowing for the coexistence of vehicles with different degrees of automation (Sect. 5). Three different stage are defined, the current one (S₀) where the number of autonomous vehicles on the roads is negligible, and those display low levels of automation, a final stage (S_f) where most if not all vehicles are highly automated, and an intermediate stage (S_i) where the two populations coexist (Sect. 6). By modelling the interaction of two vehicles in each stage—two non-autonomous (N-Type) in S₀ (Sect. 7), two autonomous (A-Type) in S_f (Sect. 8), and one N- and one A-Type in S_i (Sects. 9–11)—the paper shows how the existing liability framework at European level—primarily grounded on product liability, driver’s liability and owner’s liability—will cause the owner of an A-type vehicle to be heavily burdened, discouraging early technological uptake (Sect. 12).

In particular, the complexity and inefficiency of the current liability framework will cause apportionment of liability among possible responsible parties to become ever more complex, and ultimately leave the owner to bear the economic consequences of an accident, pursuant to strict or semi-strict liability rules such as those today in place. Manufacturers and other service providers will not be easily forced to internalize the costs they give rise to (Sect. 13).

The paper therefore suggests that reform is necessary not to delay innovation. A reform of the liability system into place should be inspired to the so-called Risk-Management Approach (RMA), whereby the party is held liable who is best positioned to (i) identify and reduce risks, and (ii) manage associated costs, also through insurance. Such an approach is based on the consideration that the primary function of liability rules should be that of ensuring compensation, while optimal safety investments are better ensured through other bodies of norms (including product safety regulation). To this end, strict (if not absolute) liability rules should be employed, clearly identifying one single responsible party towards the victim (one-stop-shop approach) (Sect. 14). Such a party might alternatively be identified in the vehicle owner, favouring the emergence of Type-1 automation (Sect. 14), or the producer, leading to Type-2 automation (Sect. 15).

According to such a perspective (Sect. 16), the legislation adopted by some European countries—namely Germany and the United Kingdom (despite the latter not being anymore a Member State at the moment the article is published)—are briefly described and assessed (Sects. 17, 18, respectively) to conclude that they do not fully abide to the RMA as defined, and still leave room for inefficiencies and uncertainties, as the current legal system (Sect. 19).

Therefore, given the inefficiency of the current liability framework, the risk that MS intervene with national legislation adopting divergent criteria—ultimately favouring different kinds of automation—leading to market fragmentation, a policy recommendation is made for the European Union to intervene and reform the field of liability for accidents arising from the use of connected and automated driving solutions (CADs), pursuant to a Risk-Management Approach (Sect. 20).

2 The need for regulation of connected and automated driving solutions: setting the framework

A recurring debate in law and technology is that of whether regulation hampers or, rather, promotes innovation. Intervening too early, when the understanding of technology is limited, might lead to the adoption of inappropriate solutions that prevent its use and diffusion. At the same time, failing to intervene might be costly in a twofold sense. Firstly, there might be aspects of extant legislation that prevent the use of a given application, and thence delay innovation¹ and cause a competitive disadvantage for players operating within that system. Secondly, if policy makers renounce a leading role, they might allow the emergence of technical solutions that conflict with fundamental values and principles that qualify the system, and yet create a path-dependency hard to address later on, once diffused.

The complexity of innovation, the number of variables involved, and the articulated interaction between these factors, prevent the identification of a one-fits-all theoretical framework, thence an analysis can only be attempted by looking closely at one specific class of applications at a time, considering the peculiarities that distinguish it from others (Bertolini 2013).

The case here considered is that of CADs, by that intending vehicles with different degrees of automation² that enable the user to relinquish partially or completely the driving task to the combination of software and hardware.

We will therefore try to assess whether there is a need for regulation, and whether this needs to occur at EU or MS level. To this end, we will make some crucial assumptions to further pursue the analysis.

First, we assume that the emergence of autonomous driving solutions is desirable, for it will reduce the number of accidents (Broggi et al. 2008), and will possibly improve other aspects of mobility, traffic and urban environment, which, however, will not be here further discussed. We also assume that the effect in terms of accidents reduction depends upon the percentage of vehicles with higher levels of automation present on the road in a non-linear way. Said otherwise, the positive effects caused by the diffusion of autonomous vehicles may not materialize until they reach a significant market share. CADs’ efficiency in improving traffic builds upon their ability to interact, exchange information and coordinate with one-another. Therefore, until such scenario in reached, allowing to unlock positive network externalities and CADs potential in reducing the number of accidents, a human driver might still perform better in anticipating and understanding—thence avoiding—the erroneous or illicit behaviour of other drivers than an autonomous system.

At the same time, we also assume that a large percentage of CADs circulating on public roads might lead to new forms of accidents to emerge due to failures, errors and interferences that may be anticipated and described only partially. Primarily, given their connected nature, cybercrimes, software and connection failures, as well as the malfunctioning of hardware and sensors involved in the performance of the driving task, will replace accidents due to the misbehaviour of human drivers.³ Determining the frequency of these accidents, and the relevance of their consequences is extremely hard. Data currently possessed is largely insufficient to this end, and therefore all statements about the increased safety brought about by autonomous driving are to be deemed qualitatively and not statistically supported (Kalra and Paddock 2016).

Secondly, we base our study on a fundamental distinction between different kinds of automation: a first one, where autonomous driving is a function that can be activated or disabled according to the choosing of the user (henceforth Type-1); a second one, where no human being is involved in the driving process and the vehicle does not even possess controls for the occupant to interact with (henceforth Type-2). The two do not necessarily—yet may (see below Sect. 11) represent different stages of technological advancement, for the former might appreciate automation merely as an additional feature of the car, that is not intended to replace “the pleasure of driving”. The two types of automation lead to very different approaches to mobility—maintaining car ownership or replacing it with service-solutions—with further effects on traffic, the way urban spaces are shaped, and how the automobile industry will evolve.

3 Identifying the fundamental legal issues

When discussing the regulation of CADs there are three essential issues that need to be tackled, namely: the lawfulness of their circulation on public roads, the possibility of testing prototypes, and the apportionment of liability rules.

Among the three considered, the first one, is indeed essential. Absent a definition of vehicle that enables their circulation, CADs could not be used. Some countries possess a sufficiently broad definition within their traffic code, that requires no adaptation,⁴ while others should modify their legislation for this very purpose and still failed to do so.⁵ The way in which such delay might prove detrimental is twofold. From a national perspective, it would limit the MS’s own market; from a European perspective instead, it might obstacle free circulation of goods and people across MSs, for it might impede CADs to be used in those countries that do not possess an all-encompassing definition of vehicle, and thence it might provide an argument for EU intervention (Evas 2018).

As for the second issue, a framework enabling testing on public roads is also essential in particular for manufacturers operating within the single MS, allowing for technological advancement and the acquisition of data necessary to assess risks, the frequency of their materialization, as well as their possible consequences. The latter, moreover, is required to tailor adequate insurance products. Different regulation within MSs would however not be problematic, eventually creating a competitive advantage for those systems that adopt it early on, easing the position of manufacturers and researchers operating within their own borders.

Conversely, how liability is attributed and apportioned among the different players involved, is a matter of seminal importance. Not only does it determine the incentives to the very development and diffusion of CADs, but it also influences the adoption of specific technological solutions, ultimately determining which approach to automation will prevail. Liability rules are therefore not technologically neutral (Bertolini 2020), thence different approaches from single MS would lead to the emergence of different technological solutions, thus fragmenting the EU market.

In the subsequent paragraphs we will focus on how extant liability rules, conceived for traditional vehicles, might delay the diffusion of CADs (see Sect. 5–13 below), and how the choice among possible alternative approaches contributes to selecting the kind of innovation that will emerge and prevail (see Sect. 14 below). We will therefore conclude that such a choice would be better made at EU rather than MS level in order to avoid market fragmentation (see Sect. 20 below).

4 Apportioning liability in light of extant regulation

Civil liability determines the obligation to compensate damage brought to the victim by the tortfeasor. To be established, some requirements need to be met that vary—despite not greatly—across different legal systems.⁶ For the sake of the current analysis we can abstract away from some details and focus on those elements that are essential, and common to all systems, in particular the causal nexus and fault.

The first is the link between the fact—or conduct of the agent—and damage, so that the latter may be deemed the consequence of the former.⁷ The second, instead, entails a judgment whereby the conduct of the agent falls below a given standard, demandable in light of all relevant circumstances.⁸

Most MS adopt a fault based system for the liability arising from the circulation of vehicles,⁹ whereby the driver is held accountable if he failed to respect the traffic code—or any other relevant regulation—or behaved negligently or recklessly.

Some legal systems then establish the joint and several liability of the owner of the vehicle on strict basis, with the aim of ensuring the victim obtains compensation, should the driver not be solvent.¹⁰ Such an apportionment of liability can already be framed as responding to a Risk-Management Approach (henceforth RMA)—as defined by Bertolini (2016)—for liability is attributed to the party best positioned to insure and with sufficient resources to repay damages, irrespective of any other consideration.¹¹

At the same time, pursuant to the product liability directive¹² (henceforth PLD), where accidents can be traced back to a defect in the manufacturing or design¹³ of the vehicle or information¹⁴ provided to the user, the producer¹⁵ would be held responsible. As of today, a malfunctioning in the throttle due to assembly problems,¹⁶ or a defect in the design of the fuel tank,¹⁷ have caused manufacturers to be bound to compensate damage resulting from accidents.

Theoretically, the PLD should ease the position of the victim, since it provides for a form of (semi-) objective liability,¹⁸ limiting the burden of proof to damage, defect and causal nexus. However, there are grounds to doubt its effectiveness– considered the limited number of cases successfully brought against producers since the implementation of the directive¹⁹—, since evidence of the defective nature of the device, and of the existence of a clear causality (Bertolini 2016; Engelhard and de Bruin 2018; Expert Group on Liability and New Technologies—New Technologies Formation 2019) is costly and complex to acquire. Increasing technological sophistication, as well as the cooperation of multiple agents in the completion of a single task—namely driving—will further exacerbate this issue.

Indeed, the overlapping of the two systems—that of liability for fault of the driver, and producer’s liability—hardly ever occurred until today, since the hypothesis falling under each one were clearly distinct. Increased human–machine cooperation in the driving process, however, leads to a progressive convergence. Until full automation is achieved—in a scenario of Type-2 automation—the liability of the human user²⁰ cannot be excluded, and the need to apportion it between the different parties involved²¹ is not eliminated. Then, even with existing rules, the exclusion of any human intervention—even in a merely supervisory role—would clearly leave all liability with the corporation—being the manufacturer or service provider –, ultimately transitioning the system from the current human and fault-centred perspective to a corporate and strict liability solution.²²

The latter represents thence the other end of a long and shaded spectrum, that unfolds starting with traditional driving, and sees the progressive increase of technological involvement in the completion of the task.

5 Analysing the transition towards increasing automation in driving

This very articulated transition cannot however be neither overlooked nor avoided, and uncertainty rests with respect to the distribution of liability among all possible players involved (Walker Smith 2017). Those encompass the user and the owner—who might be a different either physical or legal person—the manufacturer, as well as all other service providers involved. As per the former, namely user and owner, the analysis will treat them as coinciding, for reasons of simplicity. The user—who could be a driver in cases of no or low automation—could therefore be responsible on the grounds of fault, due to his conduct when driving or deciding to activate the autonomous function, and could also be held responsible on objective grounds, as described above (such as it is put forth by art. 2054 c.c. it., see Sect. 4 above). As per the latter, they might include the internet service provider, ensuring the necessary connection that allows the operation of the vehicle, or the data-set provider, should that be a different subject from the previous two. How liability is apportioned among these latter parties is a relevant matter, however it falls beyond the purposes of the current analysis, aimed at determining the incentives for owners and users of CADs, and will not therefore be discussed in detail.

Uncertainty on the apportionment of liability among such parties would provide negative incentives to the adoption of CADs with increasing levels of automation, delaying their diffusion, and further extending the time technology needs to penetrate the market, ultimately leading to a vicious cycle that could radically prevent the substitution of traditional vehicles.²³

To better understand the inefficiency of the current system, causing the overlap of two different liability regimes—driver’/owner’s on the one hand and producer’s liability on the other hand –, we shall break up the analysis into two different parts. Firstly, we shall consider the interactions between two vehicles, possessing different predetermined levels of automation (Sects. 6–10 below) so as to determine how liability is distributed among them in case of an accident. Secondly, we will discuss the interaction between user and producer, when the choice between the two driving modes is enabled in a vehicle that is not yet fully autonomous and still requires or allows the human-being to resume control (Sects. 11–12 below).

6 Interactions of vehicles displaying different levels of automation

It is indeed unlikely to expect that national legislators would altogether ban the use of traditional—less automated—vehicles, rather technological development will occur over time and only in the long-run completely replace N-type vehicles. The two kinds of vehicles will thence coexist in the transition phase to fully autonomous transport systems.

The first part of the analysis needs therefore addresses the interaction of both autonomous (A-type) and non-autonomous (traditional, or N-type) vehicles on public roads, that is—more precisely—vehicles with different degrees of automation. We here simplify all distinctions with respect to approaches and level of automation, and consider A-type vehicles as fully autonomous and requiring no intervention from the human user (Type-2 automation, see Sect. 2 above). We will add the possibility of choice among different driving modes in the second part of the analysis (infra Sect. 10).

We could theoretically assume that A-type vehicles could be segregated by developing ad hoc infrastructures only open to their circulation. The easiest form to achieve this result would be through a dedicated lane. However, a dedicated infrastructure would represent a high initial cost, both in terms of mere investment and impact on existing traffic and city structures that public authorities will be unwilling to support, at least not until such technologies already widely reached the market.²⁴ In the meantime, however, increasingly frequent interactions will occur, and traffic accidents of the kind here described will subsequently follow.

If we assume the coexistence of A- and N-type vehicles on shared lanes, we can assume that traffic accidents will involve both, in proportion to the number of vehicles of each kind present on the road and their risk profile. To simplify the analysis, we will consider the case of a crash of two vehicles, and not—more complicated—scenarios involving pedestrians, cyclists, and multiple vehicles.

In particular, accidents could involve two N-type vehicles, two A-type vehicles, or one A- and one N-type vehicles that—from a legal perspective—can be sketched as follows:

Coexistence of A- and N- vehicles	A-type	N-type
A-type	Producer/Owner (Sf)	Producer/Owner-User (Si)
N-type	Producer/Owner-User (Si)	User-Owner (S0)

Where S₀ stands for the current scenario (scenario zero), with no A-type vehicles on the roads,²⁵ described in Sect. 7 below. S_f (final scenario) is the one where the entirety of vehicles circulating is comprised of A-types, and it is discussed in Sect. 8 below. S_i (intermediate scenario) is the long and complex transition phase where both kinds of vehicles coexist, and is discussed in Sects. 9–11 below.

While both S₀ and S_f are more easily described, since either the human user is entirely in control or he has no control at all—thence excluding complex human–machine interactions and subsequent overlapping of liability rules—S_i is certainly more complex, as well as relevant.

Indeed, whether we ever reach S_f, at what speed, and with which social costs (Rohr et al. 2018), is very much dependent upon how the interaction of A- and N-type vehicles unfolds in the intermediate phase, in particular how fast the less technological cars are replaced by more advanced ones. The subsequent analysis is therefore primarily focused on describing how liability rules influence the rational decision to purchase an A-type vehicle over an N-type during such a transition phase (see Sect. 12) in light of how easy it is for the owner to transfer the cost of an accident upon the producer, and other relevant service providers, whenever they ought to be deemed responsible pursuant to applicable norms (see Sect. 11 below).

More specifically, the intuition we intend to validate is that the existing legal framework could pose a cost upon the choice to purchase a more autonomous vehicle, providing a negative incentive towards the adoption of more advanced technologies, primarily due to the difficulty for the owner to observe—and therefore demonstrate in a court—the responsibility of the producer and other service providers, ultimately being forced to internalize all such costs that, instead, should be borne by others (see Sects. 12–13 below).

Moreover, since the performance of A-type vehicles will increase—and subsequently their responsibility in case of accident will decrease—the higher their number in proportion to the overall population of vehicles circulating (see Sect. 9 below), any negative incentive towards their early adoption by worsening the overall performance of each A-type vehicle, will also further discourage the replacement of N-type ones, leading to higher social and economic costs (Evas 2018).

7 N-type vehicles crash

This first scenario (S₀) is the current, where two traditional vehicles—despite possibly equipped with advanced technologies easing the driving task—are involved into an accident and, in both cases, a human driver is in control.

National legislators address this issue with comparable solutions, despite some degrees of variation can still be observed, in particular in countries adopting no-fault (or automatic compensation) plans.²⁶ In a traditional tort law system, liability may be attributed (a) to the driver who caused the accident, or (b) to the owner.

Indeed, parties will try to show the accident was due to either a violation of the street code, or the negligent conduct of the other party, who failed to respect due care and prudence, or wrongly performed a manoeuvre (Phillips and Chippendale 2002). Should responsibility not be clearly observable—due to informational asymmetries—it might be split between both parties involved.²⁷

Moreover, some legal systems hold the owner of the vehicle directly liable for all damages deriving from its use, irrespective of whether he was actually in control when the accident occurred. Such a solution rests on both the assumption that vehicle proprietorship entails availability of sufficient economic resources to compensate the victim in case of an accident, and on the ease of insure. Indeed, the owner, as opposed to the driver, may always be identified with certainty. Ultimately, holding the former jointly and severally liable with the latter ensures the economic loss is not borne by the victim, pursuant to a pure compensatory rationale, thus renouncing all attempts of reprimand of the negligent party that fault-based rules, instead, pursue.

We might also represent liability as the relation between the performance of the two parties (1 and 2) in the driving task, whereby the party is liable $\left( {R_{d1} = 1} \right)$ when her performance is comparatively worse than that of the counterpart, thence:

$$R_{d1} = 1, R _{d2} = 0 \Rightarrow P_{d1} < P_{d2}$$

The driving performance of each party involved, using a N-type vehicle can be defined as follows:

$$P_{d} = f\left( {d,pr,c} \right) = \alpha \cdot D$$

where

• $P_{d}$ is the performance of the human driving, described as a—increasing monotonic—function of his driving conduct, namely the ability in driving d, prudence in the interactions with other vehicles pr, respect for the street code and any other relevant regulation c;

• $\alpha$ represents the overall performance of a single driver, with respect to a perfect driving conduct of D. If he had perfect abilities, were maximally prudent and always and under any circumstances respected the street code and all pertinent regulation, it would equal one, thence 0 ≤ α ≤ 1.

In S₀ the responsibility of the two vehicles can be defined as follows:

Vehicle 1:

$$R_{d1} = 1, R_{d2} = 0 \Rightarrow P_{d1} < P_{d2} \Rightarrow \alpha_{1} < \alpha_{2}$$

When $R_{d1} = 1$ vehicle 1 is responsible and needs to compensate damages.

Vehicle 2:

$$R_{d1} = 0, R_{d2} = 1 \Rightarrow P_{d2} < P_{d1} \Rightarrow \alpha_{2} < \alpha_{1}$$

When $R_{d2} = 1$ vehicle 2 is responsible and needs to compensate damages.

In the current scenario third party liability insurance, such as that required by the Motor Insurance Directive (henceforth MID),²⁸ can easily ensure victim compensation, for the liability rules are clearly laid out, and the parties who might be called in to compensate are easily identified, and statistical data is plentiful, allowing a precise assessment of potential damages, and their frequency.

8 A-type vehicles crash

The second scenario (S_f) corresponds to case of complete substitution of N-vehicles, when only A-type vehicles will interact. If two A-type vehicles crash, there are no grounds to hold a human-in-control liable, for there is no human performing the driving task.

Pursuant to current rules, a rapid shift towards product liability claims ought to be observed. Indeed, most legal systems around the world differentiate the position of the producer from other tortfeasors (Koziol et al. 2017), by holding him responsible for all damages caused by the use of his devices, most often on – semi – strict grounds.

Such rules are intended to induce desirable investments in safety on the side of the producer, while easing victim’s compensation, forcing internalization of – most – externalities caused by the marketing of the given product (Owen 2008).

Normally a strict-liability standard applies to manufacturing defects (see fn. 13 above), entailing the deviation of the single specimen from the intended design, due to mass production techniques.²⁹ A semi-strict liability standard instead normally applies for design defects (see fn. 13 above), for cases in which it can be shown that the product ought to have been conceived otherwise—with additional safeties or by adopting alternative and possibly more expensive technical solutions—.³⁰ Indeed, the development risk defence (such as that put forth by art. 7 PLD, let. e) allows for an ex-post assessment of the manufacturer’s diligence in meeting the existing technical standards, in a way that very much resembles a judgment of fault, despite with a reversal of the burden of proof.³¹ Production defects cause no particular problem for the analysis here conducted, for it is sufficient to show the material deviation of the single specimen from the prototype.

To the contrary, design defects require a complex assessment, whereby the claimant shows that the use of the product led to the accident—thence that there is a causal nexus between the product and the accident—, that the use of the product, under those circumstances, was normal and correct—or, if incorrect, foreseeable (on foreseeable misuse see (Allee et al. 2017) 4–26)—, that the product ought to have been designed otherwise, in a better, thence safer way.³² Were all the above demonstrated through a solid factual analysis and technical expert opinion, the product would be deemed defective and the defendant obliged to compensate damage.

However, the latter could free himself from liability by showing that the specific design was determined by regulation he was required to conform to,³³ or that the existing state of the art of technological and scientific knowledge did not allow to identify the risk and eventually develop a safer design (development risk defence).³⁴ Finally, in such a scenario, accidents could be due to a malfunctioning in the infrastructure. How such liability will be defined is neither obvious, nor easy to anticipate. The infrastructure manager could be either a public or private entity, and specific liability rules could be adopted, with corresponding exemptions, such as in the case of the manufacturer’s liability pursuant to the PLD. Otherwise, a contractual relationship could be governing the interaction with the user or owner of the vehicle, or even with the manufacturer. Eventually, absent all of the above, a simple rule of negligence could still apply.

By applying the concepts above briefly sketched to the case at hand, we could conceive the assessment of liability in S_f to be divided into two different steps, namely the identification of the vehicle responsible for the accident, and the assessment of the defective nature of design.

If we assume that A-type vehicles will be equipped with positioning systems as well as recording devices, it will probably be easier to establish—in a clear and objective fashion—the dynamic of the accident. Most legal systems—those with a comparative negligence rule³⁵—would then allow the apportionment of liability for the accident—and the corresponding duty to compensate damages—between the two vehicles.

We might also represent liability as the relation between the performance of the two parties (1 and 2) in the driving task, whereby the party is liable $\left( {R_{a1} = 1} \right)$ when her performance is comparatively worse than that of the counterpart, thence:

$$R_{a1} = 1, R _{a2} = 0 \Rightarrow P_{a1} < P_{a2}$$

The driving performance of each party involved, using an A-type vehicle can be defined as follows:

$$P_{a} = f\left( {d,pr,c} \right) = \beta \cdot D$$

where

• $P_{a}$ is the performance of the automated driving system, described as a—increasing monotonic—function of his driving conduct, namely the ability in driving d, prudence in the interactions with other vehicles pr, respect for the street code and any other relevant regulation c.

• $\beta$ represents the overall performance of a single driver with respect to a perfect driving conduct of D. If he had perfect abilities, were maximally prudent and always and under any circumstances respected the street code and all pertinent regulation, it would equal one, thence 0 ≤ $\beta$ ≤ 1.

In S_f the responsibility of the two vehicles can be defined as follows:

Vehicle 1:

$$R_{a1} = 1, R_{a2} = 0 \Rightarrow P_{a1} < P_{a2} \Rightarrow \beta_{1} < \beta_{2}$$

When $R_{a1} = 1$ vehicle 1 is responsible and needs to compensate damages.

Vehicle 2:

$$R_{a1} = 0, R_{a2} = 1 \Rightarrow P_{a2} < P_{a1} \Rightarrow \beta_{2} < \beta_{1}$$

When $R_{a2} = 1$ vehicle 2 is responsible and needs to compensate damages.

Then, absent a human driver, the user or owner could be called in to compensate on objective grounds—thence not based on the ascertainment of fault, as it is currently with liability for accidents in most legal systems –, if rules such as those set forth by art. 2054 c.c. it. (see Sect. 4, and fn. 10) were into play.

The owner, in those systems that allow for such form of liability, would be responsible for the mere fact that he owned the vehicle that did not circulate against his will. While in the current system his joint and several liability adds to the liability of the driver, in a S_f where no legal reform took place, it would add onto that of the producer.

Indeed, even if no human is involved in the driving task, not all liability would be borne by the producer, for on the one hand defectiveness still needs to be shown,³⁶ as well as the existence of a causal nexus, and such an evidentiary burden might be particularly hard to meet, in particular given informational asymmetries, and differences in economic power. Defectiveness of design would require the complex ascertainment that an alternative design was feasible and demandable of the producer in the given circumstances. That could also entail assessing that despite respecting the traffic code, the vehicle ought to have been conceived in a way that it allowed a prompt reaction to a possible error or malfunctioning of the other vehicle.

Reaching the evidentiary basis sufficient to show defectiveness of design would still be complicated, require litigation and relevant costs on the side of the owner of the vehicle. In particular, if the value of damages was minimal and below the cost necessary to acquire—primarily technical—evidence and pursue an action in court, there would be no incentives in forcing the internalization of defective design on the producer.³⁷

Moreover, defences might exclude the responsibility of the corporation, even when a defect was materially present, if that could be deemed due to the technological state of the art, and thence not imputable to the manufacturer.³⁸

As a result, everything else equal—and absent legal reform—either litigation increases for each traffic accident—adding one product liability claim for each A-type vehicle involved in the crash—or manufacturers will be able to externalize some costs associated with their products, exploiting the inefficiencies of the current system.

Theoretically, case law could evolve to imply that if no human-being is in control any accident occurring is per se the consequence of a defect of the vehicle, and thence the producer ought to be held responsible, unless he could prove otherwise. Such a reading of the PLD, could ease the position of the victim with a kind of res ipsa loquitur argument—reversing the burden of proof—but could not exclude the operation of defences, ultimately allowing the producer to escape liability, so that liability would only be borne by the owner on such strict grounds as those described. In all cases we would witness a radical increase in litigation requiring the application of the PLD.

Similarly, the responsibility of the infrastructure manager or service provider, could be established only so long as it was easily observable, so that those accidents that are primarily due to a failure in those systems could be identified and distinguished. It is, however, not obvious that such will be the case, and it is safe to assume that distinguishing said hypothesis—where the accident is indeed due to a failure in the smart road—will come at a cost for the owner of the vehicle. Moreover, exemptions could be provided—similar in rationale and application to the development risk defence put forth by the PLD—whereby not all failures in the infrastructure ought to lead to the responsibility of its manager.

All that considered, we could define the responsibility arising from the performance of the vehicle as follows:

$$R_{a} = R_{P} + R_{U} + R_{I}$$

where

• $R_{P}$ is the responsibility of the producer for having designed the A-type vehicle in the given way, allowing its performance as defined above;

• $R_{I}$ is the responsibility of the infrastructure manager, for accidents due to a failure in the system;

• whereas $R_{U}$ is the responsibility that rests in all cases on the user or owner, despite the vehicle running in autonomous mode, for the defect falls under one of the exemptions set forth by art. 7 PLD, and—if existent—under similar exemptions to the responsibility of the infrastructure manager.

The reason for defences under the PLD, and in particular the development risk defence, is that the producer might not be held responsible for defects that could not be identified given technical and scientific constraints, thus the loss is left with the user. On theoretical grounds, the rationale is that no additional incentive could be provided to the manufacturer in order to influence his ex ante investment in product quality, and he cannot be blamed for failing to meet a standard that is higher than what is technologically feasible. At the same time, however, in a purely compensatory perspective, it is also disputable such a loss should be left to the victim—or in this case with the user—who, according to a similar perspective, may not have neither influenced nor prevented the accident.

Nonetheless, given extant regulation, were the legal system perfectly efficient, absent litigation costs and informational asymmetries the user or owner of each vehicle should only be burdened with $R_{U}$.

$$eR_{U} = E \cdot \left( {R_{P} + R_{I} } \right) + R_{U}$$

where $eR_{U}$ is the expected responsibility of the user in this scenario, depending on the overall efficiency of the legal system $E$, 1 ≥ $E$ ≥ 0. In a perfectly efficient legal system, with no transaction costs, and informational asymmetries $E = 0$.

Moreover

$$R_{P} = f\left( {P_{a} , l} \right) = D \cdot \beta \cdot l$$

$$R_{I} = f\left( {\gamma , l} \right) = \left( {1 - \gamma } \right) \cdot l$$

where $\gamma$ represents the technological advancement of all related infrastructures, and when highest equals 1, 1 ≥ $\gamma$ ≥ 0, and $l$ is coefficient that determines, respectively, what percentage of the performance of the vehicle is imputed to the producer, for it does not fall under any defence or exemption of the directive, and, similarly, what percentage of malfunctioning of the infrastructure is borne by its manager, thence 1 ≥ $l$ ≥ 0.

While

$$R_{U} = f\left( {P_{a} , l} \right) = D \cdot \beta \cdot \left( {1 - l} \right)$$

In such a scenario, absent legal reform, a greater degree of uncertainty resides with respect to which party would bear what costs, primarily due to the application of the PLD, and its defences (see Sect. 13 below). Indeed, absent legal reform, the need for apportionment between manufacturer, service provider, and owner would persist, and most likely all three would have to acquire third party insurance, with potential overlapping, possibly leading to an overdeterrence effect.³⁹

9 N-type and A-type vehicle crash: the performance function

The intermediate scenario (S_i) is going to persist until most, if not all, N-type vehicles are replaced. Such a scenario differs from the previous for the interaction is between two different types of vehicles, that also influences the performance of the autonomous one. We assume that there is no uncertainty about driver’s type, which is known and observable.⁴⁰

Indeed, the driving performance of an A-type vehicle, unlike that of a N-type, depends upon its interaction with both the infrastructure and other autonomous vehicles. A-type vehicles are CAD solutions, thence connected, and require inputs—and data—from multiple service providers. Failures or malfunctioning in all such additional yet essential services affect the overall performance negatively. This component will persist—and possibly increase its relevance—in S_f. However, since then all vehicles will be A-type, it is reasonable to expect it will affect their behaviour identically, changing both performance functions and, for the purposes of the current analysis, may be disregarded.

At the same time, given their connected nature, their ability to dialogue with one another if of the same kind (A-type) positively affects performance, increasing overall security. To the contrary, the presence of N-type vehicles negatively affects the performance of the autonomous one,⁴¹ due to the complexity of the interactions between human drivers and autonomous systems. The interpretation of the negligent or erratic behaviour of the human driver, another human would have instead understood, eventually avoiding the crash, or the uncertainty in interpreting unclear signals that forces the A-type vehicle to slow down in order to avoid collision are plausible examples. Said otherwise, a given A-type vehicle performs better when interacting with another A-type vehicle than with an N-type, all other equal.

Such risks, as all other deriving from the interaction of A- and N-type vehicles may only be excluded once the latter are fully replaced, for they don’t depend exclusively on the status of technological advancement of the former but on the proportion between the two. Indeed, the higher the proportion of A- over N-type vehicles, the lower is the number and frequency of crossings between the two kinds, and so are the risks—and the possibility of being held liable—for the technologically advanced. For the same reason, however, early adopters are strongly penalized.

We may thence modify the performance function of the A-type vehicle accordingly:

$$P_{a} = f\left( {d,pr,c, \gamma ,n} \right) = \gamma \cdot n \cdot \beta \cdot D$$

where $\gamma$ represents the technological advancement of all related infrastructures, and when highest equals 1, 1 ≥ $\gamma$ ≥ 0; $n$ is a decreasing monotonic function of the proportion between A-type and all vehicles circulating, thence $n = f\left( {\frac{A}{T}} \right)$, 1 ≥ $n$ ≥ 0.

In S_i the responsibility of the two vehicles can be defined as follows:

Vehicle 1:

$$R_{a1} = 1, R_{d2} = 0 \Rightarrow P_{a1} < P_{d2} \Rightarrow \beta_{1} < \frac{1}{n\gamma } \cdot \alpha_{2}$$

When $R_{a1} = 1$ vehicle 1, the A-type, is responsible and needs to compensate damages.

Vehicle 2:

$$R_{a1} = 0, R_{d2} = 1 \Rightarrow P_{d2} < P_{a1} \Rightarrow \frac{1}{n\gamma } \cdot \alpha_{2} < \beta_{1}$$

When $R_{d2} = 1$ vehicle 2, the N-type, is responsible and needs to compensate damages.

If we assume that $\alpha_{2} = \bar{\alpha }$, that is to say that we consider the performance of the average human driver, then

$$\beta < \frac{1}{n\gamma } \cdot \bar{\alpha }$$

The inequation above may thus be interpreted to conclude that the A-type vehicle will be held liable unless its level of technological sophistication $\beta$ is substantially greater than the level of the driving skills possessed by the average driver,⁴² since both $n$ and $\gamma$ (or at least one of them) will fall below 1.

10 Cont.: the performance function of a partially autonomous vehicle

So far we have assumed that the A-type vehicle is Type-2 automation based, thence radically excluding any intervention or supervision of the human user. However, such an assumption is only realistic for levels of technological advancement not yet reached—level 5 vehicles⁴³ –, and that could be achieve at a later stage closer to S_f, rather than in the transitional phase here considered.

Instead, once a minimum number of vehicles with SAE level 2.5 or 3 start circulating on public roads, and their use in autonomous mode is lawful under existing regulation, we might assume S_i begins. Moreover, considering how substitution will occur over a long period of time, when class 5 vehicles are available a large number of class 3 and 4—requiring the intervention or supervision of the driver—will still be circulating.

Therefore, the simplification made needs to be relaxed, considering that, in S_i, human–machine cooperation, despite decreasingly so, will still be required. We shall then adjust the model to consider Type-1 automation, in this case intended as an intermediate stage of technological advancement, and not—only—as a potential end-model for CADs.

If human–machine cooperation is required, we might expect vehicles to be equipped with a driverless function that can be switched on and off, as well as with a signalling system that warns the user when the vehicle perceives current—weather, traffic, street—conditions require the intervention of the human, supervising or even resuming control. With lower levels of technological advancement, we might assume the choice to be entirely left to the driver, at a later stage it might be actively made by the vehicle.

By modifying the scenario, we shall consider that the performance of the partially autonomous vehicle, $P_{a - }$ will sum both the liability deriving from the performance of the driving task by the vehicle itself, and by the driver when the driverless function is deactivated, and may thus be described as follows:

$$P_{a - } = f\left( {d,pr,c, \gamma ,n, \alpha ,t} \right) = \left[ {t \cdot \alpha + \left( {1 - t} \right) \cdot \gamma n\beta } \right] \cdot D$$

where 1-t and t represent the portion of overall time the vehicle is running in driverless mode or not, respectively.

Subsequently, the responsibility of the two vehicles can be defined as follows:

Vehicle 1:

$$R_{a - 1} = 1, R_{d2} = 0 \Rightarrow P_{a - 1} < P_{d2} \Rightarrow \beta_{1} < \frac{1}{{\left( {1 - t} \right) \cdot n\gamma }} \cdot (\alpha_{2} - t \cdot \alpha_{1} )$$

When $R_{a1} = 1$ vehicle 1, the A-type, is responsible and needs to compensate damages.

The inequality can be interpreted to say that the level of technological advancement of the vehicle required for performance to exceed that of a N-type vehicle also depends upon the different driving skills of the two users, and therefore also on the proportion between the time the vehicle is operated autonomously with respect to the overall driving time.

Such a differentiation becomes of relevance only if one intends to analyse the opportunity for one specific driver to purchase an A- over and N-type vehicle, in light of his specific skills. That, however, is not the purpose of the current analysis that instead may safely assume that⁴⁴

$$\alpha_{1} = \alpha_{2} = \bar{\alpha }$$

Thence,

$$\beta < \frac{1}{n\gamma } \cdot \bar{\alpha }$$

11 Cont.: apportioning liability between user and producer

The difference between a partially and fully autonomous vehicle may however be observed with respect to liability apportionment between the user and other parties. Indeed, the overall responsibility of the A-type vehicle is the result of the sum of the responsibility of the user, of the producer, and of the infrastructure, thence

$$R_{a - } = R_{U} + R_{P} + R_{I}$$

The single responsibilities are defined as follows:

$$R_{U} = t \cdot \alpha + \left( {1 - t} \right) \cdot n\gamma \beta \cdot \left( {1 - l} \right)$$

and

$$R_{P} = \left( {1 - t} \right) \cdot n\beta \cdot l$$

and

$$R_{I} = \left( {1 - t} \right) \cdot n\beta \cdot l \cdot \left( {\gamma - 1} \right)$$

where $l$ is coefficient that determines what percentage of the performance of the vehicle is imputed to either the producer or to the infrastructure respectively, thence 1 ≥ $l$  ≥ 0.

While $\left( {1 - l} \right)$ is the coefficient that determines what percentage of the performance of the vehicle is imputed to the user (i) because some of the PLD defences are applicable to the advantage of the manufacturer, (ii) because he decided to activate the driverless function even if it was not recommended under those circumstances, (iii) because he failed to resume control when prompted to do so by the vehicle driving in autonomous mode.

Indeed, so long as the choice of when to activate the driverless function is left with the driver, the consequences will also be borne by him, including the cost of such a choice (see also Sect. 14 below) and of failing to resume control. The former, entails the possibility that the user is deemed responsible for an accident that is indeed traced back to the malfunctioning of a sensor or other element of the vehicle, due to the fact that he decided to activate the driverless function under environmental—weather, traffic and any other relevant element taken into account—conditions that are ex post ascertained as having been suboptimal. Similarly, he might be held responsible for failing to resume control when in autonomous mode, after being warned by the vehicle his intervention was required.⁴⁵ Uncertainty rests with the qualification of such facts, and they could trigger per se substantial litigation.

Then, since:

$$R_{a - } = R_{U} + R_{P} + R_{I} = 1$$

$$1 \ge R_{U} ,R_{P} , R_{I} \ge \, 0$$

Therefore, given extant regulation, were the legal system perfectly efficient, absent litigation costs and informational asymmetries, the user or owner of the A-type vehicle should only be burdened with $R_{U} < R_{a - }$.

$$eR_{U} = E \cdot (R_{P} + R_{I} ) + R_{U}$$

12 The decision to purchase an A-type vehicle in S_i

Therefore, in the user’s perspective the choice to purchase an A-type vehicle as described can be justified in two cases, solely based on technological advancement, or on legal reform (on which see Sects. 13–14 below).

In a pure technological perspective, if we assumed that the legal system was completely inefficient, and thence $E = 1$, the user would bear all responsibility deriving from the circulation of the vehicle even when in autonomous mode, including risks associated with the infrastructure ($R_{i}$)

$$eR_{U} = E \cdot (R_{P} + R_{I} ) + R_{U} = R_{a - }$$

In such a case, given that the user or owner would expect to be held liable of all damage deriving from the circulation of the semi-autonomous vehicle, the choice to purchase an A-type over an N-type vehicle would be justified when

$$\beta < \frac{1}{n\gamma } \cdot \bar{\alpha }$$

as indicated above (Sect. 10), since only then the performance of the vehicle would exceed that of the average driver, and therefore reduce his expected liability $eR_{U}$.

If instead we assume the opposite scenario, where the system is perfectly efficient, or $E = 0$, allowing for the perfect attribution of liability to the producer in all cases where the vehicle is indeed defective, as well as to other service providers when the accident can be traced back to the infrastructure, then the liability the user of the A-type vehicle would be described as follows:

$$R_{a - } = t \cdot \alpha + \left( {1 - t} \right) \cdot n\gamma \beta \cdot \left( {1 - l} \right)$$

In such a case, if

$$\beta = \bar{\alpha }$$

and thence technological development was such as to ensure that when in autonomous mode the vehicle performed as well as the average human driver,⁴⁶ the choice between an N-type and A-type vehicle would be indifferent—on pure technological grounds—, and preferable in a risk-minimizing perspective.

Indeed, if the performance of the driving task was considered, that of the human driver and of the vehicle would be the identical. Therefore, even the legal cost of choosing between the one or the other, in a perfectly efficient legal system, would be nil. However, since the costs associated with the completion of the driving task when the autonomous mode is activated would be borne by the manufacturer, as well as by the infrastructure manager or service providers involved, the overall costs for the user would diminish, proportionally with the amount of time he chooses to relinquish control to the vehicle.

In such a system, as soon as technological development reached that condition, the diffusion of A-type vehicles would drastically increase, as well as the proportion of time (1-t) the function is activated, further easing interactions between CADs and thence ever more incentivizing the transition towards higher levels of automation in driving.

The latter hypothesis is however unrealistic in light of the relevant evidentiary burden—that could be reversed and placed on the producer through legal reform (see Sect. 13 below)—and of the costs associated with product liability litigation that would be required to apportion liability between the user and producer even in such an optimal condition, and that might not be justified with respect to all accidents, in particular those of lesser economic relevance.⁴⁷ Even the difficulty in observing when the driverless function is activated, instead of the manual mode, would affect the very possibility for the owner to sue in recourse the producer. The inefficiency of the legal system also interests insurance companies, for ex ante uncertainty about how liability will be apportioned between the user and the producer does not allow the clear identification of which party is required to insure, and against which risk. In such a perspective, a requirement such as that put forth by the MID, would not per se suffice. Instead, the system would benefit from an overall simplification of the existing legal framework, pursuant to a Risk-Management Approach (see Sects. 14–15 below).

13 How existing regulation influences the emergence of CADs

Taking into account that the transition towards CADs will occur over time, and therefore vehicles displaying different levels of automation will co-exist and interact on public roads, we attempted to undergo an analysis of what incentives extant liability rules provide to all parties involved.

In an initial scenario, such as the current, where the presence of vehicles with a non-negligible level of automation (level 2.5 and above), is extremely limited if not completely inexistent, the traditional fault-based system burdening the human driver hardly overlaps or interferes with the (semi) strict standard of liability applicable to producers (see Sects. 4 and 7 above).

Increasing human–machine cooperation, and ever more frequent interactions of vehicles with different levels of automation, instead, challenge the paradigm, inducing the two bodies of law to overlap, ultimately causing the apportionment to become ever more complex, eventually preventing a correct internalization of costs by those that gave rise to them.

In particular, in a transition phase (S_i), the apportionment of liability between the user of an A- and N-type vehicle would theoretically require solving both a fault claim, to determine whom among the two vehicles is—primarily or solely—responsible for the accident, as well as a product liability claim, to assess whether the accident can be traced back to a defect (see Sect. 9 above).

Moreover, by considering that A-type vehicles will not radically exclude the human being from the driving task in the medium-run, the very choice of enabling the autonomous mode, as well as failure to supervise the vehicle would represent both potential new sources of liability for the owner (or user), as well as areas of potential litigation. Indeed, determining whether the crash occurred in driverless mode is imputable to a defect—in the design or manufacturing of a sensor—or, instead, to the reprehensible choice of not disabling the function,⁴⁸ or whether failure to intervene, when prompted to do so, is due to a non-excusable distraction, or to the failure of meeting an otherwise reasonable expectation of the user,⁴⁹ are all matters of complex ascertainment (see Sect. 11).

The owner of the A-type vehicle might as well decide not to initiate litigation against the manufacturer (see Sects. 4 and 11 above), for the inefficiencies of the current system could place too high evidentiary a burden on the claimant, requiring him to show defectiveness and the existence of a clear causal nexus with the accident.⁵⁰

To this end, an obligation to install black boxes,⁵¹ despite commendable, would not radically eliminate all uncertainty. Knowing with absolute precision whether the vehicle was driving autonomously at the moment the impact occurred, does neither clear the above mentioned issues, nor allow to easily establish the existence of a defect and of a causal nexus between that and the accident. The ex post assessment of the choice is still a matter of pondering of opposite perspectives, such as the reasonableness of user’s expectations about CAD’s performance, and the objective environmental circumstances. Similarly, showing that a given decision of the vehicle is the consequence of a defect – of any kind – requires the interpretation of the data recorded that is likely to be complex, presupposing access to the software and algorithms controlling the very functioning of the device – which the manufacturer might be unwilling to release –, and costly.

In this sense, informational asymmetries may be observed, and they do certainly play a relevant role in preventing a correct internalization of the costs generated. Those depend upon the different knowledge and understanding of the technology—much greater by the producers than by the user or owner—, and its intrinsic opacity (Expert Group on Liability and New Technologies—New Technologies Formation 2019), who might make it impossible to reconstruct ex post the reason or element that led to a given output. Moreover, the costs associated with acquiring information—analysing data eventually recorded, or assessing the technology and understanding possible flaws in design—further exacerbate the original imbalance, ultimately reflecting upon the latter and more relevant dimension of the asymmetry, namely the evidentiary burden to be met by the claimant to ground the responsibility of the manufacturer.

The reversal of the burden of proof, with respect to how it is today defined by the defective product directive, would definitely ease the position of both the victim and the user in transferring the costs generated by the device onto the manufacturer. However, such a solution is at the same time radical with respect to the current regulatory setting, and yet does not necessarily overcome all uncertainties. Indeed, on the one hand, requiring the manufacturer to show that the malfunctioning of the device is not due to a defect entails forcing him to demonstrate a negative fact, per se a disputable regulatory choice, and one that would profoundly change the entire rationale of extant legislation.⁵² On the other hand, the privileged understanding of data the manufacturer possesses would allow him to easily meet the requirement—eventually selecting those pieces of information that support his conclusion—leaving the task to rebut it to the user, who would still encounter the same obstacles in elaborating the remaining part of the data to substantiate his claim, due to the reasons just explained.

Overall, despite theoretically safer—once the new risks they give rise to are identified and assessed, as well as their diffusion reaches a critical stage, replacing considerable parts of the fleet of traditional vehicles—(see Sect. 2 above), in the intermediate stage, partially autonomous vehicles might place a larger liability burden on their user, ultimately discouraging early adoption and market penetration (see Sect. 11 above). This is reflected by the criterion of – rational – choice between the purchase of an A- over an N-type vehicle described above (see Sect. 12). The inefficiency of the current legal system, preventing the transfer of costs non-generated by the user upon the manufacturer as well as other service providers, would cause the option between the two vehicles to become indifferent only when the performance of the vehicle greatly exceeds that of the average human driver.

Such a solution, however, is not only contradictory—for as soon as the vehicle performance equates that of the average driver the choice between the two kind of vehicles ought to become indifferent—, but carries a relevant social cost in terms of lives saved, accident reductions, and economic incentives to all relevant industries interested in the value chain, further extending the transition phase and the problems associated therewith.

At the same time, the very design of CADs, aiming at reducing collisions occurring when driverless functions are activated, might cause them to assume the role of a dove in interactions with non-automated vehicles, further discouraging their use (Dresner and Stone 2006, 2007).

Legal reform aiming at providing greater ex ante certainty to all players involved is therefore advisable, and some MSs have already acted upon this need, as well as other non-European countries. Before discussing such regulation however, we shall provide a theoretical framework of the impact that a new approach to liability could have on technological development.

14 Proposals for reform, and how they influence the development of Type-1 or Type-2 automation: (i) the absolute liability of the owner

As existing rules provide negative incentives to the adoption of CADs, reforms might have an impact on the kind of technological development that is successful. We have distinguished two alternative approaches to automation, one radically replacing the human under all conditions—Type-2 –, one, instead, leaving the choice with the human—Type-1—so as to ensure the possibility to still enjoy driving itself—despite assisted—while being able to relinquish all control to the machine, when freely deciding to do so. So understood, both options meet the level 5 automation criterion, for the two automated driving systems are indeed able to perform all aspects of the dynamic driving under all roadway and environmental conditions manageable by a human driver, the sole difference being whether such driving mode is the only one available—thus excluding the human from the driving task at all times—or is rather an additional—although extremely innovative—service, which can be activated upon desire.

We may then contemplate two alternative model strategies, that adopt a Risk-Management Approach attributing liability to the party best positioned to minimize costs⁵³ and insure, thence limiting litigation and ex ante uncertainty, irrespective of the need to demonstrate negligence, but also to narrowly identify and determine the existence of a causal nexus.

Such rules do not incentivize the emergence of CADs in the same way, and differ with respect to the speed of market penetration they would ensure, as well as for the kind of automation they would favour.

Pursuant to a first strategy, the user (or owner) of the vehicle could be made responsible—by reforming the extant legal system and adopting a new liability rule specifically applicable to CADs—under all conditions for any accident involving the use of the vehicle, irrespective of whether he was materially in control or not. The underlying rationale would not substantially differ from that currently expressed by norms such as art. 2054 c.c. it. (see Sect. 4, fn. 10 above), and would ensure the victim obtains compensation, in particular if coupled with an obligation to insure.

The victim in a similar scenario would sue the user (or owner) and obtain compensation whenever the responsibility of the accident could be traced back to the given vehicle, irrespective of any ascertainment about the mode in which it was driving. Insurance would be factored among the costs associated with car ownership and use, and might provide incentives towards the optimal choice between manual and automated driving.⁵⁴ Indeed, we might expect insurance companies to offer contractual conditions that depend on CAD’s safety and technical characteristics,⁵⁵ as well as on the owner’s propensity to personally drive, and his past performance when doing so.

So conceived, liability would ease the position of the victim, it would eliminate—at least in the first instance—the need to sue the manufacturer—a possibility that could be granted, in recourse, to the user or owner, or to the insurance company⁵⁶—drastically reducing litigation and ex ante uncertainty.

In a similar setting, it is conceivable that the owner will want to retain control on how the driving task is performed, thence being able to switch, according to his own preferences, the driverless function on and off. For he is the one party bearing the economic consequences of the accident, he might decide to minimize his risk or accept higher levels instead—as well as the higher premiums associated therewith –, thence preserving a desired amount of driving, intended as a pleasurable and enjoyable activity. For this very reason, a legislative solution primarily burdening the owner can be considered favouring Type-1 automation.

The anticipated responsibility the user or owner would be facing would not differ from the one described above when E = 1. The increase in the system efficiency would therefore entirely depend on reduced litigation and increased ex ante certainty, and would lead to a result that would not differ from that of current no-fault plans, as those already existing in some MSs.

Therefore, we do not expect such a system to substantially reduce the transition phase S_i described above.⁵⁷

15 Contd.: (ii) the absolute liability of the manufacturer

Pursuant to a second and opposite strategy, the producer could be identified as the party to be held liable for accidents deriving from the use of the vehicle, irrespective of the presence of a defect, malfunctioning, or for a mistake committed by the human user. A similar solution—to be adopted through legal reform introducing a new liability rule, specifically applicable to CADs—would force the producer to internalize all costs, also those generated by other parties, including the internet service provider, data provider and infrastructure manager, as well as any other subject involved in the completion of the driving task, through a one-stop-shop approach.

The advantage for the victim with respect to the current system would be twofold: on the one hand he will be ensured compensation without the need to bring suit on the grounds of product defectiveness; on the other hand, he would be relieved of the complex duty of pinpointing the one subject that is indeed materially responsible among those mentioned above, thence the user, manufacturer, and infrastructure manager and all related service providers. In fact, determining that the accident was due to a failure in the system—eventually due to a defect—, to a momentary disconnection, or to a malfunctioning of the sensors in the infrastructure intended to communicate with the vehicle, might be complex if not at all impossible, in particular given intrinsic informational asymmetries. Such a choice would not eliminate but simply transfer the duty to apportion the economic consequences among all subjects involved to the producer, who might resort to contractual agreements, exploiting economies of scale and business relations to virtually eliminate costly litigation. The manufacturer could, in fact, better induce the internalization of all costs by the other parties involved in the driving task, exploiting both his knowledge of the system and business relations.

This – one-stop-shop – approach is radical yet not unique in European law. The consumer sales directive⁵⁸ also identifies as the entry point for all consumer’s complaints the final reseller, who certainly did not determine the defectiveness of the good purchased, and yet is called in to repair, replace or reimburse the client, then eventually acting in recourse along the entire value chain.

Such a solution is more extreme than that described above under the assumption of the legal system being perfectly efficient in attributing liability (thence $E = 0$). The user or owner would, in fact, be relieved of all liability, even that depending upon his conduct and decisions according to the current legal system. A risk of moral hazard on the side of the user could be identified, in particular if he were involved, even minimally, in the driving task. However, similar concerns could be tackled by conceiving a set of additional measures under administrative and criminal law—directly targeting the user, when involved in the driving task—and could instead be radically excluded with Type-2 solutions. At the same time, EDRs could also be used for that purpose, creating an additional economic incentive for the user. The tracking of user’s choices and behaviour could provide data about his performance—and associated level of risk—allowing the manufacturer to fine-tune the premium he would charge at the moment of sale or—in a pay as you drive setting—when the service is to be offered.

Moreover, this strategy would not necessarily leave the entire economic burden on the producer, not even prima facie. Indeed, the cost of the insurance he will purchase for his entire fleet—thence exploiting economies of scale—will be factored into the overall production costs, and ultimately be transferred onto the purchaser to a greater or lesser extent, according to the elasticity of the demand curve for that specific good.

In this hypothesis, however, it is conceivable that the producer will have an incentive to retain control over the entire driving task, radically excluding any human intervention—for which he would still be called into compensate—or limiting it to those conditions where it is strictly necessary for safety purposes. Ultimately, we might expect such a solution to favour the emergence of Type-2 automation, and drastically incentivize the emergence of CADs at an earlier stage of technological advancement.

16 A comparative analysis of existing legislations on CADs and their framing according to the incentives they provide towards the development of Type-1 or Type-2 automation

Absent any EU intervention, the current regulatory framework for automated vehicles in Europe is to be identified by analysing how the MSs' and EU's extant rules interact with one another. Given that applicable rules might differ to a significant extent from one MS to the other, such a scenario is likely to result significantly fragmented.

As recalled in Sect. 3, the issues which are mostly likely to have a direct bearing on technological innovation are those relating to testing, certification, liability and insurance. Therefore, to properly understand how current regulations affect the development of autonomous vehicles, and whether uniform criteria across MSs are needed, a broad comparative analysis should be developed, assessing all these issues in combination with each other.

In this paper, however, we will narrow the comparative analysis to liability rules, given their seminal role in incentivising and shaping the diffusion of automated vehicles, which we have thoughtfully discussed. More precisely, we will focus on those MSs which have adopted a pro-active stance in regulating CADs, i.e. Germany and the UK. Firstly, we will briefly sketch how the different legislations deal with the problem of apportioning liability among the different subjects involved. Secondly—provided that legal intervention is to be greeted, since it is likely to provide a greater ex ante certainty, compared to implicit reliance on liability rules applicable to traditional driving—such reforms will be critically evaluated against the theoretical framework elaborated in Sects. 14–15, to understand whether the solutions therein adopted prove to be efficient according to the Risk Management Approach, and eventually which kind of automation (Type 1 or Type 2) they are most likely to incentivize.

17 Cont.: Germany

Germany has recently amended its Straßenverkehrsgesetz⁵⁹ to allow “high-fully automated driving vehicles” on public roads and regulate the behaviour of their drivers, thus established itself as the first EU Member State adopting a legal framework on CADs. Despite the somehow misleading nomenclature,⁶⁰ under this law the user of the vehicle may not be completely disengaged from driving (Section 1a.1 StVG.), and no-passenger driving systems are banned, with the exception of low-speed driverless parking systems on separated private grounds outside the public roadways (Sects. 6, 1n. 14a StVG.).

The automated vehicles are required to possess the technical equipment necessary to (i) steer the vehicle upon activation and handle the driving task, including longitudinal and lateral control; (ii) abide by the traffic regulations directed towards drivers, when the highly or full automated vehicle control system is active; (iii) manually be overridden or deactivated by the operator of the vehicle at any time; (iv) recognize when it is necessary for the driver to personally control the vehicle, and (v) indicate visually, acoustically, tactilely, or otherwise perceptibly to the operator, with sufficient anticipation, the necessity to resume  control, before it is actually handed over to the driver (Section 1a.2 StVG.).

The Fahrzeugführer—the driver both when in control of the steering wheel when relying on the highly or fully automated driving function to control the vehicle (Section 1a.4 StVG.)—is now allowed, while performing medium–high or fully-automated functions, to avert his eyes from the road and defer control of the vehicle, but only so long as he remains vigilant, and ready to resume it, (i) when the highly or fully automated system prompts him to do so, or (ii) if he recognizes or, due to obvious circumstances, must recognize that the prerequisites for the intended use of the highly or fully automated driving functions no longer exist (Section 1b StVG.).

Under the newly enacted law, automated driving remains governed by ordinary fault-based liability rules, although specific caps—10 million € for personal damages, and to 2 million € for property damages—apply (Sect. 12 StVG.). Therefore, the driver holds a duty to remain vigilant and resume control when needed or required to do so; should he breach his duties, and an accident occur as a result thereof, he would be liable for the damage caused. If he is not at fault, the owner of the vehicle will be held accountable for the damages caused by the vehicle operating in automated mode, just as it would occur with ordinary driving (Sect. 7 and Sect. 18 StVG.). According to the general rules governing private law, the owner may sue the manufacturer of the vehicle, in case a product liability claim could be made.⁶¹

As for the evidentiary profiles, black boxes are intended to provide sufficient information to determine whether the driver was at fault or not, both when directly in charge of the driving task or when supervising the autonomous operation. The law indeed prescribes that automated motor vehicles shall be designed as to allow storage of the position and time when control of the vehicle changes from the driver to the automated system, as well as when the former is requested to take over control, of the vehicle control or a technical disturbance of the system occurs (Section 63a StVG.).⁶²

18 Cont.: United Kingdom

Under UK law, the driver is responsible for the vehicle and must retain control.

The UK has worked in parallel with Germany to establish a national regulation for CADs, and has recently adopted its first binding regulation on this matter.

After a series of initiatives, in September 2016 the Department of Transport released a consultation The Pathway to driverless cars: Proposals to support advanced driver assistance systems and automated vehicle technologies, leading the Government to respond proposing: (i) a step by step pragmatic approach to legislative innovation, starting with a revision of the Highway Code to enable remote control parking, motorway piloting and HGV platooning, and (ii) an extension of compulsory motor insurance to cover both the drivers’ traditional use of the vehicle and the CAD’s technology.⁶³

The Vehicle Technology and Aviation Bill, presented in February 2017, was drafted as to introduce policies for automated vehicles and road vehicle testing, extending compulsory motor insurance requirement to include automated vehicle owners. The initiative came to a halt when the Parliament was dissolved in July 2017, and has now been translated in the Automated and Electric Vehicle Bill (henceforth AEVB),⁶⁴ presented in October 2017 at the House of Commons and adopted on the 19th of July 2018.

The Bill amends and supplements the provisions in the Road Traffic Act, making it compulsory for users of automated vehicles to have insurance that covers the technical failures of the CAD. It therefore places a duty to acquire first-party insurance on users, providing coverage for damages caused to the driver when legitimately disengaged from the driving tasks. Differently from current law, applicable to traditional vehicles, CADs may not benefit from the depositing of a bond for £500,000 with the Accountant General, as an alternative to the standard third-party insurance requirements.

The bill requires the Secretary of State to maintain a list of relevant automated vehicles to which the legislation would apply, including vehicles that: (a) are or might be used on roads or in other public places in Great Britain, and (b) are in the Secretary of State’s opinion designed or adapted to be capable, in at least some circumstances or situations, of safely driving themselves without having to be monitored by an individual. Such vehicles should be identified either by their type, by their registration document, or otherwise (clause 1).

Clause 2 provides that, when (a) an accident is caused by an automated vehicle when driving itself, (b) the vehicle is insured at the time of the accident, and (c) an insured person or any other person suffers damage as a result of the accident (personal injury or death or third party property damage), the insurer would be held liable. If the vehicle is not insured at the time of the accident, and Section 143 of the Road Traffic Act 1988 (exemptions to compulsory insurance), the owner of the vehicle will be held accountable instead. In both cases, liability would be limited according to Section 145 of the Road Traffic Act 1988 Section 145(4)(b) (limit on compulsory insurance for property damage, amounting to £1,000,000), which already applies to damages caused by traditional driving. With the only exclusion of the aforementioned cap, liability may not be limited or excluded by a term of an insurance policy or in any other way.

However, according to clause 3, when the injured party contributed in causing the accident, provisions under the Law Reform (Contributory Negligence) Act 1945 (Sect. 1 in particular) apply. Also, the insurer or owner of an automated vehicle is not liable under Sect. 2 to the person in charge of the vehicle where the accident that it caused was wholly due to the person’s negligence in allowing the vehicle to begin driving itself when it was not appropriate to do so. Under clause 4(1), insurers would be able to limit their liability if the damage suffered by the insured person are a direct result of software alterations made by the insured person himself, or with his knowledge, that are prohibited under the policy, or of a failure to install safety–critical software updates. If damage to a third party occurred and the insurer paid for it, they could claim that payment back from the insured person in some circumstances. If damages are suffered by an insured person who is not the holder of the policy, subsection (1)(a) applies only in relation to software alterations which, at the time of the accident, the person knows are prohibited under the policy.

Therefore, if the car is driving automatically, and causes the incident, first instance liability is on the insurer and the (human) driver is also covered. The key policy point in this clause is that extending the insurance system applicable to non-automated-driving is preferable than requiring the consumer to pay damages and then rely on a product liability action which is likely to be costly and long. Insurance companies are left free to regulate the policy market as they prefer, but insurance would be compulsory. According to clauses 2 and 5, when the insurer, or the owner of a vehicle, are bound to a person who has suffered damage as a result of an accident (« the injured party »), and (b) the amount is settled—because it has been established by a judgment, a decree, and arbitral award or an enforceable agreement—, any other person liable is also responsible towards the insurer or vehicle owner, to the same amount. Both the insurer and the owner of vehicle can therefore recover from the actual wrongdoer (the driver who has relied on the automated system when it was not appropriate to do so; the manufacturer, in the damages where cause by a defect in the product) the amount paid in compensation.

19 Cont.: discussion

The two reforms present both commonalities and differences. The UK model is based on the assumption that extending the insurance system applicable to non-automated-driving is preferable than requiring the user to pay damages, and then rely on a product liability action, for that is likely to be time-consuming and costly.

In this sense, a first- and third-party insurance scheme the owner of the vehicle is required to purchase ensures the victim obtains prompt and certain compensation, clearly identifying the subject to be sued, resting liability on the party best position to pay (the insurance company itself), irrespectively of any ascertainment about the details of the accident and, more specifically, the mode—traditional or autonomous—in which the vehicle was driving. From the victim’s perspective, the solution thus appears to set an efficient compensatory scheme.

However, the apportionment of liability between the insurer and the user is problematic, and might trigger substantial litigation, thence partially—if not completely—vanishing the theoretical advantages of the insurance scheme just sketched.

Indeed, the possibility for the company to escape liability in case the use of the autonomous mode was ex post ascertained as being inappropriate—in light of the overall circumstances –, despite intended to discourage morally hazardous behaviour on the side of the user, will ultimately elicit litigation in most—if not all—cases when an accident occurs while the driverless function is activated. Therefore, as soon as a claim is brought by the victim to the insurer, the latter will most likely attempt to show the choice to relinquish control to the vehicle was unreasonable, causing the overall ascertainment to become complex, and costly. The economic incentives are, in fact, substantial, for, should it succeed, it would be able to recover the amounts liquidated to the third party, by suing the user in recourse, or radically deny compensation to the user himself.

Moreover, the proposed regulation burdens the user for all safety–critical software updates, excluding the liability of the insurer towards the insured person in case they are not installed (Clause 4(1)).

The very duty to update is rested on the party that is not best suited to ensure compliance. It may be easily observed how individuals fail to install even safety–critical patches to applications and software to be used on their hand-held devices or computers. Distraction, as well as failure to understand the nature, urgency, and importance of the single update, or the frequently untimely fashion in which the request is prompted to the user—forcing an interruption of the activity carried out at the moment, eventually, in the case considered, the driving task itself—determine the decision to postpone installation. Thence, if the legislator intended to ensure that all vehicles circulating had the most updated software installed, it ought to burden the manufacturer, holding him responsible. Indeed, he would be best positioned to minimize the risk associated with users’ negligence, by conceiving its vehicles in a way that software is always installed when necessary—if possible overnight and when it is not in use, minimizing inconveniences—eventually forcing a halt unless it was safe to proceed.

The proposed legislation thence fails to meet both criteria of a risk-management approach, for it does not ensure risks are managed by the party best positioned to do so, namely the insurance company, nor that the party is burdened who is capable of minimizing it, the manufacturer.

Moreover, by allowing for the possibility of the insurer to escape the duty to compensate the victim in the first instance, it would not reduce or ease litigation substantially, and eventually expose the victim to the possibility of failing to obtain due compensation, if not discouraging a claim on her side in the first place. One could expect the system to require the creation of an additional fund for those victims,⁶⁵ that would ultimately produce that socialization of damage the conceived solution fails to directly pursue.

Overall, the proposed legislation does not substantially depart from the current system, still resting on the ascertainment of some form of fault—in choosing which mode to activate, or in failing to update software—, despite adopting a strategy that primarily aims at victims’ compensation through compulsory insurance schemes. If at all it had to be traced back to one of the alternative approaches sketched above, however, it would more closely resemble the first model, possibly favouring Type-1 CADs, thence not radically excluding the user from the completion of the driving task.

Similar conclusions can be reached for the model set out by German legislation, whereby liability primarily rests upon the user and owner. In such a perspective, the duty to remain vigilant, clearly implies a fault-centred rationale, demanding a diligent behaviour on the side of the user while the autonomous function is activated. Theoretically, it is desirable of the human occupant—of a semi-autonomous vehicle of the kind described—to maintain a certain degree of control over the driving task. However, this – supervision – is precisely the kind of task humans are less apt to, and their very tendency in getting distracted primarily justifies the development of technologies intended to replace them at conducting the vehicle. Moreover, resuming control when involved in the activities described as lawful requires a very anticipated signal—most likely a few seconds—that either forces the interpretation of the provision to be very relaxed—never finding the liability of the distracted user—or seriously limiting the possibility to activate the autonomous function in the first place.

This very aspect could then ground substantial product liability litigation, for the design of the signalling system could be deemed defective if it did not take reasonable consumers’ expectations into account—for instance if it was considered forcing the user to maintain high levels of concentration that might be deemed unattainable by the average individual—but the opposite argument of the negligent behaviour of the user could also be grounded, with all implications described above. The relevant costs of product liability litigation could ultimately discourage individual actions against manufacturers, forcing externalities upon the owner or user of the vehicle, disincentivizing their diffusion.

Overall, the technical features prescribed for the vehicle to be lawful, as well as the proposed liability apportionment criteria as briefly discussed, are likely to favour Type 1 over Type 2 automation. Compared to the UK solution, however, the absence of a clear and mandatory provision requiring vehicle owners to buy insurance for damages caused by an automated-driving system, is likely to make victims under German law worse-off compared to their UK counterparts, as it would be less clear for them which subjects they should sue (being such operation more easily performed by an insurance company in a recourse claim). Furthermore, given that extant German compulsory insurance for traditional driving only covers third party liability, the lack of reform on this matter might result in denying adequate compensation to the CADs owner who suffered damages in the accident while legitimately driving on automated mode, since it would have to rely on the unsatisfactory regime of ordinary product liability to get compensation from the manufacturer.

20 The need for a European regulation of autonomous vehicles

We have shown that the transition towards full automation will be progressive, and will certainly encounter a phase where vehicles with different levels of automation will coexist. Cars are, indeed, expensive goods and, on average, are not frequently replaced by their owners.

However, the length of such phase—and the social costs associated thereto—is dependent upon both the speed of technological advancement, but also of its uptake by consumers, required to choose a more or less technologically sophisticated vehicle when replacing their own. Such a choice by a rational consumer is also affected by the anticipated effect of liability rules, and ultimately the burden such norms pose on them in case of an accident.

The current liability framework—at European level—is primarily based on two bodies of legislations, MSs’ norms regulating traffic accidents, typically establishing the fault-based liability of the driver and—in some cases at least—the objective liability of the owner, on the one hand, and European product liability on the other hand.

Such bodies of norms that were conceived as being independent and radically separated, will progressively overlap with increasing human–machine cooperation in all semi-autonomous vehicles, that will be used during the intermediate stage (S_i) together with traditional ones. Moreover, since CADs are connected vehicles, other parties will participate in the completion of the driving task, namely various service providers and infrastructure managers.

By modelling the current liability framework, applying it to the three different stages—current S₀, with no or negligible automation, intermediate S_i (as already defined), and final S_f, once full automation is achieved and the presence of traditional vehicles is negligible—we have shown how the inefficiencies of the legal system will (i) increase uncertainty with respect to whom should be held responsible, and therefore on (ii) whom should insure, and against which risks, and ultimately (iii) discourage early adoption of partially autonomous vehicles.

In particular, informational asymmetries, and high litigation costs—primarily, yet not solely, due to the complexity of the PLD and of its shaping of the evidentiary burden—will most likely force the duty to compensate damages on the owner of the vehicle, whenever he is held strictly liable by national legislation, also preventing the correct internalization of costs generated by other players involved.

For a rational agent, the choice to purchase a partially autonomous vehicle, absent legal reform, will only be sensible when the performance of such machines largely surpasses—by many folds—that of the average human driver. Overall, this will entail a very slow market penetration, with large social and economic costs associated.

Reform is therefore advisable, and it should abide a Risk-Management Approach. In such a perspective, liability rules should primarily – if not entirely – focus on ensuring victim compensation, rather than the pursuit of deterrence or optimal ex ante safety investments. Indeed, the PLD failing to ensure the correct internalization of costs by manufacturers—for the reasons described above—is not efficient in ensuring adequate incentives towards the development of safe technologies. Reputational and other market mechanisms are much more efficient towards that end (Polinsky and Shavell 2009–2010; Helland and Tabarrok 2012), together with product safety regulation (Geistfeld 2017; Bertolini 2016).

Towards that end, the legal system should attempt to minimize at least first level litigation by the victim attempting to be compensated, by identifying a single entry point for all litigation, through a clear, strict—if not absolute—liability rule (also known as one-stop-shop), eventually granting secondary litigation rights (e.g.: right to sue in recourse) (Bertolini 2016). Such party should be identified in the party that is best positioned to (i) identify and (ii) manage (typically through insurance) risks, and—when relevant—(iii) ensure compliance [similarly to Calabresi (1970)].

Within such framework two subjects can be primarily identified as possible first instance responders, the owner of the vehicle—as the current system in a less efficient and transparent way is anyway leading to—and the manufacturer. A clear-cut liability rule, imposing the duty to compensate univocally on any one of those two subjects would still minimize litigation costs and uncertainty—today due to the overlapping of the many coexisting rules—and would ensure that the cost of accidents may be internalized through insurance mechanisms. Indeed, the safety of the overall driving performance—due to the residing human factor in partial automation, and the autonomous portion dependent upon the intrinsic safety of the vehicle and of the relevant infrastructure—would reflect upon the insurance premium (Geistfeld 2017) to be paid respectively by the owner or the producer, according to the liability rule chosen.

At the same time, even in the latter case, the final cost of liability would not necessarily be borne by the manufacturer, who could instead—minimize it, exploiting economies of scale due to the insuring of an entire fleet of vehicles rather than the single one—and reflect it upon the resale price of the vehicle, ultimately distributing it among all users of the technology.

The choice between one or the other liability rule would, however, not prove neutral in terms of technology it would favour. Indeed, if the owner were to be held strictly—if not absolutely—liable, he would prefer a vehicle where the choice whether to drive autonomously or not will primarily be left with him (Type-1 automation). The opposite choice, burdening the manufacturer, would most likely incentivize Type-2 automation, where ultimately the vehicle will be entirely autonomous, depriving the human user of all control.

For this very reason, thence to avoid market fragmentation, as well as to ensure a level-playing field and increased certainty at European level, the EU should intervene to regulate liability for accidents involving—partially—autonomous vehicles. Absent European intervention MS will regulate, adopting solutions that might prove divergent even with respect to the incentives they provide towards one form or the other of automation.

In such a perspective, the ad-hoc regulation adopted in Germany and the UK was briefly analysed to show how it does not fully relinquish a fault-based perspective. So is to be understood the duty to overlook the functioning of the autonomous vehicle and resume control if prompted to do so, put forth by Section 1b StVG., and the duty to install safety–critical software updates, established by clause 4(1) AEVB, and therefore will not necessarily simplify nor diminish first instance litigation.

An intervention at EU level is therefore possible and necessary (Engelhard and de Bruin 2018), and even if it is clear that the PLD would deserve a profound revision, the preferable choice would be that of adopting specific legislation for autonomous and partially autonomous vehicles (Timan et al. 2019), pursuant to a RMA.