1. Introduction

Autonomous systems regulation is the body of legal rules, regulatory standards and civil liability principles governing technologies that can perceive their environment, process information, make decisions and perform actions with limited or no immediate human intervention.

These systems include autonomous vehicles, robotic machinery, AI-powered medical devices, automated financial trading systems, industrial robots, autonomous ships, drones and intelligent software agents.

From a civil-law perspective, autonomous systems create fundamental questions about responsibility, negligence, contractual obligations, product safety, compensation for injury, privacy, insurance and access to judicial remedies.

For example, if an autonomous vehicle causes an accident, the relevant legal questions may include whether the manufacturer supplied a defective system, whether the operator failed to maintain it, whether a software provider negligently updated it, or whether the accident resulted from circumstances that could not reasonably have been prevented.

The central legal principle is that autonomy does not automatically confer legal personality or eliminate human and corporate responsibility. Liability generally depends on the applicable legislation, the roles of the parties, the relevant duties and the evidence establishing causation and loss.

2. Meaning and characteristics of autonomous systems

An autonomous system uses sensors, software, algorithms or other technical components to perform tasks that would otherwise require human judgment or direct control.

Its main characteristics include:

Perception: Collecting information from cameras, sensors, databases or other inputs.

Decision-making: Selecting actions according to programmed rules, learned models or optimisation processes.

Execution: Performing physical or digital tasks with limited human intervention.

Adaptation: Changing outputs in response to new information or changing conditions.

Connectivity: Communicating with other systems, devices, networks or operators.

Variable human oversight: Operating under different degrees of supervision, from continuous monitoring to independent execution within defined limits.

Autonomy is not an all-or-nothing concept. A system may operate independently during ordinary conditions but require human intervention in emergencies. Legal analysis must therefore consider the actual capabilities, intended use and operational limits of the particular system.

3. Scope of autonomous systems regulation

Autonomous systems regulation draws on multiple legal disciplines.

A. Civil liability and tort law

Tort law addresses harm caused by negligent design, inadequate testing, unsafe deployment, unreasonable supervision or failure to warn of known risks.

A claimant ordinarily needs to establish the elements of the applicable cause of action, such as duty, breach, causation and legally recognised damage. The precise requirements vary between jurisdictions.

B. Contract law

Contracts govern the relationships between manufacturers, developers, operators, suppliers, insurers and customers.

Disputes may concern system performance, software updates, warranties, maintenance, service-level commitments, allocation of risk and indemnification. Automated performance does not remove the need to interpret the parties' contractual obligations.

C. Product liability

Product liability rules address injuries or losses attributable to defective products. Depending on the jurisdiction, liability may concern manufacturing defects, unsafe design, inadequate warnings or failures to meet statutory safety requirements.

Autonomous systems can complicate this analysis because a product may contain hardware, software, sensors and third-party components that are updated throughout its operational life.

D. Data protection and privacy

Autonomous systems may collect location information, images, biometric information, behavioural data or other personal information. Their use must comply with applicable data-protection and privacy rules.

E. Public and administrative law

Government authorities may regulate licensing, testing, certification, operational permissions, safety standards and incident reporting. Decisions by regulators may also be subject to administrative review or judicial scrutiny where the applicable law permits.

F. Insurance and compensation

Compulsory insurance, commercial liability insurance and specialised compensation schemes may provide mechanisms for dealing with accidents. The availability of insurance does not necessarily determine whether the manufacturer, operator or another party is legally liable.

4. Comparative regulatory approaches

A. European Union

The EU combines the AI Act, product safety legislation, data protection rules and civil liability law. The AI Act establishes a risk-based framework, including requirements for specified high-risk AI systems. The revised Product Liability Directive (EU) 2024/2853 expressly addresses software and certain digital products. Its application depends on national implementation and the directive's temporal provisions.

The EU approach seeks to connect technical safety and compliance requirements with existing mechanisms for compensating harm.

B. United States

The US combines federal vehicle-safety oversight with state-level tort, product liability and insurance law. The National Highway Traffic Safety Administration (NHTSA) oversees relevant federal motor vehicle safety requirements, while state law often determines civil responsibility for accidents.

This structure can accommodate established negligence and product liability doctrines, but differences between states may create uncertainty for manufacturers operating nationwide.

C. Australia

Australia relies on negligence, statutory product liability under the Australian Consumer Law, road transport legislation, insurance requirements and technology-specific regulatory arrangements.

The legal analysis may involve manufacturers, software providers, vehicle owners, operators and employers. Australian courts apply established principles of duty, causation and reasonable care, adapted to the circumstances of the technology.

D. United Kingdom

The UK combines negligence, product liability, insurance law and specific automated-vehicle legislation. The Automated and Electric Vehicles Act 2018 provides a statutory insurance and compensation framework for qualifying accidents involving automated vehicles when driving themselves, subject to the Act's conditions.

This model is significant because it addresses compensation for road users without requiring every claim to begin with a complex determination of whether the human user or the automated system was at fault.

E. Germany and civil-law systems

Germany applies codified civil liability principles, the German Civil Code, product liability legislation, motor vehicle liability rules and relevant EU requirements.

This model illustrates how statutory liability, duties of care and insurance can operate together. In appropriate cases, liability may arise without requiring proof of every element of ordinary negligence, although the applicable statutory conditions must still be met.

5. Ten important case laws

The following cases provide judicial foundations for analysing autonomous systems. Some are directly relevant to automated decision-making or platform control; others are established authorities on negligence, product liability and causation that can be applied by analogy. They should not be mistaken for ten judgments specifically concerning fully autonomous robots.

Case 1: Donoghue v Stevenson [1932] AC 562

Jurisdiction: United Kingdom.

Facts: A consumer allegedly became ill after consuming ginger beer containing a decomposed snail. The product had been supplied in an opaque bottle, and the consumer had no direct contract with the manufacturer.

Legal principle: The House of Lords recognised a manufacturer's duty of care towards the ultimate consumer in the circumstances of the case.

Relevance to autonomous systems: Manufacturers of autonomous vehicles, industrial robots and AI-enabled devices may owe duties to people foreseeably affected by defects in their products, even where those people have no direct contract with the manufacturer.

Civil-law significance: The case is a foundational authority for negligence-based product liability. It does not establish that every malfunction creates liability; the relevant duty, breach, causation and damage must still be proved.

Case 2: Grant v Australian Knitting Mills Ltd [1936] AC 85

Jurisdiction: Privy Council, on appeal from Australia.

Facts: Dr Grant suffered dermatitis after wearing woollen underwear that contained excessive chemical residue from its manufacture.

Legal principle: The decision applied the manufacturer's duty of care to a defective consumer product that caused physical injury.

Relevance to autonomous systems: A product may cause injury because of an undetected manufacturing defect or inadequate quality control. In autonomous machinery, similar questions may arise where a sensor, actuator, braking component or other physical element is defective.

Civil-law significance: The case supports the proposition that manufacturers must take reasonable precautions against foreseeable injury caused by defective products. Its precise application depends on the relevant modern statutory regime and facts.

Case 3: Wyong Shire Council v Shirt (1980) 146 CLR 40

Jurisdiction: High Court of Australia.

Facts: A person was injured while water-skiing in an area where the water was shallower than expected. The dispute concerned the scope of the council's duty and the precautions reasonably required.

Legal principle: The High Court explained the assessment of reasonable foreseeability and the likelihood and seriousness of harm when determining breach of duty.

Relevance to autonomous systems: Developers and operators should consider foreseeable risks arising from ordinary use and reasonably predictable misuse. For example, an autonomous robot operating near workers may require guarding, emergency stops, collision detection and appropriate supervision.

Civil-law significance: The case helps courts evaluate whether reasonable precautions were required in the circumstances. The fact that a system is technologically sophisticated does not automatically establish that its operator has met the standard of care.

Case 4: March v E & MH Stramare Pty Ltd (1991) 171 CLR 506

Jurisdiction: High Court of Australia.

Facts: A collision occurred involving a truck that had been left partly across a roadway and a vehicle driven by a person who had consumed alcohol. The case concerned causation and contributory negligence.

Legal principle: The High Court discussed the role of common-sense principles in determining factual causation, alongside the applicable legal rules of responsibility.

Relevance to autonomous systems: An accident may have multiple contributing causes, such as defective software, poor sensor performance, inadequate maintenance and a human operator's conduct. A court must assess whether the relevant conduct caused the harm and how responsibility should be allocated.

Civil-law significance: The case is useful when analysing multi-party accidents. It cautions against assuming that the last event before an injury is necessarily the sole legal cause.

Case 5: Hollis v Vabu Pty Ltd (2001) 207 CLR 21

Jurisdiction: High Court of Australia.

Facts: A pedestrian was injured by a bicycle courier working for a business that described its couriers as independent contractors.

Legal principle: The Court examined the substance of the working relationship, including the degree of control and the integration of the worker into the business, when determining whether the relationship was one of employment.

Relevance to autonomous systems: Autonomous delivery robots, remotely supervised vehicles and AI-managed transport services may involve complex relationships between platform operators, contractors and service providers. Contractual labels alone may not determine the legal character of the relationship.

Civil-law significance: The case is relevant to questions of vicarious liability and responsibility for activities carried out within a business. It does not establish that every platform operator is responsible for every act of a contractor or autonomous system.

Case 6: A v National Blood Authority [2001] 3 All ER 289

Jurisdiction: High Court of England and Wales.

Facts: Patients received blood products contaminated with hepatitis C. The dispute concerned liability under the consumer protection product liability regime.

Legal principle: The Court considered whether the blood products were defective under the applicable statutory test and whether the statutory development-risks defence was available.

Relevance to autonomous systems: Product safety cannot be assessed solely by asking whether a manufacturer acted carelessly. A product liability regime may impose liability based on defectiveness and other statutory requirements, independently of ordinary negligence.

Civil-law significance: The case illustrates the importance of distinguishing negligence from statutory product liability. The applicable law determines the defect test, available defences and recoverable losses.

Case 7: Caparo Industries plc v Dickman [1990] 2 AC 605

Jurisdiction: United Kingdom.

Facts: Investors relied on a company's audited accounts when acquiring shares. They alleged that negligent auditing had caused financial loss.

Legal principle: The House of Lords considered the circumstances in which a duty of care exists for negligent statements, including foreseeability, proximity and whether imposing a duty is fair, just and reasonable under the law at the time.

Relevance to autonomous systems: An organisation may rely on outputs from an autonomous risk assessment, diagnostic tool or decision-support system. Whether the developer or provider owes a duty to the person who suffers loss depends on the relationship, intended use, applicable statutory duties and surrounding circumstances.

Civil-law significance: The case highlights the difficulties of establishing liability for pure economic loss. A system's inaccurate output does not automatically mean that its developer owes a duty to every person affected by it.

Case 8: Uber BV v Aslam [2021] UKSC 5

Jurisdiction: Supreme Court of the United Kingdom.

Facts: Uber drivers sought recognition as workers under UK employment legislation, despite contractual arrangements that characterised their relationship differently.

Legal principle: The Supreme Court upheld the conclusion that the drivers were workers for the relevant statutory protections. It examined the practical control exercised by Uber, including fares, contractual terms and aspects of performance management.

Relevance to autonomous systems: Software can exercise substantial operational control through task allocation, ratings, access restrictions and automated monitoring. Legal responsibility cannot always be determined by contractual labels alone.

Civil-law significance: The case is particularly relevant to algorithmic management and the allocation of responsibility in technology-mediated work. It is an employment-status decision, not a general ruling on autonomous-machine product liability.

Case 9: State v Loomis, 881 N.W.2d 749 (Wis. 2016)

Jurisdiction: Supreme Court of Wisconsin, United States.

Facts: Eric Loomis challenged the use of a proprietary algorithmic risk assessment tool in sentencing proceedings.

Legal principle: The Court upheld the use of the risk assessment in the circumstances, subject to cautions and limitations on how it could be used. The decision raised concerns about transparency, proprietary methods and the risks of overreliance on algorithmic scores.

Relevance to autonomous systems: The case demonstrates that consequential automated outputs may require human judgment, appropriate limitations and scrutiny of the information on which a system relies.

Civil-law significance: Although the case concerns criminal sentencing rather than civil liability, its reasoning is relevant to the broader governance of automated decision-making. It does not establish a universal legal rule for the admissibility or validity of algorithmic decisions.

Case 10: Dederer v Roads and Traffic Authority of New South Wales (2007) 234 CLR 330

Jurisdiction: High Court of Australia.

Facts: A young person was seriously injured after diving from a bridge into shallow water. The claim concerned whether the road authority had breached its duty of care.

Legal principle: The High Court examined the scope of the authority's duty and whether reasonable care required the particular precautions alleged by the claimant.

Relevance to autonomous systems: A manufacturer or operator is not necessarily required to eliminate every conceivable risk. The legal question is whether the precautions required by the applicable duty were reasonable in the circumstances, taking into account the foreseeable risks.

Civil-law significance: The decision provides a useful framework for assessing safety obligations without treating the occurrence of an accident as proof of negligence.

6. Comparative lessons from the cases

7. Who may be liable when an autonomous system causes harm?

Responsibility depends on the technology and the circumstances. The following framework identifies potential parties without presuming that all are liable in every case.

Several parties may share responsibility. A court may need technical evidence, system logs, software versions, maintenance records and expert analysis to determine what happened and which party's conduct caused the loss.

8. Remedies in autonomous systems disputes

Civil remedies may include:

Compensatory damages for proven physical injury, property damage and other legally recoverable loss.

Product liability remedies under the relevant statutory regime.

Contractual damages or rescission where a contractual breach or recognised ground for rescission is established.

Injunctions to prevent ongoing unlawful conduct or unsafe activity where legally available.

Contribution and indemnity between responsible parties, subject to applicable law and contractual arrangements.

Insurance compensation under compulsory insurance or other applicable policies.

The appropriate remedy depends on the cause of action, the jurisdiction, any statutory defences and the evidence. A claimant must not assume that the system's unexpected behaviour alone proves liability.

9. Major regulatory challenges

Attribution of responsibility: Autonomous systems distribute decision-making across manufacturers, software providers, data sources and operators.

Opacity: Machine-learning systems may make decisions that are difficult to explain, making it harder to identify the cause of an accident.

Continuous updates: Software changes after deployment can affect safety and complicate the identification of the responsible version or party.

Cross-border operations: A system may be developed in one jurisdiction, manufactured in another and operated elsewhere, creating questions of applicable law and enforcement.

Cybersecurity: A system may cause harm because of malicious interference rather than a conventional manufacturing defect.

Insurance gaps: Existing policies may contain exclusions or unclear terms concerning autonomous operation, software failures or cyber incidents.

Evidentiary imbalance: Manufacturers may control technical information that injured persons need to establish their claims. Disclosure rules and proportionate evidentiary presumptions may help address this problem where permitted by law.

10. Recommendations for a balanced regulatory framework

An effective framework should combine technological innovation with enforceable safeguards.

Establish clear safety and testing requirements proportionate to the system's risk.

Identify the human or corporate entity responsible for deployment and operational oversight.

Require appropriate logging, incident reporting and preservation of evidence.

Clarify insurance coverage and compensation arrangements for foreseeable categories of harm.

Apply product liability rules that adequately address software and digital components.

Provide appropriate means for affected persons to challenge consequential automated decisions.

Encourage interoperability and cybersecurity standards without unnecessarily preventing competition.

Coordinate international rules to reduce uncertainty in cross-border deployment.

11. Conclusion

Comparative autonomous systems regulation demonstrates that traditional civil law remains essential even as technology increasingly performs tasks independently of direct human supervision.

The decisions in Donoghue v Stevenson, Grant v Australian Knitting Mills, Wyong Shire Council v Shirt, March v Stramare, Hollis v Vabu, A v National Blood Authority, Caparo v Dickman, Uber v Aslam, State v Loomis and Dederer provide useful foundations for examining duties of care, product defects, causation, organisational responsibility and automated decision-making.

These authorities do not create a single universal law of autonomous systems. Rather, they illustrate how established legal principles can be applied to new technological risks, alongside specific legislation and safety regulation.

The central objective is to ensure that autonomy does not become a gap in accountability. A sound legal framework must identify responsible parties, preserve evidence, establish appropr