Civil Law and Tunnel Rail Safety System Malfunction Liability in Europe

A malfunction in a railway tunnel’s signalling, fire detection, communications, emergency lighting, or evacuation systems can lead to personal injury, damaged trains, service disruption, and substantial commercial losses. Civil liability depends on which party controlled the failed system, what duty applied, and whether the failure caused or increased the damage.

Europe does not have one uniform civil liability system. National contract and tort law operate alongside EU railway safety rules, passenger-rights legislation, product-liability law, and international railway conventions. This explanation focuses on the EU framework. Different rules may apply to metros, excluded networks, and non-EU countries.

1. What constitutes a safety-system malfunction?

Potential failures include:

• A signal or train-detection system incorrectly indicating that a tunnel section is clear.
• A fire alarm failing to detect or communicate a developing fire.
• Emergency communications failing between the driver and control centre.
• Backup power failing during an evacuation.
• Emergency lighting or escape-route equipment becoming unusable.
• A control-system error preventing an appropriate emergency response.

A malfunction does not automatically establish negligence. The court must identify the applicable liability regime. Some claims require proof of fault; others involve liability without proof of negligence, subject to statutory conditions and defences.

It is also necessary to distinguish causing the initial accident from making its consequences worse. A failed evacuation system may not have started a fire but may nevertheless have contributed to smoke injuries.

2. Who may be liable?

Several failures may operate together. For example, a defective alarm, ignored fault reports, and an inadequate evacuation response may each contribute to the same injuries. Whether defendants are jointly liable, and how contribution is divided, depends on the governing law.

3. The principal legal framework

A. National contract and tort law

Contract claims commonly concern whether a supplier or maintenance contractor delivered the promised performance. Relevant obligations may cover reliability, testing, maintenance intervals, fault reporting, and compatibility with other systems.

Tort claims concern duties owed to injured people or property owners. Depending on national law, liability may arise from negligence, responsibility for dangerous operations, or responsibility for things under a defendant’s control.

Commercial contracts may contain liability caps and exclusions. Their enforceability must be assessed under the applicable law; they cannot simply be assumed to restrict an injured passenger’s independent rights.

B. EU railway safety requirements

Directive 2016/798 places responsibility for safe railway operation and risk control on railway undertakings and infrastructure managers, each for its part of the system. Their safety management systems must document responsibilities and relevant arrangements. Outsourcing maintenance therefore does not simply remove the operator’s or manager’s own safety responsibilities. EUR-Lex

These obligations can help establish the standard expected of a defendant. However, a regulatory breach does not automatically resolve every element of a damages claim.

C. Tunnel-specific requirements

Regulation 1303/2014 establishes the technical specification for interoperability concerning safety in railway tunnels. It addresses measures for prevention, mitigation, evacuation, and rescue, including emergency planning and relevant infrastructure requirements. Its application depends on the tunnel, subsystem, project, and applicable implementation provisions. EUR-Lex

A claimant should identify the particular requirement applicable to the failed installation, rather than assume every current specification applies retrospectively to every existing tunnel.

D. Passenger and infrastructure-use liability

Passenger claims and claims between railway businesses follow different routes.

Regulation 2021/782 incorporates relevant CIV passenger-liability rules. Where CIV applies, the infrastructure manager is treated as a person whose services the carrier uses to perform carriage. This matters when a carrier seeks to blame a separate infrastructure organisation. Subsequent recovery between those businesses is a distinct question. otif.org

For qualifying international infrastructure-use arrangements, the COTIF CUI rules may govern liability between the railway undertaking and infrastructure manager.

E. Product liability

An injured person may have a claim against the producer of defective safety equipment without proving negligent manufacturing, provided the governing product-liability requirements are satisfied.

Timing matters: Directive 2024/2853 expressly includes software and introduces updated liability and evidence rules. Its transposition deadline is 9 December 2026, and it applies to products placed on the market or put into service after that date. As of 6 October 2026, those rules should not be treated as already governing every installed tunnel system. Earlier products require analysis under the preceding regime and national law. eur-lex.europa.eu

4. Six relevant case laws

These decisions provide relevant principles. They are not six judgments specifically deciding tunnel safety-system malfunctions. Two concern railway disputes; the others address defective equipment, evidence, service-provider liability, and jurisdiction.

Case 1: ÖBB-Infrastruktur AG v Lokomotion Gesellschaft für Schienentraktion mbH
CJEU, Case C-500/20, 14 July 2022

Facts: Locomotives were damaged following a derailment. The railway undertaking hired replacement locomotives and sought reimbursement from the infrastructure manager.

Decision: The Court held that replacement locomotive leasing costs were not “loss of or damage to property” under Article 8(1)(b) CUI. They constituted financial loss rather than physical damage. It also held that parties could assume greater liability through a general reference to national law, including a broader fault-based regime. EUR-Lex

Application to tunnel malfunctions: A damaged locomotive, replacement hire costs, and lost operating revenue must be analysed separately. Proving responsibility for an infrastructure failure does not establish that every resulting financial loss is recoverable under the same provision.

Limit: The case concerns infrastructure-use liability and recoverable loss categories. It does not establish that the infrastructure manager must pay all derailment-related expenses.

Case 2: ÖBB-Personenverkehr AG
CJEU, Case C-509/11, 26 September 2013

Facts: A railway undertaking used terms excluding delay compensation where delays resulted from force majeure.

Decision: Under the then-applicable Regulation 1371/2007, the Court held that the undertaking could not exclude the statutory delay compensation on that ground. EUR-Lex

Application to tunnel malfunctions: Passenger delay compensation must be distinguished from fault-based damages and personal-injury compensation.

Current-law limit: Regulation 2021/782 now contains specified exceptions for certain extraordinary circumstances. However, acts or omissions of infrastructure and station managers are expressly excluded from its third-party exemption. An ordinary tunnel equipment or maintenance failure should therefore not automatically be treated as an exempt external event. The Regulation’s scope and permitted service exemptions must also be checked. EUR-Lex

Case 3: Boston Scientific Medizintechnik GmbH v AOK Sachsen-Anhalt and Betriebskrankenkasse RWE
CJEU, Joined Cases C-503/13 and C-504/13, 5 March 2015

Facts: Pacemakers and implantable defibrillators belonged to product groups associated with potential defects.

Decision: Given those products’ particular characteristics and safety expectations, the Court accepted that products belonging to the affected group or series could be classified as defective without establishing the defect in each individual device. Necessary replacement surgery could constitute compensable personal-injury damage. EUR-Lex

Application to tunnel malfunctions: Evidence of a recurring defect in a batch of safety controllers or detectors may support an investigation into whether an installed unit failed to provide the safety reasonably expected.

Limit: This reasoning arose in a specific medical-device context. It does not automatically make every tunnel component defective because another component in its series failed.

Case 4: N.W., L.W. and C.W. v Sanofi Pasteur MSD SNC
CJEU, Case C-621/15, 21 June 2017

Facts: Claimants alleged that a vaccine caused illness despite the absence of scientific consensus establishing the link.

Decision: The Court permitted national evidentiary rules allowing serious, specific, and consistent evidence to establish defect and causation. It rejected automatic presumptions that would effectively remove the claimant’s burden of proof. The court must assess the evidence from both sides. EUR-Lex

Application to tunnel malfunctions: A claimant may rely on a combination of event logs, fault reports, failed tests, expert reconstruction, and similar incidents. Direct observation of the precise internal failure is not always the only possible evidence.

Limit: An accident occurring after a software update does not, by itself, prove that the update caused it.

Case 5: Centre hospitalier universitaire de Besançon v Thomas Dutrueux
CJEU, Case C-495/10, 21 December 2011

Facts: A patient suffered burns because the temperature-control mechanism in a heated hospital mattress was defective.

Decision: The Court held that the Product Liability Directive did not regulate the liability of a service provider using defective equipment of which it was not the producer. National rules could impose no-fault liability on that service provider, provided the producer-liability system remained effective. EUR-Lex

Application to tunnel malfunctions: Liability of the equipment producer and liability of the organisation operating that equipment are separate questions. Establishing a manufacturing defect does not necessarily eliminate an operator’s liability under another applicable regime.

Limit: This was a hospital case. It does not create EU-wide strict liability for every railway operator; the relevant railway and national rules must supply that liability.

Case 6: Andreas Kainz v Pantherwerke AG
CJEU, Case C-45/13, 16 January 2014

Facts: A claimant injured while riding an allegedly defective bicycle sought damages in a cross-border dispute.

Decision: For the product-liability jurisdiction question before it, the Court identified the place of manufacture as the place of the event giving rise to the damage. EUR-Lex

Application to tunnel malfunctions: A component may be manufactured in one country, integrated in another, and cause injury in a third. Identifying the competent court requires distinguishing the relevant jurisdictional grounds.

Limit: The decision does not require every claim to be brought where the component was manufactured. Other jurisdictional grounds may apply. Jurisdiction also does not determine which country’s substantive law governs.

5. Proving causation and responsibility

A persuasive claim reconstructs what happened at each stage:

1. Initial event: What caused the collision, fire, derailment, or prolonged stop?
2. Safety response: Which systems should have detected or controlled it?
3. Failure: What equipment, software, maintenance, or operational problem occurred?
4. Consequences: What injury or loss would proper performance probably have prevented?

Relevant evidence includes control-centre logs, onboard recordings, alarm histories, software versions, maintenance records, acceptance tests, emergency plans, and communications.

For example, if a fire detector failed, the claimant must examine whether timely detection would have changed the response. If injuries occurred during evacuation, the condition of lighting, communications, and escape facilities may be more important than the cause of the fire itself.

Independent technical investigation findings can assist that reconstruction, but their legal effect depends on national procedure. They do not automatically decide civil liability.

6. Remedies and allocation of losses

Potential remedies include compensation for personal injury or death, medical and rehabilitation expenses, lost earnings, physical property damage, and qualifying commercial losses. Supplier disputes may also involve repair, replacement, contractual damages, or other contractual remedies.

Each category requires its own legal basis. Replacing defective equipment, compensating injured passengers, and reimbursing the operator’s lost revenue are different claims. Business losses may face contractual exclusions or statutory limits, while passenger claims may benefit from mandatory protections.

The decisive issues are the failed system’s role, the defendant’s responsibility for it, the applicable liability regime, and the evidence connecting the malfunction to the claimed loss. A tunnel accident may involve several responsible parties, but liability must be established separately for each.