Product liability, recalls and insurance

When a robot injures someone, the injured person may seek compensation, regulators may require the manufacturer to fix or withdraw the product, and insurers pay much of the cost. Product liability law, recall law and insurance together shape how robot makers design, test, document and support their products, often more powerfully than safety regulations themselves. This lesson explains the legal theories under which robot makers and suppliers are held liable, the duties to report and recall dangerous products, how software and AI fit, and the insurance and contracts that spread the risk.

Theories of product liability

Product liability claims usually allege that a product was defective in one of three ways: a manufacturing defect, where a particular unit departs from its intended design, such as a cracked gear or a miswired sensor; a design defect, where the design itself is unreasonably dangerous, such as a mobile robot whose scanner cannot detect people lying down when a practical alternative could; or a warning defect, where instructions or warnings fail to convey risks the user could not be expected to know, or how to avoid them. Countries differ in whether the claimant must prove fault.

In the common-law provinces, product liability rests mainly on negligence. Since the House of Lords decision in Donoghue v Stevenson (1932), adopted throughout Canada, manufacturers owe a duty of care to people who may foreseeably be harmed by their products. A claimant must prove that the manufacturer failed to meet the standard of care and that this caused the harm. For design defects, courts weigh the risks of the design against its utility and the feasibility of safer alternatives. For warnings, the Supreme Court of Canada in Hollis v Dow Corning (1995) held that manufacturers have a continuing duty to warn of risks they know or should know about, including risks discovered after sale, with warnings that are clear, complete and current; where products reach users through a learned intermediary, such as a surgeon or an integrator, warning that intermediary may be enough in some circumstances. Alongside negligence, provincial sale of goods laws imply conditions of merchantable quality and fitness for purpose into contracts of sale, which give buyers strict contractual remedies against their sellers, and consumer protection laws in several provinces limit sellers' ability to exclude them.

Quebec follows a different model. Under the Civil Code of Québec, a manufacturer, distributor or supplier of a movable property is liable to third persons for injury caused by a safety defect in the thing, without the claimant having to prove fault, where the thing does not afford the safety a person is normally entitled to expect, considering defects in design or manufacture, poor preservation or presentation, or lack of sufficient indications of risks and how to avoid them. Defences include showing that the victim knew or could have known of the defect, and that the defect could not have been known given the state of knowledge when the product was made, provided the manufacturer was not neglectful of its duty to inform once it learned of the defect. Quebec's Consumer Protection Act adds strong warranty rights for consumers.

Robots, software and foreseeable misuse

Robot cases raise particular issues. The integrated system may be built from a robot, a gripper, sensors and safety components from different makers, assembled and programmed by an integrator, so courts must decide whose design was defective. Suits after workplace robot deaths have named the robot maker, the integrator, the maker of the safety controls and the designer of the line. Reasonably foreseeable misuse, covered in lesson 2, appears again: if workers predictably entered a cell through a gap to clear jams, a design that failed to address that predictable behaviour may be found defective even though entering was against the rules.

Software and learning systems blur traditional categories. Courts have historically been reluctant to treat pure information or software as a product, but software embedded in a physical robot is generally treated as part of the product, and courts are increasingly willing to apply product principles to software that controls physical behaviour. Over-the-air updates create continuing relationships: a manufacturer that can fix a known hazard remotely may be expected to do so, and an update that introduces a hazard can itself give rise to liability. The European Union's revised Product Liability Directive (EU) 2024/2853, which member states must apply to products placed on the market after 9 December 2026, explicitly treats software, including AI systems, as a product, makes manufacturers liable for defects arising from updates or lack of updates within their control, and eases the claimant's burden of proof in technically complex cases. Although it does not apply in Canada or the United States, it is likely to influence how North American courts and legislators think about AI-enabled robots.

Reporting duties and recalls

Manufacturers and sellers must monitor their products after sale, report serious incidents and defects to regulators, and correct dangerous products. Failing to report can lead to penalties that are separate from, and sometimes larger than, liability to victims.

For consumer products, the Canada Consumer Product Safety Act requires manufacturers, importers and sellers who become aware of an incident, such as an occurrence that resulted or may reasonably have resulted in serious adverse effects on health, or a defect or inadequate labelling that could do so, to notify Health Canada and the person who supplied the product within two days, and manufacturers or importers to provide a written report within ten days. Health Canada can order recalls and other corrective measures, and recalls are commonly carried out voluntarily in cooperation with the department. Medical robots follow the incident reporting and recall provisions of the Medical Devices Regulations, and vehicles follow the defect notice and recall provisions of the Motor Vehicle Safety Act administered by Transport Canada. For industrial robots, which are not consumer products, there is no general federal reporting duty, but provincial OHS laws require employers to report serious workplace injuries, and manufacturers who learn of hazards have a continuing duty to warn under negligence law.

A recall is a project: identify affected units and their owners, design and validate a remedy, notify regulators and customers, track completion rates and verify effectiveness. For connected robots, the remedy may be a software update delivered over the air, which can reach nearly every unit quickly, but regulators still expect the defect to be reported and the update to be validated. A robot fleet operator that discovers a safety problem can sometimes stop the hazard immediately by restricting speeds or operating areas remotely, a capability worth designing in from the start.

# Comparing a recall strategy: field retrofit versus over-the-air update plus speed restriction
units = 4200
p_injury_per_unit_year = 0.0008         # estimated with the defect present (illustrative)
cost_per_injury = 450_000               # average claim cost including defence (illustrative)
options = {
    "do nothing (not acceptable, shown for scale)": dict(cost=0, months_exposed=24, residual=1.0),
    "field retrofit of rear scanners":             dict(cost=units * 1900, months_exposed=6, residual=0.05),
    "OTA update + reversing speed limit":          dict(cost=120_000 + units * 15, months_exposed=0.5, residual=0.25),
    "OTA now, retrofit within 9 months":           dict(cost=120_000 + units * 1915, months_exposed=0.5, residual=0.05),
}
for name, o in options.items():
    exposed = units * p_injury_per_unit_year * o["months_exposed"] / 12
    after = units * p_injury_per_unit_year * o["residual"] * (24 - o["months_exposed"]) / 12
    expected = (exposed + after) * cost_per_injury
    print(f"{name:45s} programme ${o['cost']:>10,.0f}  expected injuries {exposed + after:5.2f}  expected claims ${expected:>10,.0f}")

do nothing (not acceptable, shown for scale)  programme $         0  expected injuries  6.72  expected claims $ 3,024,000
field retrofit of rear scanners               programme $ 7,980,000  expected injuries  1.93  expected claims $   869,400
OTA update + reversing speed limit            programme $   183,000  expected injuries  1.79  expected claims $   803,250
OTA now, retrofit within 9 months             programme $ 8,163,000  expected injuries  0.47  expected claims $   211,050

The comparison shows why combining an immediate remote restriction with a permanent hardware fix is often the best course: the restriction cuts exposure in the weeks that a retrofit takes, and the retrofit removes most of the residual risk. Expected-cost comparisons like this can inform planning, but they must never be used to justify leaving a known safety defect uncorrected. Juries have punished companies that appeared to weigh lives against repair costs, and regulators require correction of hazards regardless of cost.

Insurance and contracts

Insurance spreads the financial consequences of robot accidents. Robot manufacturers, integrators and deployers typically hold several kinds of cover, and customers and lenders often require proof of insurance in contracts.

Insurers price risk using claims history and risk information, so new robot types without history are hard to insure, and insurers ask detailed questions about safety standards met, risk assessments, testing, software update practices, cybersecurity and battery fire protection. Good documentation therefore lowers premiums as well as legal risk. Policies contain exclusions, such as for contractual liability assumed beyond what the law would impose, professional services under a general liability policy, or cyber events, and gaps between policies are common. Engineers should know which policies their company relies on so that they understand why documentation, change control and incident reporting matter commercially.

Contracts allocate risk between the parties to a robot project or sale. Typical clauses include warranties about performance and compliance with standards; disclaimers and limitations of liability, which are often capped at the contract price for commercial buyers but restricted by consumer protection law for consumers; indemnities, in which one party agrees to cover the other's losses from specified claims; insurance requirements; and clauses allocating responsibility for risk assessment, training, maintenance and software updates. Contracts cannot take away the rights of injured third parties, such as a member of the public struck by a delivery robot, but they decide which party ultimately bears the cost among the businesses involved.