Product liability, recalls and insurance

When a robot injures someone, the injured person may seek compensation, regulators may require the manufacturer to fix or withdraw the product, and insurers pay much of the cost. Product liability law, recall law and insurance together shape how robot makers design, test, document and support their products, often more powerfully than safety regulations themselves. This lesson explains the legal theories under which robot makers and suppliers are held liable, the duties to report and recall dangerous products, how software and AI fit, and the insurance and contracts that spread the risk.

Theories of product liability

Product liability claims usually allege that a product was defective in one of three ways: a manufacturing defect, where a particular unit departs from its intended design, such as a cracked gear or a miswired sensor; a design defect, where the design itself is unreasonably dangerous, such as a mobile robot whose scanner cannot detect people lying down when a practical alternative could; or a warning defect, where instructions or warnings fail to convey risks the user could not be expected to know, or how to avoid them. Countries differ in whether the claimant must prove fault.

In the United States, product liability is mainly state law, and most states apply strict liability in tort for defective products, a rule that began with Greenman v Yuba Power Products (California, 1963) and spread through section 402A of the Restatement (Second) of Torts. The Restatement (Third) of Torts: Products Liability (1998) distinguishes the three defect types. Manufacturing defects create liability without proof of fault. For design defects, most courts ask whether a reasonable alternative design would have reduced the foreseeable risks of harm at reasonable cost, a risk-utility test, while some states, notably California, also allow a consumer expectations test. Claims about warnings turn on whether reasonable instructions or warnings would have reduced foreseeable risks. Claims can also be brought in negligence and for breach of the warranties implied by the Uniform Commercial Code, such as merchantability.

Defenses matter as much as the theories. Comparative fault reduces damages when the injured person was partly to blame; misuse that was not reasonably foreseeable can defeat a claim; statutes of limitations and statutes of repose cut off claims after set periods; and compliance with government standards is evidence of reasonable care but generally not a complete defense. Federal preemption can bar some claims entirely: in Riegel v Medtronic (2008), the US Supreme Court held that state-law claims challenging the safety of a medical device approved through premarket approval are preempted, while devices cleared through the 510(k) process do not receive that protection under Medtronic v Lohr (1996). Injured workers generally cannot sue their employers because workers' compensation is their exclusive remedy, so claims after workplace robot injuries are often brought against the robot's manufacturer, integrator or component suppliers instead.

Robots, software and foreseeable misuse

Robot cases raise particular issues. The integrated system may be built from a robot, a gripper, sensors and safety components from different makers, assembled and programmed by an integrator, so courts must decide whose design was defective. Suits after workplace robot deaths have named the robot maker, the integrator, the maker of the safety controls and the designer of the line. Reasonably foreseeable misuse, covered in lesson 2, appears again: if workers predictably entered a cell through a gap to clear jams, a design that failed to address that predictable behavior may be found defective even though entering was against the rules.

Software and learning systems blur traditional categories. Courts have historically been reluctant to treat pure information or software as a product, but software embedded in a physical robot is generally treated as part of the product, and courts are increasingly willing to apply product principles to software that controls physical behavior. Over-the-air updates create continuing relationships: a manufacturer that can fix a known hazard remotely may be expected to do so, and an update that introduces a hazard can itself give rise to liability. The European Union's revised Product Liability Directive (EU) 2024/2853, which member states must apply to products placed on the market after 9 December 2026, explicitly treats software, including AI systems, as a product, makes manufacturers liable for defects arising from updates or lack of updates within their control, and eases the claimant's burden of proof in technically complex cases. Although it does not apply in Canada or the United States, it is likely to influence how North American courts and legislators think about AI-enabled robots.

Reporting duties and recalls

Manufacturers and sellers must monitor their products after sale, report serious incidents and defects to regulators, and correct dangerous products. Failing to report can lead to penalties that are separate from, and sometimes larger than, liability to victims.

For consumer products, section 15(b) of the Consumer Product Safety Act requires manufacturers, distributors and retailers to report to the CPSC within 24 hours of obtaining information that reasonably supports the conclusion that a product contains a defect that could create a substantial product hazard, creates an unreasonable risk of serious injury or death, or fails to comply with a mandatory standard. Late reporting has led to civil penalties in the millions of dollars. The CPSC negotiates voluntary recalls and can seek mandatory recalls. Medical devices follow FDA reporting under 21 CFR Part 803 and correction and removal reporting under Part 806, vehicles follow NHTSA's defect reporting and recall rules, and OSHA requires employers to report work-related fatalities within 8 hours and in-patient hospitalizations, amputations and losses of an eye within 24 hours.

A recall is a project: identify affected units and their owners, design and validate a remedy, notify regulators and customers, track completion rates and verify effectiveness. For connected robots, the remedy may be a software update delivered over the air, which can reach nearly every unit quickly, but regulators still expect the defect to be reported and the update to be validated. A robot fleet operator that discovers a safety problem can sometimes stop the hazard immediately by restricting speeds or operating areas remotely, a capability worth designing in from the start.

# Comparing a recall strategy: field retrofit versus over-the-air update plus speed restriction
units = 4200
p_injury_per_unit_year = 0.0008         # estimated with the defect present (illustrative)
cost_per_injury = 450_000               # average claim cost including defence (illustrative)
options = {
    "do nothing (not acceptable, shown for scale)": dict(cost=0, months_exposed=24, residual=1.0),
    "field retrofit of rear scanners":             dict(cost=units * 1900, months_exposed=6, residual=0.05),
    "OTA update + reversing speed limit":          dict(cost=120_000 + units * 15, months_exposed=0.5, residual=0.25),
    "OTA now, retrofit within 9 months":           dict(cost=120_000 + units * 1915, months_exposed=0.5, residual=0.05),
}
for name, o in options.items():
    exposed = units * p_injury_per_unit_year * o["months_exposed"] / 12
    after = units * p_injury_per_unit_year * o["residual"] * (24 - o["months_exposed"]) / 12
    expected = (exposed + after) * cost_per_injury
    print(f"{name:45s} programme ${o['cost']:>10,.0f}  expected injuries {exposed + after:5.2f}  expected claims ${expected:>10,.0f}")

do nothing (not acceptable, shown for scale)  program $         0  expected injuries  6.72  expected claims $ 3,024,000
field retrofit of rear scanners               program $ 7,980,000  expected injuries  1.93  expected claims $   869,400
OTA update + reversing speed limit            program $   183,000  expected injuries  1.79  expected claims $   803,250
OTA now, retrofit within 9 months             program $ 8,163,000  expected injuries  0.47  expected claims $   211,050

The comparison shows why combining an immediate remote restriction with a permanent hardware fix is often the best course: the restriction cuts exposure in the weeks that a retrofit takes, and the retrofit removes most of the residual risk. Expected-cost comparisons like this can inform planning, but they must never be used to justify leaving a known safety defect uncorrected. Juries have punished companies that appeared to weigh lives against repair costs, and regulators require correction of hazards regardless of cost.

Insurance and contracts

Insurance spreads the financial consequences of robot accidents. Robot manufacturers, integrators and deployers typically hold several kinds of cover, and customers and lenders often require proof of insurance in contracts.

Insurers price risk using claims history and risk information, so new robot types without history are hard to insure, and insurers ask detailed questions about safety standards met, risk assessments, testing, software update practices, cybersecurity and battery fire protection. Good documentation therefore lowers premiums as well as legal risk. Policies contain exclusions, such as for contractual liability assumed beyond what the law would impose, professional services under a general liability policy, or cyber events, and gaps between policies are common. Engineers should know which policies their company relies on so that they understand why documentation, change control and incident reporting matter commercially.

Contracts allocate risk between the parties to a robot project or sale. Typical clauses include warranties about performance and compliance with standards; disclaimers and limitations of liability, which are often capped at the contract price for commercial buyers but restricted by consumer protection law for consumers; indemnities, in which one party agrees to cover the other's losses from specified claims; insurance requirements; and clauses allocating responsibility for risk assessment, training, maintenance and software updates. Contracts cannot take away the rights of injured third parties, such as a member of the public struck by a delivery robot, but they decide which party ultimately bears the cost among the businesses involved.