Dissecting liabilities in adversarial surgical robot failures: A national (Danish) and European law perspective

TL;DR

This paper analyzes legal liabilities and safety/security failure taxonomy of surgical robots within EU law, highlighting how current legal frameworks address adversarial cyberattacks and safety issues affecting patients.

Contribution

It introduces a taxonomy for safety and security failures in surgical robots and examines how EU law addresses liabilities and rights related to adversarial cyberattacks.

Findings

EU law can effectively address security failures in surgical robots

Liability can be shifted from manufacturers via public law measures

EU law emphasizes patient rights and regulator powers

Abstract

Over the last decade, surgical robots have risen in prominence and usage. For surgical robots, connectivity is necessary to accept software updates, accept instructions, and transfer sensory data, but it also exposes the robot to cyberattacks, which can damage the patient or the surgeon. These injuries are normally caused by safety failures, as seen in accidents with industrial robots, but cyberattacks are caused by security failures instead. We create a taxonomy for both types of failures in this paper specifically for surgical robots. These robots are increasingly sold and used in the European Union (EU); we therefore consider how surgical robots are viewed and treated by EU law. Specifically, which rights regulators and manufacturers have, and which legal remedies and actions a patient or manufacturer would have in a single national legal system in the union, if injuries were to occur from a security failure caused by an adversary that cannot be unambiguously identified. We find that the selected national legal system can adequately deal with attacks on surgical robots, because it can on one hand efficiently compensate the patient. This is because of its flexibility; secondly, a remarkable absence of distinction between safety vs security causes of failure and focusing instead on the detrimental effects, thus benefiting the patient; and third, liability can be removed from the manufacturer by withdrawing its status as party if the patient chooses a separate public law measure to recover damages. Furthermore, we find that current EU law does consider both security and safety aspects of surgical robots, without it mentioning it through literal wording, but it also adds substantial liabilities and responsibilities to the manufacturers of surgical robots, gives the patient special rights and confers immense powers on the regulators.