Stock take: Legal groundwork laid for self-driving cars on UK roads

“It was enacted in 2018, but so far it just creates compulsory automated vehicle insurance. It’s really a three-year review of the regulatory framework for the safe deployment of automated vehicles,” said Jonathan Butler, the head of automotive at law firm Geldards and a member of the Vehicle Remarketing Association (VRA) board.

Legal specialists developing the AEVA have already published two consultation papers on autonomous vehicles, and a report from a third, which closed in April, is due later this year.

“It’s going to work out how [the law] will look, not just in terms of obvious safety, as in accidents and injury, but also in terms of cybersecurity and data privacy and making sure that liability issues are addressed,” explained Butler.

He said the consultations would initially look for “lacunas or loopholes” in the law, which would need to be addressed if autonomous cars are to be successfully rolled out.

Liability has long been one of the biggest hurdles for self-driving vehicles, with frequent questions about whether the manufacturer, the insurer or the person behind the wheel is responsible for accidents.

“It might be that the law treats automated vehicles like pets,” said Butler, “and there’s some kind of strict liability rule as would apply to owners of animals: if they cause harm, the owner or user bears responsibility.”

Cybersecurity is another area in which autonomous vehicles are subject to close scrutiny, because they rely on increasingly complex levels of connected technology, leaving them more vulnerable to hackers than cars of old, and this is yet another area that’s due to be addressed at a legal level.

During Autocar Business’s The Truth About Autonomous Cars live web broadcast last week, Thatcham Research director Matthew Avery pointed out that many manufacturers already work to established barometers, such as ISO 21434 (a cyber ecurity standard designed for road vehicles), but acknowledged that the risk would remain.

“The problem with cyber is that we really don’t know where the threat comes from [or] where the attack profile might be. Is [the safety standard] good enough yet? Probably not. But there’s certainly a lot of effort being put into it.”

Avery suggested that ransomware is one of the most likely types of attack. “A lot of cybercrime is for monetary gain, so you could maybe have ransomware so that vehicles can’t start,” he explained.

Butler took it a step further, saying: “You could have a message pop up on your dashboard saying ‘pay us £10,000 or I will turn your brakes off’.”

He added that the issue could become so pervasive that it would transcend individual legal issues and form part of wider regulation.

“I would go as far as to suggest that cyber resilience is going to feature quite heavily, even as part of the MOT [test]. It’s just like environmental issues and when emissions testing was introduced into the MOT [in 2018]. You’re going to have cyber resilience forming part of it, because this is ultimately not just an in-car entertainment issue; it’s a safety issue. That’s no different to having a faulty airbag.”

As legislation governing autonomous cars takes hold, England’s comparatively flexible legal system might in fact leave it in a better position than other countries, at least in a legislative sense. Codified legal systems, common in Europe, are typically black-and-white about laws and penalties. Although they offer certainty for cases with historically established circumstances, they’re allegedly less able to accommodate developing subject matter.