A fully self-driving car that causes an accident by its own machine-learned decision strains the classical tools of tort and criminal law: foreseeability-based causation doctrine, the strict liability of the keeper and of the producer, and the parties' unequal access to technical evidence. A 2021 analysis of Lithuanian law (Rimkutė and Povylius) concluded that the existing framework avoids a liability vacuum but left a residual core: courts will presume necessary causation as long as large-scale operational safety data are missing, the adequate-causation theory is partly insufficient for unforeseeable autonomous decisions, and the release-into-circulation moment for post-sale-updated software was unsettled. Between 2023 and 2026 the EU legislature settled parts of this bundle by statute: the new Product Liability Directive 2024/2853 expressly makes software a product and re-anchors liability for software updates, and the General Product Safety Regulation 2023/988 and the AI Act 2024/1689 formalize monitoring and corrective duties. However, the AI Liability Directive, which would have generalized evidentiary presumptions for AI-caused harm, was withdrawn in 2025. The surviving open core is the attribution problem itself: when an autonomous algorithmic decision counts as an unforeseeable intervening cause rather than being imputable to human omissions, and whether accumulating operational safety data can ground judicial findings of foreseeability.

Background

A fully self-driving car (SAE Level 4/5, the highest levels of driving automation) performs the entire dynamic driving task without any human fallback. Its behaviour is produced not only by code written in advance but by machine learning, that is, software that improves its own behaviour from accumulated experience; consequently, some of its driving decisions cannot be foreseen in concrete detail even by its developers. Rimkutė and Povylius, whose 2021 analysis of Lithuanian law is the source of the present problem, call such decisions "autonomous decisions".

Two strict-liability regimes govern civil compensation for a road accident in Lithuania, as in most of Europe: the keeper's liability for damage caused by a "source of increased danger" (Article 6.270 of the Lithuanian Civil Code, applying to the owner or lawful user of the vehicle), and the producer's no-fault liability for defective products (the Civil Code's producer-liability provisions beginning at Article 6.292, implementing Council Directive 85/374/EEC of 1985, with Article 6.294 setting the defectiveness criterion). A product is defective when it does not provide the safety a lawful user is entitled to expect; the producer may escape liability under the development-risks defence if the defect could not have been discovered given the state of scientific and technical knowledge when the product was released into circulation. Criminal liability, in contrast, requires fault and rests on the negligence concept together with causation doctrine: courts ask first whether the defendant's act or omission was a necessary condition of the harm (conditio sine qua non), and then, under the adequate-causation theory prevailing in Lithuanian criminal practice, whether the harm followed from that act in a regular, foreseeable way; an unforeseeable intervening factor breaks the causal chain and with it criminal liability.

These doctrines presuppose a human driver or a conventionally engineered machine. When harm is produced by a machine-learned decision, legal scholarship since Gless, Silverman and Weigend (2016) has warned of a "responsibility gap": harm that looks criminal is attributable to no one, because neither the programmer's coding nor any identifiable human act foreseeably produced the outcome. Rimkutė and Povylius answered with a two-branch model: (A) if the traffic situation in which the car took its decision was foreseeable at the most advanced technical level, the outcome is imputable to a human omission, for instance the producer's failure to update the software in time, and causation is necessary; (B) if the situation was objectively unforeseeable, the autonomous decision is an intervening factor that renders the causal chain accidental. On that basis they concluded that existing Lithuanian regulation suffices and creates no liability vacuum, while conceding that, until large-scale operational safety data exist, courts will in practice always presume necessary causation, and they proposed tying the "release into circulation" moment for software defects to each software update.

The legislative landscape has since been rebuilt on the product-law side. The new Product Liability Directive (EU) 2024/2853 repeals Directive 85/374/EEC with effect from 9 December 2026, expressly includes software in the definition of "product" irrespective of its mode of supply (including software-as-a-service), treats a substantial modification made through a software update or through the continuous learning of an AI system as a new placing of the product on the market, requires disclosure of relevant evidence, and introduces rebuttable presumptions of defectiveness and causation where the claimant faces excessive difficulties due to technical or scientific complexity. The General Product Safety Regulation (EU) 2023/988 obliges manufacturers who know that a product they placed on the market is dangerous to take immediate corrective measures, including withdrawal or recall, and to inform consumers and market-surveillance authorities; the Artificial Intelligence Act (Regulation (EU) 2024/1689) requires providers of high-risk AI systems, which include AI in vehicle type approval, to operate a post-market monitoring system. A parallel project failed: the proposed AI Liability Directive (COM(2022) 496), which would have created EU-wide rebuttable presumptions easing the victim's proof of causation for AI-caused harm, was officially withdrawn by the Commission in 2025. Outside the EU, the United Kingdom's Automated Vehicles Act 2024 grants a "user-in-charge" statutory immunity from liability for the manner of driving while the vehicle drives itself, shifting responsibility to authorised operators.

What the new EU acts settle is strict product liability and product safety. They do not touch national criminal law, the fault-based or keeper-based civil liability that Lithuanian (and other national) law applies outside product-defect claims, or the general distribution of the burden of proof in criminal proceedings. The question how a human court should attribute harm caused by an autonomous decision therefore survives the 2023–2026 legislative wave in a narrower, but still unresolved, form.

Problem Statement

When a fully self-driving car (a vehicle, such as an SAE Level 4/5 system, that performs the entire driving task without any human fallback) causes damage by an autonomous algorithmic decision — a driving decision produced by machine-learned software that could not be foreseen in concrete detail even by its developers — how should civil and criminal liability be attributed among the producer, the keeper (the owner or lawful user of the vehicle), and the operator or driving-service provider under Lithuanian law within its EU-law constraints — and which parts of that attribution can the existing legal framework deliver? In line with the source's own delimitations, the civil analysis is confined to consumer-related situations and excludes damage caused by a person driving in the course of employment or service duties; on the criminal side, attribution is examined through causation and negligence, and the subject-of-offence and punishment question, which the source excludes, is not part of the problem. After the 2023–2026 EU legislation has settled the classification of software as a product and the moment relevant to post-sale software updates for strict product-liability claims, the problem has two linked components:

(a) Causation and imputation. Under the adequate-causation theory applied in Lithuanian practice (under which harm is attributable to an act or omission only if it followed from it in a regular, foreseeable way), determine when an autonomous algorithmic decision operates as an unforeseeable intervening cause that breaks the causal chain, and when the harm is instead imputable to human omissions such as failure to update the software in time, insufficient testing, or inadequate monitoring. The source paper's two-branch answer (imputation to omission where the traffic situation was objectively foreseeable; an accidental chain otherwise, with necessary causation presumed as long as operational safety data are lacking) was asserted doctrinally, not tested against cases or against the post-2024 EU framework; whether it yields a workable, socially acceptable allocation remains undetermined, including for criminal liability, where EU harmonization does not reach.

(b) Empirical basis. Determine whether accumulating large-scale operational safety data, such as per-mile crash-rate comparisons between rider-only fleets and human benchmarks, can support judicial findings that a class of autonomous decisions was or was not foreseeable.

References

  1. Deimantė Rimkutė, Kristijonas Povylius (2021). Civil and criminal liability for damage caused by self–driving cars. Vilnius University Open Series, pp. 182–210. DOI 10.15388/tmp.2021.10, https://doi.org/10.15388/tmp.2021.10
  2. Sabine Gless, Emily Silverman, Thomas Weigend (2016). If Robots Cause Harm, Who Is to Blame? Self-Driving Cars and Criminal Liability. New Criminal Law Review 19(3), 412–436. DOI 10.1525/nclr.2016.19.3.412, https://doi.org/10.1525/nclr.2016.19.3.412
  3. Council Directive 85/374/EEC of 25 July 1985 on the approximation of the laws, regulations and administrative provisions of the Member States concerning liability for defective products. CELEX 31985L0374, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:31985L0374
  4. Directive (EU) 2024/2853 of the European Parliament and of the Council of 23 October 2024 on liability for defective products and repealing Council Directive 85/374/EEC. CELEX 32024L2853, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024L2853
  5. Regulation (EU) 2023/988 of the European Parliament and of the Council of 10 May 2023 on general product safety. CELEX 32023R0988, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32023R0988
  6. Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). CELEX 32024R1689, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689
  7. European Commission (2022). Proposal for a Directive on adapting non-contractual civil liability rules to artificial intelligence (AI Liability Directive), COM(2022) 496 final. CELEX 52022PC0496, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52022PC0496
  8. European Commission (2025). Withdrawal of Commission proposals, Official Journal C/2025/5423, 6 October 2025. CELEX 52025XC05423, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52025XC05423
  9. Automated Vehicles Act 2024, c. 10 (United Kingdom). https://www.legislation.gov.uk/ukpga/2024/10/contents
  10. Zhihua Chen, Qianyi Cai, Hanbing Wei (2024). Distribution of the Burden of Proof in Autonomous Driving Tort Cases: Implications of the German Legislation for China. World Electric Vehicle Journal 15(7), 305. DOI 10.3390/wevj15070305, https://doi.org/10.3390/wevj15070305
  11. Phuc G. Dao (2026). Attributing Liability for Autonomous Vehicles: EU Multi-Level Approaches and Implications for Vietnamese Law. Review of European and Comparative Law 64(1), 133–152. DOI 10.31743/recl.19473, https://doi.org/10.31743/recl.19473
  12. Yuanqi Luo (2025). Legal Challenges in Attributing Responsibility for Autonomous Driving Accidents. Current Research in Law & Practice 3(1), 41–54. DOI 10.53104/curr.res.law.pract.2025.07004, https://doi.org/10.53104/curr.res.law.pract.2025.07004
  13. Miriam C. Buiten (2024). Product liability for defective AI. European Journal of Law and Economics 57(1–2), 239–273. DOI 10.1007/s10657-024-09794-z, https://doi.org/10.1007/s10657-024-09794-z
  14. Martin Ebers (2025). Civil Liability for Autonomous Vehicles in Germany. In: Autonomous Vehicles and the Law. Brill Nijhoff, pp. 188–241. DOI 10.1163/9789004711891_007, https://doi.org/10.1163/9789004711891_007
  15. Kristofer D. Kusano, John M. Scanlon, Yin-Hsiu Chen, Timothy L. McMurry, Tilia Gode, Trent Victor (2025). Comparison of Waymo Rider-Only crash rates by crash type to human benchmarks at 56.7 million miles. Traffic Injury Prevention 26(sup1). DOI 10.1080/15389588.2025.2499887, https://doi.org/10.1080/15389588.2025.2499887
  16. Nidhi Kalra, Susan M. Paddock (2016). Driving to Safety: How Many Miles of Driving Would It Take to Demonstrate Autonomous Vehicle Reliability? RAND Corporation. DOI 10.7249/RR1478, https://doi.org/10.7249/RR1478
  17. Deimantė Rimkutė (2024). AI and Liability in Medicine: The Case of Assistive-Diagnostic AI. Baltic Journal of Law & Politics 16(2), 64–81. DOI 10.2478/bjlp-2023-0013, https://doi.org/10.2478/bjlp-2023-0013