Fundamental and Special Legal Questions for Autonomous Vehicles

Abstract

The “Autonomous driving on the roads of the future: Villa Ladenburg Project” by the Daimler und Benz-Stiftung looks at degrees of automation that will only become technically feasible in the distant future.

These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

1 Introduction

The “Autonomous driving on the roads of the future: Villa Ladenburg Project” by the Daimler und Benz-Stiftung looks at degrees of automation that will only become technically feasible in the distant future. The treatment of the legal questions in the present chapter therefore draws heavily on the description of the use cases (see Chap. 2), which begin to provide a concrete basis for evaluating individual issues. Uncertainties in predicting future technical developments can be expected and will have a commensurate impact on the assumptions and conclusions of this chapter. The resulting uncertainty is nevertheless unavoidable if one wants to press ahead with important interrelated issues. This chapter is therefore intended as a contribution to the debate on societal aspects of automated driving from a legal perspective and not as a legalistic evaluation of the subject. The consideration will largely focus on the situation within the context of current German law. The legal views expressed are those of the author and are based on nine years of experience in the field of driver assistance system research.

In terms of the underlying conception presented here, the societal dimension of autonomous vehicles addressed in the present project goes well beyond the adjustments to the legal framework currently being called for in Germany. The following will examine the question of “societal acceptance” in the context of the legal questions raised by autonomous vehicles. This line of investigation is not immediately obvious and covers only a segment of the more thoroughgoing focus of the project (see Chap. 29).

Autonomous vehicles will presumably only attain widespread success when their overall societal benefits exceed the damage associated with them [1]. This early hypothesis, asserted in regard to driver assistance systems, must be regarded in relation to the supremely important matter of traffic safety. The requirement would be fulfilled if overall traffic safety were improved through advancements in the vehicle technology (which, however, would not necessarily result in societal acceptance (see Chap. 29)). Even today it may be surmised that autonomous vehicles which are controlled on the basis of automated perception of the environment will not be capable of completely flawless operation. It may therefore be concluded that even with autonomous vehicles, there will continue to be individual severe damage incidents, which in extreme cases will include multiple human deaths. The societal acceptance of autonomous vehicles therefore necessarily depends upon societal acceptance of the consequences of these developments. From a legal perspective, the fundamental issue at hand is understanding and accepting the “effect of autonomous vehicles” in the public space as an independent “action” by machine. This situation in road traffic would indeed be totally new (other forms of transportation such as automated, driverless trains generally strictly implement the concept of separation between automated control and public space through physical barriers; there are, apparently, very few exceptions,¹ which, however, seek to exclude any resulting dangers by means of exhaustive safety concepts nearly completely see [2]).

The novelty of autonomous vehicles as effective actors in the public space of road traffic from a legal standpoint can be demonstrated—as will be attempted in the following—in order to highlight that societal acceptance of such a substantial change must indeed begin to take root (see Chap. 30) before it can begin to have an impact on the adjustment of relevant regulations.

2 Previous Work and Preliminary Considerations

To this author’s knowledge, the question of societal acceptance of driver assistance systems with machine perception was first raised by Homann [1] in the context of a working conference in October 2002. The contents of that paper can be applied to the present examination of autonomous vehicles. In this regard, it can only be concluded that the societal acceptance issue that was discussed at the time with regard to “new generation driver assistance systems” has yet to become anchored in the public consciousness as a “problem,” although the systems discussed back then have become available on the open market and sufficiently widespread to reveal the existence of any actual problems. This is presumably due to the fact that to date, spectacular negative effects resulting from such systems (as could be imagined in the case of emergency braking assistance, for example) have not been recorded. One reason for this could be that the systems do indeed function (almost) flawlessly. A more differentiated explanatory approach, however, is that any such interventions in the control of the vehicle only occur extremely briefly in very accident-proximate situations. This suggests the use of a technical variant that only intervenes when the evaluation of the environment recognition system determines a very high probability that an intervention is indeed necessary, thus reducing negative effects to a minimum. It must also be taken into account that the driver still has the duty to perform all requisite control functions. Thus the driver potentially remains available as a comprehensive fallback level in all cases of non-activation. The result of these considerations is the relatively minor significance of such functions not only in terms of their share of active time in the overall control of the vehicle but also with regard to the reliability expected of them. Such functions can therefore only be used in a very limited capacity in conjunction with independent or autonomous vehicle control systems: The subordinate significance and a tightly circumscribed “field of action” of a function lead to a strengthening of the driver’s role. This is presumably an important reason why the discussion regarding societal acceptance has not taken place thus far.

There is little reason to believe, however, that societal acceptance will play an equally minor role in the case of autonomous vehicles: If one takes the representative use cases used as the basis for the current project as a baseline (see Chap. 2), it becomes clear that they demonstrate a very high degree of automation. The “automated driving capability” of these use cases as a reference value is defined in greater detail in terms of “capabilities of perception, cognition, behavioral decisions and behavior execution” (see underlying definitions in Chap. 2). A machine-based “autonomy” of the vehicle emerges which makes it possible to speak of “driving robots” “as a subject … analogous to the role of the driver in the vehicles of today” (see Chap. 2). At this point it becomes clear that we are speaking of a very fundamental shift that will be accompanied by the introduction of such automated decisions in the public space.

Not much can be said about the question of societal acceptance of autonomous automated driving capabilities from a legal standpoint. However, what legal regulations will presumably reflect to a high degree is what can be regarded as amenable to consensus on the societal level—an assumption which can be regarded as justified, at the very least where individual regulations are not discussed and scrutinized by a wide swath of the public. Comparing autonomous vehicles with current law shows that the spirit of current regulations does indeed not cover independent “performance” by machines in the public space (understood as behavioral decisions and behavior execution as a new sense of automated action; see above).

Laws should be abstractly/generally applicable to all life situations. This maxim also fundamentally applies to the stipulations of traffic law. But when changes to the realities of life emerge which cause previously fundamental presumptions to lose their validity, as would be the case in the eventuality of autonomous vehicles with decision-making capacities in the public space, this can only be represented through an application of the law. It is possible to precisely describe the emergent change and bring the overarching fundamental values of our society—such as basic rights—into the argument, which can provide a framework which will presumably outlive the changes and set the parameters for development.

3 The Current Traffic Situation as a Starting Point

Fundamental state duties even with regard to road traffic accidents can be traced back to the constitution. In view of the hazards associated with road traffic, the basic rights relating to life and physical integrity [protected by article 2, paragraph 2, clause 1 of Germany’s Fundamental Law (GG)] are paramount. The scope of protection afforded by the basic right to life includes protection for all (universal fundamental right) not only against targeted homicide, but also against behaviors that may unintentionally (unintended interventions such as the effects of accidents) cause death. The state’s duty to provide protection is comprehensive and also affords protection against illicit interventions by third parties. This ultimately leads, where interventions cannot be justified, to a state duty to prohibit such interventions, for example by establishing rule of law [3].

Here a discrepancy between the realities of life in society and constitutionally grounded rights comes into focus. Notable in particular is the fact that “traffic safety [is barely discussed], although the still large number of traffic deaths and permanently severely injured accident victims provide ample reason to do just that” [3]. Indeed, in the media major traffic accidents are regularly treated as relatively insignificant matters of merely regional interest. The phenomenon that emerges from this view, namely that the dangers associated with the current traffic situation, excites so little interest and plays such a minor role in the socio-political discussion [4], which can at least be seen as an indicator of broad societal acceptance of this state of affairs.

At the same time, the duty to protect vis-à-vis the “risks of technology” is critically important with regard to road traffic as well. Statistics are recorded on (severe) road traffic accidents (as per section 5, paragraph 3 of the Law on the Statistics of Road Traffic Accidents (StVUnfStatG), with research conducted by the Federal Highway Research Institute), which enables precise monitoring of traffic safety trends and accident causes (bearing in mind that the number of road traffic deaths has shown an overall decline for many years). Yet the significance of traffic safety extends far beyond this as a critical factor in traffic policy overall, including in (but not limited to) the establishment and adaptation of traffic-related (driver permission, vehicle technology, behavioral and many other) legal regulations, but also in the design of roadways, road maintenance, road equipment, and so on. In spite of these various efforts and ongoing improvements, the status quo of 3339 deaths and 374,142 injuries (in Germany in 2013) remains a reality with which no one can truly be satisfied.

Finally, from a very fundamentally legal perspective, the question arises as to the constitutional rationale for these interventions in the fundamental rights to life and physical integrity. It can be argued on the basis of the mobility requirements of other fundamental rights-bearers associated with motor vehicle traffic and their willingness to subject themselves to the concomitant hazards of such traffic on account of the benefits associated with it. But even that is not universally valid, in particular if one considers that the dangers that flow from motor vehicles, in view of the considerable operational hazards in comparison to non-motorized traffic participants, does not allow for any utterly unambiguous argumentation: While with motorized traffic participants it can be argued that they are prepared to accept the increased danger associated with motor vehicles which they themselves create, this cannot be extended to pedestrians or bicyclists [3]. That said, pedestrians and bicyclists, with 557 and 354 deaths, and 30,897 and 71,066 injuries, respectively (for 2013) [5], represent a significant share of all road traffic accidents in Germany.

Nevertheless, it seems probable that across broad sections of the public, there will be a significant degree of consensus that the consequences of road traffic are acceptable in view of the mobility needs of society. If one were to venture the thought experiment of imagining significant limitations of motor vehicle traffic in the interest of improving traffic safety, this would at the same time mean failing to take account of some other important societal needs: Immediately effective (radical) changes would obviously be associated with substantial limitations on individual (motorized) mobility, as well as (and not only) the general freedom of action protected in the Basic Law under section 2, paragraph 1 GG). Because such an approach would be extreme, its proportionality comes under scrutiny: Identifying any such measures which would be suitable to the task in view of roadway driving of a total of 724 billion kilometers (in 2013 in Germany) [5] and yet not result in severe consequences for the economic development of the country, the ability of people to carry out their jobs, the provision of public services and much more, is virtually inconceivable. Against this backdrop, the probability of a majority being in favor of restrictions with regard to motor vehicle traffic is low. The currently practiced approach of continuous improvement of traffic safety thus emerges—as the positive development heretofore attests—as successful, realistic and exemplary. The aforementioned appeal from a constitutional standpoint for a more vigorous debate on traffic safety does not in itself call into question the existing legal situation with respect to road traffic, but instead highlights, at this stage, the importance of traffic safety efforts in this context.

But if one carries the pursuit of causes of the comparatively poor performance of road traffic compared to other forms of transportation, it is worthwhile to consider a fundamentally unique factor with regard to road traffic. With the legal definition of roads as “public goods in public use … [which] are made immediately available to the public for the established purpose without special permission”, including recognition of roads as a “multi-purpose institution” [6], attention is rightly drawn to a characteristic in which road traffic as we know it today—including the associated accidents—is rooted. As public goods in public use, roads exist not only for the purpose of changing locations (traffic in the narrower sense), but also serve to enable commercial and communicative traffic (traffic in a broader sense) [7]. Ultimately this definition of the purpose of “roads” gives rise to a multiplicity of traffic situations understood in terms of diversity of traffic participants, traffic scenarios, sudden, unexpected events and conditions and developments between traffic participants on roads. A comparable variety of possible interactions in which nearly the entire population is involved in some form or another and which would be associated with a comparable risk of injury is not to be found in any other area of life. Roads therefore have a multifarious function which typically is not the case for the space occupied by other forms of transportation. This functional diversity has a significant impact with respect to the circumstances that must be considered in the context of vehicle control: The requirements for the safe conduct of the driving activity are complex and diverse in nature. The driver of a motor vehicle is called upon to perform comprehensive perception of the traffic situation, make decisions and execute appropriate actions on that basis, particularly with regard to hazard recognition. In terms of the legal framework, at present this task is primarily regulated through laws governing behavior and driving license requirements. Just what significance the diversity and complexity of the task when performed by an automated vehicle control apparatus will take on in terms of legal categories will be examined in the following sections.

4 Assessing Autonomous Driving

Against this backdrop, this project on “autonomous driving” raises the fundamental and far-reaching legal question as to how autonomous vehicles could be integrated into this agglomeration of factors in legal terms. A starting point for answering this question—as mentioned above—would be to re-examine and describe the characteristic of such vehicles as “driving robots” or “subject” analogous to the driver (see Chap. 2) and lay out the associated consequences of such an approach for real-life situations.

4.1 Current State of Driver Assistance Systems Available on the Market

To date, an action and decision quality exists only in the case of human action (which always exists at least in the sense of the driver’s own perception and decisions—or at least in the sense of a continuous duty in this respect). In fact this is the still current minimum requirement in terms of driver participation in controlling the vehicle: Current driver assistance systems in a broader sense can only aid the driver in controlling the vehicle, not act as a replacement. At the present moment (August 2014), a division of labor between the driver and the driver assistance system would be possible involving active control of the longitudinal and lateral steering of the vehicle (on the basis of independent, automated environment perception). But this control system currently possesses no independent decision quality: Rather, it is predicated at all times on the driver’s immediate intervention and resumption of control of the vehicle if required for whatever reason—for instance due to faulty perception of the environment by the system. Thus the driver maintains a superordinate role and responsibility, making the vehicle control by the system appear derivative and subordinate. From a technical view of this division of labor, this is currently absolutely necessary, as the driver assistance systems currently available on the market are not capable of independently recognizing that all system limits have been reached. One characteristic warning (of several) in the instructions for the “DISTRONIC PLUS” system (an adaptive cruise control and thus a longitudinal control system of Daimler Corp.) reads as follows (as of August 2014):

WARNING

DISTRONIC PLUS and the active blind-spot assistant are only aids designed to assist you while driving.

They cannot act as a replacement for your attention. Responsibility for regulating the distance to other vehicles, for the driving speed and timely braking rests with you. Always pay attention to the traffic situation and your environment. Otherwise you might recognize hazards too late, cause an accident and injure yourself and others. [8]

From this warning—which can be found in similar form with other currently available driver assistance systems—illustrates very clearly that the system can only assist the driver if the driver maintains uninterrupted attention to his/her own perception of the traffic situation. All of the control processes automated by the system must be checked by the driver and overridden as needed through appropriate control actions by the driver.

Driver assistance systems are therefore described from a control engineering perspective as a “redundant-parallel” form of the division of labor combined with the same tasks [9]. This description in terms of division of labor is indeed appropriate from a legal standpoint, but does not say anything about where decision-making authority lies in case of contradictory performance of the task. With current driver assistance systems, the authority to override the driver assistance system at any time always rests with the human driver. The proper use of the system that emerges from the operating instructions is always directed towards observing and assuring the proper performance of the system and making appropriate changes if the system is not acting as it should.

If the longitudinal and lateral control of a vehicle—i.e. the two fundamental aspects of the driving function in terms of control—are both automated at the same time, this division of labor is described as partially automated [10]. This does not change the fact, however, that such systems are not capable of recognizing system limits on their own and are thus necessarily subjugated to the redundant-parallel perception, decision-making and action of a human driver (understood as performance of authority in the spirit of “override in the case of any recognizable need”). Thus with respect to automation which is subject to monitoring by the driver, the aspect of “authority” attains the legally decisive significance.

The result, then, is that with regard to the driver assistance systems on the market to date, there is never an independent, but only a derivative action and decision quality residing in the vehicle control system, which only occurs under the complete authority of the driver, who continuously monitors it according to regulations.

4.2 Autonomous Driving

The matter is fundamentally different in the case of autonomous driving, which is examined here by means of four representative use cases (see Chap. 2). All four use cases envision a driving robot that assumes the vehicle control function. Even the “Interstate Pilot Using Driver for Extended Availability” use case, which clearly recalls current driver assistance systems, does not indeed require that the “driver” actually perform any functions during automated driving that would correspond to our current definition of a “driver”. This emerges in the clear formulation that the driver “becomes a simple passenger during automated driving”.

Thus autonomous driving essentially envisions a situation in which the redundant-parallel performance of tasks by the driver and the system gives way to—potentially temporally and spatially delimited—independent automated vehicle control by the system. The person now fittingly referred to merely as the “vehicle user” does still retain a “dominant” intervention capability in the aforementioned “Interstate Pilot” use case, which does not fundamentally differ from the “authority” in the case of driver assistance systems described in Sect. 25.4.1. However, the basis for performance is rather likely to be lacking: As soon as the role of the driver changes so dramatically that not only performance of the task but also observation of the traffic situation and the evaluation of the automated control decisions which are based on it are dropped, the significance of this “dominance” or “authority” is inevitably limited. Thus even where the vehicle user is paying attention to the situation, there is de facto no basis for performance of this “dominance” or “authority”. In the case of the two use cases distinguished by the spatial absence of the vehicle user (see the “Autonomous Valet Parking” and “Vehicle on Demand” representative use cases in Chap. 2), the lack of a basis for actually exerting “dominance” or “authority” is even more evident.

The lack of a basis for immediate observation of the traffic situation as a starting point for vehicle control can only be interpreted as de facto independence or “autonomy” of the automated control system. The therefore decisive significance of the autonomy of the automated vehicle control system in the present context has naturally found its way into the name of the underlying project.

5 Fundamental Legal Questions vis-à-vis Autonomous Driving

Legal questions related to autonomous driving cannot, as touched on in Sect. 25.2, adequately, let alone exhaustively, be addressed in terms of the current legal framework. The reason for this is that in their creation and ongoing development, the legal bases of road traffic law could only take account of considerations that were in need of regulation at a given time. In the field of public road traffic, the question of autonomous vehicles has not arisen thus far—including in the context of driver assistance systems currently available on the market (see Sect. 25.4.1): Heretofore it could always be assumed that a driver would execute vehicle control at least in the sense of redundant-parallel task performance. If one looks at autonomous driving, by contrast, there is a shift of fundamental significance towards independent automated vehicle control.

5.1 Risks of Automation

For autonomous vehicles, it is assumed that “hardware failures and software failures … [can] also occur with autonomously driving vehicles,” although such vehicles developed “with state-of-the-art technology” are classified as “at least as reliable and safe … as current conventional vehicles are.” The following considerations also demonstrate, however, that there is a great deal of uncertainty in this regard since the “success rate” in terms of vehicle control is assumed to be “similar to the quality and success rate of human drivers”, but at present this represents only a conservative expert opinion which can only serve as a basis for discussion for the present project (see Chap. 2). Thus the performance of automated vehicle control systems cannot be definitively assessed; it may be assumed, however, that the risk of automation will remain, but at the same time will not be higher than the risk resulting from human vehicle control.

5.1.1 The Automation Risks Against the Backdrop of Fundamental Rights

If we now examine the aforementioned potential automation risk in light of the situation of today’s road traffic as it pertains to the fundamental rights to life and physical integrity (see Sect. 25.3), it becomes clear that the shift from human control to automated vehicle control would presumably be regarded as “critical to the exercise of fundamental rights” [11]. Due to the significant intervention that any such new automation risk would mean with respect to the fundamental rights to life and physical integrity, it must be regarded as probable that a decision regarding the allowance of automated vehicles and thus of an automation risk flowing from automated control systems in road traffic would fall under the purview of the legislative authority. The lawmaking body would bear the duty of making key decisions itself, flowing from the democratic principle and the rule of law. The critical provisions for the protection of fundamental rights should therefore not be left in field of action or decision-making authority of the executive [12]. This argumentation places the focus squarely on the novelty of such an automation risk because it would revolutionize vehicle control in general. At the same time, it must be acknowledged that the most realistic scenario for the introduction of automated vehicle control is gradual, step-by-step implementation by means of continual improvement of driver assistance systems available today (see Chap. 2). This raises the question of whether the transition to automated vehicle control will still be regarded as “critical” at the time when the decision is actually made. The Federal Constitutional Court has traditionally been rather restrained with respect to the parliamentary prerogative regarding the fundamental rights to life and physical integrity and has been satisfied to let questionable types of risks to life be covered by the legislative will expressed in the atomic energy act (Atomgesetz) [3, 13] (more specifically the “breeder technology” in that case). It is also not necessary to explicitly name the risks and consequences of road traffic that impact the fundamental rights to life and physical integrity (so there is no unconstitutionality of the road traffic act (StVG) flowing from this alone in current practice) [13]. Thus the question remains whether the road traffic act in its present form can encompass the novel quality of automated control. At the time of this writing (August 2014), the novelty and independence of the automated decision quality raises considerable doubts.

Should the underlying assumptions and relationships prove correct, the question of allowing for an automated control risk in public road traffic would have to be regulated by formal law (the so-called proviso of formal law). The legislator would be free to permit risks that remain “below the danger threshold” and which can therefore be justified, also in the light of freedom on the part of the person who causes the risk. However, the legislator is not restricted to this and can also become active below the danger threshold as a means of minimizing risk, insofar as this is still considered proportionate under constitutional law [3]. In terms of the magnitude of a potential automation risk, then, it seems—not least in view of the indicative effect of the situation in current road traffic—realistic to presume a level of safety and thus also regulatory authority on the part of the legislator that remains within the scope of “at least as reliable and safe as current vehicles” (see Chap. 2).

5.1.2 Liability of the Product Manufacturer for Autonomously Operating Vehicle Control?

Product liability on the part of the manufacturer with fully-automated systems (see Chap. 2 for classification of the present use cases as “fully automated”) could be determined in large part through the intended use of the product as defined by the manufacturer. Insofar as system functions—as in the case of full automation—no longer envision a necessary role for the driver with regard to vehicle control, it could in turn be concluded that the acceptance of prima facie evidence in the event of accident damage is proper: If (accident) damage occurs in the course of automated driving, the question arises whether this can be attributed causally to an underlying product defect (insofar as the relevant cause is not due to an intervention by the driver in the form of an override action or exclusively the result of improper behavior on the part of another traffic participant—all within the context of the applicable burden of presentation/proof in civil suits) [10]. In the final result, the decisive question would be whether an incorrect automated control decision could ultimately be classified as a product defect and thus that in practically all cases of incorrect control, civil liability on the part of the manufacturer could be assumed.

In that case, the manufacturer—in addition to the vehicle owner (see also [10])—would (almost) always bear the liability risk with respect to civil law for the automation risk associated with the automated action. In view of the expanded possibilities for intervention of automated vehicle control (see Sect. 25.5.2 for more on this), the scope of application for control-relevant errors would actually even expand vis-à-vis the driver.

Whether this conclusion is appropriate, however, is another question: To a great extent, the argumentation follows the assumption that the cause of accidents today is regularly due to improper control decisions on the part of the driver. However, the (in future potentially automated) vehicle control may represent only one of multiple possible accident causes.

Current road traffic law still seems to be shaped by a different fundamental understanding. This becomes clear for instance in the current edition of the road traffic act, which presumes the existence of “unavoidable events” (which in section 17, paragraph 3 of the road traffic act (StVG) still play a role in assigning the respective shares of responsibility for damage between motor vehicles). It must be emphasized, however, that of the cases currently encompassed by this, from a purely scientific standpoint and in consideration of the current state of technical capabilities it may be presumed that only some of these incidents will in future be considered “unavoidable”. Even so, to date the understanding of this legal term is only limited insofar as the “the greatest possible care” and the “behavior of an ‘ideal driver’” in terms of average performance expectations (as opposed to an imputed “super-driver”) are sufficient [14]. (There is evidently a different underlying idea here: the question as to responsibility for an accident, not scientific causality for its occurrence).

Consistent application of the question of scientific causality could mean that only a subsection of damages occurring during automated vehicle control would in fact be traceable to a defective control system (or some other product defect). This would ultimately fundamentally call into question the aforementioned inference of damage due to the existence of a product defect during automated control. The open question in this context is therefore to what extent the current “road traffic system” represents an independently relevant cause for accident damage (vis-à-vis control decisions that might be automated).

5.2 “Dilemma Situations”

In the context of the legal discussion, the suggestive term “dilemma situation” encompasses two interconnected aspects which can pointedly describe the characteristic properties of automated action and illustrate the consequences of a worst-case scenario of such a transformation with exceptional clarity: first, the expansion of the scope of intervention in the control of the vehicle in time-critical situations and second, the question as to the implementation of an automated control decision within the scope of fundamental rights.

To begin with, we must fundamentally question the existence of “dilemma situations” in road traffic. It is particularly unclear whether the underlying thought model of unavoidability is compelling. In road traffic, individual cases provide diverse, discreet and strongly situation-dependent opportunities to intervene in vehicle control. Preceding alternative control decisions in road traffic thus offer—potentially, this would have to be examined in greater detail—the possibility of taking action to prevent the occurrence of an unavoidable situation in which damage was inevitable. It would seem, then, that the possibility of preventing unavoidable situations through anticipatory vehicle control behavior cannot be excluded. On the other hand, it could turn out that certain hazards in road traffic arise from its very nature and are indeed not avoidable (for example due to the plenitude of possible interactions of differently protected traffic participants). In exceptional cases, the potential coincidence of two possible damages would then need to be assumed realistic, requiring a consideration of “dilemma situations”. In legal categories, the question as to relevant accident causes is thus brought up which is subject to scientific determination both in terms of internal (vehicle control-dependent) and external (traffic system-dependent) factors.

Irrespective of the result of this theoretical examination of vehicle control in road traffic, discussion-worthy aspects emerge from the consideration: Using “dilemma situations” makes it possible to delineate a framework with respect to fundamental rights for automated control decisions. If one presumes the existence of “dilemma situations”, it also emerges that a limitation of the manufacturer’s responsibility could be called for in these cases because damages due to control actions would then be just as unavoidable as they would be in the case of the existence of independent risks flowing from the “road traffic system” per se (see Sect. 25.5.1).

Finally, it should be noted that “dilemma situations” are also addressed in various forms in the discussion of ethical aspects, where they are likewise used as a means of illuminating and examining the overarching ethical considerations (see Chap. 4).

5.2.1 Expansion of the Scope of Influence

The conceptual model of “dilemma situations” for autonomous vehicles is based on the working hypothesis that certain acutely accident-proximate situations could still be affected by the use of automated vehicle control: In many cases it could therefore be possible to “save” materially endangered legal interests literally at the last second. With the current state of technology (and exclusively human vehicle control), these situations always require consideration of the driver’s reaction time [14]. The thus delayed control action can, depending on the case, influence the occurrence of an accident or its consequences. In fact this working hypothesis, taken in the context of a transition to automated control decisions, is by no means far-fetched. Further, it may also be assumed that another benefit could be achieved, namely that an automated control system could consider alternative control options, such as avoiding rather than braking for an acutely endangered pedestrian, which average drivers seldom succeed in doing [15]. One salient working hypothesis underlying the “dilemma situations” is therefore that automated vehicle control could lead to controlling traffic situations which were previously uncontrolled or only controlled after a delay.

5.2.2 The Automated Control Decision

A further assumption in the “dilemma situation” conceptual model which builds on the preceding takes account of the novel automated “decision quality” of an autonomous vehicle control system. This point of view is explicitly expressed in the designation of the “driving robot” as a “subject” which is revealed—with all due care in this regard—in the underlying definitions of the current project (see Chap. 2). In order to highlight this effect and argue the ethical dimension of automated control decision-making, a decision dilemma is brought in to accentuate the underlying quandary. This amplification is not to be regarded as a completely unrealistic scenario and worthy of discussion per se because it deals with the societal acceptance of a wide-ranging decision-making quality which is hereby brought into focus. This automated decision-making quality can, in individual cases—as constructed in the “dilemma situations”—impact the right of the (acutely endangered) individual to life and physical integrity and is thus not fundamentally different than in the case of the hazards affecting fundamental rights in road traffic as it exists today (see also Sect. 25.3). The major difference lies only in the underlying automated control.

5.2.3 Critical Analysis of the “Dilemma Situation”

In any theoretical analysis of the possible consequences of automated control decisions, it is only possible to do justice to the matter if it is made clear that the “dilemma situation” in the form of the “decision dilemma,” insofar as it exists at all, represents an absolutely exceptional case. In the interest of proper assessment, it must therefore be stated at the outset that this could only be an exceedingly rare exception.

The assumption underlying the dilemma is that there is no alternative to damaging two essentially equivalent objects of legal protection in a concrete individual case although the automated vehicle control system has taken all alternative possible control decisions into account. But even if in the concrete situation—in consideration of the control behavior prior to the hazard becoming acute—there were no alternative to damage, relevant alternative causes to the control behavior in the antecedent causal chain could be considered. It therefore seems plausible to assume that dangers may not reside exclusively in the vehicle control, but indeed inhere in the nature of road traffic in itself and thus flow from the complexity and variety of possible situations in the “road traffic system” as described in Sect. 25.3. This seems particularly probable where one considers the influence of driving speed, for example, which in most cases presumably represents a necessary cause (in the scientific sense) in the occurrence of traffic accidents. But the “normal” driving speed is also simultaneously a component of the current understanding of the “road traffic system” and indeed largely defines it in some parts. The image of today’s road appears decidedly risky in individual cases: It is therefore appropriate to question whether in individual situations—for example when driving past a pedestrian—a risk exists [16] that could be adapted to address existing accident risks in road traffic.

5.2.4 “Dilemma Situations” Against the Backdrop of Fundamental Rights

The legal evaluation of “dilemma situations” should take its starting point in the overarching legal framework, the fundamental rights. In the area of fundamental right to life and physical integrity nothing of fundamental significance changes due to the transition from human vehicle control to automated agency. In particular, it does not give rise to a “targeted” intervention in life or physical integrity, which in light of the importance of these objects of legal protection as the highest value and their fundamental significance would be impossible to justify for all practical purposes [3]. While every control decision is predetermined under particular external conditions by the programming of the respective system and thus is not random, as will need to be discussed in the context of product liability as well, this does not in fact represent the specification of a particular course of action. Rather, the programming of an automated driving function (only) specifies which factors should be taken into account so that among multiple alternatives, the one which completely avoids damage, if possible, or causes the least damage, can be selected. It is particularly this situation-dependent consideration of alternative courses of action which represents the decisive added value of automated vehicle control, which was described as “Expansion of the scope of influence” through automated control in Sect. 25.5.2.1. Thus in the context of programming, no actual control decisions are made, but (only) abstract criteria for control decisions in individual cases specified. This illustrates that ultimately it is still an abstract risk that is posed by automated control in road traffic. In terms of the fundamental rights, automated control would therefore not be handled differently than human vehicle control, which poses the risks presented in Sect. 25.3. Thus the associated unintentional damages to objects of protection (see [3]) which are equally caused by accidents under automated control in road traffic where an automation risk is assumed (see Sect. 25.5.1) should not be evaluated any differently than current risks in road traffic from the standpoint of the fundamental right to life and physical integrity.

One aspect, however, should be given particular attention from a fundamental rights perspective: If it emerges that automated perception of the environment is sufficient to recognize non-motorized traffic participants (pedestrians and bicyclists) as such, their protection would have to be given particular weight in the action variants established to handle such situations (see the argumentation in Sect. 25.3).

The decision dilemma described by the term “dilemma situation” between two equivalent objects of legal protection cannot be resolved, however, against the backdrop of the fundamental right to life and physical integrity: any trade-off between two equivalent values or, with regard to life, “absolute” fundamental right of other fundamental rights-bearers in terms of constitutional protection [3] is absolutely impermissible. From a legal standpoint, therefore—if one assumes the actual existence of such “dilemma situations” in reality—there can be no contribution in the sense of a decision flowing from the current state of the fundamental rights dogma; rather, a novel question in need of an answer would be raised. It would therefore be of some importance to clarify the question of whether “dilemma situations” actually occur in this manner, and in particular whether the relevant cause of their occurrence can actually be traced back to the automated control decision and not to some inherent risk within the “road traffic system”—for example due to the driving speeds in certain situations (see also Sect. 25.5.2.3). If it emerged that “dilemma situations” exist and that their relevant cause resides in automated control, it would be essential to make this question transparent and—presuming societal acceptance of an automation risk—conduct a debate about it. It would presumably be necessary to create a catalog of recognized decision criteria for such situations.

In all of this it would be essential to bear in mind that the question only arises in the first place through the expansion of the scope of intervention (see Sect. 25.5.2.1), which in most cases without a “dilemma” would lead to an improvement over the current situation. The scientific comparison of the automated decision dilemma with the driver of today will in all likelihood demonstrate that in otherwise identical situations, the driver is not regarded as culpable, not least in consideration of the moment of shock accorded to the driver (see [14]). There is likewise no distinction between the scenarios with regard to “dilemma situations” in that damage occurs in either case. The reason for addressing the question would thus be due to the decidedly welcome development that technological advancements had made it possible to influence such situations and thus to save acutely endangered objects of legal protection. The weight of this argument will presumably carry the day in the end.

5.3 Possibility of Override by Passengers

The question of an override possibility of vehicles results from past discussions on driver assistance systems, which in large part draws on the concrete formulations of the Vienna Convention on Road Traffic of 1968 [17], which is still valid as of this writing (August 2014). Although this was not specifically mentioned, the underlying thought is nevertheless related to the question as to the duties of the driver in case of fully-automated vehicle control, which with respect to the applicable law in Germany has been described as contradictory [10]. The context can be described in terms of the concept of “dominance” or “authority”, which was taken as a basis in the “use cases” discussed in the present project (see Chap. 2). All four representative use cases envision a role for the driver or passenger in vehicle control, which diminishes as the scope of autonomy rises since other factors must be given precedence in the context of functional implementation. Even the representative use case examined here with the lowest degree of autonomy, the “Interstate Pilot Using Driver for Extended Availability” use case envisions that the driver “becomes a mere passenger during autonomous driving” such that he/she “[can] pursue another activity”. Thus even here there is a complete lack of a basis for an override capability at any time, which from the outset has always been regarded as factually (and not just technically) necessary. The factual override possibility by the driver was a reformulation of the initially uncontroversial “final decision authority of the driver” in driver assistance systems. This represented the subordinate role of driver assistance systems vis-à-vis the driver in vehicle control, where the system was regarded as having only a derivative authority to act and take decisions (see Sect. 25.4.1). Autonomous vehicles call this entire situation into question, such that it seems inadvisable to derive interpretations for future application from regulations that assume a human driver is taking part in vehicle control. This fundamental shift to independent automated action is already described in Sect. 25.4.2.

With regard to fundamental rights, however, one aspect does bear a brief mention: The liberties of passengers of autonomous vehicles specified in art. 2 of the German Fundamental Law provide an overall framework which—to the extent relevant in the present case—applies in particular to the right to personal mobility and personal freedom (see [3]). The limitations on these liberties resulting from autonomous vehicles do not seem as of this writing to have been fundamentally called into question, as long as the passengers always have the possibility of causing the vehicle to stop at the nearest safe and appropriate location.

5.4 Error Compensation Capability in Autonomous Driving

A “basic presumption” of the present project is that the use cases are deployed at the considered time in a mixed operation of transportation systems with different levels of automation ... ranging from “driver-only” to “assisted” to “fully automated” (see Chap. 2). This leads to the requirement that autonomous vehicles integrate in the existing traffic system.

In the case of conventional vehicle control, as in the case of currently available driver assistance systems (in the broadest sense), which never enjoy actual autonomy (see Sect. 25.4.1), the German road traffic regulations (StVO) are applicable without exception. Drivers thus find themselves confronted with conflicting priorities of the “principle of trust” and “defensive driving”. The “Principle of Trust” means that properly behaving traffic participants under normal circumstances do not need to take all possible (rare) traffic violations by others into account as a preventive measure. The “Principle of Trust” is necessary to maintain traffic flow. At the same time, the driver is called upon to “drive defensively” (to contribute to traffic safety) and thus apply more than the prescribed care (which in fact means partially hedging one’s trust in the proper traffic behavior of other drivers) without this “fundamentally” undermining the principle of legitimate expectation [14]. Just how these requirements are understood in individual cases, could be inferred from court rulings in Germany. However, the continental European norm of systematized statutory law can provide but a degree of orientation in this regard, but no precedence for individual cases, which ultimately means that the value of any such aggregation of rulings is limited.

It must therefore ultimately be required of “mixed operation” vehicles that they meet (at least) the same standards required of drivers in order to ensure that they do not, at the minimum, cause any new hazards. In a precise description of the requirements on an error compensation capability, it must be noted that a significant degree of imprecision remains. If one translates the current legal requirements in road traffic into a definition of the capabilities required of an autonomous control function, it can only be asserted with sufficient certainty that autonomous vehicles must absolutely have error compensation capabilities. Autonomous vehicles would have to be able to take clearly identifiable inappropriate behavior by other traffic participants into account and adapt the automated control accordingly. According to current law, how this is achieved is left up to the judgment of the driver in individual cases. Just implementing this requirement alone from a technical standpoint would require an extremely sophisticated environment recognition capability and extremely complex decision-making processes; but these are—including in the case of the driver—not specifically defined, but rather taken as given in the context of the requisite suitability and permission to drive [18]. This lack of specificity concerning the requirements could therefore prove too difficult for implementation in the form of an automated control system.

In light of the uncertainty resulting from the antagonistic demand of “defensive driving”, the only remaining option at this point is the—potentially traffic-flow-compromising—overfulfillment of the error compensation capability to the extent of total risk exclusion. This leaves the question, however, of whether a significant restriction of the traffic flow would indeed be expected: due to the aforementioned expanded scope of intervention of automated control (see Sect. 25.5.2), automated vehicle control could actually prove much more capable than a human driver. This advantage, which is presently unmeasurable, could compensate for deficits in terms of traffic flow (although the resulting scope is equally unknown).

In the question of the error compensation capabilities of autonomous automated control systems, it could prove beneficial to the cause of legal certainty to formulate uniform requirements targeted to specific objectives (comparable to brake effectiveness standards for vehicles, for example) that define and harmonize the state of the science and technology. Such a catalog of requirements would presumably bear fruit in the legal definition of realistic capability requirements for autonomous control systems.

5.5 Communication in Road Traffic

As concerns communication, for road traffic the currently existing options can be assumed. The use of some vehicle-based light and audible signals—such as headlight flashers, turn signals and hazard warning lights—if present, is explicitly prescribed by the German Road Traffic regulations. For example, warning signals (use of the hazard warning light) are prescribed in the case of hazards with school buses, when passengers get in or out, or as a warning when approaching the end of a traffic jam, with stalled cars and cars being towed [see also sections 15, 15a, 16 of the road traffic regulations (StVO)]. Section 5 paragraphs 4a and 5 of the road traffic regulations (StVO) prescribe and allow the use of turn signals and headlight flashers, respectively, in the context of overtaking maneuvers. The use of turn signals is prescribed, if available on the vehicle, when turning [section 9 paragraph 1 of the road traffic regulations (StVO)] or starting up [section 10 of the road traffic regulations (StVO)]. Through this standardized, formalized communication, the road traffic regulations achieve simplified expectations among other traffic participants [19].

Alongside this, an informal (or not legally secured) use of (light) signals has established itself which, however, is not envisioned by the road traffic regulations (flashing the high beams, for instance, can also represent ceding the right of way to another driver in Germany). It should be noted, however, that such a use of the signals is no longer subject to the principle of legitimate expectation in road traffic because it cannot be regarded as “traffic-appropriate” behavior (and, incidentally, also represents a major risk for misinterpretation).

Immediate verbal communication from within closed vehicles in road traffic is rendered more difficult or even impossible due to the physical separation of the driver from the immediate environment and the noise level of the surroundings. Even informal communication through simple gestures is considerably compromised due to the reflective effects of today’s typically tinted and angled vehicle windows. Nevertheless, even the road traffic regulations offer up an application in the case of “special traffic situations,” which envisions unspecified informal communication [as a special legal variant of the duty of care and consideration in section 1 paragraph 1 of the road traffic regulations (StVO)]. For instance, if it is necessary to cede the right of way, this requires communication with the driver yielding the right of way as per section 11 paragraph 3 of the road traffic regulations (StVO), providing that this communication is conducted in an unambiguous manner—in exceptional circumstances, even flashing the high beams can thereby be used to further clarify intent [14].

In view of existing communication challenges (see also Chap. 7), beforehand action, in particular when expressed in the form of motion, can also represent an indication of the intended target actions [19], such that the road traffic behavior which can be perceived from the outside such as stopping, braking and starting up also attain major significance in the context of informal communication. Such conduct is also explicitly envisioned by section 8, paragraph 2 of the road traffic regulations (StVO), which specifies that in right-of-way situations, the party required to wait shall “indicate through driving behavior that he/she will wait.”

Aside from the nonverbal nature and anonymity, the complexity of the situation is also singled out as a characteristic marginal condition for communication in road traffic. This complexity is particularly determined by the speed and fleeting nature of the communication in road traffic [20].

This enables us to identify some initial important conclusions for autonomous driving: While standardized, formal communication may represent merely a challenge for machine perception and interpretation and may indeed be possible to program automatically in the other direction, the question arises at this point already as to the degree to which other drivers can only recognize automated control or how this could be implemented. Consequently, in the “mixed” communication relationship with machines, the question further arises whether other drivers would trust the contents of formal communication. This would at least predicate knowledge of the respective capabilities of autonomous vehicles in order to allow communicative interaction to function. The case could even arise that other traffic participants feel a need to reproduce the content of automated communication (for example after an accident) in order to develop a willingness to trust in machine-generated communication content.

While the resulting challenges in the case of formal communication appear amenable to resolution, informal communication in mixed operation is characterized by much greater challenges [mixed operation is the basis of the present examination (see Chap. 2)]. In this area there is a need to find approaches which would establish a bridge between machine-controlled vehicles and other traffic participants. Ultimately this conflict flows from the cause already described in Sect. 25.5, namely that detailed situation-specific regulation of communication between human drivers in road traffic is not strictly necessary and that implementation can be left to the traffic participants according to situation. This informal communication between traffic participants may be subject to conflicts and in need of improvement [20], yet it can still be presumed that drivers are generally able to resolve this challenge in all situations—not least as this is necessary to guarantee the situation-specific adjustment that is required for road traffic in the first place. With the introduction of automated vehicle control, the machines would lack this human-specific capability of achieving understanding though such unspecified means; indeed, the machine may lack even the capability of recognizing that such communication is called for. The prerequisite for human communication is establishing a reflexive attentiveness to the communication partner and mutual perception [19]. This illustrates clearly that “mixed” communication still requires fundamental approaches for bridging this communication gap with machines. This would have to be a fundamental prerequisite in order for a mixed road traffic scenario including human drivers and machine-controlled vehicles to function.

At the same time, the importance of communication for the implementation of autonomous driving can be rated according to how important informal communication proves in a given situation—an apparently very challenging task from a technical standpoint. The abovementioned speed and fleeting character of communication in road traffic would presumably differ significantly based on the environmental conditions and driving speeds. Simply structured, extremely fleeting environmental conditions such as on a highway, where the driving speeds generally require formal communication, could substantially simplify the implementation of autonomous driving in that context and minimize the apparent necessity of adapting autonomous vehicles to the requirements of informal communication (in comparison to communication needed for an urban traffic environment).

It may also be assumed that the challenge posed by communication will only occur in mixed traffic because, particularly between autonomous machines, the problem seems eminently manageable from a technical standpoint (via cooperative systems). Moreover, for mixed traffic the significance of beforehand action expressed in motion, and how it can be used for future communication in road traffic, must also be examined. Of particular interest is the question which situations can be unambiguously resolved by it. At the same time, there is the risk that an automated driving system—with a set-up designed to take full account of the error compensation capabilities of other traffic participants (see Sect. 25.5.4)—could indirectly compromise traffic flow if its configuration were taken advantage of by other traffic participants.

Finally, it may be concluded with regard to communication in road traffic that here, too, a catalog of technically implementable communication strategies for autonomous vehicles in the form of a catalog of requirements would be advisable as soon as technical feasibility is foreseeable. This summarization of the technical features required of autonomous vehicles with regard to communication will be necessary over the long term, particularly in mixed traffic, and could substantially advance the discussion on possible communication concepts.

5.6 Violations

Through section 24 of the Road Traffic Act as a blanket provision in conjunction with the regulatory offenses specified by the road traffic regulations (StVO, section 49), the vehicle registration regulations (FZV, section 48), the road traffic licensing regulations (StVZO, section 69a) and driver licensing regulations (FeV, section 75), violations of prohibitions, duties and orders are generally prosecuted against traffic participants and vehicle owners [14]. Punishable offenses also include road traffic-related violations from the 28th section of the criminal code (StGB) on offenses dangerous to public safety (noteworthy in the present context are external interventions in road traffic as per section 315b StGB and hazards in road traffic as per section 315c StGB). It is evident that the machine-controlled conduct of autonomous vehicles would obviate the application of these provisions: Regulatory offenses and criminal provisions are always linked to a human action, which is lacking in the autonomous scenario.

The existing regulations, which carry penalties under criminal law or as regulatory offenses, also have an indicative effect concerning what behavior in road traffic not only impacts public order, but may, in line with our focus here, especially compromise public safety. The traffic regulations are “to be handled and interpreted in an elastic (traffic-appropriate) manner and without pettiness;” this applies equally, in the case of special regulations, to those which may impede or endanger [14]. Moreover, section 16 of the law on regulatory offenses provides a standard for legitimate emergency, which permits actions contrary to the law, including traffic regulations, in cases of acute danger to life, limb, property or other objects under legal protection in order to prevent imminent harm. The dangers must be grave, however, and the defensive actions commensurate to the dangers. Although the respective cases must be handled in a restrictive manner, not least to prevent specious assertions, this is ultimately a normative instrument to enable an appropriate consideration of the interests of different objects of legal protection in individual cases in a consistent and thus constitutional manner. The violation itself is subject to the same standard, such that its most extreme limit for road traffic is ultimately defined by the “danger threshold” for other traffic participants (see [21] on the question of the consideration of traffic safety in the context of the defense of necessity as a justification as per section 16 of the law on regulatory offenses).

If the introduction of autonomous driving is taken into account against this backdrop, it may be assumed that the interests would remain unchanged—at least for the mixed traffic scenario of autonomous and driver-controlled vehicles on which this study is based (see Chap. 2). A change could occur if—due to a very high degree of automated-system mastery of the automated control risk associated with a violation—the described consideration finds that the violation does not result in an increased risk. This would, of course, call into question the very rationale for the rule itself: “Violation” of the rule would then not actually produce any disadvantage in the context of mixed traffic.

It is also conceivable, however, that autonomous driving will lead to a need for considerably more detailed traffic rules which are significantly less flexible (which would in turn raise the question of societal acceptance again). Such a restriction of the existing situation would in turn require a more detailed catalog of requirements in terms of the technical control capability of autonomous vehicles as soon as they become foreseeable from a technical standpoint. This would make it possible to identify consequences, including in the case of violations, in much greater detail than is currently possible.

6 Special Legal Questions Related to Autonomous Driving

As regards the evaluation of fully-automated, driverless driving in terms of legal regulations and product as well as road traffic liability, the introductory passages on these issues can be referred to (see Sect. 25.4.2 as well as the introduction to Sect. 25.5). In summary, the principal conclusion we may draw in this regard is that the legal regulations and traffic law provisions [in particular the road traffic act (StVG), road traffic regulations (StVO), road traffic licensing regulations (FeV) and the regulations authorizing the use of vehicles for road traffic (StVZO)] at the time of their establishment could only consider as objects of regulation what was known in terms of the state of technology in road traffic. In all aspects of public road traffic, there is an underlying presumption that a driver will personally perform vehicle control. It is accordingly true of all available systems that they do not possess an independent decision-making quality (see Sect. 25.4.1), but indeed require that the driver be at least “an active monitor” at all times.

6.1 Legal Assessment of Driverless Vehicles

If the legal assessment of fully-automated driving [10] is therefore further extended to completely unmanned vehicles and passengers who are not able to control the vehicles themselves, clearly there would initially be no change in the present incompatibility with current regulatory law, which does not take account of this technological development.

At the same time, it must be noted that driverless and completely autonomous vehicles (see the representative use cases “Autonomous Valet Parking” and “Vehicle on Demand” in Chap. 2) differ significantly in the requirements for the legal framework from those which call for an “available driver”. With the continued option of vehicle control by the driver for certain sections of a trip or due to a desire on the driver’s part to take control, the same fundamental requirements (suitability and competence to drive; see also [18]) must be fulfilled that are currently required of drivers—in the case of “Full Automation Using Driver for Extended Availability,” at least when the driver intends to make use of the possibility of controlling the vehicle (i.e. perform an independent act of driving). As such, there is no need for a fundamentally different legal framework, but simply one augmented by necessary regulations governing autonomous vehicles and thus an independent, machine-based decision-making quality. With regard to this independent, machine-based decision-making quality, then, one arrives at the same result from a legal perspective for all of the use cases. The transformation resides primarily in enabling independent, automated agency and how that is shaped. The framework for automated vehicle control from a legal standpoint is currently unregulated, although regulation seems called for (at least in the spirit of road traffic regulations as technically effective regulation).

Insofar as a need for regulation of autonomous vehicles does not emerge naturally from the novel machine-based automation risk (see Sect. 25.5.1), it would seem that at least in terms of the use of suitable functions in mixed traffic relating to error compensation (see Sect. 25.5.4) and communication capabilities (see Sect. 25.5.5) of autonomous vehicles, a need for legal regulation seems evident. In the legal regulation of such interactive behavior, it must be examined precisely how far the role of the driver even extends in individual cases. If one considers the technical capabilities resulting from solely machine-based mobility in a given case (as described in the “Full Automation Using Driver for Extended Availability” and “Vehicle On Demand” use cases), the heretofore fundamental requirements of a driver’s driving suitability and driving competence already appear superfluous. The manifold possibilities could therefore give rise to an unprecedented variety of regulatory duties for participation in road traffic with (autonomous) vehicles, which could be distinguished primarily by the reach of the automated control quality and to what extent it is intended to be used.

6.2 Evaluation of Autonomous Driving According to Liability Law in Road Traffic

As concerns the shift towards automated agency which is associated with autonomous driving, it is likewise the case with road traffic liability law that the existing regulations do not take account of this change.

6.2.1 Keeper Liability

Nevertheless there is in this area a fundamental German liability regulation for motor vehicles [section 7 of the road traffic act (StVG)] according to which the keeper of the vehicle, regardless of fault in the operation of the vehicle, is liable for compensation of all causally related damages which are not asset damages [where the only remaining reason for exclusion of liability is force majeure, section 7 paragraph 2 of the road traffic act (StVG)]. Thus even today, this restriction to operation of the vehicle as a liability-triggering legal definition does not make a distinction based on whether damage was caused by the driver’s conduct or due to technical failure. Since automated control decisions which cause damage can without contradiction be classified as technical failures, there is no fundamental inconsistency in this regard.

The vehicle keeper is the person who uses the vehicle for his or her own account, in particular who draws the benefits and pays its expenses and thus also has the authority to decide regarding its use as a potential source of hazard [14]. If one assumes that driverless vehicles, too, can be assigned to a keeper, which would be possible without inconsistency according to current law, no incompatibility with current law would arise in this case. Autonomous driving would nevertheless change the matter of keeper responsibility—however, the keeper responsibility for autonomous driving is already covered by the wording of the applicable regulation today: The vehicle control previously conducted by the driver is replaced by an automated vehicle control system (as far as the scope of application of the respective autonomous control reaches). Concerning the keeper responsibility, therefore, there would be no new duties, but rather a completely different control quality which triggers civil liability.

6.2.2 Driver Liability and Accident Data Recording

Other regulations of the road traffic act which are relevant for civil liability do, however, clearly assume control by a driver, for example section 18 paragraph 1 of the road traffic act (StVG), according to which in cases of keeper liability a liability on the part of the driver is likewise presumed (see clause 2). Thus we see that section 18 of the German road traffic act (StVG) also merely assumes the heretofore always correct presumption that a driver is always responsible for the control behavior of the vehicle. Ultimately the assessment of driverless vehicles from a liability law perspective does not differ substantially from fully-automated [10] vehicles. The situation is similar with the heretofore applicable provisions of the German Civil Code (BGB) covering unlawful behavior by drivers (e.g. section 823 paragraph 1 BGB or section 823 paragraph 2 BGB in conjunction with violations of the road traffic regulations): These provisions can no longer cover the case of automated agency because they are linked to human action which is not applicable to autonomous vehicles.

In the autonomous vehicles which are the subject of this study, which in some cases do not even require the presence or occasional assumption of control by a driver, the question must be addressed to what extent it may be assumed in a typical case that vehicle passengers will be capable of describing the course of an accident. This illustrates that with respect to the question of compensation of accident damages occurring between two or more autonomous vehicles, the apportionment of damages according to applicable law and thus section 17 of the road traffic act (StVG) is confronted with the problem that the principally applied “degree of causation” [14] no longer—as is commonly the case today—can at least be supported through hearing of the drivers (generally also parties to a civil case—as the case may be also witnesses). This is due primarily to the role change in which the driver becomes a “mere passenger” (see Chap. 2) and is therefore able to make statements regarding the course of an accident only in exceptional cases and only on the basis of chance observations. Thus a change is introduced which even with respect to liability law in road traffic would seem to require technical measures (such as crash data recording during automated vehicle control) as a basis for the corresponding damage apportionment, insofar as the desire exists to maintain this distribution principle according to shares of causation for autonomous driving as well (which does indeed seem possible).

6.3 Evaluation with Respect to Product Liability Law

The field of product liability for automated control of autonomous vehicles was already discussed in Sect. 25.5.1. The salient question here is determination of the relevant cause of accident damage in individual cases in the sense of scientific causality.

6.3.1 Significance of Accident Data Recordings in Autonomous Driving in Terms of Product Liability Law

Going further, for the cases of autonomous driving which require a “driver for extended availability” (see the use cases “Interstate Pilot Using Driver for Extended Availability” and “Full Automation Using Driver for Extended Availability” Chap. 2) there is another aspect which in turn stands in relation to the question of crash data recorders. Both in terms of product liability law (as well as with regard to violations of regulatory law subject to fines) it seems reasonable to assume that an active available driver could argue the exculpatory defense that he/she was not controlling the vehicle him/herself, but with the aid of the autonomous control system. If one wishes to preclude such assertions, it will be difficult to avoid considering the recording of vehicle control data—at least during autonomous control—in order both to protect the interests of the manufacturers in terms of product liability law and to secure evidence with respect to regulatory violations. This option does not seem excluded a priori from a data protection standpoint provided that the data remains in the vehicle, the transparency requirement is granted and data processing is conducted only to the extent necessary, or that data is, for example, only permanently stored in the event of accident damage. Moreover, a restriction of data recording to the period in which the vehicle was under automated control would have to be considered which would meet the principle of data minimization [section 3 of the German Data Protection Act (BDSG)], which incidentally would equally arise from the principle of proportionality with regard to data processing. This would also largely avoid the recording of behavior related data on the driver’s control of the vehicle. Particular attention would also have to be given to the transitions between the respective periods in which the driver and the automated control system are driving. Data recording could be of particular importance in this transition period, although it would simultaneously deal with data clearly related to the driver. As such, it would be necessary to clarify in an initial step the extent of recording required for a driver-controlled drive to protect against subsequent exculpatory defenses.

6.3.2 The State of Science and Technology in Autonomous Driving

From a product liability law perspective, the significant aspect for the layman would appear to be the question of exclusion of liability for errors in the context of automated vehicle control which the latest science and technology cannot identify at the time of introduction (development risk). In this context of product liability law, we must return to the question raised in Sect. 25.5.1 in which it appears possible in the context of road traffic that risks which manifest themselves in accidents could also be traced back to the current traffic system as a relevant cause (and not in all cases to the control behavior, whether by drivers or automated control systems). This question is fundamental and needs to be answered as a matter of priority in order to avoid erroneously inferring that (alleged) product defects are the relevant cause.

But as soon as the grounds for exemption from liability are affected in view of the state of science and technology, it must be taken into account that this exemption in practice is of decidedly minor significance. Whether a hazard was indeed recognizable according to the state of science and technology is to be tested in two steps: First, it must be established whether the error was recognizable for any scientist or engineer in the world. If that was the case, claiming the exemption is still not yet ruled out, because the decisive factor would be the objective accessibility of that knowledge for the manufacturer. It would also be necessary to take into consideration deviating opinions by individual scientists, provided that those opinions satisfy the minimum requirements for scientific work [22].

As such, it is equally critical to determine for autonomous vehicles whether the recognizability of an error could indeed be ruled out at the time of introduction (which indeed would also have to be provable in retrospect in the event of an accident according to the applicable standards of presentation and proof in civil suits). Only in this rare case would the manufacturer gain legal certainty through the use of these grounds for exemption of the development risk [and if not at fault, also according to section 823 paragraph 1 of the German Civil Code (BGB)]. In practice, this case will be of nearly no importance.

Cognizance of the fact that product defects cannot be entirely ruled out even according to the latest science and technology and the observance of all due care, i.e. that a “residual fault tolerance”—as the ISO 26262 standard words it—exists, must be regarded as a technical description of the development process which has no correlation in product liability law.

6.4 Possible Differences of Legal Evaluation in the International Context

First, it must be noted that the present chapter from the outset only considers the situation from the perspective of German law and makes assertions on the basis of German law currently in force. Applicability to other countries must be considered limited. Transferability of the conclusions here will, aside from coincidental reasons, be most likely in the event of harmonization of laws due to international agreements (in the context of international law) or through regulations and directives issued in the context of EU law.

It is therefore salient to add that, as concerns the fundamental rights situation depicted here, there is a largely concordant standard of fundamental rights—for our present purposes in the context of the German fundamental rights to life and physical integrity—recognized for example through the European Union’s Charter of Fundamental Rights. It bears references to the European Convention on Human Rights and, with the exception of the United Kingdom and Poland, the EU fundamental rights charter was declared binding for the countries of the European Union through a provision in the Treaty of Lisbon. The rights to life and physical integrity are explicitly recognized therein—in particular through article 2 paragraph 1 and article 3 paragraph 1 of the Charter of Fundamental Rights of the European Union (see also [23]). This interpretation could be extended almost at will to the constitutions of other states; the chief conclusion, however, is that the fundamental rights framework can differ significantly in many individual areas. Such an examination is therefore the realm of specialists in the respective legal contexts.

This applies equally to the regulatory law of road traffic as well as to the liability law being applied which is relevant for autonomous driving. But as we have seen in Sects. 25.6.1 and 25.6.2, the legal situation according to German law is to a great extent only transferable to autonomous driving to a very limited degree. It seems quite possible that a comparable situation would subsist in other legal systems as well. This assumption is also supported by the fact that international road traffic accords such as the Vienna Convention on Road Traffic of 1968 and the Geneva Convention on Road Traffic of 1949 are based on a definition of the driver and continuous vehicle control which is highly comparable to that of the German road traffic regulations.

In the interest of greater comparability, the product liability law which was harmonized within the European Union through council directive 85/374/EEC of 25 July 1985 rates a mention. Here again, in addition to restrictions in terms of legal doctrine, uncertainties arise due to the fact that the directive’s implementation is binding only with regard to the objective (a principle that existed even prior to the current situation and which finds expression today in article 288 paragraph of the Treaty on the Functioning of the European Union). Yet there is a comparable legal foundation for intra-state application which is not linked to culpability (so-called strict liability).

In sum, it can be concluded that in these areas, there are still significant differences which could impact the development of autonomous driving. Due to the national variations within the field of law, however, the impact cannot be predicted in detail and remains—as far as can be ascertained today—in need of further examination.

6.5 Special Question: Supervisory Duty with Regard to the Passengers of Autonomous Vehicles

One of the benefits of autonomous driving is that the attention resources of the human occupant are no longer required for the task of driving. This could potentially call into question the necessity of the presence of the “driver,” or indeed the person with a supervisory duty at all. Thus a significant benefit of autonomous driving could be that the mobility desires of children—without requiring a driver—could be fulfilled. It is therefore by no means impossible that dangers could arise from this if—as presumably would often be the case—the driver is the person with a supervisory duty who is no longer present in the vehicle.

However, of the representative use cases examined here, only the “vehicle on demand” case would appear suitable for performing such a transport activity without the accompaniment of a person with a supervisory duty. Even the representative use case “Full Automation Using Driver for Extended Availability” calls for the presence of a driver to drive in zones or sections of roads not approved for autonomous driving (see Chap. 2). Since the “Vehicle on Demand” representative use case does not even have a driver’s seat (but only a completely freely-usable interior space), dangers and effects flowing from use by persons requiring supervision would seem to be limited to the interior of the vehicle and not relevant for road traffic. Thus the question of the absence of the person with the supervisory duty would not be relevant for road traffic. It is, however, every bit as plausible that such autonomous vehicles would indeed have driving controls. In that case there would be the possibility of a significant negative influence over vehicle control by means of overriding the autonomous driving functions through the control elements.

It is clear, however, that the legal question of a duty to supervise does not depend on the introduction of autonomous driving. Indeed, even today independent compensation obligations can be triggered by violations of the duty to supervise [see section 832 of the German Civil Code (BGB)]. The law stipulates a parental duty to supervise children in the exercise of parental care, sections 1626 and following BGB. Thus it would be necessary to determine the intensity of supervision required in view of the predictability of damaging conduct in an individual case based on the age, maturity, character, knowledge and abilities of a child [24]. If the resulting duty is violated and damage occurs on account of it, an independent claim for damages (aside from any claims lodged against the child) could be leveled against the parents of the child as well. Thus the possibilities arising from the advent of autonomous vehicles could result in the correct fulfillment of supervisory duties in this context receiving a novel, heretofore completely unknown meaning. A need to alter the legal basis is not foreseeable, however.

7 Conclusion

The examination of autonomous driving from a legal perspective undertaken in the present chapter reveals—in addition to the questions raised in the respective subsections—in particular a fundamental aspect which may take on greater prominence in the context of the transition from human to automated vehicle control than was previously the case. Even if we were to assume today that every accident involving motor vehicles were due to faults in the control of the vehicle, it must be examined scientifically to what extent the current traffic system, in view of the conditions under which it operates, does not itself represent a relevant cause for some portion of the accidents which take place today. The answer to the question is not to be regarded as an end in itself, but as a means of understanding whether, and if so, which changes in the vehicle control scenario are suitable under certain conditions to prevent accidents. This question is also decisive for the design of a safe product from the manufacturer’s point of view in terms of developing appropriate autonomous machine-based control functions.

It would also appear that the description of an automated control quality in the sense of a definition of requirements will be an important milestone in the ongoing advancement of autonomous driving in terms of legal certainty both for the operator of the vehicles as well as their manufacturers. This could be the basis for an evaluation that determines precisely in which areas there is a need for further development such as the communication or error compensation capabilities of autonomous vehicles. On the other hand, it would allow for an assessment of how the corresponding legal framework must be designed in order to make a functioning “road traffic system” involving autonomous vehicles a reality.