The harms caused by the Internet of Things: categorising damage and legal liability under the EU and UK liability frameworks.

Abstract

The Internet of Things blurs the line between virtual and physical worlds. Increasingly, adaptive and autonomous IoT systems have changed the way we interact socially and economically; emerging technology will continue to integrate pervasive IoT systems into society. These systems are increasingly complex, and the likelihood of harm is high. Existing laws and regulations often struggle to adequately address the potential harm. This thesis aims to define the types of harm that IoT systems are likely to cause. Harm caused by the Internet of Things includes physical, mental, and economic harm. In addition, these IoT systems may violate an individual’s right to privacy, control, and autonomy. The study analyses EU and UK laws and tests whether existing frameworks may address the harms caused by these IoT systems: it analyses the Product Liability Directive in connection with the General Data Protection Regulation, the Artificial Intelligence Act, the Data Act, and the Cyber Resilience Act, in comparison with the corresponding frameworks in the United Kingdom. Using black-letter analysis, comparative approaches, and examples from various smart systems such as smart grids, smart medical devices, hiring technologies, and smart transportation systems, this thesis will identify inconsistencies and gaps in the assignment of legal responsibility and risk. Furthermore, it will illustrate that the legal and regulatory environment is fragmented and that the many ongoing reforms create and entrench legal uncertainty. Notable examples are the 2026 deferral of the effective date of the digital edition of the Artificial Intelligence Act and the variable rates of member state implementation of the 2019 EU Product Liability Directive. This thesis also argues that the Internet of Things creates risks that fall outside the established and accepted thresholds of legal concern in the EU and UK. Recent amendments to EU laws increased access to legal redress for victims of material bodily harm, but responsibility for such acts remains undefined because of artificial intelligence and other factors beyond the control of producers and service providers. This thesis advocates a risk-based liability framework for IoTs and other similarly evolving technologies.