--- title: "Article: Automated vehicles: Cybersecurity, data protection and the emerging litigation landscape" canonical: "/article-automated-vehicles-cybersecurity-data-protection-and-the-emerging-litigation-landscape" published: 2026-11-13 --- # Article: Automated vehicles: Cybersecurity, data protection and the emerging litigation landscape ## Automated vehicles: Cybersecurity, data protection and the emerging litigation landscape #### Introduction AVs are widely regarded as one of the most transformative technological developments of the modern era. Advances in AI, sensor technology, connectivity and real-time data processing have enabled vehicles to perform increasingly complex driving functions with minimal human intervention. The potential benefits are considerable, including improved road safety, increased mobility and greater efficiency across transportation networks. The UK's ambition to become a global leader in automated mobility is reflected in the Automated Vehicles Act 2024, which establishes a regulatory framework intended to support innovation while maintaining public safety. However, the same technologies that enable autonomous operation also create significant legal and regulatory challenges, particularly in relation to cybersecurity, data protection and accountability. As the sector continues to develop, organisations involved in the design, deployment and operation of AV technology must increasingly consider not only operational and regulatory risks, but also the prospect of litigation. Cyber incidents, data breaches and system failures have the potential to give rise to regulatory investigations, group actions and complex disputes involving multiple participants across the AV ecosystem. “A cyberattack on an automated vehicle could move digital risk into the physical world.” #### Core risks for AVs As AVs become increasingly integrated into everyday transport networks, the risks associated with their operation extend far beyond road safety. Their reliance on sophisticated software, constant connectivity and real-time data processing creates significant cybersecurity and privacy challenges. A successful cyberattack could compromise safety-critical systems, disrupt vehicle functionality or expose substantial volumes of personal data. At the same time, the continuous collection of geolocation and behavioural information allows organisations to build highly detailed profiles of individuals' movements, routines and habits. The complexity of the AV ecosystem further increases these risks. Manufacturers, software developers, connectivity providers and other third-party suppliers often play critical roles in the development and operation of AVs. The involvement of multiple stakeholders creates numerous potential points of vulnerability and can make responsibility for security incidents more difficult to identify when failures occur. “A single cyber incident could affect thousands of individuals simultaneously.” #### An emerging litigation landscape As adoption of AV technology increases, cybersecurity incidents are likely to become one of the principal drivers of future legal claims. The nature of disputes is also evolving. While traditional motor vehicle litigation has largely focused on driver error and physical accidents, future claims are increasingly likely to centre on software vulnerabilities, cybersecurity controls and failures in data governance. The Automated Vehicles Act 2024 introduces new legal actors, including Authorised Self-Driving Entities, which are intended to assume responsibility for the operation of self-driving vehicles. Nevertheless, questions of liability may remain complex where cyber incidents arise from malicious third-party activity, software defects or failures within the wider supply chain. Claimants are likely to focus on whether organisations took reasonable steps to prevent foreseeable cyber threats. Potential allegations may include: - Failure to patch known vulnerabilities. - Inadequate penetration testing and security assurance processes. - Insufficient monitoring and threat detection capabilities. - Poor supply-chain cybersecurity oversight. - Failure to adhere to recognised industry standards and regulatory expectations. Where regulators identify deficiencies in an organisation's cybersecurity controls, those findings may be relied upon by claimants as evidence of broader failures in governance and risk management. The prospect of group litigation may present an even greater source of exposure. Given the scale of personal, behavioural and geolocation data processed by AVs, a single cyber incident could affect thousands of individuals simultaneously. Organisations may therefore face collective claims arising from the loss, misuse or unauthorised disclosure of personal data. Even where financial loss is limited, claimants may seek compensation for distress resulting from the exposure of highly personal information, including travel histories, location patterns and behavioural profiles. The particularly sensitive nature of geolocation data is likely to attract heightened scrutiny from both regulators and the courts following any significant breach. AV disputes may also become increasingly complex due to the number of parties potentially involved. Manufacturers, software providers, cybersecurity vendors, cloud service providers and connectivity partners may each play a role in the development and operation of AV systems. Determining responsibility following a cyber incident may therefore lead to multi-party litigation involving competing allegations regarding system design, security controls and contractual risk allocation. “Cybersecurity and privacy are strategic business issues, not simply technical concerns.” #### Beyond litigation: The reputational impact While regulatory enforcement and civil claims are often the primary focus following a cyber incident, reputational damage may prove equally significant. Public acceptance of AVs depends not only on confidence in their ability to operate safely, but also trust in the organisations responsible for collecting and processing large volumes of personal data. A significant cyber incident has the potential to undermine that trust rapidly. The combination of media scrutiny, regulatory investigations and litigation can create lasting commercial consequences that extend well beyond the immediate costs of remediation. For emerging technologies such as AVs, maintaining public confidence may ultimately prove as important as maintaining legal compliance. “Maintaining public confidence may prove as important as maintaining legal compliance.” “AV disputes could increasingly centre on software vulnerabilities, cybersecurity controls and failures in data governance.” #### Mitigating potential legal and regulatory risk To mitigate legal and regulatory risk, organisations operating within the AV ecosystem should adopt a proactive and holistic approach to cybersecurity and data governance. This begins with embedding security-by-design principles throughout the vehicle development lifecycle, ensuring that cybersecurity considerations are incorporated from the earliest stages of design and deployment. Organisations should also implement robust data governance frameworks, prioritising data minimisation, accountability and compliance with data protection obligations. Given the extensive use of third-party providers within the AV ecosystem, organisations should undertake comprehensive supply-chain due diligence and maintain appropriate contractual safeguards to allocate risk and establish clear security expectations. Regular penetration testing, vulnerability management programmes and ongoing monitoring capabilities should also form part of a broader cybersecurity strategy. From a privacy perspective, Data Protection Impact Assessments should be conducted where appropriate to identify and mitigate risks associated with the processing of personal data. Organisations should also ensure that incidents can be managed effectively through well-rehearsed response plans, enabling rapid containment, regulatory reporting and remediation when cyber or data security events occur. Strong governance is equally important. Senior management and boards should maintain oversight of cybersecurity and privacy risks to ensure that they are treated as strategic business issues rather than purely technical concerns. #### Conclusion The legal challenges facing the AV sector are likely to evolve alongside the technology itself. While questions of road safety and product liability will remain important, cybersecurity and data governance issues may increasingly shape the future disputes landscape. As AVs generate greater volumes of data and become more deeply integrated into connected digital infrastructure, organisations will face growing scrutiny from regulators, consumers and claimants alike. Cyber incidents and data breaches have the potential to trigger regulatory investigations, collective actions and complex multi-party disputes involving numerous participants across the AV ecosystem. For manufacturers, fleet operators, software developers and other industry participants, the challenge is no longer simply ensuring that vehicles can operate autonomously. It is demonstrating that they can do so securely, transparently and in compliance with evolving legal obligations. Organisations that successfully embed cybersecurity, privacy and governance into their operational frameworks will be best placed to reduce litigation exposure, satisfy regulatory expectations and maintain public confidence in this rapidly developing market. **Next page >>** Yagna Hitchcock Trainee Solicitor DAC Beachcroft Justin Tivey Partner DAC Beachcroft **Careers** **Complaints / Our Policies** **Accessibility** **Legal & Regulatory** **Emergencies** **Modern Slavery Act Statement** 2025 DAC Beachcroft LLP. All rights reserved.