  Over the last decade, surgical robots have risen in prominence and usage. For
surgical robots, connectivity is necessary to accept software updates, accept
instructions, and transfer sensory data, but it also exposes the robot to
cyberattacks, which can damage the patient or the surgeon. These injuries are
normally caused by safety failures, as seen in accidents with industrial
robots, but cyberattacks are caused by security failures instead. We create a
taxonomy for both types of failures in this paper specifically for surgical
robots. These robots are increasingly sold and used in the European Union (EU);
we therefore consider how surgical robots are viewed and treated by EU law.
Specifically, which rights regulators and manufacturers have, and which legal
remedies and actions a patient or manufacturer would have in a single national
legal system in the union, if injuries were to occur from a security failure
caused by an adversary that cannot be unambiguously identified. We find that
the selected national legal system can adequately deal with attacks on surgical
robots, because it can on one hand efficiently compensate the patient. This is
because of its flexibility; secondly, a remarkable absence of distinction
between safety vs security causes of failure and focusing instead on the
detrimental effects, thus benefiting the patient; and third, liability can be
removed from the manufacturer by withdrawing its status as party if the patient
chooses a separate public law measure to recover damages. Furthermore, we find
that current EU law does consider both security and safety aspects of surgical
robots, without it mentioning it through literal wording, but it also adds
substantial liabilities and responsibilities to the manufacturers of surgical
robots, gives the patient special rights and confers immense powers on the
regulators.
