Hacker attacks or faulty software could shift the burden of legal and regulatory liability toward makers of self-driving cars and away from customers, experts say, forcing regulators and insurers to develop new models.

Autonomous cars have the potential to reduce the rate of traffic accidents as sensors and software give a car faster and better reflexes to prevent a collision. However, a greater level of automation increases the need for cyber security and sophisticated software, experts said.

“Although accident rates will theoretically fall, new risks will come with autonomous vehicles,” said Domenico Savarese, Group head of Proposition Development and Telematics at Zurich Insurance.

“What should be done in the case of a faulty software algorithm? Should manufacturers be required to monitor vehicles post-sale in the case of a malfunction or a hacker attack?” Savarese asked.

While established models for assigning liability – such as holding the owner responsible for what the car does – will still be relevant, the onus may shift toward manufacturers.

Greater automation may also change consumer behavior and affect insurance costs if drivers become less vigilant and less practiced in their ability to avert an accident.

“Could a manufacturer become liable if a distracted driver causes an accident while relying on autopilot? It’s too early to tell,” Savarese said, adding that increased liability would unlikely deter carmakers since customers were demanding more self-driving functions.

Software and connected cars are creating new opportunities for insurance companies to customize policies to clients.

“You could pay for how much you drive, or get a lower premium based on how well you drive,” Savarese said, adding that these policies will only be made possible if the client allows the insurer to monitor them.

Without driver consent, the insurer will have no right to spy on the driver, not even for exceeding the speed limit.

“We do not want to be big brother, or big puppeteer,” Savarese said.

If customers buy in to the idea of lower premiums in exchange for higher monitoring, they can opt to have some sort of black box device installed in their car or via their smartphone.

It will take until 2025 for fully autonomous cars to emerge, Boston Consulting Group senior partner Nikolaus Lang said, adding that carmakers will have to pave the way for winning over regulators by showing they have invested to make their cars less vulnerable to hacker attacks. (Reporting by Edward Taylor; Editing by Jonathan Oatis)