Legal Issues With AEDs: Immunity, Compliance, and Post-Use Steps

AED legal requirements come from several layers at once: federal immunity under 42 U.S.C. § 238q, state Good Samaritan statutes, FDA rules that treat most defibrillators as prescription devices, state placement mandates, and ordinary negligence principles. The federal shield protects both the person who uses an AED and the organization that acquired it, but the acquirer keeps that protection only if it registered the device with local emergency services, maintained and tested it, and trained the staff expected to use it. Miss any one of those, and the legal cover an organization assumed it had can quietly disappear.¹

The Federal Immunity Shield and Its Conditions

The Cardiac Arrest Survival Act, codified at 42 U.S.C. § 238q, is the federal starting point. It creates two separate immunities. One protects the person who uses or attempts to use an AED on someone having a perceived medical emergency. The other protects the person or entity that acquired the device.¹

Acquirer immunity is the conditional one. It survives only when the acquirer did three things:

Notified local emergency responders of where the AED was placed.
Properly maintained and tested the device.
Provided appropriate training to any employee or agent reasonably expected to use it.

If the acquirer failed on any of these and the failure contributed to the harm, federal immunity drops away.¹

The training piece has a practical carve-out. It does not apply when the person who used the AED was not someone the acquirer would have reasonably expected to use it, or when there was not enough time between hiring and the emergency to train them. That matters when a bystander employee grabs the nearest device rather than a designated responder.

Who the Federal Shield Does Not Cover

Even a program that meets every acquirer condition can run into categorical exclusions. Under 42 U.S.C. § 238q, immunity does not apply when the harm was caused by willful or criminal misconduct, gross negligence, reckless misconduct, or a conscious and flagrant indifference to the victim’s safety.¹

Four categories of actors fall outside federal immunity entirely:

Licensed or certified health professionals using an AED within the scope of their professional duties and employment.
Hospitals, clinics, and other entities whose purpose is providing healthcare directly to patients, when their employees use an AED on the job.
Entities that leased an AED to a healthcare provider, if the provider’s staff caused the harm while acting within their job duties.
Acquirers that failed to register the device with local EMS, keep it maintained, or train the employees expected to use it.

The last category is where most organizations stumble. Buying an AED and mounting it on a wall is simple. The ongoing obligations around maintenance, training, and registration are what create exposure, because letting any of them lapse strips protection without any outward sign that it has happened.

How State Good Samaritan Laws Fit On Top

Every state has a Good Samaritan law that protects people who voluntarily provide emergency aid, including AED use, from liability for ordinary negligence. The specifics vary. Some states cover lay rescuers, trained responders, and program sponsors alike. Others draw tighter lines.

Most states share a core requirement: the rescuer acted voluntarily, without expecting payment, and without a preexisting duty to treat the person. The distinction matters for clinicians. A nurse who happens on a cardiac arrest at a grocery store and uses the store’s AED is generally protected. The same nurse using an AED on a patient during a hospital shift usually is not, because the nurse owes that patient a professional duty and is being paid for the care.

The federal statute reinforces the same line. Immunity does not apply to licensed or certified health professionals acting within their professional duties, or to entities whose purpose is direct patient care.¹

FDA Classification and Prescription Requirements

The FDA classifies AEDs as Class III medical devices, the agency’s most heavily regulated category. Each model must go through premarket approval, with testing for safety and effectiveness before it can be sold.²

Because of that classification, most AEDs require a prescription or medical authorization at the point of purchase. It is not just paperwork. The prescription ties into the medical oversight requirements many state AED program laws impose and that the federal statute supports indirectly through its training and maintenance conditions. An organization that acquires an AED without the required prescription may be operating outside the device’s approved use, which can complicate its legal position after an incident.

The FDA also issues recalls when safety problems are found. When a recall is announced, device owners have a legal obligation to follow the corrective actions.³ Ignoring a recall and continuing to deploy a compromised device creates obvious liability and can undermine any later claim of immunity.

Running a Compliant AED Program

Most of the operational requirements for an AED program double as conditions for keeping liability protection. Treating them as mere administrative tasks is where programs fail.

Training and Certification

The federal statute conditions acquirer immunity on “appropriate training” for employees reasonably expected to use the device.¹ Most states fill in that term by requiring CPR and AED certification from a recognized provider such as the American Heart Association or the American Red Cross. Courses cover recognizing cardiac arrest, performing chest compressions, and operating the device safely. Keep certifications current. A lapsed certification can be treated like no training at all when immunity is tested.

Medical Oversight

Because the FDA treats most AEDs as prescription devices, a licensed physician or other qualified medical professional typically has to authorize the program. The physician oversees protocols, reviews training, and acts as the medical authority behind the program. Many states make physician oversight an explicit condition for liability protection, and a program without it may lack the legal foundation to claim immunity in the first place.

Maintenance and Inspection

Federal acquirer immunity is tied to properly maintaining and testing the device. What “properly” looks like comes from manufacturer guidelines and state regulations. Most manufacturers recommend monthly visual inspections to confirm the status indicator shows the device is ready, batteries hold charge, and electrode pads have not expired. Some states require inspections on a set schedule and formal testing at least twice a year or after each use.

Document everything. Inspections without records are nearly as bad as no inspections at all, because defending a lawsuit means proving the maintenance standard was met. Logs of every check, battery replacement, and pad swap are the evidence that keeps immunity intact.

Registration With Emergency Services

The federal statute requires acquirers to notify local emergency responders about where the AED is placed. Roughly two-thirds of states also have laws requiring entities that acquire an AED to register it with an EMS system or AED location registry. About 22 states go further and require both registry enrollment and activation of EMS whenever the AED is actually used in an emergency.⁴

Registration has a practical function: it lets 911 dispatchers direct callers to the nearest AED. It also has a legal one. Failure to notify local emergency personnel is one of the three federal conditions that erase acquirer immunity.¹

When State Law Requires You to Have an AED

Federal law protects organizations that choose to deploy AEDs. Many state laws go in the opposite direction and require them. According to the CDC’s most recent survey, all 50 states and the District of Columbia have enacted at least one law requiring certain businesses, schools, or other entities to implement AED programs.⁴

Schools are the most common target, especially K-12 public schools with athletic programs. Health clubs and fitness facilities come next, followed by public buildings, dental offices that administer sedation, nursing homes, and assisted living facilities. The scope differs sharply by state. Some require AEDs only in public high schools with sports programs; others reach private schools, colleges, swimming pools, and places of public assembly.

A duty to provide an AED can also come from general negligence principles. An employer whose workforce faces foreseeable cardiac risk, or a business that invites large numbers of people onto its premises, can face a negligence claim for failing to have an AED available even if no state statute specifically requires one. OSHA does not have a dedicated AED standard, but its general duty clause and first-aid standards may apply depending on the workplace.⁵

Where a statutory or common-law duty to provide an AED exists, failing to do so, or failing to keep a required AED in working condition, can anchor a negligence lawsuit if someone has a cardiac arrest and no functional device is available.

When the Device Itself Fails

Not every AED-related injury traces back to a user. Devices can malfunction, and when they do, the legal focus moves to the manufacturer. Product liability claims against AED makers fall into three familiar categories: manufacturing defects where a specific unit left the factory flawed, design defects where the product line has an inherent problem, and failure-to-warn claims where risks or instructions were not adequately communicated.

Manufacturing defect claims usually proceed under strict liability. The injured person has to show a defect existed and caused the harm, without proving carelessness. Design defect and failure-to-warn claims typically require more, often including proof that a safer alternative design was feasible or that the warnings were inadequate for the foreseeable user.

FDA recalls carry weight here. When a recall is classified, the manufacturer must notify affected customers and specify corrective actions. An organization that ignores a recall and keeps deploying a known-defective AED takes on significant exposure, and the recall itself can become evidence in a product liability case because it documents the manufacturer’s own acknowledgment of a safety problem.

After an AED Is Used

Legal obligations do not end when paramedics arrive. A few post-use steps are typically needed to stay compliant and keep liability protection intact.

Reporting and Medical Review

Many state AED program laws require the organization to report each use to the program’s medical director, and in some states to local EMS. The report usually covers what happened, what the AED did, and how the patient responded. It lets the overseeing physician review whether protocols were followed. In states that tie immunity to proper program administration, failing to report a use can be treated as a compliance gap that weakens legal protection.

Data Download and Preservation

AEDs record ECG rhythms, whether a shock was delivered, and timestamps throughout operation. That data should be downloaded after each use for medical review and quality assurance. It also has evidentiary value: in any lawsuit, the device’s internal record can confirm what it detected, what it recommended, and whether it functioned. Treat the data as potential evidence and preserve it.

When the record is tied to an identifiable patient, it qualifies as protected health information under HIPAA if the organization holding it is a covered entity, such as a healthcare provider or employer health plan. Organizations that are not covered entities should still handle the data carefully, because state privacy laws may impose their own requirements.⁶

Restoring the Device

Electrode pads are single-use and must be replaced after every deployment. Batteries may also need replacement depending on how much energy the device delivered. The AED should be inspected, re-serviced, and confirmed ready before it goes back on the wall. An organization that uses its only AED and then leaves it sitting with spent pads for weeks has a gap in coverage that carries the same liability risk as never having had the device at all.

1
Office of the Law Revision Counsel. 42 USC 238q – Liability Regarding Emergency Use of Automated External Defibrillators
2
U.S. Food and Drug Administration. Product Classification – MKJ
3
U.S. Food and Drug Administration. Class 2 Device Recall ZOLL Powerheart G5
4
CDC. Public Access Defibrillation State Law Fact Sheet
5
Occupational Safety and Health Administration. Automated External Defibrillators (AEDs) – Overview
6
U.S. Department of Health and Human Services. The HIPAA Privacy Rule