Automotive Cybersecurity: How Far Does Manufacturers’ Liability Extend?

Smart Keys and Relay Attacks: A Class-Action Lawsuit Against Automakers 

The plaintiff, whose Toyota vehicle equipped with a smart key was stolen in 2022, alleges that he was the victim of a relay attack. This tactic involves intercepting and relaying a key’s signal to gain access to a vehicle without any apparent physical forced entry. The thief then allegedly used the OBD port, a device through which some of the vehicle’s systems can be accessed, to start the engine. 

According to the plaintiff, the manufacturers failed to adequately inform consumers of the risks associated with this technology and failed to secure access to the OBD port, which can be used to reprogram keys and start the vehicle. 

The complaint initially targeted 18 automakers. The Superior Court partially authorized the class-action lawsuit against 13 of them. Five manufacturers were excluded, primarily because of the evidence presented regarding the safety features of their vehicles or the failure to establish that they were at fault. 

Automotive Cybersecurity: What Are the Manufacturers’ Obligations? 

This case raises an important question: Can a manufacturer be held liable when the technology built into its product has a security flaw that could be exploited by criminals? 

The plaintiff relies notablyon the Civil Code of Québec and the Consumer Protection Act. The legislation pertains, among other things, to the safety of a product, its normal use and important information that must be provided to consumers., among other things, to the safety of a product, its normal use and important information that must be provided to consumers. 

At this stage of the proceedings, the Court finds that the arguments presented were sufficiently compelling to warrant a hearing on the merits on some of these issues. In particular, it points out that information about a car’s locking system may be important to convey to consumers. 

One crucial nuance remains, however: Authorizing a class-action lawsuit does not mean that the manufacturers’ liability has been established. At this stage, the Court essentially determines whether the conditions necessary for the class action to proceed have been met. Issues regarding possible negligence  or a safety defect in smart keys will have to be decided on the merits. 

Does the Thieves’ Role Rule Out Potential Manufacturer Liability? 

The fact that the theft was committed by criminals raises another question: Could a manufacturer still be held liable for the damages if a technological vulnerability in its product facilitated the theft? 

The manufacturers argue that organized crime groups are the main cause of the rise in vehicle thefts, regardless of the alleged security vulnerabilities in smart keys and OBD ports. The plaintiff, for his part, argues that the manufacturers have contributed to the damages. 

The Court does not rule on this issue at this stage; rather, it believes that the arguments raised are serious enough to allow the class action to proceed. The issue of possible shared liability between the thieves and manufacturers will need to be examined on the merits. 

Artificial Intelligence and Evidence: What Is the Value of an AI-Generated Translation? 

The decision also addresses a particularly relevantt issue of the modern day: the use of artificial intelligence to translate a document submitted as evidence to a court. 

Notably, the plaintiff relied on a study by the Allgemeiner Deutscher Automobil-Club (ADAC) concerning security vulnerabilities in smart key systems. Written in German, this study was translated into French using an artificial intelligence engine. The translation was then reviewed by the plaintiff’s lawyer to make it easier to understand. 

The manufacturers objected to the use of this study, arguing that a certified translation was required. 

The Court rejects this objection, concluding that, under the circumstances, the absence of a certified translation does not automatically render the document inadmissible and that the issue, rather, concerns proof of its content. It also points out that the use of artificial intelligence is not prohibited in court. 

Since no concrete evidence has been presented to call into question the accuracy of the translation, the Court accepts the AI-translated ADAC study for the purposes of the application for authorization of a class action. 

As Annie-Claude Trudeau and Ariane Boyer point out, the trial decision could set a precedent regarding the admissibility as evidence of an uncertified translation produced using artificial intelligence. This aspect of the ruling, however, is among the issues raised by the manufacturers in their appeal. 

Manufacturer Liability and Cybercrime: What Lessons Can We Learn? 

Although it is still at the authorization stage, the authorization judgment raises important questions regarding manufacturers’ liability in the face of new forms of technology-related crime.  

As the authors point out, it sends a message to manufacturers regarding their level of vigilance and their duty to inform consumers about these new risks. 

In a landscape where technological risks are evolving rapidly, BCF supports companies in managing their cybersecurity, privacy and data protection challenges, particularly to help them better identify risks and implement practices tailored to their specific circumstances.

For a more in-depth look at the issues raised by this decision, read the comprehensive analysis of Lacroix v. Toyota by Annie-Claude Trudeau and Ariane Boyer, published in Repères, Éditions Yvon Blais, in June 2026 (EYB2026REP3949).