AED Liability Protection Under the Cardiac Arrest Survival Act

The Cardiac Arrest Survival Act gives you federal civil liability protection when you use an automated external defibrillator on someone you reasonably believe is in a medical emergency, and it extends that protection to the person or organization that acquired the device, provided the owner has met a short list of conditions. The immunity provisions sit at 42 U.S.C. § 238q, enacted in 2000 as part of Public Law 106–505.¹ Bystander protection is nearly absolute. Owner protection is conditional, and the conditions are where most compliance questions live.

Who the Statute Protects

Two groups fall inside the shield.

The first is the user. Anyone who uses or attempts to use an AED on a person they reasonably believe is having a medical emergency is protected from civil liability for resulting harm. No medical training or credential is required. Pull the device off an airport wall, apply it to a stranger who has collapsed, and federal law stands between you and a lawsuit.¹

The second is the acquirer, meaning the person or entity that bought the AED and placed it somewhere. Businesses, schools, gyms, churches, community centers, and any other organization that made an AED available are covered in this category. Unlike user immunity, acquirer immunity comes with strings attached.¹

Three Conditions an Owner Must Meet

If you acquired the AED, your federal protection depends on satisfying three obligations. Failing any of them, where the failure caused the harm, pulls the shield away.

Notify Local Emergency Responders

You have to tell local emergency response personnel or another appropriate entity where the device is, within a reasonable time after placing it.¹ The point is operational: 911 dispatchers and paramedics can then direct callers to the nearest device. Federal guidance for public access defibrillation programs in government buildings recommends that the notification include quantity, brand, and specific location.² Many jurisdictions run registration through the local fire department or EMS agency. If you move the device to another floor or another building, update the record.

Maintain and Test the Device

The AED must be properly maintained and tested.¹ The statute doesn’t set a schedule; the manufacturer’s instructions do. In practice that means watching two things: battery life and electrode pad expiration dates. Batteries commonly last two to five years on standby, and pads typically expire within 18 to 30 months. AEDs run daily or weekly self-tests that quietly drain the battery even if the device is never fired in an emergency.

The fastest way to lose owner immunity is to ignore a blinking low-battery indicator or leave expired pads in the cabinet. If the device fails during a cardiac arrest and there was a long paper trail of ignored warnings, the maintenance condition wasn’t met. A simple log of inspections and component replacements is your evidence that it was.

Train the People Expected To Use It

If the person who used the AED was your employee or agent, you must have given that person appropriate training on the device.¹ Two built-in carve-outs soften this. Training isn’t required for an employee who wouldn’t reasonably have been expected to use the device. And if there wasn’t enough time between hiring the employee (or acquiring the AED) and the emergency to complete training, the condition doesn’t apply. For an organization that has had the device for years and has designated responders, the absence of any documented training is a real exposure.

When the Shield Doesn’t Apply

Section 238q(b) lists the situations where federal immunity disappears entirely.¹

Harm caused by willful or criminal misconduct, gross negligence, reckless misconduct, or a conscious, flagrant indifference to the victim’s safety. A panicked mistake is protected. Deliberate misuse is not.
A licensed health professional who used the AED while acting within the scope of the professional’s license and employment. Standards of care and malpractice rules apply instead.
A hospital, clinic, or other entity whose purpose is providing direct patient care, when its employee used the AED within the scope of employment.
An acquirer who leased the AED to a healthcare entity, or otherwise provided it for compensation without selling it, when the harm was caused by that healthcare entity’s employee acting within scope.

The pattern is consistent: the Act targets bystander hesitation and business-owner reluctance, not medical professionals doing their jobs. The “within the scope of employment” language is what draws that line, so an off-duty nurse who helps at a shopping mall is in a different position than the same nurse on shift.

What the Statute Doesn’t Do

Two boundaries are worth stating plainly so you don’t assume the law reaches farther than it does.

It doesn’t require anyone to place an AED. The statute says explicitly that it does not require a device to be placed at any building or location, and it does not create any new cause of action against a person for failing to have one available.¹ Whether a specific building must have an AED is a question of state or local law. Many states impose placement requirements on schools, fitness centers, and public venues.

It doesn’t protect manufacturers. The Cardiac Arrest Survival Act covers users and acquirers only. A device maker faces product liability under the same rules as any other manufacturer if a design defect, software flaw, or manufacturing error causes harm.³ For an owner, that split can matter: a properly maintained AED that fails because of a product defect leaves your federal immunity intact while the injured party pursues the manufacturer.

How Federal and State AED Laws Fit Together

The federal statute is a floor, not a ceiling. It supersedes state law only where a state has no statute or regulation providing immunity to the same class of people in emergency AED situations.¹ Every state now has some form of Good Samaritan protection covering AED use, but the scope varies. A state law that covers users but not acquirers leaves the acquirer question to the federal statute. A comprehensive state law governs on its own terms.

Some states layer on additional obligations that the federal statute does not: physician oversight, specific training curricula, or registration with a state EMS agency. Meeting the state’s requirements is the starting point. The federal Act picks up what state law leaves uncovered.

Keeping the Protection Intact

Compliance is a short list of habits.

Register the device with your local fire department or EMS agency, including location, brand, and quantity, and update the record when anything changes.
Follow the manufacturer’s maintenance schedule. Replace batteries before they expire (commonly two to five years) and swap pads by their printed expiration date (commonly 18 to 30 months).
Keep a written log of inspections, battery replacements, and pad changes with dates. That documentation is the strongest answer to any later challenge.
Identify the employees or volunteers who are reasonably expected to use the AED and give them hands-on training, with refreshers every one to two years.
Order replacement batteries and pads at least 60 days before expiration to absorb shipping or supply delays.

Buying the device is the easy part. The Act rewards organizations that treat the follow-through seriously, and it withdraws the shield from those that mount an AED on the wall and forget about it.

1
Office of the Law Revision Counsel. 42 USC 238q – Liability Regarding Emergency Use of Automated External Defibrillators
2
Federal Register. Guidelines for Public Access Defibrillation Programs in Federal Facilities
3
GovInfo. 42 USC 238p – Recommendations and Guidelines Regarding Automated External Defibrillators for Federal Buildings and 42 USC 238q – Liability Regarding Emergency Use of Automated External Defibrillators