The single biggest legal issue complicating AED use is liability: the fear of being sued for harm caused while trying to save someone’s life. Good Samaritan laws exist in every state to address this, but they vary widely, creating a patchwork of protections that leaves both bystanders and businesses uncertain about their legal exposure. This uncertainty discourages people from acting during cardiac emergencies and discourages organizations from placing AEDs in public spaces.
Good Samaritan Immunity and Its Limits
Federal law (42 U.S.C. § 238q) grants civil liability immunity to any person who uses or attempts to use an AED on someone experiencing a perceived medical emergency. That protection extends to the person or organization that purchased the device as well. But immunity is not absolute. It disappears if the harm resulted from willful misconduct, gross negligence, reckless behavior, or “conscious, flagrant indifference” to the victim’s safety.
Immunity also does not apply to licensed health professionals acting within the scope of their certification, or to hospitals and clinics whose employees use AEDs on patients. In those settings, standard malpractice and professional liability rules apply instead. This means a nurse using an AED at work and a bystander using one in an airport operate under entirely different legal frameworks, even though the device and the emergency are identical.
The deeper problem is that every state has its own version of Good Samaritan protections, and they don’t line up. Some states require the rescuer to have completed CPR and AED training to qualify for immunity. Others protect anyone acting in good faith regardless of training. Some protect the property owner where the AED is stored; others don’t. A 2025 bill introduced in Congress, the Cardiac Arrest Survival Act, specifically cited this “patchwork of State Good Samaritan laws” as providing “incomplete, inconsistent, and, in some instances, inadequate protection” that discourages AED deployment.
Liability for Device Owners and Businesses
Organizations that acquire AEDs take on legal obligations the moment the device arrives. Under federal law, the owner’s immunity depends on three conditions: notifying local emergency responders about the device’s location within a reasonable time, maintaining and testing the device properly, and providing appropriate training to employees who would reasonably be expected to use it. Failing any of these can strip away liability protection.
Maintenance is a particularly common source of legal exposure. AED pads and batteries expire, and a device that fails during a cardiac arrest because of neglected upkeep can become the basis of a negligence claim. Lawsuits have alleged that AEDs failed to function due to product defects or improper maintenance. For businesses, this creates ongoing compliance costs: regular inspections, parts replacement, record-keeping, and in some states, reporting the device’s location to local emergency medical services.
California, for example, requires AED owners to maintain and test devices according to manufacturer guidelines, keep records of all maintenance and use, train personnel, and report the AED’s location to the local EMS agency. Certain California facilities must also report any AED use to state authorities within 24 hours. These requirements vary by state, so a company operating in multiple locations faces a web of different compliance rules.
The Duty to Provide or Use an AED
One of the thorniest legal questions is whether a business has a duty to have an AED on-site in the first place, and if it does have one, whether it must use it during an emergency. Courts have generally been reluctant to impose either obligation without a specific statute.
In a landmark California case, Verdugo v. Target Corporation, the family of a customer who died of cardiac arrest in a Target store sued, arguing the retailer had a duty to keep an AED available. The California Supreme Court acknowledged that a business’s common-law duty of care to customers could theoretically include providing an AED, but ultimately decided the question was better left to the legislature. Without evidence of a heightened risk of cardiac arrest at the specific location, the court found the burden of requiring AEDs was too great to impose through case law alone.
Tennessee courts reached a similar conclusion from a different angle. The state’s Supreme Court ruled that an employer who voluntarily purchased an AED had no legal obligation to use it when an employee suffered a non-work-related cardiac event. The court held that businesses are encouraged to acquire AEDs, but owning one does not create a legal duty to deploy it. This reasoning has appeared in other jurisdictions as well, though it remains an evolving area of law. For businesses, the concern is real: acquiring an AED out of goodwill could, in some interpretations, create expectations and potential liability that didn’t exist before.
State Mandates for AED Placement
While courts have been cautious about imposing AED requirements through case law, state legislatures have stepped in selectively. As of a 2017 CDC survey, 38 states had laws supporting targeted AED placement. Among those, 25 required or authorized AEDs in schools, 15 in health and fitness facilities, 10 in state-owned buildings, and a handful in gambling venues and public golf courses.
The specifics can be remarkably detailed. Louisiana, for instance, requires college athletic departments competing in intercollegiate sports to place an AED in an open-view, easy-to-access location within two feet of a phone that can reach 911. Other states set broader requirements with less precise language, leaving room for interpretation and, inevitably, litigation over whether a facility was in compliance.
These mandates create a two-tier system. Facilities covered by a state law face clear obligations but also clear legal protections if they comply. Facilities not covered by any mandate occupy a gray zone where the decision to acquire an AED is voluntary, the rules for maintaining it may be unclear, and the legal consequences of having one (or not having one) during a cardiac emergency are uncertain.
Training Requirements and Legal Gray Areas
Whether a rescuer needs formal training to be legally protected is one of the most confusing aspects of AED law. The model legislation promoted by the American Heart Association and allied organizations requires that anyone likely to use an AED complete a nationally recognized CPR and AED course. Under that framework, immunity extends to the rescuer, the supervising physician, the trainer, and the site owner, provided the rescuer acted in good faith and without compensation.
In practice, states interpret training requirements differently. Some require certification as a condition of immunity. Others protect untrained bystanders who act in good faith, recognizing that cardiac arrest kills within minutes and waiting for a trained person may not be realistic. This inconsistency means a bystander’s legal protection can depend entirely on which state they happen to be in when someone collapses.
For employers, the training question adds another layer of complexity. Federal immunity for device owners can be lost if an employee who was “reasonably expected” to use the AED wasn’t trained. But the law carves out exceptions: if the employee wouldn’t have been expected to use it, or if there simply wasn’t enough time between hiring (or acquiring the device) and the emergency to complete training, immunity still holds. These fact-specific exceptions make it hard for businesses to know in advance whether they’re covered.
Why the Legal Uncertainty Matters
Every minute without defibrillation during cardiac arrest reduces a person’s chance of survival by roughly 7 to 10 percent. AEDs are designed to be used by ordinary people with minimal training, and the devices themselves analyze heart rhythm and will not deliver a shock unless one is needed. The technology is intentionally simple. The legal landscape around it is not.
The combined effect of inconsistent state laws, unclear duty-of-care standards, maintenance obligations, and training requirements creates hesitation at every level. Bystanders worry about lawsuits. Businesses worry about the liability of owning a device or the liability of not owning one. Organizations in multiple states face conflicting rules. The result is fewer AEDs in public spaces and more reluctance to use them, which costs lives that the technology was built to save.