AED Legal Requirements: Federal Immunity, Duties, and Costs

AED legal requirements come from two layers of law working together: a federal statute that grants civil immunity to people who use an AED in an emergency, and a patchwork of state laws that decide who has to install the devices and how they must be managed. All 50 states and the District of Columbia have enacted at least one law covering AED availability, bystander liability, or facility programs.¹ The federal shield is not automatic. It depends on the device owner meeting specific obligations around maintenance, training, and EMS notification, and it disappears entirely in certain situations.

The Federal Liability Shield Under 42 U.S.C. §238q

The Cardiac Arrest Survival Act, codified at 42 U.S.C. §238q, grants civil immunity to any person who uses or attempts to use an AED on someone experiencing a perceived medical emergency.² The protection extends past the rescuer to the person or entity that acquired the device, but only if three conditions are met.

First, the acquirer must have notified local emergency response personnel of the device’s placement within a reasonable time after installing it. Second, the device must have been properly maintained and tested as of the date of the emergency. Third, if the person who used the AED was an employee or agent of the acquirer, that person must have received appropriate training. The training condition does not apply if the employee would not reasonably have been expected to use the device, or if there was not enough time between hiring and the emergency to complete training.²

Missing any of the three can strip away the immunity that would otherwise apply. A skipped battery check, an expired set of pads, or a failure to register the device with local EMS is enough to put an acquirer back in the ordinary civil liability system.

When the Federal Immunity Does Not Apply

Section 238q lists four situations in which the shield does not attach at all. It does not cover harm caused by willful or criminal misconduct, gross negligence, reckless behavior, or a conscious indifference to the victim’s safety. It does not cover a licensed health professional using the AED within their professional scope of practice and employment. It does not cover a hospital, clinic, or other healthcare entity’s employee using the device on the job. And it does not cover an acquirer who leased the device to a healthcare entity rather than selling it.² Healthcare facilities and professionals operate under their own liability frameworks, so the lay-rescuer statute leaves them out.

Who Is Legally Required to Have an AED

No federal law forces private businesses or organizations to install AEDs. OSHA encourages workplace AED programs but has not enacted a standard that mandates them.³ For federal buildings, 42 U.S.C. §238p directs the Secretary of Health and Human Services to publish placement guidelines, but the resulting program remains voluntary. Placement mandates come almost entirely from state legislatures.

Schools are the most common target. Roughly 20 states plus the District of Columbia require AEDs in K–12 schools, and several additional states require them specifically in schools that sponsor interscholastic athletics. Health and fitness clubs are the next most frequent target, with about 14 states requiring gyms to keep AEDs on-site. A smaller group of states extends mandates to dental offices that administer sedation or anesthesia, public swimming pools, assisted living facilities, large-occupancy venues, and government buildings. The triggers, whether square footage, occupancy, or type of activity, differ from one statute to the next.

Because these mandates are state-driven, a facility trying to figure out whether it has an obligation should check its own state’s public health or EMS statutes. A gym in one state may face a legal requirement and potential liability exposure while an identical gym across the border has none.

Ongoing Duties That Keep You Compliant

Owning an AED is not a one-time compliance step. Both the federal statute and most state laws impose ongoing duties that, if ignored, expose the owner to the lawsuits the immunity was meant to prevent.

Accessibility and Signage

An AED locked in a supply closet might as well not exist. State laws commonly require that AEDs sit in visible, easily accessible locations with clear signage so that any bystander can find and retrieve the device in seconds. Most programs recommend placement within a three-minute round trip from any point in the building.

Maintenance and Inspection

Federal immunity conditions on the device being “properly maintained and tested.”² In practice, that means following the manufacturer’s schedule. AED batteries are non-rechargeable and typically last two to five years. Electrode pads dry out and generally expire within two to four years, even unused. A monthly visual check of the status indicator, battery level, and pad expiration date is standard. Many AEDs run an automatic self-test and display a warning light, but the self-test does not replace a human check of the pads and accessories.

The FDA classifies AEDs as medical devices and posts manufacturer corrections and removals in its public Medical Device Recall database.⁴ Owners should monitor recall notices and report device problems through MedWatch.⁵

Training

Federal immunity ties to providing “appropriate training” to employees or agents who would reasonably be expected to use the device.² Many state laws go further and require that a set number of staff hold current CPR and AED certifications. An accredited course from the American Heart Association or the American Red Cross typically costs $20 to $150 per person, and certifications generally need renewal every two years.

AEDs are designed for use by untrained bystanders. They provide voice prompts, analyze the rhythm automatically, and will not deliver a shock unless one is warranted. For a random bystander the law is forgiving. For a designated employee, the acquirer’s immunity depends on whether that person was trained.

EMS Notification

Federal law conditions the acquirer’s protection on notifying local emergency response personnel of the device’s most recent placement “within a reasonable period of time.”² Many states add their own registration rules. The point is practical. When 911 dispatchers know an AED is on-site, they can send a caller to fetch it before paramedics arrive. Some jurisdictions require notification to a state health department rather than local EMS, and a few require re-registration when devices are moved or replaced.

Physician Oversight

Some states require an AED program to operate under the medical direction of a licensed physician. Where required, the physician’s role typically involves approving the response protocol, reviewing training plans, and conducting a clinical review of any event in which the AED is used. Not every state imposes this requirement, and the level of involvement varies. Medical oversight services are available through AED vendors and third-party providers in states that require it.

Good Samaritan Protection for the Person Who Uses the AED

Every state and the District of Columbia has some version of a Good Samaritan law that covers AED use during an emergency.¹ These laws sit on top of the federal statute, and in many states the state protection is broader. The pattern is consistent: act voluntarily, act reasonably, don’t charge for your help. The universal carve-out is gross negligence or willful misconduct.

A bystander who follows an AED’s voice prompts faces virtually no realistic liability risk. The real legal danger runs the other way. A facility that was required to have an AED and didn’t, or had one that was expired and non-functional when it was needed, can face negligence claims. Liability waivers signed by gym members or event attendees generally do not shield against gross negligence.

What Compliance Costs

A new AED unit ranges from roughly $1,200 for an entry-level model to $4,000 for a professional-grade device. A wall-mounted cabinet with signage runs $30 to $350. Pediatric electrode pads, if needed for a school or community center, add about $115. Replacement pads cost $30 to $100 per set and expire every two to four years. Batteries run $100 to $300 and last two to five years. Training and recertification for designated staff adds $20 to $150 per person every two years.

These figures matter for planning, but the real message of the statute is simpler. Federal law will protect you if someone uses your AED in an emergency, but only if you kept the device maintained, notified local EMS, and trained the employees you expected to use it.² Your state’s EMS or public health statutes will tell you whether you were required to have the device in the first place, and what else you must do to keep the program in compliance.

1
Centers for Disease Control and Prevention. Public Access Defibrillation State Law Fact Sheet
2
Office of the Law Revision Counsel. 42 USC 238q – Liability Regarding Emergency Use of Automated External Defibrillators
3
Occupational Safety and Health Administration. Automated External Defibrillators – Overview
4
U.S. Food and Drug Administration. Automated External Defibrillators (AEDs)
5
U.S. Food and Drug Administration. Recalls, Corrections and Removals (Devices)