Re: Safety-critical updates?
"Patch released at (for argument's sake) 12 noon. Accident at 2pm. Is that negligent? Or is it a reasonable delay?"
It would make sense to remove the user from the software update process entirely, especially if the updates are potentially safety critical. Have over the air updates automatically download and install. Then the insurers would have to pay out to the user and to any third parties in the event of an accident. By all means inform the user when an update is ready/ has been applied, but removing the responsibility and putting this on the manufacturer should solve that particular problem for the most part.
This would then mean insurers can only reasonably wiggle out of paying if the user has purposely modified the ROM to stop updates, or has installed custom updates.
However if an update fails, although I would hope the car would let the user know about it, it could create a pretty big legal headache and would possibly shift some of the liability back onto the manufacturer/ software publisher.