If a COVID-19 vaccine does turn out to be dangerous, who’s on the hook?

When it comes to vaccine liability in a pandemic, manufacturers are almost entirely in a safe zone.

What if—and this is the biggest of ifs—one of the COVID-19 vaccines turns out to be harmful to some of the people receiving it? Who, if anyone, would have to pay out?

The question of vaccine liability will hopefully remain theoretical throughout this pandemic.

Subscribe to unlock this article and get full access to Fortune.com

What if—and this is the biggest of ifs—one of the COVID-19 vaccines turns out to be harmful to some of the people receiving it? Who, if anyone, would have to pay out?

The question of vaccine liability will hopefully remain theoretical throughout this pandemic.

However, while public health officials say there’s no doubt that refusing a COVID vaccine is far more dangerous than taking it, the liability question does remain important—not least because of the possible link between AstraZeneca’s vaccine and rare blood-clotting incidents in Europe. (No causal link has been proven and health authorities continue to recommend using the AstraZeneca vaccine to keep people safe from the hospitalization and death associated with severe COVID infections. On Wednesday, the European Medicines Agency and its British equivalent, the Medicines and Healthcare products Regulatory Agency, repeated that the benefits of the AstraZeneca jab outweigh the risks.)

Usually, drug manufacturers are liable for the safety of their products, and they spend many years developing and testing their drugs to ensure they are safe to use.

That’s not how things work in a pandemic.

Rather than years, companies such as BioNTech, Moderna and AstraZeneca managed to develop their COVID vaccines in a matter of months. And drug regulators, who would usually demand to see the final results of large-scale testing before approving any vaccine, have been issuing temporary authorizations while testing was still ongoing.

That’s the nature of this situation: COVID is a killer and it spreads fast, so speed is of the essence in fighting it. Nobody in the vaccine business has thrown caution to the wind, but it is equally true that nobody has had the luxury of being quite as cautious as they might like.

Which is why, in these circumstances, the pharma companies have mostly been absolved of liability over the potential side-effects of their COVID-19 vaccines. If problems were to arise, the people affected would need to look elsewhere for compensation.

And, history suggests, claiming that compensation won’t be easy.

“A very high threshold”

In most cases, liability would rest with the countries whose regulators issued the emergency authorizations. And the countries that accepted this fact early on—notably, the United States and the United Kingdom—are the ones that managed to conclude their negotiations with manufacturers first, giving them a headstart in vaccinating their populations.

“I presume that the risk is considered manageable [by governments] simply because these companies are profit-driven,” says Evelyn Tjon-En-Fa, the head of the Dutch dispute resolution practice at the law firm Bird & Bird. “If they don’t feel the benefits of bringing [a vaccine] into the market is worth the risk, they won’t do it.”

That’s because the pharma firms have been burned before.

Tjon-En-Fa points to the saga surrounding whooping-cough or pertussis vaccines in the 1970s and 1980s. At the time, some people claimed the pertussis components in the DPT (diphtheria, pertussis and tetanus) vaccines being administered to children were occasionally causing rare but permanent brain damage.

Although the link eventually turned out to be bogus, negative publicity sparked a wave of lawsuits against the vaccine manufacturers, some of which were successful. Most U.S. manufacturers responded by withdrawing their DPT vaccines, which had earned them only low margins, from the market. The affair prompted the creation of the National Vaccine Injury Compensation Program (VICP), which the drugmakers fund with a levy of 75 cents on each dose of their vaccines—in exchange, they cannot be sued in state or federal civil courts if an unanticipated and serious side effect emerges.

However, the VICP is designed for routinely administered vaccines, such as standard childhood jabs or the regular flu shot. In the case of COVID vaccines, the relevant scheme is the Countermeasures Injury Compensation Program (CICP), which was established under the 2005 Public Readiness and Emergency Preparedness (PREP) Act.

The Trump administration invoked the PREP Act in February 2020, near the start of this pandemic. It gives vaccine manufacturers and distributors four years of legal protection, unless willful misconduct can be proved. And, in theory, people suffering serious injury from COVID vaccines will be able to tap the CICP for compensation.

In reality, though, the CICP—which also handles the liability for medical countermeasures against things like Ebola and anthrax—has only accepted 39 of the 551 claims that have been filed since its 2010 creation. Of those, only 29 were compensated, for a total of $6 million.

“The PREP Act is very strict,” says Tjon-En-Fa. “The burden of proof is on the claimant [who has] to show willful misconduct on the producer of the vaccine. That’s a very high threshold, and that’s the reason so little has been paid out of this fund. I think it’s too high a threshold—you have to prove state of mind.”

When vaccines really go wrong

The whooping-cough vaccine scare may have been a dud, but it is not unheard-of for vaccines to go genuinely wrong for some of their recipients—and claiming compensation was no simple matter.

In 2009, decade before COVID-19 appeared, the world faced a different pandemic: a resurgence of the H1N1 influenza virus, or “swine flu” as this version was known. The drugmaker GlaxoSmithKline took a vaccine it had already developed to combat the H5N1 (bird flu) virus and quickly adapted it for swine flu. The new vaccine was pushed out in the U.K. and other European countries—it was never authorized in the U.S.—to inoculate health care workers, small children, and at-risk people such as asthmatics.

“By February 2010, doctors were noticing that there were large numbers of people being diagnosed with narcolepsy,” says Peter Todd, a consultant with the British law firm Scott Moncrieff. “This was within a few months [of the inoculations beginning] and they started to suspect that there could be a connection between these cases of narcolepsy and the pandemic vaccination campaign.”

Narcolepsy is a rare and incompletely-understood condition, probably an auto-immune disease, in which sufferers experience debilitating drowsiness, often falling asleep during the day. There is no cure.

Todd—who represented 88 of the affected people in the U.K. in their battle to claim compensation—estimates around 2,000 people across Europe developed narcolepsy when they were injected with Pandemrix. That’s out of more than 30 million people who received the vaccine. (GSK, the manufacturer, continued to deny any causal link as recently as 2019.)

Much as would happen in the current COVID-19 pandemic, GSK was indemnified against potential product liability claims because of the speed at which it had to roll out Pandemrix, which meant it could not complete safety testing before the deployment began. However, the British government resisted payouts from the U.K.’s Vaccine Damage Payments Scheme, on the basis that narcolepsy was not “severe” enough to merit compensation.

Todd says he is not free to confirm how the claims against GSK and the government were resolved. However, in 2017 the government lost a test case involving a boy who had developed narcolepsy after his vaccination, and a freedom-of-information request last year revealed that the government had paid out in six cases, for a total of £720,000 ($997,000).

“COVID is massively more dangerous than the pandemic in 2009 was, but there was the same need for a vaccine, urgently…and indemnity has been given to all the manufacturers,” says Todd.

In the U.K., a manufacturer’s immunity is theoretically whipped away if their vaccine is shown to be “defective,” meaning it isn’t as safe as people should reasonably expect. But, Todd says, it “would be difficult to prove a reasonable expectation of consumer safety” when most people know COVID-19 vaccines have been rushed out before their large-scale, long-term testing can be completed, to urgently fight an extremely dangerous disease.

That leaves the statutory scheme, which pays out a fixed sum of £120,000 to those suffering severe disablement—not a lot of money in such circumstances, and legal costs are also not reimbursed.

“The lessons weren’t really learned from Pandemrix,” says Todd. “What should have happened is that [the government] should realize there will always be pandemics, and there will always be a need for vaccinations to be developed quickly, and that’s always going to threaten clinical safety, so…instead of having a system that heaps the risk and loss onto unfortunate individuals, we need a system where we all stand together as a society.”

Clubbing together

Of course, not every society has the means to compensate affected people, if a problem with a COVID-19 vaccine were to emerge—but the manufacturers still won’t play ball unless they get their indemnity.

That’s what led to the creation in February of the world’s first and only global vaccine injury compensation fund, developed for the 92 low- and middle-income countries getting their doses through the World Health Organization-backed COVAX facility.

The fund, which is being administered by Chubb subsidiary ESIS, will potentially provide no-fault lump sum payments in cases of “serious adverse events” until mid-2022. It’s being funded by a 10-cent levy on each dose.

But is it really inevitable that the manufacturers get indemnity?

European resistance

The European Union has made much of the fact that it isn’t issuing emergency use authorizations for vaccines, like other countries have done. Noting that this route really amounts to clearing the temporary use of an unauthorized vaccine, it has instead granted BioNTech/Pfizer, Moderna, AstraZeneca and Johnson & Johnson one-year “conditional marketing authorizations” that—the European Commission claims—provide “safeguards that emergency use authorizations might not.”

Crucially, the Commission said in December, companies that receive conditional marketing authorizations don’t get to shed their liability, and remain as on-the-hook as they are when obtaining a standard authorization. “The marketing authorization holder will be responsible for the product and its safe use,” it said, adding that this wouldn’t be possible with an emergency use authorization.

In reality, though, the situation looks a little different.

When the European Commission published a redacted version of its advance purchase agreement with AstraZeneca, the document said each EU country shall indemnify AstraZeneca “from and against any and all damages and liabilities” relating to death, injury and illness.

The contract goes on to describe the situations in which the companies would not be indemnified—but this part is redacted. As with almost all the contracts involved in the vaccination push, crucial details are not available for the public to scrutinize.

The Commission stresses that its contracts preserve patients’ rights. “Patients can go to court as if the [advance purchase agreement] would not be there,” says a spokesman. “If the company is held liable it will have to compensate the citizen.”

However, the EU’s cautious approach may not last. With its vaccine rollout being tardier than those in the U.K., the U.S. and some other advanced economies, the Commission and the European Medicines Agency have come under fire over the relative slowness of the bloc’s vaccine authorizations.

So, at the start of March, the Commission conceded it was considering switching to emergency use authorizations, with “shared liability among member states.” No switch has been announced since then, but nor has the Commission rejected the idea. If the liability issue really is a blocker, it seems all options are still on the table.