Software Professionals, Malpractice Law, and Codes of Ethics

We all know what a professional is—or do we? For years, ACM has proclaimed that its members are part of a computing profession. But is it really a profession? Many people describe themselves as "professionals" in the colloquial sense of being paid to perform some specialized skill. Yet, only a few occupations are regarded as professions in the legal sense. Courts do not consider athletes or chefs to be professionals the way doctors and lawyers are. Likewise, courts have consistently excluded software developers from that select group.

To understand why U.S. law does not recognize computing as a profession—and whether that classification could be changed—calls for a fresh look at the law of professions. Why does the law distinguish professionals from nonprofessionals such as mechanics or pilots? What would happen if courts treated software developers like doctors or lawyers? What are professionals' legal duties of care and how do they differ from ethical codes of conduct? Can one bootstrap the other?

U.S. tort law draws a clear distinction between professionals and nonprofessionals. When nonprofessionals cause injury to others, they can be sued for ordinary negligence. Their conduct is compared to that of the "ordinary reasonable person." For example, when a homebuyer sues a home inspector for failing to disclose a material defect, the jury must decide whether the inspector acted with reasonable care. Defendants who fail that common-sense standard must pay damages for the harm they caused.

Evidence of industry custom can be considered, but the jury is free to override it based on the jurors' own personal understanding of how reasonable people are expected to behave. Thus, even if the inspector followed an industry-standard checklist, the jury could find the checklist itself to be deficient. That rule prevents an entire industry from hiding behind an obviously negligent custom.

By contrast, professionals like doctors and lawyers are subject to malpractice claims. The relevant metric is the custom of the profession—not the ordinary reasonable person or even the ordinary reasonable professional. Under this "customary care" standard, the jury is restricted to evaluating whether the defendant complied with the profession's internal customs and norms. In a medical malpractice case, what matters is whether the doctor followed practices accepted by other peers in the same field, not whether the jury feels those customary practices were reasonable. Juries are not free to substitute their own views on how the professional should have acted.

Most legal scholars agree the list of professions includes medicine and law. Beyond that there is little consensus as to who else qualifies. A scattering of court decisions have allowed accountants, architects, engineers, social workers, or even sports coaches. One leading legal authority, the Second Restatement of Torts, recommends extension to "skilled trades" such as airplane pilots, precision machinists, electricians, carpenters, blacksmiths, and plumbers.^a A more recent version, the Third Restatement of Torts, argues in favor of adding insurance agents but not construction contractors.^b Despite the many candidates, there is still great uncertainty as to which occupations should be treated as professions, and why.

The computing industry is not on any of those lists. On the contrary, every court to consider this question has refused to recognize software developers as professionals. The leading case is Hospital Computer Systems, Inc. v. Staten Island Hospital,^c in which the court recited a long list of traits that the professional possesses but that the software developer lacks. The judge wrote: "A profession is not a business. It is distinguished by the requirements of extensive formal training and learning, admission to practice by a qualifying licensure, a code of ethics imposing standards qualitatively and extensively beyond those that prevail or are tolerated in the marketplace, a system for discipline of its members for violation of the code of ethics, a duty to subordinate financial reward to social responsibility, and, notably, an obligation on its members, even in nonprofessional matters, to conduct themselves as members of a learned, disciplined, and honorable occupation."^d

Most legal scholars agree the list of professions includes medicine and law. Beyond that there is little consensus as to who else qualifies.

As one leading computer law treatise summarized: "Computer programmers commonly define themselves as 'professionals.' Yet, despite the complexity of the work, computer programming and consultation lack the indicia associated with professional status."⁵

At first sight, those cases seem to imply that meeting the professional indicia will provide an automatic pathway to professional status. If one accepts that premise, then it makes sense to push the computing industry to check the appropriate boxes. Thus, many universities have sought to formalize accreditation standards for computer science and engineering degrees. Some members of the community have advocated for state licensure and professional exams for software engineering.

That pursuit of professional status also explains why ACM approved major revisions to its Code of Professional Conduct in 1992—the same year that Hospital Computer Systems was decided. The authors who led the revisions explained that ACM was "tak[ing] a new direction" in order to achieve greater "consensus and commitment of its members to ethical behavior."¹ Those efforts, in turn, would "help persuade the public that professionals are deserving of its confidence and respect, and of increased social and economic rewards."^e With the latest revisions in 2018, ACM has again proclaimed that "computing is a profession," and that members should uphold "the responsibilities the profession has to the larger society that it serves."²

But who generated this list of professional traits? Are we sure that formal education, licensure bars, and codes of ethics properly distinguish professionals from nonprofessionals? After all, although countless occupations have faithfully pursued this formula, courts remain reluctant to extend the professional designation much beyond the traditional domains of medicine and law.

In fact, this list of professional traits can be traced back to early work in organizational sociology. Early 20^th-century sociologists sought to identify the key traits that separated the "gentlemanly" professions—such as medicine, law, and clergy—from other, common-class occupations. That work produced lists of traits closely resembling the indicia described in the Hospital Computer Systems case. Yet, later critics condemned the trait-based approach as being "essentially atheoretical"⁷ and suffering from status quo bias and confirmation bias.⁴ They accused earlier thinkers of "becom[ing] the dupe of established professions"⁶ and inventing arbitrary factors that serve only to lock in elitist class distinctions. That lock-in effect remains evident in the judicial case law today.

Is there a better way to distinguish professionals from nonprofessionals? In short, yes. The key distinction between professionals and nonprofessionals is the legal substitution of "customary care" for the ordinary "reasonable care" standard. That substitution is an important safeguard when the practice is not a precise science but an inexact art, and thus there is a great need for the exercise of professional judgment. Arguably, this need for professional judgment arises when three conditions are met: bad outcomes are inevitable in the practice; those bad outcomes are attributable to inherent uncertainties in the science of the field; and the practice is socially vital even where bad outcomes are especially likely to occur.³

The first factor is important because it means run-of-the-mill practitioners will face questions of tort liability. Doctors and lawyers, for example, are lightning rods for tort claims because they are expected to intercede in fraught areas with a high likelihood of failure. Doctors are encouraged to treat patients who are unlikely to survive, just as lawyers are encouraged to represent defendants who are unlikely to be acquitted. By contrast, barbers and cosmetologists are not expected to injure their clients in the ordinary course of performing their services. The professional designation is unnecessary when one is unlikely to be sued.

The second factor gets to the heart of the distinction between professional judgment and professional expertise. When the science of the field is inherently uncertain in light of current knowledge, even experts can reasonably disagree about the appropriate course of action in a particular instance. Medicine and law are inexact sciences. That uncertainty makes it problematic to allow a judge or jury to second-guess the judgment calls that the professional does make. In other words, it is important to judge a professional's actions in light of the full range of choices that would be acceptable in the field.

This explanation also provides a crisp justification for why courts have refused—and will likely continue to refuse—to extend the professional designation to skilled trades such as electricians and plumbers. Although skilled artisans possess a high degree of specialized expertise, there is also high uniformity in best practices. When electricians cause fires or plumbers cause water damage, there is less uncertainty about which safety principles should have been followed.

The third factor reserves the professional designation for only those activities that are truly vital to societal functioning. A reduction in medical or legal services would diminish care for the neediest cases. Doctors and lawyers provide essential services for the community and their disappearance can be a crippling loss. Similar reasoning could be extended to other occupations such as clergy and teachers, as well as to firefighters, police, and other critical personnel. By contrast, many dangerous activities can be deterred or even prohibited without ill effect on society. For example, tiger keepers are ineligible for professional status even if their work involves a high degree of risk and uncertainty.

The key distinction between professionals and nonprofessionals is the legal substitution of "customary care" for the ordinary "reasonable care" standard.

This alternate framework offers a clearer, more compelling case for legal recognition of software workers as a profession. Unlike the trait-based test, which rests on antiquated notions of class nobility, the judgment-based test addresses a problem of modern science. Despite decades of maturation, the practice of software development—like medicine and law—remains deeply uncertain. Any software system of nontrivial complexity is expected to have undetected faults and errors despite careful design and testing practices. Yet, once an error is exposed, it is too easy for outside observers to second-guess one's coding practices and characterize them as careless. Under the ordinary "reasonable care" standard, software liability looks essentially random and unpredictable. Instead, requiring judges and juries to use the "customary care" standard would allow software experts to define a range of acceptable practices, as well as a minimum floor of competence. Ultimately, the professional malpractice framework would improve software quality by offering more sensible legal oversight.

The professional malpractice framework is a nuanced tool capable of addressing a broad range of practice arrangements. For example, both medicine and law can be performed by solo practitioners or large teams, by generalists or specialists, and in local or national regions. Moreover, who counts as a "member" of a profession can be determined on a case-by-case basis, just as courts have considered whether the medical profession should include dentists, nurse practitioners, orthopedists, and other related occupations. That heterogeneity should allay concerns that the practice of software development does not look enough like the practice of medicine or law. Customary practices for building cyber-physical systems can and do differ from those for developing database systems, just as they do for enterprise applications versus mobile apps.

Finally, a word should be said about the role of ethics in governing professional conduct. For nonprofessionals, ethical codes of conduct have little bite in determining legal duties of care. If a jury finds one's conduct to be unreasonable, it is no defense to argue that one's conduct was ethical. For professionals, however, evidence of customary practice is decisive. Accordingly, a code of ethics can be deeply influential in shaping the legal duties of professionals, as long as that code reflects and guides actual norms among the professional community.

Much of the computing community has assumed that a more robust commitment to ethics is a prerequisite for legal recognition as a profession. That assumption is exactly backward. Professional malpractice law is needed to catalyze a robust code of ethics. The lesson is this: the best way for ACM's Code of Ethics to make a meaningful difference in changing software development practices is for courts to recognize software as a profession.