The notion of software operating correctly didn't really come up. We're not talking about regulating the reliability or effectiveness of software, but rather the security vulnerabilities, and I suspect the regulations would treat the seriousness of different vulnerabilities by the actual harm they can do, just like flaws in the manufacturing of cars. And sure, there are still cases where one could argue about whether a certain attribute of a certain piece of software constitutes a security vulnerability or not, but that's okay. Laws aren't mathematical proofs. There is undoubtedly some ambiguity and room for reasonable debate in the specifics of car safety regulations as well.

> You don't say your car made a mistake when it refuses to start one cold morning. There's essentially universal agreement on the 'semantics' of cars and bridges.

Since you mentioned it...I don't know whether this is the case, but I would guess that there might be regulations about the temperatures at which car batteries and other components must be capable of operating at. And, as car automation software becomes more advanced and prominent, I think we'll be discovering that there is not in fact universal agreement on the "semantics" of cars. There is probably already considerable overlap in the subjects of my analogy, for recent self-driving capabilities but also for much older standard things like airbags and anti-lock braking systems.