Georgia's negligent-security law spent a decade drifting toward plaintiffs, then snapped back with a single statute. For any lawyer building a premises case against a property owner over a third-party attack, the moment turns on one question: did the cause of action arise before or after April 2025. The answer decides which of two very different foreseeability standards governs, and the leading case, Georgia CVS Pharmacy, LLC v. Carmichael, now marks the high-water line of the old regime.
What Carmichael held
In Carmichael, docketed as S22G0527, the Georgia Supreme Court in 2023 affirmed a multimillion-dollar verdict, reported at roughly $43 million, for a man shot in a CVS parking lot. The holding that mattered was doctrinal. A premises owner need not have known of a substantially identical prior crime to owe a duty to protect invitees from third-party criminal acts. Foreseeability, the court held, is measured by the totality of the circumstances, and it is a jury question in all but the clearest cases.
That framing was a gift to plaintiffs. It meant a security expert could build foreseeability from the neighborhood's crime data, the property's own incident history, the adequacy of lighting and patrols, and the general character of the location, rather than being forced to produce a near-identical prior shooting. Motions for summary judgment on foreseeability grew far harder to win, and the settlement value of parking-lot and apartment-complex cases climbed with the difficulty.
The plaintiff theory the ruling enabled
Under Carmichael, the plaintiff's case-building sequence was straightforward. Establish the owner's superior knowledge of the risk through crime-grid data and prior calls for service, show the security measures were inadequate to that known risk, and let the jury weigh whether the attack was reasonably foreseeable. The defense theory, that the criminal act was an unforeseeable intervening cause, became a fact question rather than a ticket out on summary judgment.
SB 68 rewrites the standard going forward
Then the legislature moved. Senate Bill 68, the 2025 tort-reform package signed in April, narrowed negligent-security liability sharply for causes of action arising after its effective date. Under the new standard, a property owner is liable for a third-party crime only where the owner had a particularized warning of imminent wrongful conduct, or knew of substantially similar crimes within a defined proximity of the property. That is a deliberate return to something close to the prior-similar-incidents rule Carmichael had loosened.
SB 68 did more than reset foreseeability. It requires juries to apportion fault to the criminal actor, and directs courts to set aside verdicts that fail to assign a reasonable share to the perpetrator, with a rebuttable presumption against allocations that put less fault on the criminal than on the non-criminal defendants combined. The statute also lets parties elect a bifurcated trial, separating liability and fault allocation from damages. Those procedural levers took effect immediately on signing, while the narrowed negligent-security standard applies only to claims arising afterward.
The dividing line is the accrual date. Carmichael governs the older cases still moving through the system; SB 68 governs everything that arises after April 2025.
What it means for case-building
The practical guidance splits by timeline. For an incident predating the statute, Carmichael is still your authority, and the totality-of-the-circumstances record remains the way to defeat summary judgment. Preserve the crime data and the property's incident history now, because those files are the spine of the foreseeability showing. Pull the calls-for-service logs for the address and a defined radius, the owner's prior incident reports, and any internal security assessments, and do it before litigation puts the owner on notice to let those records age out. For an incident after the effective date, the analysis is harsher: without a particularized warning or a genuinely similar nearby crime, the duty may not attach at all, and the apportionment rule means even a winning liability case can see its damages diluted by fault assigned to an absent, judgment-proof criminal.
Two drafting points follow directly. First, plead the specific prior crimes and the particularized-warning facts with dates and proximity, rather than a generic dangerous-neighborhood allegation, because the new standard rewards specificity and punishes the boilerplate that Carmichael tolerated. Second, in any post-statute case, build the damages proof to survive apportionment by developing the record on what a reasonable security program would have cost and prevented, so the jury has a concrete basis to weigh the owner's share against the criminal's.
Georgia is not alone in tightening these claims, and the pattern of legislatures overriding plaintiff-friendly premises rulings is one to watch nationally. We track the state-by-state movement in our industry news coverage, the underlying premises doctrine in our premises liability reporting, and the appellate decisions applying both standards in our case law and settlements analysis.
The takeaway
Carmichael has not been overruled, and it still controls a substantial inventory of pending Georgia cases. But it now sits on one side of a bright statutory line. Read the accrual date first, then choose the foreseeability theory that the date allows, and price the apportionment risk into any post-SB 68 file before you sign it.