You're right, there doesn't have to be criminal penalties. Codifying compensation requirements for buggy software seems like it would need to be very broad and effectively a useless law, though.
Courts are our mechanism for sorting out the details, not legislation.