dissenting.
I respectfully dissent.
1. Deese contends, under a theory of premises liability, that he was injured as a result of the bank’s negligence in executing its security procedures and in failing to warn him of the danger posed that morning. OCGA § 51-3-1. “Where an owner or occupier of land, by express or implied invitation, induces or leads another to come upon his premises for any lawful purpose, he is liable in damages to such persons for injuries caused by his failure to exercise ordinary care in keeping the premises and approaches safe.” OCGA § 51-3-1. “The proprietor is not the insurer of the invitee’s safety, [cit.] but is *279bound to exercise ordinary care to protect the invitee from unreasonable risks of which he or she has superior knowledge. [Cit.] If the proprietor has reason to anticipate a criminal act, he or she then has a ‘duty to exercise ordinary care to guard against injury from dangerous characters.’ [Cit.]” Lau’s Corp. v. Haskins, 261 Ga. 491, 492 (1) (405 SE2d 474) (1991). It is undisputed that Deese was the bank’s invitee.
The court’s order granting summary judgment states: “a proprietor has a duty to protect an invitee from injury caused by a third party’s criminal act only when the proprietor had knowledge of a prior substantially similar incident.” That is incorrect. “[A] showing of prior similar incidents on a proprietor’s premises is not always required to establish that a danger was reasonably foreseeable. ‘An absolute requirement of this nature would create the equivalent of a “one free bite rule” for premises liability, even if the (proprietor) otherwise knew that the danger existed.’ [Cit.]” Shoney’s, Inc. v. Hudson, 218 Ga. App. 171, 173 (2) (460 SE2d 809) (1995). The issue is whether there is “evidence of record that [the] defendant had knowledge that its customers were in danger of criminal attack” on its premises. Id. at 173-174 (2); see also Lay v. Munford, 235 Ga. 340 (219 SE2d 416) (1975); Howell v. Three Rivers Security, 216 Ga. App. 890, 892 (456 SE2d 278) (1995); Good Ol' Days Downtown v. Yancey, 209 Ga. App. 696, 697-698 (2) (434 SE2d 740) (1993).
2. Deese asserts that the bank violated federal banking regulations requiring security systems and procedures, see 12 CFR §§21.1-21.4, and thus was negligent per se. OCGA § 51-1-6; see Walter v. Orkin Exterminating Co., 192 Ga. App. 621, 624-625 (3) (385 SE2d 725) (1989); Dupree v. Keller Indus., 199 Ga. App. 138, 141-142 (1) (404 SE2d 291) (1991); Central of Ga. R. Co. v. Butts, 211 Ga. App. 619, 620 (2) (440 SE2d 218) (1994). “ ‘In determining whether the violation of a statute[, regulation,] or ordinance is negligence per se as to a particular person, it is necessary to examine the purposes of the legislation and decide (1) whether the injured person falls within the class of persons it was intended to protect and (2) whether the harm complained of was the harm it was intended to guard against. (Cits.)’ [Cit.]” Horney v. Panter, 204 Ga. App. 474, 476 (2) (420 SE2d 8) (1992); accord Rabinovitz v. Accent Rent-A-Car, 213 Ga. App. 786 (446 SE2d 244) (1994).
This analysis differs from an inquiry as to whether the Bank Protection Act itself provides an independent federal cause of action. See Sadler v. Citibank, N. A., 947 F2d 642 (2nd Cir. 1991); Bowden v. McAndrew, 434 NW2d 195 (Mich. App. 1988). The cause of action is based in OCGA §§ 51-1-6 and 51-3-1; the proprietor’s duty is based in the Bank Protection Act. “OCGA § 51-1-6 provides for recovery of damages upon breach of a legal duty and specifies that the require*280ment under the law to perform or refrain from doing an act must be for the benefit of the injured person. ‘One of the problems arising out of the question of duty is the parties’ status and their relation to each other.’ [Cit.] Does the defendant owe the duty to this plaintiff? If a defendant owes no legal duty to the plaintiff, there is no cause of action in negligence. [Cit.] ‘ “(W)hat duty a defendant owed a plaintiff is ... a policy problem — a matter of law.” (Cit.)’ [Cit.]” Dupree, supra at 141 (1). Whether the bank owed a duty to Deese is determined by the analysis quoted above from Homey, supra.
The parties do not dispute that the bank falls under the regulations set forth in 12 CFR § 21.1 et seq., which require that each bank designate an officer responsible for developing and administering a written security program to protect the bank from robberies. 12 CFR § 21.2. The security programs must establish procedures for opening the bank for business, training the employees in their responsibilities under the security program during a robbery, and selecting and maintaining security devices. 12 CFR § 21.3 (a) (1), (3), & (4). Security devices must include an alarm system that promptly informs police of any attempted robbery, and other devices as may be appropriate in light of certain stated circumstances. 12 CFR § 21.3 (b). Deese argues that the behavior of the employees on the morning of the robbery, and the failure of the alarms to sound when they should have been activated, would allow a jury to conclude that the bank violated the duties imposed by these regulations.
The bank responds that negligence per se cannot be established because the regulations do not have as their purpose the protection of customers. 12 CFR § 21.1 et seq. was issued pursuant to 12 USC § 1882, part of the Bank Protection Act of 1968. The Code section requires administrative agencies to promulgate regulations for the “installation, maintenance, and operation of security devices and procedures ... to discourage robberies . . . and to assist in the identification and apprehension of persons who commit such acts.” The Senate Report addressing the Act contains a section entitled “Need for the Legislation.” S. Rep. No. 1263, 90th Cong., 2d Sess. (1968), reprinted in 1968 USCCAN 2530, 2531-2533. After reciting statistics concerning bank robberies and the amount of money lost to robbers, the Report states “more important than these monetary losses are the injuries and deaths often suffered by bank employees and customers during bank holdups. Law enforcement officials and innocent bystanders in the streets also sometimes fall victim to the shootings and high-speed automobile chases that follow the robbery of a financial institution. . . . Clearly, the large number of injuries and deaths in 1967 indicates a pressing need for this type of legislation.” 1968 USCCAN at 2531-2532.
The legislative history shows that the “more important” purpose *281behind the passage of the Bank Protection Act was to protect customers and employees from injury due to the violence that can surround a bank robbery. That was the “more important” reason behind requiring banks to adopt measures to discourage robberies. Deese, the bank’s customer, was injured by just the type of violence addressed. He was in the class of persons the Bank Protection Act intended to protect, and the harm he complains of was one of the harms the Act envisioned. Homey, supra. The regulations were put forth to further the Act, and a violation of them gives Deese a basis for a claim of negligence per se.
3. Even if the bank’s actions did not constitute negligence per se, Deese contends a jury could determine that the bank breached a duty to him that arose otherwise. He argues the bank had a duty to exercise ordinary care to guard him against injury from the robber because of the specific circumstances occurring on the bank’s premises that morning. See Days Inns of America v. Matt, 265 Ga. 235 (454 SE2d 507) (1995); Lau’s Corp., supra; Sun Trust, supra. The bank contends no duty arose because there had been no previous similar incidents of criminal attack on the premises, and Deese’s injuries were therefore not reasonably foreseeable. That is answered in Division 1 hereof.
Despite the absence of prior similar incidents on the premises, the circumstances of what occurred that morning allow a conclusion that the bank had knowledge criminal activity was in the offing. That is why Collins activated the security procedures and it is what Roberts suspected when she looked inside. The bank’s knowledge of a possible robbery makes it reasonably foreseeable a criminal attack on its customers might occur in the process and, viewing the evidence most favorably to Deese, the bank knew what was happening while Deese did not. Thus, the bank had superior knowledge of the risk involved and was required to exercise ordinary care to protect Deese from that risk. If Deese is believed, he was left ignorant of the circumstances and thus deprived of the opportunity to protect himself, while bank employees were alerted and could take appropriate measures. A jury could conclude the bank did not exercise ordinary care for Deese’s safety.
Although this factual situation has not previously been seen in Georgia reports, other states have addressed the issue of what duty a bank owes to protect its customers when it is aware it is being robbed. In Sinn v. Farmers’ Deposit Savings Bank, 150 A 163, 164 (Pa. 1930), a customer entered a bank and was directed to a teller’s window despite the fact that the teller knew a robber was in the bank with a bomb that eventually injured the customer. There, as here, “[t]he opportunity to warn plaintiff was present, for [the bank could] easily have suggested his withdrawal because of the threatened dan*282ger. Then, had he failed to heed the warning, it would have been his own fault.” Id. This differs from a situation in which a customer is present when a robbery is announced, has the same knowledge as the bank, and there is no opportunity to warn him. See Boyd v. Racine Currency Exchange, 306 NE2d 39, 41 (Ill. 1973). While the bank contends Deese was warned and did fail to heed, as noted above, that is a matter in dispute.
Despite knowledge of the possible robbery, the bank contends negligence cannot be shown because it could not have foreseen Deese would be attacked after the robbery and after he deliberately rammed the robber’s car. “ ‘ “ Tn order for a party to be liable ... for negligence, it is not necessary that he should have been able to anticipate the particular consequences which ensued. It is sufficient, if in ordinary prudence he might have foreseen that some injury would result from his act or omission, or that consequences of a generally injurious nature might result. (Cits.)’ ” [Cit.]’ [Cits.]” Ga. Osteopathic Hosp. v. O’Neal, 198 Ga. App. 770, 776 (9) (403 SE2d 235) (1991). The issue is whether “ ‘ “the possibility of an accident was clear to the ordinarily prudent eye.” (Cits.)’ ” Western Stone &c. Corp. v. Jones, 180 Ga. App. 79, 80 (348 SE2d 478) (1986).
Although the specific incident which occurred would take imagination to predict, it was clearly foreseeable that some injurious consequence might result from failing to properly execute the security procedures or to advise Deese to leave the premises and remove himself from harm’s way. That the injury actually occurred after the robber left the building but while he was still on the premises does not take it outside the scope of foreseeability, nor make it “after the robbery.” The getaway was part of the criminal act, the event of which the bank had received warning.
In premises liability cases in which the ultimate injury is caused by a criminal actor, anticipating “the particular consequences” that ensue will always be difficult, but that does not end foreseeability. In Ga. Osteopathic Hosp., supra at 770, a patient was killed by police when he “went berserk” due to a drug reaction. The defendant hospital claimed that the policeman’s action must be considered the proximate cause of the death and that it was not foreseeable he would begin attacking people with a knife and be shot by police. Id. at 777 (9). We rejected that argument, stating “it was certainly foreseeable that the negligent administration of an inappropriate medication might result in injury to him.” Id. There, as here, the details of the injury might not have been predictable, but that an injury could result was foreseeable. Similarly, it was foreseeable that an injury would result because a psychotic adolescent was released on a temporary basis from a mental hospital; that he stabbed his father was a specific detail that did not affect the issue of foreseeability. Swofford *283v. Cooper, 184 Ga. App. 50, 53-54 (3) (360 SE2d 624) (1987), aff'd, Cooper v. Swofford, 258 Ga. 143 (368 SE2d 518) (1988). Accord Burdine v. Linquist, 177 Ga. App. 545, 546-547 (340 SE2d 198) (1986) (prior burglaries make crime foreseeable; it need not be specifically foreseen that crime will be armed robbery); Bayshore Co. v. Pruitt, 175 Ga. App. 679, 680 (1) (334 SE2d 213) (1985) (prior break-ins on ground-level apartments make break-in of second-floor unit foreseeable).
The bank also argues that any act of negligence on its part was not the proximate cause of Deese’s injuries. However, the bank raises this issue for the first time on appeal. In its motion for summary judgment, brief in support thereof, “Statement of Theory of Recovery,” and “Statement of Material Facts as to Which There Exists no Genuine Issue,” the bank only addressed the issue of whether it owed any duty to Deese. After Deese responded to the motion, the bank filed a “Brief in Reply to Plaintiff’s Brief in Opposition to Defendant’s Motion for Summary Judgment” in which, again, it only addressed the duty issue. The law of summary judgment does not place any “burden on a plaintiff to respond to issues which are not raised in the motion for summary judgment or to present its entire case on all allegations in the complaint — even on issues not raised in the defendants’ motion. Indeed, until [the bank] pierced the allegations of [Deese’s] complaint on a particular issue, he was neither required to respond to the motion on that issue ([cits.]), nor required to produce evidence in support of his complaint on that issue. [Cits.] The issues that must be rebutted on motion for summary judgment are those raised by the motion. Consequently, [Deese] was not required to present proof on all matters raised in his complaint until appellees pierced his complaint on those issues.” Hodge v. SADA Enterprises, 217 Ga. App. 688, 690 (1) (458 SE2d 876) (1995).
Proximate cause has never been raised or argued in the trial court and this should preclude any decision by this Court on the issue. “As a court of review, this court does not decide questions which were not raised and ruled on and preserved in the record below. [Cit.]” Atlanta Gas Light Co. v. Ga. Pub. Svc. Comm., 212 Ga. App. 575, 577 (1) (442 SE2d 860) (1994).
Even if we consider the issue of proximate cause under the “right for any reason” theory, Hodge, supra at 690-691 (2), the issue should not be decided by summary judgment. Deese’s ramming of the robber’s car took place after the bank’s negligence and before his injury, and the bank argues his actions were the proximate cause of his injury so as to relieve the bank of liability as a matter of law. While proximate cause is ordinarily a question for the jury, lack of proximate cause may be decided as a matter of law when “ ‘ “the causal connection between [the defendant’s] conduct and the injury is too *284remote for the law to countenance a recovery.” ’ [Cit.]” Strickland v. DeKalb Hosp. Auth., 197 Ga. App. 63, 67 (2) (d) (397 SE2d 576) (1990). This, however, is not such a case; the bank’s conduct in not warning its customers about an armed robber on the premises is not remote from injury resulting from an attack by that robber on a customer. Compare McAuley v. Wills, 251 Ga. 3 (303 SE2d 258) (1983) (death of a baby the day after birth too remote from an accident that left the mother a paraplegic before the baby’s conception); Southern Bell Tel. &c. Co. v. Dolce, 178 Ga. App. 175 (342 SE2d 497) (1986) (injury to pay-phone patron resulting from vehicle’s brakes failing on a road adjacent to parking lot next to which telephone company placed a public phone too remote from act of placing and maintaining phone at that location).
The majority’s recitation of the facts here is accurate, but places emphasis on an irrelevancy. It does not matter whether Deese knew the man who came out of the bank and pointed a shotgun at him was a robber or a disgruntled employee. The issue as it relates to proximate cause is not Deese’s knowledge but whether the bank’s negligence in not properly following its security procedures and not warning Deese of the danger posed by the robber are too remote from the injury for the law to countenance a recovery. Strickland, supra. Deese reacted to the danger presented. Although the majority characterizes Deese’s action in ramming the robber’s car as “for his own reasons,” he clearly deposed that his reason was self-defense; he feared that when the robber had gotten his car clear he would shoot and the only way to prevent it was to take offensive action. He did so because the bank did not warn him or cause its alarms to sound. Under these circumstances it cannot be said that the reason he acted in this way was “not because of anything NationsBank did or failed to do.” While Deese had the additional goal of disabling the car and calling the police, that does not preclude a jury from determining that the bank’s negligence placed him in a position which forced him to reasonably act in self-defense.
Even if Deese’s actions after the robber exited the bank are considered an independent cause, proximate cause is still a jury question; this is not a case in which the defendant’s negligence posed “ ‘no danger . . . except because of the independent cause.’ ” Western Stone, supra at 81. Allowing an unwarned armed robbery poses a danger to customers, regardless of any later independent cause. It is not “unreasonable, as a matter of law, to resist an assailant.” Killebrew v. Sun Trust Banks, 216 Ga. App. 159, 161 (1) (453 SE2d 752) (1995), rev’d on other grounds, Sun Trust Banks v. Killebrew, 266 Ga. 109 (464 SE2d 207) (1995).
Further, the fact that federal law and associated regulations require banks to take security precautions to protect their customers *285from the harm posed by robbers shows federal law, at least, recognizes a degree of proximate cause between bank security measures and harm to bank customers. As noted above, protecting customers from such harm was a major reason the Bank Protection Act required banks to implement such measures. When they failed, the customer was harmed. Foreseeability and proximate cause should be left to the jury.
Decided June 28, 1996 Reconsideration denied July 12, 1996 Kirbo & McCalley, Thomas L. Kirbo III, Jon V. Forehand, for appellant. Long, Weinberg, Ansley & Wheeler, Joseph W. Watkins, Griffith J. Winthrop III, for appellee.I am authorized to state that Presiding Judge McMurray and Judge Ruffin join in this dissent.