The EU's Product Liability Directive Treats Software, Including AI Systems, as a Product

Directive (EU) 2024/2853, dated October 23, 2024, lays down the European Union's common rules on liability for damage caused to people by defective products. It repeals a directive of 1985 with effect from December 9, 2026. The new one applies to products placed on the market or put into service after that date. The old one still applies to products placed on the market or put into service before it. Member states must bring in the laws needed to comply by December 9, 2026.

Its definition of a product "includes electricity, digital manufacturing files, raw materials and software." Parts of the directive follow, not the whole.

What Counts as a Product

A recital explains the choice. Software, it says, such as operating systems, firmware, computer programs, applications or AI systems, plays an increasingly important role for product safety. In the interest of legal certainty, it says, software is a product for the purposes of no-fault liability, however it is supplied or used. That holds whether it is stored on a device, reached over a network or the cloud, or supplied as software-as-a-service. A developer or producer of software, including AI system providers under the EU's AI law, should be treated as a manufacturer.

There are limits. Information is not a product, the recital says. So the rules do not apply to the content of digital files, such as media files or e-books, or to "the mere source code of software." And the directive does not apply to free and open-source software developed or supplied outside the course of a commercial activity.

What Counts as Defective

A product is defective when it does not provide the safety that a person is entitled to expect, or that the law requires. All circumstances are taken into account. Among them, the directive lists the effect on the product of "any ability to continue to learn or acquire new features" after it is placed on the market or put into service. It lists the foreseeable effect of other products used with it, including by inter-connection. It lists safety requirements, "including safety-relevant cybersecurity requirements."

Another item on the list, for a product whose very purpose is to prevent damage, is "any failure of the product to fulfil that purpose."

That item reaches the quiet failure. For an alarm that never sounds, failing at its one job is itself part of the case.

A product is not defective just because a better product, including updates or upgrades, has already been or is later placed on the market.

Damage, Including Data

The right to compensation covers death or personal injury, including medically recognized damage to psychological health. It covers damage to property, with exceptions that include the defective product itself and property used exclusively for professional purposes. And it covers the "destruction or corruption of data that are not used for professional purposes."

Compensation covers all material losses that result from that damage. It covers non-material losses too, in so far as national law allows.

Updates and Control

An economic operator, such as a manufacturer, is not liable if it proves that the defect probably did not exist when the product was placed on the market or put into service, or came into being later. That defense does not apply where the defect is due to a related service, or to software, including software updates or upgrades. Nor does it apply where the defect is due to "a lack of software updates or upgrades necessary to maintain safety," or to a substantial modification of the product. Each exception holds only where the cause is within the manufacturer's control.

For software that keeps changing after the sale, the sale is not the end of the maker's exposure. While the maker controls the updates, an update, or a missing safety update, can be the defect.

Proof, Defenses and Time Limits

A claimant must prove the product was defective, the damage suffered, and the causal link between the two. The directive also sets presumptions. Defectiveness is presumed where, for example, the claimant shows the damage was caused by "an obvious malfunction of the product during reasonably foreseeable use or under ordinary circumstances." A national court shall also presume defectiveness, the causal link, or both, under two conditions. First, despite the disclosure of evidence, the claimant faces excessive difficulties proving them, "in particular due to technical or scientific complexity." Second, the claimant shows that they are likely. The defendant has the right to rebut any of these presumptions.

There are other defenses. One is that the objective state of scientific and technical knowledge was not such that the defect could be discovered. That is judged at the time the product was placed on the market or put into service, or while it was within the manufacturer's control.

The directive sets a limitation period and an expiry period. A claim must be brought within three years. That period runs from the day the injured person became aware, or should reasonably have become aware, of the damage, the defect and who can be held liable. National rules on suspending or interrupting that period are not affected. And the right to compensation ends 10 years after the product was placed on the market or put into service, unless the injured person has by then started proceedings against an economic operator that can be held liable under the directive. For a substantially modified product, the 10 years run from when it was made available or put into service after the modification. Where the latency of a personal injury kept the injured person from starting proceedings within those 10 years, the right ends after 25 years instead, unless such proceedings have been started by then.

Member states have until December 9, 2026, to bring in their own laws.