The Law Commission of England and Wales Provisionally Proposes Treating Software and AI Systems as Products Under the Consumer Protection Act

The Law Commission of England and Wales describes itself as "an independent body established by statute to make recommendations to Parliament to reform the law." On October 8, 2026 it published a summary of its consultation paper on product liability, the law that "governs who may be held liable for damage caused by defective products and how those harmed can obtain compensation." In England and Wales that law sits in Part 1 of the Consumer Protection Act 1987, under which consumers can claim for personal injury or certain property damage caused by defective products "without having to prove fault on the part of the defendant."

The summary says the regime "has not kept pace" with digital technologies and online platforms. Its proposals, it says, "are provisional and should be understood as such." Responses close on January 14, 2027. The Commission says it will publish its final recommendations in a report late in 2027, and that it will then be "for the Government of the day to decide" whether to progress them. Parts of the summary follow, not the whole.

What Would Count as a Product

The Act's definition of a product, the summary says, "was designed primarily with tangible goods in mind" and "does not easily accommodate digital technologies such as software and AI systems that may cause injury or damage." The Commission calls that "a potential gap in the regime."

It proposes that software and AI systems be treated as products under the Act, "regardless of whether they are delivered on or embedded into a physical product or supplied digitally." Such systems, it says, "often replace or control processes that were previously mechanical, and can give rise to risks of personal injury or property damage." And the case for bringing them in is "particularly strong given the evidential difficulties they can create for claimants," especially, it says, for AI systems, which "can make it very difficult for claimants to establish how and why harm has occurred." The summary points to the asymmetry of knowledge between claimant and developer, the developer typically having exclusive insight into the system's design, training and operation.

The Commission does not propose a specific exemption for non-commercial open-source software. Developers who make open-source software available "on a genuinely non-commercial basis would generally fall outside the regime," because the Act already leaves out a producer who supplies a product outside the course of business and without a view to profit. Open-source software supplied "in the course of business and/or with a view to profit" would fall within it, "even where users do not pay for it directly." Services would stay outside the Act, the Commission proposes, including services "that are interconnected with a product, or that are required for a product to function."

Defect, and Proving It

Under the Act, the summary says, "A product is defective if its safety falls below the level that persons are generally entitled to expect." The summary says the breadth of that definition can generate confusion, inconsistency in its application and uncertainty, "particularly in technically complex cases," and that these difficulties "are likely to become more pronounced in the context of products with digital elements." Many such products "operate in opaque, technically complex ways that are not readily understood by the public." They can be modified remotely, "for example through software updates, making their performance programmable and capable of change over time."

The Commission proposes a non-exhaustive list of principles for judging defect, and updated and additional circumstances for the courts to consider. Among the circumstances are "whether a product intended to prevent damage fulfils that purpose," the product's ability to learn or acquire new features after supply, and the producer's control after supply, "including their ability to modify the product by software update, upgrade or otherwise, to address risks of harm."

The summary also describes cases where the available evidence is insufficient to determine whether a product is defective, "not merely because the claimant has failed to discharge the burden of proof, but because the relevant evidence does not exist or cannot be obtained." In such cases, it says, "the claim will fail and the loss will fall entirely on the claimant." The Commission does not consider that fair where the defendant "has created and profited from the risk," and says such cases are "likely to become more frequent as increasingly complex and opaque technologies, including AI systems, become more widespread and their operation more difficult to understand and explain."

For those cases it proposes a rebuttable presumption of defect, "subject to strict thresholds." The claimant would have to satisfy the court that it is arguable the product is defective, that the facts relied on are not fanciful, that it faces exceptional evidential difficulties due to the limited availability of evidence, and that the risk of harm is not so widely known as to be socially accepted. The defendant would then choose. It could try to rebut the presumption, and if it failed, damages would be assessed as if defect had been proven. Or it could accept the alleged defect, and the court would allocate the risk between them, starting from "an award of 50% of the damages that would have been recoverable had defect been established," which the court could adjust. Either way, that holds only if the claimant establishes damage and causation and no defense applies. Evidence that does not exist or cannot be obtained is the case the summary treats as exceptional. The proposal does not supply that evidence. Past its thresholds, it decides who carries the loss without it.

Defenses, the Long-Stop and Data

The Act gives a defendant a defense where the defect did not exist in the product at the relevant time, generally the time of supply. The summary says that defense "does not adequately account for products that can be modified after supply, including modern products such as smartphones that receive regular software updates to maintain and improve their performance." A producer "may cause a product to become defective after it has been supplied, for example by introducing a faulty software update or by failing to provide an update necessary to address a safety risk."

The Commission proposes that a defendant should not be able to rely on the defense "if they caused the product to become defective after that time," and that this would include a producer who "fails to provide necessary software updates or upgrades." The development risks defense, which turns on the state of scientific and technical knowledge, "should be retained and should apply to all products and industries." But where the producer causes the product to become defective after supply, the state of knowledge "should be assessed at the time the product became defective, rather than at the time of supply."

The long-stop would change too. Under the Act it extinguishes any right of action "ten years after the product was supplied." The Commission proposes that it reset where a product is substantially modified after supply. If the modification is within the original producer's control, time "should restart from the date when the modified product is made available." If it is made by a person outside that control, "time for the original producer should remain uninterrupted," and the modifier's time starts when it supplies the modified product "in the course of their business and/or with a view to profit." The Commission does not consider that an AI system's ordinary self-learning would count as a substantial modification. It also proposes that the long-stop "be extended to 25 years for latent personal injury claims, but only where it was not possible for the claimant to initiate proceedings within the initial 10-year period due to the latent nature of the injury."

On data, the Commission proposes that the Act recognize "destruction and corruption of data (as distinct from data leaks or breaches of data protection rules)" as damage that can be compensated, "unless the data is used exclusively for professional purposes." It also asks, as an exploratory question, whether loss of access to data held on or accessed via a product should be recognized too, where that data is not used exclusively for professional purposes, "given that it may have practical consequences similar to those of the destruction or corruption of data."