Directive · EU · Dir. 2024/2853
The Product Liability Directive
The revised PLD makes software a product. From 9 December 2026, liability for a defective AI system is strict and no-fault.
- Transposition by
- 9 December 2026
- Basis
- Strict, no-fault
- Replaces
- Dir. 85/374/EEC
- AI Liability Directive
- Withdrawn
What changed
Software Is Now a Product
The old product-liability regime was written for physical goods. The revision drags it into the software era: standalone software and AI systems are products, their updates and the digital services they depend on are in scope, and liability remains strict, so a claimant need not prove you were careless, only that the product was defective and caused harm.
For AI the decisive move is procedural. Recognising that proving a defect in a complex model is often impossible for a claimant, the directive lets courts presume defect and causation in defined situations, and lets claimants compel disclosure of your evidence. Your governance file stops being only a compliance artefact and becomes the centre of a liability case.
- Scope
- Software is a product. Standalone software, AI systems, and safety-relevant updates all fall within product liability.
- Burden
- Presumption of defect. Courts may presume defect or causation where set conditions are met, easing the claimant's proof.
- Evidence
- Disclosure of records. Claimants can compel disclosure of relevant technical evidence; refusal triggers a presumption.
- Harm
- Wider damages. Death, personal injury including psychological harm, property, and destruction or corruption of data.
Where it meets the others
The Burden Can Shift to You
One fact about a system, and each regime that asks for it.
- One technical file
- EU AI Acttechnical documentation (Art. 11)kept for 10 years (Art. 18)
- PLDdisclosure of evidence (Art. 9)on a court's order; a defect is presumed if it is not disclosed
Strict liability already removes the need to prove fault. The revised directive goes further and lets a court presume the product was defective, or that the defect caused the damage, in situations that map directly onto AI governance failures:
- Non-disclosure
- You fail to disclose relevant evidence a court has ordered, such as technical documentation or logs.
- Breach
- The product broke a mandatory safety requirement meant to prevent the harm that occurred, which may include requirements of the EU AI Act.
- Complexity
- The case is too technically or scientifically complex for the claimant to prove, and a defect is plausible.
Who owes what
The Chain Is Longer Than the Manufacturer
Liability follows the product along its economic chain, and a substantial modification can make the modifier the new manufacturer.
- Manufacturer
- You made the product or component. Primary liability, including for the software components and AI models you develop and the updates you push.
- Importer & authorised rep
- You bring it into the EU. Where the manufacturer is outside the EU, liability can attach to the importer or the EU authorised representative.
- Fulfilment & distribution
- You place it on the market. Distributors and fulfilment service providers can be liable where an EU-based responsible party cannot be identified.
- Substantial modifier
- You materially changed it. Substantially modify a product outside the original maker's control, and you can be treated as its manufacturer.
Timeline
The Date That Matters Is Close
The directive is adopted; the work is transposition. It applies to products placed on the market after the transposition date, so systems placed on the market into 2027 are in scope.
- Late 2024
- Directive 2024/2853 adopted, replacing the 1985 regime.
- Adopted
- 2025
- The separate AI Liability Directive is withdrawn, leaving the PLD as the main route for AI harm.
- Live
- 9 Dec 2026
- Member states must transpose; the regime applies to products placed on the market after this date.
- Weeks away
Source: Official Journal of the EU · Dir. 2024/2853 · Applies to products placed on the market after transposition into national law · Check the consolidated text before relying on a date.
Penalties
A Civil Claim You Can Lose by Default
The PLD is civil liability, so the exposure is compensation rather than a regulatory ceiling, and the procedural changes make it easier to reach.
- Uncapped
- Strict, no-fault liability for death, personal injury, property damage, and data loss caused by a defective AI product.
- Presumption
- Defect or causation can be presumed against you on non-disclosure, a breach of a safety requirement meant to prevent that harm, or excessive complexity.
- Disclosure
- Claimants can compel the technical documentation and logs you hold, turning your governance file into their evidence.
Compensation is determined by litigation.
The regimes alongside it
The Regimes That Apply Alongside It
- Reg. 2024/1689
EU AI Act
Applies across every sector. Obligations by risk tier for providers and deployers, phasing in to December 2027.
Full guideRead the guide - Reg. 2016/679
GDPR for AI
Data protection. Lawful basis, impact assessments (DPIAs) and people's rights, wherever AI uses personal data.
In forceRead the guide - Reg. 2017/745 · 746
MDR / IVDR
Patient safety and clinical performance. An AI medical device goes through one conformity assessment under two regimes.
In forceRead the guide
FAQ
Common Questions
Yes. Directive (EU) 2024/2853 expressly brings software, including AI systems and standalone software, within the definition of a "product." Manufacturers, and in some cases those who substantially modify a product or provide related digital services, can be held liable for damage caused by a defect.
Member States must transpose it into national law by 9 December 2026, and it applies to products placed on the market or put into service after that date. The old regime (Directive 85/374/EEC) continues to apply to products placed on the market before 9 December 2026.
It is no-fault (strict) liability: an injured person does not need to prove the manufacturer was negligent, only that the product was defective, that they suffered damage, and the causal link between the two. The directive also introduces rebuttable presumptions of defectiveness and causation that lighten the claimant's burden in technically complex cases.
The PLD is a civil-liability instrument, not a regulatory-fine regime, so it does not set administrative penalties like GDPR or the AI Act. Exposure comes through civil damages claims for death, personal injury, property damage, and, newly, destruction or corruption of data that are not used for professional purposes.
The revised PLD lets national courts order a defendant to disclose relevant evidence at the claimant's request where a claim is plausible (Article 9). Failure to disclose can trigger a presumption that the product was defective. This materially shifts the evidential balance toward claimants in complex software and AI cases.
Potentially yes. The directive contemplates defects arising after the product is placed on the market where the manufacturer retains control, for example through software updates, upgrades, or machine-learning that changes behaviour. This can extend the relevant time window for liability beyond the point of sale.
The revised directive expressly makes standalone software and AI systems products. Your model, and its updates, are within strict product liability.
The directive presumes a defect where you won't disclose evidence or where the product broke a safety requirement meant to prevent the harm suffered. Where technical complexity makes proof excessively difficult, a court can presume defect, causation or both.
The AI Liability Directive was withdrawn. The PLD is the primary route for harm caused by AI, and it applies from December 2026.
Your next step