Article: The EU’s revised Product Liability Directive, adopted as Directive (EU) 2024/2853, now treats software – including AI systems – as a “product” and places strict liability on manufacturers, component providers, importers and, where applicable, fine-tuners of models. The rule takes effect once every member state transposes it by 9 December 2026 and will apply to any software placed on the market after that date.

Why the change matters

For four decades the EU’s liability framework left standalone software in a legal gray zone. Courts struggled to decide whether a piece of code counted as a “product” under the earlier directive that governs defective goods. The 2024 amendment removes that uncertainty by expressly defining software—whether downloaded, embedded in hardware or offered as a cloud service—as a product. That single definition reshapes how companies assess risk in every line of code they ship.

What strict liability means

Under strict liability a claimant does not have to prove that a developer was negligent. The plaintiff must only show three elements: the software was defective, the defect caused damage, and the damage is covered by the law.

Who can be held responsible

Liability is no longer limited to the original equipment manufacturer. The directive extends responsibility to any entity that places a component on the market – importers, component providers and, crucially, anyone who fine-tunes a model and distributes it as part of a commercial offering. In practice, a data-science team that adapts an open-source model for a paid service could be treated as the “manufacturer” of that AI product.

Learning AI and post-market changes

The law explicitly covers products that continue to learn or evolve after they are released. A self-optimising recommendation engine that updates its algorithm in response to user behaviour cannot escape liability by arguing that the defect emerged only after deployment. The supplier remains accountable for the entire lifecycle of the system.

Evidence and “black-box” relief

Courts may order a defendant to disclose internal logs, training data or model parameters. If a company refuses, the court can infer that the product is defective. When a system is so technically complex that a layperson cannot understand its operation, the judge may presume a defect exists. This “complexity relief” levels the playing field against opaque “black-box” AI.

What damages are recoverable

The directive makes clear that liability covers death, personal injury, property damage and even data corruption. A malfunctioning medical-diagnosis AI that leads to a wrongful treatment, or a logistics algorithm that corrupts a client’s inventory data, could trigger full compensation under the new rules.

Timeline and scope

Member states must adopt the provisions by 9 December 2026. The liability regime applies only to software placed on the market after that date; legacy products are exempt. An exception exists for free and open-source software created outside any commercial activity. However, if a commercial product incorporates such code, the whole offering falls under the directive.

What firms should do now

  • Audit the supply chain. Identify every piece of code, third-party library or AI model that ends up in a commercial product.
  • Map liability exposure. Determine whether your organisation could be deemed a “manufacturer” under the fine-tuning rule.
  • Strengthen documentation. Keep detailed records of training data, version histories and post-deployment updates to meet potential court orders.
  • Review insurance. Verify that product-liability policies cover software-related damages, including data loss.
  • Plan for the deadline. Align product-release schedules so that any software slated for launch after December 2026 complies with the new definition and safety expectations.

The revised directive ends years of ambiguity around software liability in Europe. Companies that act now will avoid surprise lawsuits and position themselves for a market where code is no longer a gray-area commodity but a regulated product with clear legal responsibilities.