The EU Product Liability Directive (Directive (EU) 2024/2853) is reshaping liability risk for companies that design, sell or operate AI-enabled products, software systems and connected industrial equipment. With Member States required to implement the legislation by 9 December 2026, manufacturers, importers, online marketplaces, system integrators and logistics operators face a broader strict-liability regime that treats software as a product and expands compliance obligations around updates, documentation and product safety.
The central legal question is straightforward: can a business be held liable when software or an AI-driven system causes damage even if negligence cannot be proven? Under the revised framework, the answer may increasingly be yes. Claimants may no longer need to establish fault where a defective product causes harm, and software now falls squarely within the product liability regime.
The growing attention surrounding the legislation reflects more than a legal update. Organisations across technology, manufacturing, healthcare, logistics and connected-device industries are assessing whether existing governance, cybersecurity and product oversight frameworks remain adequate for products that can make autonomous decisions, receive remote updates and evolve throughout their operational life.
Regulatory Action in Brief
The revised EU Product Liability Directive modernises a framework that had remained largely unchanged for more than four decades.
The most consequential change for many businesses is the explicit recognition of software as a product. Software embedded in industrial machinery, AI-powered robotics, warehouse management systems, connected devices and cloud-based applications can all fall within the scope of the new regime.
The reform is intended to address liability questions arising from software-driven products and connected technologies that were largely absent when the original framework was introduced. It also expands potential exposure across complex digital supply chains, reflecting the reality that software increasingly determines how products function, operate and interact with users.
Key Legal Authority
Directive (EU) 2024/2853 replaces Council Directive 85/374/EEC and establishes the European Union’s updated strict-liability framework for defective products. The legislation expressly extends product liability principles to software and certain digital products, reflecting the growing role of artificial intelligence, connected technologies and software-driven systems within the modern economy.
What Is Known So Far
The revised framework introduces several significant changes for businesses operating within the European Union. Software can now qualify as a product whether it is embedded in hardware or delivered through cloud-based services. Open-source software developed outside a commercial activity remains excluded from the legal definition of a product, but commercial software products face a much broader liability landscape.
Products may also become defective if necessary software updates or security patches are not provided. Courts may obtain broader powers to require disclosure of technical documentation during litigation, and claimants may face fewer evidential hurdles where highly complex products make technical causation difficult to establish. The overall effect is a liability regime that extends beyond traditional manufacturing defects and reaches into the ongoing operational lifecycle of digital products.
Legal and Regulatory Framework
Directive (EU) 2024/2853 repeals and replaces Council Directive 85/374/EEC, the European Union’s longstanding product liability framework that has governed defective product claims since the 1980s. The revised legislation was introduced to address technologies that either did not exist or were not commercially significant when the original Directive was drafted, including artificial intelligence systems, software products, connected devices and cloud-based digital services.
Historically, software occupied a grey area within product liability law. Businesses could argue that software constituted a service rather than a product, creating uncertainty around compensation claims involving software failures.
The revised framework removes much of that ambiguity. Software is now expressly recognised as a product for liability purposes, reflecting the growing role that software plays in determining how modern products operate.
The new regime retains a strict liability framework. In practical terms, liability may arise where a product is defective and that defect causes damage, regardless of whether negligence can be established. For businesses deploying AI, connected devices and software-driven systems, the legal focus shifts towards product safety, lifecycle management, cybersecurity and documentation rather than solely examining the conduct of individual developers or engineers.
EU Product Liability Directive and the End of the Software Exemption
The formal recognition of software as a product may prove to be the most commercially significant aspect of the reform.
In logistics plant engineering, software controls autonomous vehicles, robotic picking systems, conveyor networks and warehouse management platforms. Under the revised rules, failures within those systems could trigger product liability claims if damage results.
A software defect causing an autonomous vehicle to misidentify an obstacle, a robotic system to perform unsafe movements or warehouse software to generate hazardous operating instructions could potentially become the basis of a claim. Where machine-learning systems continue adapting their behaviour after deployment, liability questions may extend beyond the product’s original release and into its ongoing operation.
Similar liability questions could arise in healthcare software, connected consumer devices, industrial monitoring systems or other products where software updates directly influence safety, functionality or operational performance.
Nature of the Potential Liability Risks
The legislation does not create a specific enforcement action against any company. Instead, it establishes a framework through which liability claims may arise.
The revised rules create exposure in several distinct areas. Software failures may create liability where autonomous decisions result in physical damage. AI systems that adapt their behaviour during operation may attract additional scrutiny where unexpected outcomes emerge after deployment. Products may also become defective through failures to provide necessary updates or cybersecurity protections.
This creates particular challenges in sectors where products remain operational for long periods. Industrial logistics systems, medical technologies and connected infrastructure often remain in service for decades, extending the period during which product oversight may remain relevant.
A realistic compliance failure scenario illustrates the risk. A manufacturer deploys autonomous warehouse robots supported by cloud-based software. Several years later, cybersecurity vulnerabilities emerge and updates are not adequately managed. If a resulting malfunction contributes to property damage or workplace injury, questions may arise regarding whether the product became defective because of inadequate lifecycle management rather than a flaw present at launch.
Penalties, Sanctions and Remedies
Unlike regulatory regimes that impose administrative fines, the Product Liability Directive primarily creates exposure through civil claims.
Businesses may face compensation awards for personal injury or property damage, substantial litigation and disclosure costs, product recall expenses, increased insurance premiums and commercial disputes involving manufacturers, operators, suppliers and system integrators. For many organisations, the financial consequences may extend well beyond the value of any individual claim.
Industry stakeholders have also raised concerns that broader liability exposure could increase litigation activity and insurance costs across sectors that rely heavily on software-driven products. As a result, the commercial implications of the legislation may be felt not only in courtrooms but also in procurement decisions, insurance arrangements and risk-management strategies.
Regulatory Trends and Enforcement Priorities
The reforms reflect a broader shift in European regulatory thinking.
Software, algorithms and connected technologies are now being treated as products capable of creating real-world safety risks. Policymakers are also placing greater emphasis on accountability throughout the entire product lifecycle rather than limiting responsibility to the point of sale.
Another important trend is the effort to address information imbalances between claimants and technology providers. Expanded disclosure mechanisms and evidential reforms reflect concerns that highly complex AI systems can operate as black boxes, making traditional proof requirements difficult to satisfy.
Regulators are moving away from the assumption that software risks can be managed informally. Businesses deploying AI-enabled products are expected to document testing, maintain auditable records and demonstrate how safety controls operate throughout the product lifecycle.
Implications for Corporate Compliance Programmes
For boards, in-house counsel and compliance teams, the revised framework creates governance obligations that extend far beyond product design.
Organisations should review whether existing product governance frameworks adequately address software-related liability risks. Particular attention should be paid to update-management procedures, AI validation controls, monitoring arrangements, supplier oversight, incident response protocols and technical record-keeping. Documentation may become especially important where organisations are required to explain how algorithmic systems functioned at the time an incident occurred.
Where courts can require disclosure of source code, training records, technical logs or risk assessments, organisations lacking structured governance processes may struggle to demonstrate compliance or defend claims effectively. In this environment, documentation becomes more than a regulatory requirement; it becomes a core component of legal risk management.
Compliance Actions Organisations Should Consider Before December 2026
Businesses deploying AI-enabled products, connected devices or software-driven industrial systems should consider reviewing their governance frameworks before Member State implementation begins.
Formal software update and security-patch governance procedures should be established and documented. Organisations should also maintain clear records of AI testing, validation and monitoring activities, while reviewing supplier and integrator contracts to clarify liability allocation. Technical audit trails capable of supporting future disclosure requests may become increasingly important, particularly where autonomous decision-making systems are involved.
Boards and risk committees should ensure they receive regular reporting on software-related product liability exposure. For organisations operating long-life industrial systems, compliance planning should focus not only on product launch but also on the ongoing maintenance, monitoring and safety oversight expected throughout a product’s lifecycle.
Key Takeaways for Business and Legal Leaders
For legal, compliance and risk leaders, the immediate challenge is recognising that software now carries many of the same liability characteristics traditionally associated with physical products. Procurement, engineering, cybersecurity and governance teams will need closer coordination, particularly where AI systems continue to evolve after deployment.
Organisations should review how responsibility is allocated across suppliers, developers, system integrators and operators, while ensuring that product oversight extends beyond launch and into the ongoing operation of software-enabled products. Documentation, testing records and update-management processes may become as important in defending future claims as the original product design itself.
Businesses that can demonstrate transparency, traceability and effective governance are likely to be better positioned to manage both litigation risk and regulatory scrutiny under the revised framework.
Why This Matters Beyond the Directive
Many organisations continue to treat cybersecurity, software maintenance, AI governance and product safety as separate disciplines.
The revised framework brings those disciplines together within a single liability landscape. A failure to maintain software updates, monitor system performance, document algorithmic behaviour or define operational boundaries could create liability exposure years after a product enters the market. As software becomes embedded within physical products, legal risk increasingly shifts from isolated manufacturing defects to broader organisational control failures.
For businesses operating in the digital economy, legal resilience is becoming as important as technical resilience. The cost of getting this wrong may include litigation, compensation claims, disclosure obligations, reputational damage, increased insurance costs and prolonged operational disruption.
What Happens Next
EU Member States must transpose the revised Product Liability Directive into national law by 9 December 2026.
The implementation period provides businesses with an opportunity to assess how software, AI systems, connected devices and automated decision-making technologies fit within existing product liability, compliance and governance frameworks.
The practical scope of several provisions, particularly those concerning disclosure obligations, software defects and highly complex AI systems, will ultimately be shaped through future litigation and judicial interpretation across Member State courts and potentially the Court of Justice of the European Union (CJEU). Businesses should therefore view implementation not as the end of the reform process but as the beginning of a new period of legal development in European product liability law.
While courts and national regulators will ultimately shape how specific provisions are applied, businesses do not need to wait for national implementation measures to understand the trajectory of reform. Under the revised EU Product Liability Directive, software is no longer peripheral to product liability analysis. In many sectors, it now sits at the centre of it.
People Also Ask
What is the EU Product Liability Directive?
The EU Product Liability Directive establishes a strict-liability framework that allows individuals to seek compensation for damage caused by defective products. Directive (EU) 2024/2853 updates the previous framework to address software, artificial intelligence and connected technologies.
Does the EU Product Liability Directive apply to software?
Yes. Under Directive (EU) 2024/2853, software can qualify as a product for liability purposes, including software embedded in devices and certain cloud-based software services used in commercial products.
How does the revised Product Liability Directive affect AI systems?
The revised framework recognises that AI systems may influence product safety and performance. Businesses deploying AI-enabled products may face liability exposure where defects in software or AI-driven functionality contribute to damage.
Can companies be liable for failing to provide software updates?
Potentially. The revised framework recognises that a product may become defective if necessary software updates or security patches are not provided and the resulting deficiency contributes to harm.
When must EU Member States implement the new Product Liability Directive?
EU Member States must transpose Directive (EU) 2024/2853 into national law by 9 December 2026.
Sources and Legal Authorities
- Directive (EU) 2024/2853 on liability for defective products.