The revised Product Liability Directive, Directive (EU) 2024/2853, applies to products placed on the EU market from 9 December 2026. Member States must transpose it into national law by the same date. Products placed on the market before then remain under the 1985 Directive, 85/374/EEC, which means two liability regimes will run in parallel for years. The date that matters is when each individual unit was placed on the market, not when it was sold, manufactured or updated.

Yes, the revised Directive treats software as a product in its own right, including standalone software, AI systems, firmware and software supplied as a service. This is the most significant change from the 1985 regime, which covered only tangible movables.

A software developer placing a product on the EU market is now a manufacturer for liability purposes, whether the software is embedded in hardware, downloaded, or delivered over a network.

Article 10 allows a court to presume that a product was defective, and that the defect caused the damage, where the technical or scientific complexity of the case makes it excessively difficult for the claimant to prove either. The presumption is rebuttable, but rebutting it requires the defendant to produce evidence about how the product actually behaved. For AI and complex software, “the system is too complex to explain” therefore works against the defendant rather than for them.

No. Liability under the Product Liability Directive is strict. A claimant does not need to show negligence, breach of a standard, or any failure of care. They must show the product was defective, that they suffered damage, and that the defect caused it — and Article 10 can supply the first and third of those by presumption.

The manufacturer is primarily liable, and where the manufacturer is established outside the EU, liability extends to the importer, the authorised representative and, in defined circumstances, the fulfilment service provider. Distributors can become liable where they fail to identify an upstream economic operator on request. A company that substantially modifies a product outside the original manufacturer’s control can itself become the manufacturer of the modified product.

Yes. Where a manufacturer retains control over a product after it is placed on the market — through software updates, machine learning, or connected services — defects arising from that control fall within the manufacturer’s liability. The manufacturer cannot rely on the defence that the defect did not exist when the product was placed on the market if the defect resulted from something within its ongoing control.

Death and personal injury, including medically recognised harm to psychological health; damage to property other than the defective product itself; and the destruction or corruption of data that is not used for professional purposes. The data limb is new and reaches software products directly. The revised Directive also removed the €500 lower threshold that applied to property damage under the 1985 regime.

Liability runs for ten years from the date the product was placed on the market, extended to twenty-five years where a claimant could not bring proceedings within ten years because of a latent personal injury. A separate three-year limitation period runs from the date the claimant became aware, or should reasonably have become aware, of the damage, the defect and the identity of the liable operator.

In practice, yes. GDPR data minimisation encourages deletion, while the PLD’s ten-year longstop — twenty-five years for latent injury — means the evidence that would rebut an Article 10 presumption may need to survive far longer than a typical retention schedule allows. Companies that delete on a two or three year cycle can find they have lawfully destroyed the only records capable of defending a claim. Reconciling the two positions in writing is part of what this pack does.

Yes. Article 9 allows a national court to order a defendant to disclose relevant evidence at its disposal, and failure to comply triggers the presumption of defectiveness in its own right. The practical consequence is that the question is not only whether you hold the records, but whether you are prepared to produce them.

Yes. Article 9 allows a national court to order a defendant to disclose relevant evidence at its disposal, and failure to comply triggers the presumption of defectiveness in its own right. The practical consequence is that the question is not only whether you hold the records, but whether you are prepared to produce them.

No. The Product Liability Directive creates no supervisory authority, no registration, no conformity assessment and no filing. It creates a civil liability position that is tested in court, which is why the compliance work is evidentiary rather than administrative. There is no fine schedule and no cap on liability.

Yes. Liability attaches to products placed on the EU market regardless of where the company is established. Where the manufacturer is outside the EU, the importer and the authorised representative carry liability alongside it, which is why non-EU manufacturers frequently need EU-established representation for reasons unconnected to the AI Act.

They operate independently and cover different populations. The AI Act regulates AI systems by risk tier through documentation and conformity assessment, with obligations for high-risk systems deferred to December 2027 and August 2028. The PLD applies to any product with software, regardless of risk tier or whether AI is present, from December 2026. A company entirely outside AI Act high-risk scope can still face an Article 10 presumption.

Economic operator determination per product; a placement-date register, because liability attaches per unit by reference to when it entered the market; a defectiveness evidence file covering the state of the art at placement and what was tested; a retention schedule reconciling the ten-year longstop, the twenty-five-year extension and GDPR minimisation; an Article 9 disclosure readiness record; and post-placement update documentation covering defects arising from ongoing manufacturer control.

Free and open-source software developed or supplied outside a commercial activity falls outside the Directive. Where open-source software is supplied in the course of a commercial activity, or integrated into a commercial product, the ordinary rules apply and the integrator carries the exposure.