The EU's Revised Product Liability Directive: A Guide to New Strict Liability for Software, AI, and Digital Services

For nearly four decades, the European Union’s approach to product liability was anchored entirely in the physical world. If a toaster caught fire or a car’s brakes failed, the 1985 Product Liability Directive provided a clear, standardized path for consumers to seek compensation. But as global commerce shifted to the digital realm, that legacy framework began to fracture, leaving massive gaps in consumer protection when software failed.[1]

Now, the EU has fundamentally rewritten the rules to close those gaps. Directive (EU) 2024/2853, commonly known as the revised Product Liability Directive (PLD), officially modernizes the bloc's liability regime for the digital age.[1]

The most consequential shift in the revised PLD is its expanded definition of what constitutes a "product." For the first time, software, digital manufacturing files like 3D printing blueprints, and artificial intelligence systems are explicitly classified as products under EU law.[2]

This classification introduces strict, no-fault liability to the software industry. Previously, software developers largely managed liability through complex licensing agreements and contract law, often requiring claimants to prove negligence. Under the new regime, consumers only need to prove that the software was defective and caused damage, bypassing the need to establish developer fault entirely.[2]

The directive also captures "related services" that are integral to a physical product's function. If a smart refrigerator relies on a cloud-based temperature control service, or an autonomous vehicle depends on a continuous navigation data stream, those digital services are treated as core components of the product itself.[1]

Defining a "defect" has also been modernized to reflect the realities of connected devices. A product can now be deemed defective if it fails to meet mandatory cybersecurity standards, or if the manufacturer fails to provide the necessary software updates required to maintain safety.[2][3]

Furthermore, the directive accounts for products that evolve after they are sold. If an AI system learns new behaviors post-deployment, or a substantial over-the-air software update fundamentally alters a device's functionality, the manufacturer remains liable for any resulting defects introduced by those changes.

The scope of compensable damage has seen a similar, sweeping expansion. Historically limited to physical injury, death, or tangible property damage, the revised PLD now covers the destruction or corruption of data.

This means that if a defective software update wipes a consumer's hard drive, corrupts essential business files, or bricks a device, the developer can be held strictly liable for the material losses. The directive also explicitly recognizes medically diagnosed psychological harm as a compensable damage.

To ensure that consumers always have a viable target for legal recourse, the EU has established a strict liability hierarchy targeting the global supply chain. The primary target remains the original manufacturer. However, if the manufacturer is located outside the EU, the liability automatically cascades down the chain.

Importers, authorized representatives, and even fulfillment service providers can now be held liable if the original manufacturer cannot be reached. This ensures that non-EU companies cannot shield themselves behind international borders, forcing EU-based distributors to take a much harder look at the compliance of the products they handle.[2]

Recognizing the sheer technical complexity of modern digital systems, the revised PLD also alters the burden of proof. In cases involving "black box" AI or highly intricate software architectures, it can be nearly impossible for an average consumer to pinpoint exactly how a defect occurred.[1]

To remedy this imbalance, the directive allows national courts to presume a defect exists if the claimant can demonstrate that the product did not comply with safety requirements, or if the damage is clearly consistent with a suspected defect. Courts can also order manufacturers to disclose necessary technical evidence to the claimant.

While the directive officially entered into force in December 2024, the critical enforcement date is December 9, 2026. Member states have until then to transpose the directive into their national laws.[1][3]

Crucially, the new rules will only apply to products placed on the market or put into service after that December 2026 deadline. Products sold before that date will remain governed by the legacy 1985 framework, creating a bifurcated liability landscape for several years.[3]

For global tech companies, software developers, and cross-border distributors, the 2026 deadline represents a ticking clock. The next two years will require a massive overhaul of supply chain contracts, indemnity clauses, and liability insurance to prepare for an era where a line of code carries the exact same legal weight as a physical machine part.