New EU rules change product liability: the risks for your company

The European legislator is ushering product liability rules into the digital age. With the new Directive (EU) 2024/2853, which replaces the old product liability directive, software, AI, and data-driven products now also fall under the liability regime. This means that product liability is no longer limited to physical goods, with direct consequences for manufacturers, developers, and companies deploying smart technology.

What is actually changing
Product liability will no longer be limited to physical goods. Software, raw materials, and digital manufacturing records are now also considered products. Manufacturers of smart devices or digital applications can thus be held liable if something goes wrong with the software or a connected digital service under the principle of product liability.

A manufacturer also remains responsible if it permits a third party to integrate software or digital services. Only free or open-source software outside a commercial context remains excluded from these rules to stimulate innovation. This is an important aspect to consider when evaluating product liability.

New risks
Cybersecurity, connected products, vulnerable user groups, and AI behaviour are, in addition to the classic considerations of presentation, reasonably expected use, and the time at which the product was placed on the market, now expressly mentioned as possible causes of a defective product. A warning in the manual is no longer sufficient. The Directive examines how a product behaves in practice, including under misuse or inattentive use. A dynamic safety approach has been chosen, requiring manufacturers and distributors to continuously oversee software patches, cyber resilience, and AI behaviour throughout the entire product lifecycle. This is essential in the context of product liability.

The concept of damage now extends beyond property damage or personal injury. Loss of data or costs of data restoration are included. Non-material damages, such as medically recognised psychological harm, can also be compensated. Goods and data used exclusively in a professional context are entirely excluded from compensation under the new directive.

Reuse and repair
The new rules for reuse and repair tie in with the circular economy. The old directive contained no rules for reuse and repair, resulting in only the original manufacturer or importer typically being considered liable. Under the new regime, anyone who makes substantial modifications or repairs to a product outside the control of the original manufacturer assumes responsibility for potential defects. This also applies to refurbishers and repairers.

Evidence and transparency
The burden of proof for victims is reduced. If the producer refuses to provide information, or if the product does not comply with mandatory safety standards, the court may assume the product was defective. This may also be presumed where there are typical damage patterns, or the technical complexity of the product imposes unreasonable difficulties on the victim. Comprehensive documentation and transparent processes thus become indispensable.

What you should do now
The Directive must be transposed into national law by 9 December 2026 at the latest. The rules will apply to products placed on the market thereafter. Companies working with smart technology, software, or data are well advised to review or amend their liability position, contracts, and technical documentation now to prepare for product liability.

Summary

• Software and AI fall under product liability
• Cybersecurity and data loss can result in damage claims
• Refurbishers and repairers face new risks
• Proof rules are eased for affected parties
• Entry into force: December 2026

Time to act
The new rules affect the core of your product liability. Do not wait for implementation.
Would you like to know where your risks lie and how to control them? We will ensure that you are compliant. Contact us. Our specialists will be happy to assist you.