--- title: "AI, Software and the New Product Liability Directive | Pitch" description: "Directive (EU) 2024/2853 treats software and AI systems as products. It applies to products placed on the market after 9 December 2026." url: https://pitch.law/academy/ai-software-and-the-new-product-liability-directive --- [pitch](https://pitch.law/) [Academy](https://pitch.law/academy) [AI](https://pitch.law/academy/topics/legal-aspects-of-artificial-intelligence) # AI, Software and the New Product Liability Directive Directive (EU) 2024/2853 treats software and AI systems as products. It applies to products placed on the market after 9 December 2026. Who is liable, for what damage, how the burden of proof shifts and what to put in your contracts. - - By [Bart Lieben](https://pitch.law/team/bart-lieben), Attorney-at-Law - 13 November 2026 - Updated 13-11-2026 ## The legal framework The new Product Liability Directive is [Directive (EU) 2024/2853](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024L2853) of 23 October 2024. It was published in the Official Journal on 18 November 2024 and entered into force on 8 December 2024. Member States must transpose it by 9 December 2026 (Article 22). It applies to products placed on the market or put into service after 9 December 2026 (Article 2(1)). The old Directive 85/374/EEC is repealed from that date but keeps applying to products placed on the market before it (Article 21). The Directive is a maximum harmonisation text: Member States may not keep or introduce stricter or less strict rules, unless the Directive allows it (Article 3). It sets liability without fault: a claimant does not have to prove that anyone was careless, only that the product was defective, the damage and the causal link (Article 10(1)). It does not replace contractual liability or other non-contractual liability under national law (Article 2(4)(b)). It also leaves data protection law untouched (Article 2(4)(a)). ### Software and AI are products A _product_ is any movable, and the definition now expressly "includes electricity, digital manufacturing files, raw materials and software" (Article 4(1)). Recital 13 explains that software includes "operating systems, firmware, computer programs, applications or AI systems", whether it is stored on a device, accessed over a network or supplied as software-as-a-service. It also says that a developer or producer of software, including an AI system provider under the AI Act, should be treated as a manufacturer. Information as such, such as the content of e-books or the mere source code, is not a product. Two further concepts matter for digital products: - a **related service** is a digital service integrated into or interconnected with a product so that, without it, the product could not perform one of its functions (Article 4(3)), for example the cloud service that runs a smart thermostat; - the **manufacturer's control** covers updates, upgrades and components the manufacturer supplies or authorises, and its ability to supply software updates itself or through a third party (Article 4(5)). Free and open-source software developed or supplied outside a commercial activity is excluded (Article 2(2)). ### Who is liable (Article 8) - the **manufacturer** of the defective product (Article 8(1)(a)), which includes anyone who puts its name or trademark on the product (Article 4(10)); - the **manufacturer of a defective component**, including software, integrated within the manufacturer's control (Article 8(1)(b)); - for manufacturers outside the EU: the **importer**, the **authorised representative** and, failing both, the **fulfilment service provider** (Article 8(1)(c)); - anyone who **substantially modifies** a product outside the manufacturer's control and then makes it available (Article 8(2)); - **distributors** and **online platforms** that let consumers conclude contracts with traders, if they do not name an EU operator or their own supplier within one month of a request (Article 8(3) and (4)). Liable operators are jointly and severally liable (Article 12(1)). ### What damage is covered (Article 6) Death or personal injury, including medically recognised damage to psychological health; damage to property, except the defective product itself and property used exclusively for professional purposes; and, new, the destruction or corruption of data not used for professional purposes (Article 6(1)). Losses that follow from that damage are covered, non-material losses as far as national law compensates them (Article 6(2)). ### When is a product defective (Article 7) A product is defective when it does not provide the safety a person is entitled to expect or that EU or national law requires (Article 7(1)). Among the circumstances the court considers (Article 7(2)): - the effect of any ability to keep learning or to acquire new features after the product is placed on the market (point (c)); - the effect of other products used with it, including by interconnection (point (d)); - the moment the product left the manufacturer's control, where the manufacturer keeps control after placing it on the market (point (e)); - product safety requirements, including safety-relevant cybersecurity requirements (point (f)). ### Evidence and the burden of proof (Articles 9 and 10) A claimant who presents a plausible claim can ask the court to order the defendant to disclose relevant evidence, with protection for trade secrets (Article 9(1), (4) and (5)). Defectiveness is presumed if the defendant does not disclose, if the product breaches mandatory safety requirements, or if there was an obvious malfunction during normal use (Article 10(2)). The causal link is presumed if the damage is typical for the defect (Article 10(3)). If technical or scientific complexity makes proof excessively difficult, the court presumes defectiveness or causation, or both, once the claimant shows they are likely (Article 10(4)). All presumptions can be rebutted (Article 10(5)). ### Defences and their limits (Article 11) An operator escapes liability if it proves one of the grounds in Article 11(1), for example that the defect probably did not exist when the product was placed on the market (point (c)) or that the state of scientific and technical knowledge did not allow the defect to be discovered (point (e)). But the "later defect" defence does not apply, as long as it is within the manufacturer's control, where the defect is due to a related service, to software including updates, to the lack of software updates "necessary to maintain safety", or to a substantial modification (Article 11(2)). ### Time limits and contracts Claims must be brought within three years of awareness of the damage, the defect and the liable operator (Article 16). Rights expire ten years after the product was placed on the market or substantially modified, or 25 years for latent personal injury (Article 17). Liability towards the injured person cannot be limited or excluded by contract (Article 15). Between operators, rights of recourse follow national law (Article 14). A manufacturer that integrates software from a micro or small enterprise may agree with that supplier to waive its right of recourse (Article 12(2)). ## In practice **A Ghent company sells a home energy app** that controls heating through a cloud service. A faulty update overheats a boiler and damages a living room. The app is a product and the cloud service is a related service. The update was within the company's control, so it cannot argue that the defect arose later (Article 11(2)(b)). **A Leuven developer supplies an AI vision module** that a Dutch manufacturer builds into a forklift sold in Belgium. A worker is injured. The forklift maker is liable as manufacturer, and the developer as manufacturer of a defective component (Article 8(1)(a) and (b)). They are jointly and severally liable. Between them, the contract and national law decide who pays in the end. **A webshop resells smart cameras** that it buys from a wholesaler. A customer's private photo archive is corrupted by a camera fault. Data loss is now covered damage if the data were not used professionally (Article 6(1)(c)). If no manufacturer, importer or authorised representative in the EU can be identified, the webshop must, on request, name one or its own supplier within one month, or it becomes liable itself (Article 8(3)). **An AI system keeps learning after sale.** That ability is a factor in assessing defectiveness (Article 7(2)(c)). A substantial change through learning or an update may restart the ten-year period for the modified product (Article 17(1)(b)). ### Contracts and practical steps 1. **Map your role per product.** Are you manufacturer, component maker, importer, distributor or a platform? Remember that a brand on the product makes you a manufacturer. 2. **Plan your updates.** Lack of updates necessary to maintain safety can defeat a defence. Under the [Cyber Resilience Act](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R2847), manufacturers of products with digital elements must also handle vulnerabilities during a support period of at least five years in most cases (Article 13(8)). 3. **Rewrite supply contracts.** You cannot exclude liability towards victims, but you can allocate it between you: indemnities, cooperation in disclosure, access to logs and documentation, update duties, insurance and caps between the parties. See [AI clauses in vendor contracts](https://pitch.law/academy/ai-clauses-in-vendor-contracts). Our [contract review](https://pitch.law/technologies/clause-library-risk-review) flags clauses that no longer work, and [Document Studio](https://pitch.law/technologies/contract-studio) helps you draft new ones. 4. **Keep evidence ready.** Courts can order disclosure. Organise technical documentation so you can disclose what is needed without giving away more trade secrets than necessary. Your AI Act documentation helps here. 5. **Track dates and duties.** Record support periods, update commitments and recourse rights in your [contract register](https://pitch.law/technologies/contract-obligations). 6. **Check your insurance.** Ask whether your policy covers software, data loss and products placed on the market after 9 December 2026. ## Frequently asked questions ### Does the Directive cover SaaS? Yes. Recital 13 states that software is a product irrespective of how it is supplied, including as software-as-a-service. ### Is an AI system provider a manufacturer? Recital 13 says a developer or producer of software, including an AI system provider under the AI Act, should be treated as a manufacturer. ### Can I exclude liability in my terms and conditions? Not towards the injured person (Article 15). You can allocate the risk between businesses in the supply chain, subject to national law on recourse. ### What about products already on the market? Products placed on the market or put into service before 9 December 2026 stay under the old Directive 85/374/EEC (Article 21). ### Does free open-source software count? Not when it is developed or supplied outside a commercial activity (Article 2(2)). A manufacturer that builds it into a commercial product remains liable for that product. ## How this connects This article is part of our series on the EU digital rulebook. See [the EU digital rulebook in 2026](https://pitch.law/academy/eu-digital-rulebook-2026) for the full map and [the Digital Omnibus on AI](https://pitch.law/academy/digital-omnibus-on-ai-regulation-2026-1744) for the AI Act duties that shape your technical documentation. For contract terms, read [AI clauses in vendor contracts](https://pitch.law/academy/ai-clauses-in-vendor-contracts) and [SaaS agreements](https://pitch.law/academy/saas-agreements). For the security duties on the same products, see [Cyber Resilience Act I: which products are caught](https://pitch.law/academy/cyber-resilience-act-products-and-classes) and [Cyber Resilience Act III: importers, distributors and open source](https://pitch.law/academy/cyber-resilience-act-importers-distributors-open-source). Our [commercial contracts](https://pitch.law/solutions/commercial-contracts-transactions) team rewrites supply and distribution terms, and our [AI Act compliance](https://pitch.law/solutions/ai-act-compliance) team aligns your documentation. **Provisions cited.** Directive (EU) 2024/2853, Articles 2, 3, 4(1), (3), (5) and (10), 6, 7, 8, 9, 10, 11, 12, 14, 15, 16, 17, 21 and 22, and recital 13. Cyber Resilience Act, Article 13(8). **Key dates.** 18 November 2024: publication. 8 December 2024: entry into force. 9 December 2026: transposition deadline, repeal of Directive 85/374/EEC, and the new rules apply to products placed on the market after that date. **Sources.** [Directive (EU) 2024/2853](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024L2853), [AI Act, Regulation (EU) 2024/1689](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689) and [Cyber Resilience Act, Regulation (EU) 2024/2847](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R2847). ## In short - Software, including AI systems and SaaS, is a product - Liability without fault for developers, importers and others in the chain - Missing security updates can make a product defective - Presumptions that ease the burden of proof for claimants - Liability towards the injured person cannot be excluded by contract ## Related solutions - [Solutions](https://pitch.law/solutions/commercial-contracts-transactions) ### [Commercial Contracts & Transactions](https://pitch.law/solutions/commercial-contracts-transactions) [Supply, distribution, services, SaaS and procurement contracts, and the deals around them, drafted and reviewed with the IP, data and tax angles in view.](https://pitch.law/solutions/commercial-contracts-transactions) - [Solutions](https://pitch.law/solutions/ai-act-compliance) ### [AI Act Compliance](https://pitch.law/solutions/ai-act-compliance) [We help you find out which of your AI systems fall under the EU AI Act, in what role, and what you must have in place and by when.](https://pitch.law/solutions/ai-act-compliance) ## Our proprietary Legal Tech - [Technology](https://pitch.law/technologies/contract-studio) ### [Document Studio](https://pitch.law/technologies/contract-studio) [Our Document Studio drafts and analyses legal documents in a secure, on-premise environment, and keeps the documents behind your matters up to date as new data comes in and procedural steps fall due.](https://pitch.law/technologies/contract-studio) - [Technology](https://pitch.law/technologies/clause-library-risk-review) ### [Contract Review](https://pitch.law/technologies/clause-library-risk-review) [Send us the contract the other side drafted and we check it clause by clause against our playbook, with a risk ranking an attorney has verified.](https://pitch.law/technologies/clause-library-risk-review) - [Technology](https://pitch.law/technologies/contract-obligations) ### [Contract Management: Rights and Obligations](https://pitch.law/technologies/contract-obligations) [Once a contract is final, we pull out each party's duties and rights with the clause they come from, have a person confirm them, and follow them with reminders.](https://pitch.law/technologies/contract-obligations) ## More in AI - ### [EU AI Act Timeline: Every Date from 2024 to 2030](https://pitch.law/academy/ai-act-compliance-timeline) [The AI Act applies in stages from 2 February 2025 to 31 December 2030. Every date, what applies and who it affects, with the 2026 high-risk postponement.](https://pitch.law/academy/ai-act-compliance-timeline) - ### [AI Act Meets GDPR: Where the Two Frameworks Overlap](https://pitch.law/academy/ai-act-meets-gdpr-where-frameworks-overlap) [How the AI Act and the GDPR apply side by side to the same AI system: roles, impact assessments, automated decisions, transparency, data quality and special categories.](https://pitch.law/academy/ai-act-meets-gdpr-where-frameworks-overlap) - ### [AI Act Risk Classification: the Four Risk Levels](https://pitch.law/academy/ai-act-risk-classification-explained) [The AI Act sorts AI into unacceptable (prohibited), high, limited (transparency) and minimal risk. How to tell which level your AI system falls in.](https://pitch.law/academy/ai-act-risk-classification-explained) - ### [AI Clauses in Vendor Contracts: 9 Terms to Negotiate](https://pitch.law/academy/ai-clauses-in-vendor-contracts) [The AI clauses to negotiate when you buy or supply AI: AI Act roles, training on your data, output ownership, IP indemnity, audit and logs, liability.](https://pitch.law/academy/ai-clauses-in-vendor-contracts) - ### [AI Act in HR and Recruitment: the High-Risk Rules](https://pitch.law/academy/ai-in-hr-and-recruitment-under-the-ai-act) [Recruitment and HR AI is usually high-risk under the AI Act (from 2 December 2027), and emotion recognition at work is banned. What employers must do.](https://pitch.law/academy/ai-in-hr-and-recruitment-under-the-ai-act) - ### [AI and Intellectual Property: Training Data and Copyright](https://pitch.law/academy/ai-intellectual-property-training-data-copyright-disclosure) [How EU copyright law and the AI Act treat training data, rights holders' opt-outs, training summaries, and the protection of AI-generated output and inventions.](https://pitch.law/academy/ai-intellectual-property-training-data-copyright-disclosure) ## Let’s talk Tell us what you’re working on. We’ll get the right person on it and reply within one business day. The first chat is free. [Schedule a meeting](https://pitch.law/schedule)