Why the new Product Liability Directive matters now
The EU has overhauled its 40-year-old product liability rules. The revised Product Liability Directive (Directive (EU) 2024/2853) replaces the 1985 regime and brings software, apps and artificial intelligence squarely within the scope of strict liability for defective products. It entered into force on 8 December 2024, and Member States must transpose it into national law by 9 December 2026. From that date it applies to products placed on the market or put into service after the deadline.
If your company develops, manufactures, imports, distributes or sells products – and especially if those products contain software, connectivity or AI – these rules will reshape your exposure. This article explains what the directive changes, who is affected, the timeline to plan around, and the practical steps to take now.
What is the Product Liability Directive?
Product liability is a form of strict liability: an injured person can claim compensation for a defective product without having to prove that the manufacturer was at fault. They need only show the defect, the damage and the causal link between them. The original 1985 directive was written for a world of physical goods and no longer fits digital products, connected devices and software that changes after it is sold. The revised directive modernises the regime for the digital and circular economy while keeping the core principle of liability without fault.
Software and AI are now “products”
The most significant change is the expanded definition of a product. Standalone software, including AI systems and machine-learning models, is now treated as a product for liability purposes, whether it is supplied on a physical medium, downloaded or accessed in another way. The scope also expressly covers digital manufacturing files, raw materials and the components that go into a product. In short, a defect in your code can now trigger strict product liability in the same way as a defect in a physical part.
There is an important carve-out: free and open-source software developed or supplied outside the course of a commercial activity falls outside the directive. Once open-source software is monetised or supplied commercially, however, it can come back within scope.
The most important changes
Liability for updates, cybersecurity and self-learning products
A product can be defective not only when it is placed on the market but also because of what happens afterwards. Manufacturers can be held liable for damage caused by missing or inadequate security updates, by weak cybersecurity, or by the behaviour of products that continue to learn or change after sale, where these remain within the manufacturer’s control. Safety is assessed over the product’s whole life, not just at the moment of sale.
New types of compensable damage
The categories of recoverable damage are broader than before. Alongside death and personal injury, claimants can now recover for medically recognised harm to psychological health, even without a physical injury, and for the destruction or corruption of data that is not used for professional purposes. For data-driven and connected products, this significantly widens potential exposure. The previous lower threshold for property damage has also been removed.
Easier burden of proof for claimants
Recognising how hard it can be to understand complex software or AI, the directive eases the claimant’s burden of proof. Courts can order defendants to disclose relevant evidence, and a defect or a causal link can be presumed where proving them would be excessively difficult because of technical or scientific complexity, provided the claimant shows that a defect or causal link is at least probable. Businesses should expect more claims to survive the early stages of litigation.
More parties can be held liable
Liability now reaches further along the supply chain. Beyond the manufacturer, potentially liable parties include the manufacturer of a defective component, importers, the manufacturer’s authorised representative, fulfilment service providers and – under certain conditions – distributors and online marketplaces. Anyone who substantially modifies a product outside the original manufacturer’s control can be treated as a manufacturer for that product.
The timeline you need to plan around
The directive entered into force on 8 December 2024. Member States, including Sweden, must adopt national implementing legislation by 9 December 2026. The new rules apply to products placed on the market or put into service after 9 December 2026, while products already on the market before that date remain under the old regime. This creates a transition period in which the two frameworks run in parallel, so 2026 is the year to review contracts, insurance and documentation.
Praktiskt exempel
Imagine a Swedish company that sells a connected security camera together with an AI-powered mobile app. Under the new directive both the hardware and the software are products. If a missing security update leaves the camera open to intrusion, or a flaw in the AI causes it to fail in a way that damages the user’s stored data, the company could face a strict-liability claim – and the customer may be able to rely on a presumption of defect if the technology is too complex to unpick. If a reseller substantially reconfigures the app and sells it under new conditions, that reseller could itself be treated as a manufacturer. The company that maps these risks and tightens its update and documentation practices in 2026 will be far better protected.
Vanliga misstag som företag gör
The first mistake is assuming product liability is only about physical goods; standalone software and AI systems are now explicitly covered. The second is treating liability as fixed at the point of sale, when defects can arise from later updates, cybersecurity gaps or self-learning behaviour. The third is underestimating the new disclosure and presumption rules, which make it easier for claimants to bring a case. The fourth is overlooking who else in the chain is exposed – importers, authorised representatives, fulfilment providers and, in some cases, distributors and marketplaces – and failing to address that in contracts and insurance.
Rekommenderade åtgärder
Start by mapping which of your products, components and software fall within the new definition, and how long you keep control over them through updates and connectivity. Review and strengthen your software-update, cybersecurity and vulnerability practices, since these now bear directly on liability. Improve your technical documentation and record-keeping so you can respond to disclosure requests and defend against presumptions. Revisit contracts across your supply chain to allocate the new risks clearly, and check that your product liability insurance reflects software, AI and data-related exposure. Finally, watch for the Swedish implementing legislation and align your compliance programme before 9 December 2026.
Vanliga frågor
When does the new Product Liability Directive apply?
It entered into force on 8 December 2024, and Member States must transpose it by 9 December 2026. It applies to products placed on the market or put into service after that date; products placed on the market earlier remain under the previous rules.
Does the directive really cover software and AI?
Yes. Standalone software, including AI systems, is now a product for liability purposes, as are components, digital manufacturing files and raw materials. Free and open-source software supplied outside a commercial activity is excluded.
Do claimants still have to prove a defect?
In principle yes, but the directive makes it easier. Courts can order the disclosure of evidence, and defect or causation can be presumed where proof would be excessively difficult due to technical or scientific complexity and a defect or causal link is at least probable.
Slutsats
The revised Product Liability Directive brings software, AI and connected products into the heart of Europe’s strict-liability regime, widens the types of recoverable damage, and makes claims easier to bring against more parties in the supply chain. With national transposition due by 9 December 2026, the companies that map their exposure, tighten their update and documentation practices and revisit their contracts and insurance now will be ready – while those who wait may be caught out by a broader and more claimant-friendly regime.
Lawgent helps companies navigate product liability, technology and AI regulation using law and AI. Want to understand how the new Product Liability Directive affects your specific products and how to prepare in practice? Kontakta Lawgent och vi hjälper dig att komma igång.
