What is changing

Directive (EU) 2024/2853 replaces the 1985 product liability regime. Its key change for our industry is that the definition of a product expressly extends to software, including AI systems and digital services that are integrated into or interconnected with products. Member states must transpose it into national law by 9 December 2026.

Law-firm summaries agree that the new regime applies to products placed on the market after that date, while the older rules continue to apply to products placed on the market earlier. Several national implementing laws were still in progress at the time of writing, so watch the bill in each country where you sell.

This is strict liability for damage from a defective product, covering things like personal injury, property damage, and certain data loss. It is separate from contract claims between you and your customer.

Why this matters beyond lawyers

Two features make this an engineering concern. First, a product can be defective if it fails to provide the safety a person is entitled to expect, and that can include the effect of software updates, or the lack of necessary security updates, that remain within the manufacturer's control. Second, the directive includes rules on disclosure of evidence and presumptions that can ease a claimant's burden when technical complexity makes proof hard.

In practice, whether you can show what you shipped, when, with which components, and what you did about known vulnerabilities starts to matter in a dispute.

Keep release and component records

Know which version shipped to whom, with which dependencies, and keep that history retrievable.

Treat security updates as a duty

A documented process for finding, assessing, and shipping fixes is both good practice and evidence.

A practical preparation list

Review your update and support policies so they say what you actually do. Make sure your incident and vulnerability handling is documented. Check contracts with component suppliers and, where relevant, with customers, to understand how liability would be allocated and insured. Talk to your insurer about whether software is covered under your policies.

This work overlaps heavily with the Cyber Resilience Act, so plan the two together rather than as separate projects.

Selling software or connected products into the EU? Talk to us about release, SBOM, and update processes that stand up to scrutiny.

Key takeaways

  • The revised Product Liability Directive treats software and AI as products, with national transposition due by 9 December 2026.
  • Reports indicate the new regime applies to products placed on the market after that date; earlier products stay under the old rules.
  • Update practices, security fixes, and the ability to prove what you shipped become relevant evidence.
  • Plan this together with Cyber Resilience Act work, and check each country's implementing law.
This is general information, not legal advice. It reflects public law-firm summaries as of October 2026; national implementation varies and some sources disagree on detail. Check Directive (EU) 2024/2853 and each member state's law.