Skip to content
Back to policy library
European UnionEnacted, not yet in forceRelevance to Chinese AI firms: HighSector-specificAI regulation

EU revised Product Liability Directive (covering software and AI systems)

Directive (EU) 2024/2853 on liability for defective products and repealing Council Directive 85/374/EEC

European Parliament and Council of the European Union · Directive (EU) 2024/2853

Extends the EU no-fault product liability regime into the digital age. Art. 4(1) makes clear that "product" includes electricity, digital manufacturing files, raw materials and software, so standalone AI software and AI components embedded in products are both covered. Arts. 4(3) and (4) bring in "related services" and "components", tangible or intangible, raw materials or related services. Art. 4(5) defines "manufacturer’s control" to cover integration, inter-connection or supply of a component including software updates or upgrades that the manufacturer performs, authorises or consents to, modification of the product including substantial modification, and the manufacturer’s ability to supply software updates or upgrades itself or via a third party. In assessing defectiveness, Art. 7(2) expressly requires account to be taken of the effect on the product of any ability to continue to learn or acquire new features after it is placed on the market or put into service, of the reasonably foreseeable effect of other products expected to be used together with it including by inter-connection, and of relevant product safety requirements including safety-relevant cybersecurity requirements. Art. 11(2) removes certain defences: an economic operator cannot rely on the defect not existing when the product was placed on the market where the defectiveness is due to a related service, software including updates or upgrades, a lack of updates or upgrades necessary to maintain safety, or a substantial modification, provided these are within the manufacturer’s control.

Verified against official sources · 2026-09-12Partly secondary sources — verify before relying

Does this apply to me?

This is a civil liability rule invoked before EU courts rather than an administrative obligation, but it determines a Chinese company’s EU exposure. It is triggered by placing robots, smart hardware, autonomous driving systems, medical AI devices or standalone AI software on the EU market after 9 Dec 2026. The liability chain under Art. 8(1) runs to the manufacturer of a defective product; the manufacturer of a defective component where it was integrated or inter-connected within the manufacturer’s control and caused the product to be defective; and, where the manufacturer of the product or component is established outside the Union, the importer, the manufacturer’s authorised representative, and where there is neither an EU importer nor an authorised representative, the fulfilment service provider. In addition, any natural or legal person that substantially modifies a product outside the manufacturer’s control and thereafter makes it available on the market or puts it into service is considered the manufacturer of that product for the purposes of the Directive (Art. 8(2)). The Directive does not apply to free and open-source software developed or supplied outside the course of a commercial activity (Art. 2(2)).

Key industries: Embodied AI & robotics, AI hardware & compute, Autonomous driving, Healthcare AI, Computer vision, GenAI & foundation models

Application timeline

  1. 2024-12-08

    Directive enters into force

    Enters into force on the twentieth day following publication; national effect follows transposition.

  2. 2026-12-09

    Transposition deadline; applies to products placed on the market or put into service after this date

    Art. 22(1) requires Member States to bring into force the necessary laws, regulations and administrative provisions by this date; Art. 2(1) provides that the Directive applies to products placed on the market or put into service after 9 Dec 2026.

Obligations (4)

Each states its trigger, the evidence to retain and the clause it comes from

Mapping the EU liability chain and agreeing recourse arrangements

Severity HighArt. 8

Before placing a product on the EU market, identify who will be the EU-based liable operator under Art. 8(1): the importer, the authorised representative, or where neither exists the fulfilment service provider; and agree in supply contracts the allocation of liability, insurance, evidence cooperation and recourse. Note also Art. 8(3): where no Art. 8(1) operator established in the Union can be identified, a distributor becomes liable if the injured person asks it to identify such an operator or its own supplying distributor and it fails to do so within one month of the request; Art. 8(4) extends this to qualifying online platform providers.

Applies when
Chinese companies selling robots, smart hardware or AI software into the EU. A practical warning: many Chinese vendors ship on a distributor-buyout basis and assume liability transfers with title; in fact the manufacturer remains primarily liable and an EU distributor sued under the Directive will seek contractual recourse upstream.
Deadline: To be in place before placing products on the EU market after 9 Dec 2026.
Applies from: 2026-12-09
Evidence to retain
  • · EU liable-operator mapping by product line and sales channel
  • · Liability and recourse clauses with importers, authorised representatives and fulfilment service providers
  • · Product liability insurance policy and an adequacy assessment of the cover
  • · Process for answering distributor identification requests within the one-month deadline

Estimated first-time effort: 5–15 person-days (estimate, not a commitment)

Safety lifecycle management for continuous learning and software updates

Severity HighArt. 7(2)(c), Art. 11(2)

Because Art. 7(2)(c) requires the effect of any ability to continue to learn or acquire new features after placing on the market to be taken into account when assessing defectiveness, and Art. 11(2) removes the defence where defectiveness is due to software, software updates or upgrades, or the lack of updates necessary to maintain safety within the manufacturer’s control, companies must bring model iteration, online learning and OTA updates into safety lifecycle management: run a safety impact assessment, regression testing and rollback design for every model or firmware change, ship updates promptly for known safety defects, and retain an evidence chain sufficient to show both that the product was not defective when placed on the market and that safety has been maintained since.

Applies when
Embodied-AI and autonomous driving vendors are most exposed: harm caused by behavioural drift in a robot that keeps learning on a customer site will be assessed under this Directive, and "the model taught itself badly" is not a defence.
Applies from: 2026-12-09
Evidence to retain
  • · Model and firmware version ledger including a snapshot of the baseline shipped at placing on the market
  • · Safety impact assessment and regression test report for each change
  • · Release and reach records for safety updates
  • · Design and operating evidence for online-learning boundaries and drift monitoring

Estimated first-time effort: 15–40 person-days (estimate, not a commitment)

Retaining technical evidence in anticipation of the disclosure regime

Severity MediumArt. 9

Art. 9 requires that, where a claimant has presented facts and evidence sufficient to support the plausibility of a compensation claim, the defendant must disclose relevant evidence at its disposal; conversely, where a defendant has presented facts and evidence sufficient to demonstrate its need for evidence to counter a claim, the claimant must disclose relevant evidence at its disposal in accordance with national law. Disclosure must be limited to what is necessary and proportionate, and in assessing that, national courts must consider the legitimate interests of all parties including third parties, in particular the protection of confidential information and trade secrets; where a defendant is required to disclose a trade secret or alleged trade secret, courts are empowered, on a duly reasoned request of a party or of their own motion, to take protective measures. Companies should plan accordingly for which technical evidence must be retrievable, explainable and producible while protecting trade secrets.

Applies when
Chinese companies selling AI products into the EU. The practical implication is that if operating logs, model version records, test reports and safety assessments cannot be retrieved and explained in litigation, the company will be at a disadvantage on the facts; it should also pre-classify which materials are trade secrets and prepare the reasoning for protective measures.
Applies from: 2026-12-09
Evidence to retain
  • · Technical evidence retention policy covering scope, period and retrievability
  • · Trade secret classification markings and a template request for protective measures
  • · Verification that operating logs and model version records can be exported
  • · Records of an internal legal and engineering evidence-production drill

Estimated first-time effort: 8–20 person-days (estimate, not a commitment)

Defining substantial modification and governing channel-side alterations

Severity MediumArt. 8(2), Art. 11(1)(g)

Any natural or legal person that substantially modifies a product outside the manufacturer’s control and thereafter makes it available on the market or puts it into service is considered the manufacturer of that product for the purposes of the Directive (Art. 8(2)); correspondingly, Art. 11(1)(g) exempts such a modifier that proves the defectiveness causing the damage relates to a part of the product unaffected by the modification. Companies should define permitted and prohibited alterations clearly in product documentation and channel contracts, and set up an approval and record-keeping mechanism for secondary development by system integrators and distributors so that liability boundaries are determinable.

Applies when
Chinese robotics and industrial AI companies delivering through system integrators. Secondary development performed by an EU integrator for the end customer — swapping end effectors, replacing perception modules, altering control parameters — may amount to substantial modification and put the integrator in the position of deemed manufacturer. That is both an opportunity to shift risk and a reason to set the conditions clearly in contracts and documentation.
Applies from: 2026-12-09
Evidence to retain
  • · Product documentation clauses defining permitted and prohibited alterations
  • · Alteration approval and notification duties in channel and integrator contracts
  • · Approval records for secondary development and the as-shipped configuration baseline
  • · Written confirmations of liability allocation following alterations

Estimated first-time effort: 5–15 person-days (estimate, not a commitment)

Penalties

The Directive imposes no administrative fines but civil liability in damages: an injured person can obtain compensation for damage caused by a defective product without having to prove fault. The practical impact on companies comes from two directions. First, the Art. 9 evidence disclosure regime: where the claimant has presented facts and evidence sufficient to support the plausibility of the claim, the defendant must disclose relevant evidence at its disposal, with courts empowered to protect trade secrets. Second, the availability of an EU-based defendant: where the manufacturer is outside the Union the importer or authorised representative becomes the defendant directly, and the resulting recourse pressure ultimately reaches the Chinese manufacturer.

Known uncertainty

Confidence is medium because the Directive must be transposed into national law: the heads of damage, limitation periods, the practical operation of the evidentiary presumptions and procedural details are set nationally, and this entry verifies the Directive text only without checking transposition country by country. As at the verification date, which precedes the 9 Dec 2026 transposition deadline, most national implementing laws were not settled. There is also no CJEU case law yet on the boundaries of "substantial modification" and "manufacturer’s control", so individual outcomes remain uncertain.

Sources (1)

Content as of 2026-09-12 · corpus 2026.09|Compiled from public official sources with links and review dates for compliance decision support. Rules change; have licensed professionals review before external disclosure, regulatory filing or contractual commitments.

Related regulations

GDPR · PIPL · CCPA control mapping
Traceable AI · cited when sourced
ISO 27001 alignment in progress
WCAG 2.1 AA accessibility target
EU revised Product Liability Directive (covering software and AI systems) · Obligations & official sources | HaiWen HQ