The directive is part of the package of measures aimed at harmonizing liability rules for artificial intelligence ("AI"). The new Product Liability Directive now also extends to digital products such as digital design documents and software, including AI systems.

Furthermore, developers or manufacturers of software, including providers of AI systems as defined by the AI Regulation (EU) 2024/1689, are considered manufacturers within the meaning of the directive. Therefore, they can be held liable for damages resulting from the use of their AI systems. A contractual relationship between the software manufacturer and the claimant is not required for this purpose.

The directive aims to reflect the changing nature of products in the digital age and the associated risks, while also enhancing the protection of injured persons.

This is associated with increasing liability risks for manufacturers. Not only is the scope of application and the group of potential defendants expanded, but extensive evidentiary relief in favor of the injured parties and comprehensive disclosure obligations incumbent on the defendant companies are also introduced, enabling injured parties to better substantiate their claims.

In practice, the new Product Liability Directive is expected to lead to an increase in litigation, particularly in industries whose products reach consumers at the end of the production and supply chain (including the consumer goods, pharmaceuticals/medical products, automotive, and software industries). This is also relevant in view of the fact that representative actions regarding product liability issues will now be possible, which could have significantly more severe consequences than individual lawsuits.

The following outlines the specific changes associated with the new Product Liability Directive and the challenges and questions that affected companies may face.

Essential regulatory content of the new product liability directive

Increased liability for manufacturers

Extensive disclosure obligations – U.S.-style

The new Product Liability Directive not only envisages a modernization of existing product liability rules but also an expansion of the group of liable parties and stricter liability for manufacturers.

Furthermore, numerous changes (e.g. involving reversals of the burden of proof and disclosure obligations) offer additional benefits and better protection to consumers who suffered damage caused by defective (digital) products. As a result, the new product liability regulations reach significantly beyond the previous regime.

Key changes at a glance:

• Modification of the criterion triggering product liability: Previously, liability was established solely by the act of placing a product on the market. In the future, a manufacturer can also be held liable if they continue to control the product after it has been placed on the market, for example, through software updates.
• Expansion of the group of liable parties: Liability can now extend to component manufacturers, persons who significantly alter products, as well as importers or EU representatives of manufacturers based outside the EU whose products are imported into and sold to consumers within the EU. Additionally, fulfilment service providers, suppliers and online platforms can also be held liable.
• Disclosure Obligations: Introduction of a disclosure obligation for companies, requiring defendant companies to surrender evidence in their possession that supports the claimant's claim. The protection of trade secrets will still be ensured.
• Extension of evidentiary relief for injured parties: Presumption of product defectiveness and/or causality between the product defect and the damage. Presumptions can also be made if proving the defect is excessively difficult due to technical or scientific complexity.

In detail:

Scope of application

The new Product Liability Directive grants natural persons the right to claim compensation from manufacturers of products and, in some cases, components that have been placed on the EU market or put into operation within the EU, based on strict liability, for certain types of damage caused by a defect in these products.

The new Product Liability Directive defines "product" very broadly and includes (AI) software (Article 4(1)). This applies regardless of whether the software is stored on a device, accessed via a communication network or cloud technologies, or provided through a software-as-a-service model.

“Component” refers to any item, raw material, or associated service (such as a navigation system or a voice assistant) that is integrated into or connected with a product (Article 4(4)). Thus, the new Product Liability Directive encompasses (digital) services that are integrated into a product, even though it generally does not extend to services.

Compensatable damage within the meaning of the Directive also includes the destruction of or damage to data, provided that the data is not used exclusively for professional purposes (Article (6)(1)(c)).

Defectiveness

The assessment of defectiveness continues to be based on an objective analysis of the safety that the general public can reasonably expect, rather than the safety that a specific individual might expect. 

In Article 7(2), the new Product Liability Directive,  provides a non-exhaustive list of several factors that may be relevant in assessing defectiveness (including, among others, the impact of capabilities to learn or acquire new functions after deployment, as is the case with AI systems, and cybersecurity requirements).

A notable change compared to the previous Product Liability Directive is the timing for the determination of defectiveness: In the future, not only the time of placing the product on the market will be considered, but also the period during which the product remains under the control of the manufacturer after being placed on the market (e.g. due to the presence or absence of software updates and upgrades or a significant modification) (see Article 7(2)(e)).

If a significant modification occurs through a software update or upgrade, or due to the continuous learning of an AI system, it should be assumed that the modified product was made available on the market or put into operation at the time of the actual modification.

Claimant and defendant

On the side of the injured party, the following may be involved:

• the natural person who has suffered the damage or a person to whom the claim of the injured person has been transferred, and
• a person acting on behalf of one or more injured persons based on EU or national law (e.g., under the laws of member states implementing the Directive on Representative Actions (EU) 2020/1828) (Article 5(2)).

This opens up the possibility of representative actions related to product liability across the entire EU.

On the side of the injuring party, the following may be involved:

• the manufacturer of the defective product (Article 8(1)(a)), and
• the manufacturer of a defective component, if this component was integrated into or connected with a product under the control of the manufacturer (Article 8(1)(b)).

If the damage was caused by a defective component, the individual can claim compensation from the manufacturer of the component and/or the manufacturer of the product. This means that companies without direct contact with consumers can also be affected by compensation claims. Several companies are jointly and severally liable (Article 12(1)).

If the manufacturer is based outside the EU, claims can also be asserted pursuant to Article 8(1)(c) against:

• the importer,
• the manufacturer's authorized representative, or
• the fulfilment service provider.

If the claimant is unable to identify the manufacturer or, in the case of manufacturers outside the EU, any of the aforementioned companies, under certain conditions, any supplier of the product can be held liable for the damage (Article 8(3)).

Online platform providers can also be held liable under certain circumstances (Article 8(4)). This aims to comprehensively cover all economic players along the manufacturing and supply chain. Finally, anyone can be held liable who significantly modifies a product outside the control of the original manufacturer and subsequently places it on the market or puts it into operation (Article 8(2)).

Disclosure obligations

The most significant change introduced by the directive is the implementation of disclosure obligations for companies. These obligations also apply in the context of representative  actions and can therefore have far-reaching consequences for the affected companies. The new disclosure obligations are fundamentally modeled after the Anglo-American principle of disclosure of documents, which requires defendants to surrender relevant evidence in their possession to support the claimant's claim.

The extensive disclosure obligations are justified, among other reasons, by the fact that the claimant has no insight into the functioning of the AI systems (the so-called "black box" phenomenon). As a result, it is extremely difficult for the claimant to comprehend and prove the system's defects and their causality for any damage.

To benefit from disclosure, it is required that the injured party either presents facts or submits evidence that are "sufficient to support the plausibility of the claim for compensation" (Article 9(1)) or "sufficient to demonstrate the defendant's need for evidence for the purposes of countering a claim for compensation" (Article 9(2)).

Upon request, the defendant company must disclose the relevant evidence, such as design documents or documented findings from product monitoring. The disclosure should be limited to what is necessary and proportionate and take into account the legitimate interests of all parties concerned, including third parties (Article 9(3) and (4)).

Considering the complexity of certain types of evidence, particularly in relation to digital products, courts may require that evidence be presented in an easily accessible and easily understandable manner (Article 9 (6)). This may sometimes involve the necessity to present existing information in new documents.

If the defendant company fails to comply with its disclosure obligations, the directive provides for a sanction mechanism by simply presuming defectiveness of the product (see below).

According to the directive, a certain level of protection for companies against disclosure is possible for confidential information and trade secrets (Article 9(5)). National courts are authorized, but not obliged, to take appropriate protective measures. However, the qualification of evidence as a trade secret does not automatically eliminate the disclosure obligation.

Furthermore, the proposed measures only pertain to the protection of trade secrets as defined by Directive (EU) 2016/943. According to its wording, the new Product Liability Directive does not provide protection for other types of confidential information or intellectual property, unless a member state has enacted such provisions at the national level.

Evidentiary relief

The newly introduced evidentiary reliefs are expected to have significant practical implications. According to the new Product Liability Directive, in certain situations, the defect of a product and/or the causal link between the defect and the damage will be presumed. This shifts the burden of proof almost entirely onto the defendant company, which in turn has the right to rebut these presumptions (Article 10(5)).

The defectiveness of the product is presumed where:

• the defendant has failed to comply with the obligation to disclose relevant evidence (pursuant to Article 9; see above) (Article 10(2)(a)), or
• the claimant proves that the product does not meet mandatory safety requirements of the EU or the member states which are intended to protect against the risk of the damage that has occurred (Article 10(2)(b)), or
• the claimant proves that the damage was caused by an obvious malfunction of the product during reasonably foreseeable use or under ordinary circumstances (Article 10(2)(c)).

The causal link between the defectiveness of the product and the damage will be presumed where it has been established that the product is defective and that the damage caused is of a kind typically consistent with the defect in question (Article 10(3)).

Furthermore, the defectiveness of a product and/or the causal link will also be presumed if

• despite the disclosure of evidence and taking into account all the relevant circumstances of the case, the claimant faces "excessive difficulties" (in particular due to technical or scientific complexity, e.g. in the case of AI systems) in proving the defectiveness of the product or the causal link, or both, and
• The claimant has demonstrated that it is likely that the product was defective or that its defectiveness caused the damage, or both (Article 10(4)).

Limitation of liability

Article 15 ultimately stipulates that liability cannot be limited or excluded by contractual provisions or national law.

This will result in the complete elimination of the previously applicable deductibles (EUR 500 for property damage) and liability caps (EUR 85 million for personal injury), as well as a restriction on the liability exclusions that previously existed in favor of the liable economic operators. For example, the manufacturer will no longer be exonerated if the product defect was not detectable at the time of market placement, provided that the defect could have been remedied by a safety software update.

Time horizon

The directive will enter into force on December 8, 2024, twenty days after its publication in the Official Journal of the EU. Member states will then have two years – until December 9, 2026 – to transpose it into national law.

The new Product Liability Directive applies only to products that are placed on the market or put into operation after the expiration of the period granted for the implementation of the new Product Liability Directive.

Open questions for manufacturers

For manufacturers of (digital) products, the adoption of the directive raises numerous questions, including the following:

• A product is considered defective under the Product Liability Directive if it does not provide the safety that a person is entitled to expect. What legitimate safety expectations can an average consumer have, for example, regarding a system as complex as AI?
• When is the provision of evidence considered "excessively difficult" so that the presumption rules in favor of the injured party apply?
• According to which standards does the court decide what constitutes relevant evidence that must be disclosed for the assertion of the claim? How extensive is the obligation to disclose to be understood?
• When is disclosure necessary and proportionate? How should a judge, who is trained in national law but not technically, assess these requirements concerning technical documentation?
• How can courts ensure that the trade secrets of the defendant are adequately protected? On what basis is it determined whether legal remedies against the disclosure of confidential documents are permissible and justified?

Outlook

Objective: Legally secure liability regime

Problem: Significant practical and procedural uncertainties

The new Product Liability Directive aims to strengthen acceptance and trust in new technologies, including AI, by creating more legal certainty and equal competitive conditions. This, in turn, is intended to contribute to innovation and the further development and use of such products within the EU.

At the same time, it seeks to ensure that injured parties benefit from the same level of protection, regardless of the technology involved. Thus, a fair balance is to be established between the legitimate interests of the injured parties and the product manufacturers.

However, the directive could also have the opposite effect, as companies may be significantly burdened by extensive disclosure obligations and presumption rules, the practical implementation of which remains unclear.

Furthermore, the specific application of the new rules by civil courts is uncertain. The Product Liability Directive contains numerous vague legal terms and new presumption rules that are formulated in a very broad manner and have the potential to create significant problems in practice when interpreting their requirements. How courts will handle the extensive innovations, and the wide discretion granted is currently unforeseeable.

Companies must prepare for the stricter product liability rules within the two-year implementation period. They should:

• assess whether their products now fall within the scope of the directive (e.g. as software),
• evaluate if they, as a manufacturer of components, importer, or fulfilment service provider, are now considered a liable party,
• adjust their insurance coverage as necessary and adapt contractual arrangements regarding responsibilities,
• develop a strategy for managing disclosure obligations, particularly to protect their trade secrets,
• ensure sufficient and readily available documentation for existing and future (digital) products to effectively protect against liability claims. Whereas previously, doubts regarding proof of defectiveness or causality often led to the dismissal of claims, manufacturers must now refute a presumption against them, thus bearing the risk of unresolved issues.

In conclusion, practical uncertainties and the potentially extensive handling of disclosure obligations cannot be ruled out. Even though national legislators still need to codify the amendments to the Product Liability Directive, the outlined challenges indicate that companies must act promptly and should make good use of the remaining time.