Tartu: A small Estonian firm that licenses fleet-management software to customers in nine member states will, from 9 December, answer for that code the way a Bavarian machine-tool maker answers for a faulty spindle. The Product Liability Directive entered into force in December 2024 and gives capitals until 9 December 2026 to write it into national law. It then governs everything placed on the Union market or put into service after that date.
The regime it replaces dates from 1985 and assumes a product is something a person can drop on a foot. Courts stretched that assumption for four decades. The new directive stops stretching and simply redefines the term.
What counts as a product after December
Software becomes a product in its own right. Embedded firmware, standalone applications, operating systems, artificial intelligence systems and software delivered as a service all fall inside the definition. So do digital manufacturing files, the instructions that drive a 3D printer. Related services that a product needs to function, such as the cloud backend behind a connected thermostat, count as components, which means the company running the backend can be sued alongside the manufacturer.
Liability stays strict. A claimant proves the defect, the damage and the link between them, and never has to prove that anyone behaved carelessly. Two changes make that easier. Courts can order a defendant to disclose relevant technical evidence, and where a case turns on technical or scientific complexity that makes proof excessively difficult, judges may apply rebuttable presumptions of defectiveness or causation. Manufacturers who hold the only meaningful record of how a model behaved now carry the practical burden of explaining it.
The heads of damage widen as well. Destruction or corruption of data that a person did not use exclusively for professional purposes becomes compensable. Medically recognised psychological harm counts. The ten-year cut-off from the moment a product went on the market remains, but claimants whose injuries surface slowly get twenty-five years.
Two provisions matter most for software houses. A substantial modification brings a product back under the manufacturer’s control, and a security patch or a feature update pushed to a device in the field can qualify. A producer who keeps control of updates therefore keeps liability running rather than closing it off at the point of sale. Separately, when a manufacturer sits outside the Union, importers, authorised representatives, fulfilment service providers and, in defined circumstances, online marketplaces step into the defendant’s chair. Consumers gain a party they can serve in Riga or Rennes instead of a company address in a third country.
The gap the withdrawn AI directive left
Brussels designed this instrument as one half of a pair. The other half, the AI Liability Directive, was meant to harmonise fault-based claims against providers and deployers of artificial intelligence. The Commission dropped it from the 2025 work programme and never revived it. What remains is a strict-liability route that works when an AI system causes death, personal injury, property damage or data loss, and twenty-seven separate national tort regimes for everything else, including discriminatory outputs, financial loss and reputational harm.
That split creates a forum question rather than a liability question. A German claimant and a Spanish claimant suing the same model developer over the same output will litigate under different national rules, with different limitation periods and different standards of proof. The Commission’s own guidance assumes the directive answers the hard cases. It answers a defined subset of them.
Insurers have started repricing product recall and technology errors cover on the assumption that claims frequency rises. Software vendors face a subtler cost. Evidence disclosure rewards firms that keep disciplined records of design decisions, test results and update histories, and punishes firms that do not. Most small European developers built no such archive, because nothing before December required one.
Transposition tells the rest of the story. Member states have three months left, and product liability sits low on most legislative agendas. A directive that applies to products placed on the market after 9 December will, in practice, apply unevenly across the single market it was written to unify.
