EU Product Liability Directive (Directive (EU) 2024/2853)

The Product Liability Directive (PLD), formally Directive (EU) 2024/2853 of the European Parliament and of the Council of 23 October 2024 on liability for defective products and repealing Council Directive 85/374/EEC, sets common rules in the European Union on the no-fault liability of economic operators for damage suffered by natural persons and caused by defective products. It was published in the Official Journal on 18 November 2024 (OJ L, 2024/2853) and applies to products placed on the market or put into service after 9 December 2026, the date by which member states must transpose it and on which the 1985 directive is repealed (Source: eur-lex.europa.eu). Under the directive a person who has suffered damage can claim compensation by proving the defect, the damage and the causal link between them, "regardless of whether or not the manufacturer is at fault" (Source: eur-lex.europa.eu).

The directive replaces Council Directive 85/374/EEC of 25 July 1985. Its principal change for AI is that software, including AI systems, is expressly a product, and that AI system providers within the meaning of the AI Act (Regulation (EU) 2024/1689) are treated as manufacturers (recital 13) (Source: eur-lex.europa.eu). It was proposed by the European Commission in September 2022 as a package with the AI Liability Directive, which covered fault-based claims; only the product-liability revision was enacted, and the Commission withdrew the AI Liability Directive in 2025 (Proposal for an AI Liability Directive, COM(2022) 496 — Source Summary) (Source: politico.eu).

Status and timeline

Sources for the table: the directive text and its footnotes (Source: eur-lex.europa.eu) and the AI Liability Directive proposal's account of the 2022 package (Proposal for an AI Liability Directive, COM(2022) 496 — Source Summary).

Article 23 provides for entry into force on the twentieth day after publication; Latham & Watkins dated this 9 December 2024. The law firm noted that the directive is fully harmonising (Article 3), which limits the room member states have to adjust it in transposition (Source: lw.com). Directive 85/374/EEC continues to govern products placed on the market or put into service before 9 December 2026 (Article 21) (Source: eur-lex.europa.eu).

Scope and definitions

Products, including software. Recital 13 states that software "such as operating systems, firmware, computer programs, applications or AI systems" is a product for the purposes of no-fault liability "irrespective of the mode of its supply or usage", and so whether it is stored on a device, accessed over a network or cloud, or supplied as software-as-a-service. Information is not a product, so the rules do not apply to the content of digital files such as media files or e-books, or to "the mere source code of software" (Source: eur-lex.europa.eu). The EUR-Lex summary lists the digital-economy consequences: all types of software, including applications and AI systems, are covered; the manufacturer is liable for defects that appear after an update or upgrade performed under its control, and for defects that appear through the continuous learning of an AI system that remains under its control; and digital services necessary for a product to function that have been integrated under the manufacturer's control, which the directive calls related services, are covered (Source: eur-lex.europa.eu). Latham & Watkins gives navigation systems, voice assistants and health-monitoring programmes as examples of related services, and notes that digital manufacturing files, such as a computer-aided design file used in 3D printing, are also treated as products (Source: lw.com).

Exclusions. Article 2 excludes free and open-source software developed or supplied outside the course of a commercial activity, and damage from nuclear accidents covered by international conventions (Source: eur-lex.europa.eu).

Compensable damage (Article 6). The right to compensation covers death or personal injury, including medically recognised damage to psychological health; damage to property; and destruction or corruption of data not used for professional purposes (Source: eur-lex.europa.eu). Non-material losses resulting from that damage are compensable only so far as national law allows. Latham & Watkins notes that the directive does not cover pure privacy violations or discrimination, that the legislators rejected compensation for immaterial damage from data leaks, and that the previous directive's €85 million liability cap and deductible of up to €500 were removed (Source: lw.com).

Key provisions

Defectiveness (Article 7). A product is defective if it does not provide the safety a person is entitled to expect or that EU or national law requires. The assessment takes into account, among other circumstances, the product's presentation, characteristics and labelling; "the effect on the product of any ability to continue to learn or acquire new features"; and the reasonably foreseeable effect of other products used with it (Source: eur-lex.europa.eu). Latham & Watkins notes that relevant product-safety requirements, including cybersecurity requirements, enter the assessment, and names the AI Act and the Cyber Resilience Act as sources of such requirements (Source: lw.com).

Liable persons (Article 8). The directive is designed so that a liable person established in the EU is always available. Manufacturers are liable, and importers and authorised representatives can be held liable for products made outside the Union; where there is neither, a fulfilment service provider can be. Online platforms that act as a manufacturer, importer, authorised representative, fulfilment service provider or distributor are liable as those operators are, and platforms acting as intermediaries can be held liable under certain conditions. A person who substantially modifies a product outside the original manufacturer's control becomes a manufacturer of it (Source: eur-lex.europa.eu).

Disclosure of evidence (Article 9). Both parties may request access to evidence necessary to support their claims (Source: eur-lex.europa.eu). Where a claimant presents facts and evidence sufficient to support the plausibility of the claim, a court may order the defendant to disclose relevant evidence, and may require it to be presented in an accessible and easily understandable manner (Source: lw.com).

Burden of proof and presumptions (Article 10). The claimant must prove defectiveness, damage and causation. Defectiveness is presumed where the defendant fails to disclose relevant evidence, where the product does not comply with mandatory safety requirements, or where there is an obvious malfunction. Under Article 10(4), a court may find defectiveness or causation where the claimant cannot prove it because of technical complexity, provided it is plausible and probable. The presumptions are rebuttable (Source: lw.com). Latham & Watkins reads the provisions as a response to what recital 48 describes as the complexity, autonomy and opacity of AI systems, and notes that for an AI system non-compliance with the AI Act can ground a presumption of defect (Source: lw.com).

Exemptions (Article 11). Article 11 lists the grounds on which an economic operator escapes liability, among them the development-risk defence of Article 11(1)(e): that the objective state of scientific and technical knowledge when the product was placed on the market, or while it was within the manufacturer's control, was not such that the defect could be discovered. Under recital 51, the defence that a defect arose after placing on the market is restricted where the defect consists in the lack of a software update or upgrade needed to address a cybersecurity vulnerability, unless its supply or installation was beyond the manufacturer's control; the directive imposes no obligation to provide updates (Source: eur-lex.europa.eu). Article 18 lets member states keep or, after notifying the Commission and a six-month standstill, introduce rules that make operators liable even where the development-risk defence would apply; existing measures had to be notified by 9 December 2026 (Source: eur-lex.europa.eu).

Limitation. A claim must be brought within three years. Liability ends ten years after the product was placed on the market or put into service, extended to 25 years where a latent personal injury prevented proceedings from being brought within the ten years (Source: eur-lex.europa.eu) (Source: eur-lex.europa.eu).

Transparency and review. Member states must publish final appellate and highest-instance judgments under the directive, which the Commission is to collect in a public database (Article 19). The Commission's evaluations from 2030 are to cover the costs and benefits of transposition, a comparison with OECD countries and the availability of product liability insurance (Article 20) (Source: eur-lex.europa.eu).

Relation to other EU AI liability rules

The Commission's 2022 package divided liability between the two instruments: the revised product-liability regime for producers' no-fault liability for defective products, "leading to compensation for certain types of damages, mainly suffered by individuals", and the AI Liability Directive for fault-based national claims by any type of victim for any type of damage (Proposal for an AI Liability Directive, COM(2022) 496 — Source Summary). With the AI Liability Directive withdrawn, the PLD is the EU-level civil liability instrument that applies to AI systems as products. Writing in December 2024, Latham & Watkins noted that the AI Liability Directive would have applied in business-to-business cases and covered damage such as discrimination or infringement of personality or intellectual-property rights, which the PLD does not (Source: lw.com). In a September 2026 note to the Commission, four members of the European Parliament asked for an AI liability act, and POLITICO Europe reported the PLD's December 2026 start date in that context; Bruegel's Mario Mariniello said the existing arrangement "basically grants no rights to people who are harmed by artificial intelligence" (Source: politico.eu). The broader set of liability theories is covered at AI Liability.

Relationships

• supersedes: Council Directive 85/374/EEC
• related: EU AI Liability Directive (proposed, withdrawn)
• related: EU AI Act (Regulation 2024/1689)
• related: EU Cyber Resilience Act
• instance-of: AI Liability
• related: Specification Hazard
• related: European Parliament