European Union - Product Liability Reform (2024/2853)

Overview

Directive (EU) 2024/2853 updates the EU product liability framework to the digital age by redefining the notion of 'product' to cover software, including AI systems, and digital manufacturing files. The full text is available on EUR-Lex: Directive (EU) 2024/2853. The Directive keeps strict (no-fault) liability as its core principle but adapts substantive and procedural rules to address new technical complexities, cross-border supply chains and post-sale product evolution (e.g., updates and learning systems). It aims to ensure injured natural persons can obtain compensation while providing clearer rules for economic operators and aligning with other EU digital-technology laws such as the Artificial Intelligence Act (Regulation (EU) 2024/1689) and the Cyber Resilience Act (Regulation (EU) 2024/2847).

Definitions

The Directive establishes modernised definitions to remove ambiguity. 'Product' means all movables and specifically includes electricity, digital manufacturing files and software (operating systems, firmware, computer programs, applications and AI systems). 'Digital manufacturing file' is a digital template enabling automated control of machinery to produce tangible items. The Directive distinguishes software-as-product from mere information: media files and source code as content are not treated as 'products', and non-commercial free and open-source software (OSS) developed outside the course of a commercial activity is excluded. These definitions align with Decision No 768/2008/EC principles and with the AI Act where appropriate, providing cross-regulatory consistency.

Governance and Institutional Framework

The Commission retains an oversight and coordination role. Member States are required to designate competent national authorities (consumer protection and market surveillance authorities) to implement and enforce the Directive and to exchange information. The Commission must establish and maintain a public, easily accessible database of final appellate judgments published by Member States, facilitating transparency and case-law harmonisation; see the Commission summary on product liability EU Single Market: Liability for defective products. The Directive requires Member States to notify national transposition measures to the Commission and cooperate on enforcement and information exchange. It also sets time-bound obligations for evaluation (first report due by 9 December 2030) and regular five-year reviews.

Key Focus Areas

The Directive focuses on several substantive areas: (1) Scope and product definition—explicitly including software, AI and digital manufacturing files; (2) Economic operators and chain of liability—designating manufacturers, component manufacturers, importers, authorised representatives and, where relevant, fulfilment service providers as liable parties; (3) Defectiveness—safety expectations consider presentation, technical features, labelling and instructions; (4) Post-sale defects and updates—liability can extend to defects emerging after placing on the market when products remain under the manufacturer’s control or when related services (updates, upgrades or authorised third-party services) are part of the product lifecycle; (5) Damages covered—death, personal injury (including medically certified psychological harm), property damage (with certain exclusions), and destruction or corruption of non-professional data; (6) Evidence and disclosure—new duties to disclose technical information in litigation to remedy information asymmetry and technical complexity; and (7) Exemptions and proportionality—non-commercial OSS is excluded, while micro and small enterprises receive limited safeguards to avoid disproportionate burdens. The Directive is intended to work in tandem with the AI Act and the Cyber Resilience Act, aligning safety and liability expectations across regulatory instruments.

Implementation Framework

Member States must transpose the Directive into national law by 9 December 2026. The Directive applies to products placed on the market or put into service after 9 December 2026; products placed before that date remain governed by Directive 85/374/EEC (repealed with effect from 9 December 2026 but continuing to apply to earlier products). Transposition must include mechanisms to ensure the availability of compensation, the special disclosure duty in court proceedings and publication of appellate judgments in an accessible electronic format. National authorities responsible for consumer protection and market surveillance will coordinate enforcement and exchanges of information. The Commission will maintain the EU judgment database and perform periodic evaluations (first by 9 December 2030) to assess effectiveness, costs and the need for further measures.

Monitoring and Evaluation

The Commission is required to evaluate the Directive by 9 December 2030 and every five years thereafter, using efficiency, effectiveness, relevance, coherence and added-value criteria. Member States must report on transposition measures and send the texts of national laws to the Commission. National consumer protection authorities and market surveillance authorities are urged to exchange information, and the Commission database of appellate judgments is intended to improve transparency and support harmonised interpretation. The evaluation will include data on insurance availability, litigation burdens, and comparative analysis with OECD countries.

Penalties, Liability, and Appeals

The Directive sets substantive rules on strict liability and compensable damage but leaves penalties and sanction levels to Member States. Injured natural persons can claim compensation for death, personal injury (including certified psychological damage), property damage (with exclusions) and corruption/destruction of non-professional data. The Directive introduces presumptions (e.g., presumption of defect or causation in defined circumstances) to ease claimant burdens where technical complexity would otherwise prevent proof. Member States must provide judicial procedures and ensure remedies; administrative fines, civil damages and other national sanctions apply for failure to comply with national measures implementing the Directive or for misleading consumers. The Directive also mandates publication of appellate judgments and an EU database to assist appeals and harmonised jurisprudence.

Relationship to Other Instruments

The Directive interacts closely with other EU instruments. It preserves application of data-protection rules (e.g., GDPR). It aligns definitions and obligations with the AI Act (Regulation (EU) 2024/1689) and complements the Cyber Resilience Act (Regulation (EU) 2024/2847) by addressing liability for safety and cybersecurity defects. The Directive repeals Council Directive 85/374/EEC (with transitional arrangements) and retains national special liability regimes that pre-existed (e.g., certain pharmaceutical systems), so long as they achieve equivalent protection for natural persons.

International Alignment

The Directive was drafted to harmonise internal market rules and to reduce divergences between Member States that distort competition. Its modernised approach to digital and AI products aligns with international efforts to regulate AI and cybersecurity risk (OECD, Council of Europe, ISO standards) and facilitates interoperability for trade. The Commission's evaluation requirement includes a comparison with OECD countries to assess competitiveness and transnational impacts. Liability rules for manufacturers established outside the Union target importers, authorised representatives and fulfilment service providers to ensure enforceability across borders.

Implementation Timeline

Sources and References