Software and AI Are Now Products
The EU Product Liability Directive (EU) 2024/2853 has entered into force and must be transposed by member states by 9 December 2026. For the first time, software counts as a product whether it is embedded in a device, downloaded, or delivered as a service, and AI systems are treated as a form of software. The strict liability regime that has long applied to a faulty brake or a defective appliance now applies to the model and the application you ship.
This closes a gap that producers have relied on for years. The European Commission withdrew its separate AI Liability Directive in early 2025, so the Product Liability Directive is now the main civil route for anyone harmed by an AI system. The rules apply to products placed on the market or put into service after the deadline, which means the regime you design for today is the one a court will judge tomorrow.
Complexity No Longer Protects You
The change that matters most is procedural. A claimant still has to show a defect, the damage, and the link between them, but the directive eases that burden precisely where AI is hardest to challenge. Where proof is excessively difficult because of the technical or scientific complexity of the product, and a defect is at least probable, the court can presume both the defect and the causal link.
Read that against how AI actually behaves. The opacity of a model used to be an informal defense, since no outsider could prove how an output was produced. Under the new regime that same opacity triggers the presumption. The argument that no one can prove the system failed now works against the producer, not for it.
Disclosure Is the New Front Line
The directive pairs the presumption with a disclosure duty. When a claimant presents a plausible case, the economic operator must disclose the necessary and proportionate evidence in its control, subject to protection of genuine trade secrets. Refuse, and the court may presume the product was defective. Withholding your logs, model documentation, and test records is no longer a neutral act; it becomes evidence against you.
For any company that builds, integrates, or deploys AI, this turns documentation into a legal asset. The records that prove how a system was trained, tested, monitored, and corrected are what you will produce when a claim arrives, and their absence is what a court will hold against you. Germany is moving in the same direction with a reform of its Produkthaftungsgesetz, its first fundamental revision since 1989, aimed squarely at software and AI.
Read next: If Apple Decided It Could Not Build Its Own AI, Why Do You Think You Can? · Your AI Vendor Just Became Your Competitor. What Now?