Direct answer: the EU's new Product Liability Directive (PLD, Directive (EU) 2024/2853) entered into force on 8 December 2024. Member States must transpose it by 9 December 2026, and it applies to products placed on the market or put into service from 9 December 2026. The key changes: software, including applications, operating systems and AI systems, is expressly a "product"; manufacturers are liable for defects existing when the software/AI was released, including defects that become apparent after release through updates, upgrades or machine learning while still under their control; where a non-EU manufacturer has no EU establishment, victims can claim against the importer, authorised representative or, in their absence, the fulfilment service provider, and in some cases the distributor. Liability generally runs for 10 years after placing on the market, extended to 25 years for latent health injuries; victims have 3 years to bring a claim. Software/AI exporters should prepare four things before 9 December 2026: pre-release defect review, update/learning control, the EU liability chain, and evidence retention.
This guide is for Chinese manufacturers exporting software, AI systems, embedded software, smart hardware and digital products to the EU, and for their EU importers, authorised representatives, fulfilment service providers and distributors. Data cut-off: 8 November 2026; sources are the European Commission "Liability for defective products" page, EUR-Lex Directive (EU) 2024/2853 and the official EUR-Lex summary. Official facts, editorial interpretation and items to confirm are kept separate. This is not legal advice.
(1) The PLD is not a product-safety regulation but a civil compensation regime: the victim proves the defect, damage and causation, not fault. (2) Software/AI is expressly a product; problems caused by updates, upgrades and continuous learning may also be attributed to the manufacturer, depending on control. (3) 9 December 2026 is the transposition/application date; products placed before then remain under the 1985 Directive, so do not mix old and new rules.
Timeline: 9 December 2026 is the transposition and application date
The PLD was adopted on 23 October 2024, published in the Official Journal on 18 November 2024 and entered into force on 8 December 2024; Member States must transpose it by 9 December 2026. The new rules apply to products placed on the market or put into service from 9 December 2026; products placed before that date remain under the 1985 Directive (85/374/EEC). So 9 December 2026 is not a "start preparing" date but the date the new law starts to apply; cross-border software/AI vendors should have contracts, the liability chain and evidence ready before then.
| Date | Event | What it means |
|---|---|---|
| 23 Oct 2024 | PLD adopted | Replaces the 1985 Directive |
| 18 Nov 2024 | Published in the Official Journal | Transposition preparation begins |
| 8 Dec 2024 | PLD enters into force | Member States begin transposition |
| 9 Dec 2026 | Transposition deadline + application | Products placed afterwards fall under the new PLD |
| Before 9 Dec 2026 | Old Directive continues | Earlier products remain under 85/374/EEC |
Sources: European Commission Liability for defective products page, EUR-Lex Directive (EU) 2024/2853 and the official summary (accessed 8 November 2026). Specific transposition progress and national-law details follow each Member State.
What counts as a "product": software, AI, digital services and substantial modification
The PLD covers all types of products (traditional products, raw materials, digital products and so on) placed on the EU market. The Commission expressly states that software is a product, including applications, operating systems and AI systems; digital services necessary for the product to function and incorporated into it under the manufacturer's control are also covered. A product substantially modified outside the original manufacturer's control (for example by remanufacturing) is treated as a new product and the modifier becomes the manufacturer. Defectiveness is assessed in light of, among other things, the product's presentation and labelling, its ability to continue learning or acquire new features, and the reasonably foreseeable effect of other products used together with it.
| Object | Coverage | Check first |
|---|---|---|
| Software | Expressly a product: applications, operating systems, etc. | Version, release records, known defects |
| AI systems | Expressly a product; includes continuous learning | Model version, learning/update mechanism |
| Digital services | Necessary for the product and incorporated under manufacturer control | Service boundary, control relationship |
| Substantial modification | Treated as a new product; modifier becomes manufacturer | Remanufacturing/modification contracts and liability |
| Traditional products | Still covered, including raw materials | Date placed on the market |
Sources: European Commission Liability for defective products page and the EUR-Lex official summary (accessed 8 November 2026). This is an editorial summary; software/AI classification, digital-service boundaries and "substantial modification" require case-specific legal analysis.
Who is liable in the EU: the chain and "always someone to claim against"
The manufacturer is the primary liable person; a non-EU manufacturer remains liable, but victims can claim against the EU importer or authorised representative; in their absence, against the fulfilment service provider. A victim can ask the distributor for information on the EU liable party; if there is no EU liable party or the distributor does not respond within one month, the victim can claim against the distributor. Online platforms can be liable if they act as a manufacturer, importer, authorised representative, fulfilment service provider or distributor for the defective product; platforms acting as a mere intermediary may also be liable under certain conditions.
| Role | Liability position | Action |
|---|---|---|
| Manufacturer | Primary liable person (including non-EU manufacturers) | Defect management, insurance, evidence |
| Importer | Can be claimed against | Contractual recourse, compliance checks |
| Authorised representative | Can be claimed against | Mandate scope, document retention |
| Fulfilment service provider | Can be claimed against if no importer/representative | Warehousing/delivery contract liability |
| Distributor | Can be claimed against if no EU liable party/no response within one month | Liable-party information, response process |
| Online platform | May be liable when acting as an economic operator | Role review, seller due diligence |
| Substantial modifier | Treated as manufacturer of a new product | Modification/remanufacturing liability |
Sources: European Commission Liability for defective products page and the EUR-Lex official summary (accessed 8 November 2026). This is an editorial summary; the chain, recourse and platform liability follow the Directive and national law.
Software/AI specifics: defects at release, updates and continuous learning
The Commission states that manufacturers can be held liable for defects that existed when their software or AI system was released; this includes defects that become apparent after release as a result of updates, upgrades or a machine-learning feature. "It worked at launch" is therefore not a safe harbour: if the defect arises from an update/learning mechanism under the manufacturer's control, liability may still attach. For AI, continuous learning is part of the product's capability and may also be a factor in defect assessment; for software, release versions, patches, rollbacks and known-issue records are key evidence. The PLD also allows both parties to request access to evidence in court where proportionate and necessary, so internal documents, test records and update logs are not just compliance material but potential litigation evidence.
| Scenario | Liability point | Evidence |
|---|---|---|
| Defect at release | Manufacturer liable for defects existing at release | Release review, test reports, known issues |
| Updates/upgrades | Defects appearing after release may be attributed | Update log, regression tests, rollback records |
| Continuous learning | Defects from learning under manufacturer control may be attributed | Model versions, training/evaluation records, monitoring |
| Digital services | Necessary for the product and incorporated under control | Service boundary, SLA, control evidence |
| Evidence disclosure | Both parties may request necessary, proportionate evidence | Document retention, traceable versions |
Sources: European Commission Liability for defective products page and the EUR-Lex official summary (accessed 8 November 2026). This is an editorial summary; "defect at release", update/learning attribution and evidence disclosure follow the Directive, national law and court practice.
Damage, proof and time limits: 10 years, 25 years, 3 years
The PLD covers death or personal injury (including physical and psychological harm), damage to property, and destruction or corruption of data not used for professional purposes. The victim must prove the defect, the damage and the causal link; fault does not need to be proven. Economic operators remain liable for defective products for 10 years after placing on the market; for latent health injuries the period can extend to 25 years; the victim has 3 years to bring a claim. Note that the PLD primarily protects natural persons; companies as victims are not necessarily covered (some Member States have separate rules).
| Item | Rule | Business implication |
|---|---|---|
| Personal injury | Death/personal injury, including psychological harm | Insurance, recall, medical risk |
| Property damage | Damage caused by the defective product | Liability limits, contracts |
| Data damage | Destruction/corruption of data not used for professional purposes | Backup, recovery, data governance |
| Liability period | 10 years after placing on the market; 25 years for latent health injuries | Long-term archives, insurance term |
| Limitation | Victim must claim within 3 years | Evidence retention, defence readiness |
| Victim scope | Primarily natural persons; companies not necessarily covered | Address B2B liability separately |
Sources: European Commission Liability for defective products page and the EUR-Lex official summary (accessed 8 November 2026). This is an editorial summary; damage types, starting points, interruption of limitation and additional national rules follow the Directive and national law.
90-day implementation checklist
If software/AI products will be placed on the EU market after 9 December 2026, use the first 90 days to connect the product inventory, liability chain, release/update control, evidence, insurance and contracts. The order is: scope and placement date, EU liability chain, defect/update process, evidence retention, contracts/insurance, drill.
| Phase | Action | Output |
|---|---|---|
| Weeks 1-2 | Inventory software/AI/digital services, versions and EU placement dates | Product list, scope |
| Weeks 2-3 | Confirm importer/authorised representative/fulfilment/distributor/platform roles | EU liability-chain map, contracts |
| Weeks 3-5 | Build pre-release defect review and update/learning change control | Release checklist, update log, rollback plan |
| Weeks 5-7 | Build evidence retention (tests, known issues, monitoring, incidents) | Evidence index, retention period |
| Weeks 6-8 | Review contractual recourse, liability limits and insurance cover | Contract clauses, insurance plan |
| Weeks 8-10 | Run a defect/recall/litigation evidence drill | Drill report, remediation items |
| Weeks 10-12 | Management review and 9 December cut-over plan | Management review, cut-over checklist |
Editorial implementation advice, not an official template; specific product scope, liability chain, contracts, insurance and evidence follow the PLD, national law and legal advice.
FAQ
Does the PLD apply now?
Not yet to new products. The PLD entered into force on 8 December 2024; Member States must transpose it by 9 December 2026, and it applies to products placed on the market or put into service from 9 December 2026. Earlier products remain under the 1985 Directive.
Are software and AI "products"?
Yes. The Commission expressly states that software is a product, including applications, operating systems and AI systems; digital services necessary for the product to function and incorporated under the manufacturer's control are also covered. Software/AI is no longer automatically excluded as a "service".
Who is liable for problems caused by updates or continuous learning?
The manufacturer is liable for defects existing when the software/AI was released, including defects that become apparent after release through updates, upgrades or a machine-learning feature, depending on whether it remains under the manufacturer's control. Continuous learning is part of the AI product's capability and may be a factor in defect assessment.
What if a Chinese vendor has no EU entity?
The non-EU manufacturer remains liable, but victims can claim against the EU importer or authorised representative; if neither exists, against the fulfilment service provider; if the distributor does not respond within one month to a request for the liable party, the victim may claim against the distributor. Contracts should set out recourse and cooperation duties.
Is data damage compensated?
The PLD covers destruction or corruption of data not used for professional purposes, as well as personal injury and property damage. Whether business/professional data is covered depends on national law and the facts; B2B contracts should address data liability separately.
How long does liability last?
Generally 10 years after the product is placed on the market; for latent health injuries the period can extend to 25 years; the victim must bring the claim within 3 years. Plan archives, insurance terms and defence readiness accordingly.
Do older products fall under the new rules?
No. Products placed on the market or put into service before 9 December 2026 remain under the 1985 Directive (85/374/EEC); the new PLD applies to products placed from that date. Manage cross-border products by placement date.
How do the PLD, AI Act and CRA relate?
They are different: the AI Act is ex ante regulation (risk tiers, conformity, transparency); the CRA governs cybersecurity of products with digital elements; the PLD is a civil compensation regime (defect, damage, causation, no fault requirement). AI Act/CRA documentation and risk management can support PLD evidence but do not replace the liability chain and insurance arrangements.
Research method and limitations
This article separates "official facts" from "editorial advice": the PLD's adoption/publication/entry-into-force/transposition/application dates, software and AI as products, update/continuous-learning liability, the liability chain, 10/25-year periods, 3-year limitation and evidence disclosure come from the European Commission Liability for defective products page, EUR-Lex Directive (EU) 2024/2853 and the official EUR-Lex summary (accessed 8 November 2026). The 90-day list and the "action/evidence" columns are editorial.
Eight limitations: (1) this is not legal advice; (2) national transposition, national-law details and court practice are not checked country by country; (3) software/AI defects, digital-service boundaries and "substantial modification" are highly fact-specific; (4) coverage of companies as victims, data-damage scope and B2B contractual liability need separate analysis; (5) the article does not map product safety, AI Act, CRA and GDPR clause by clause; (6) no contract template, insurance scheme or litigation strategy is provided; (7) classification of old vs new products depends on the specific transaction; (8) the Directive/guidance may update, so recheck the official pages before publishing.
Sources and basis
- European Commission, Liability for defective products: single-market-economy.ec.europa.eu/single-market/goods/free-movement-sectors/liability-defective-products_en. Software/AI as products, update/continuous learning, liability chain, 10/25 years, 3 years, 9 December 2026 transposition/application. Accessed 8 November 2026.
- EUR-Lex, Directive (EU) 2024/2853: eur-lex.europa.eu/eli/dir/2024/2853/oj. Product definition, defect, damage, liability chain, evidence disclosure, liability periods and limitation. Accessed 8 November 2026.
- EUR-Lex, Defective products - liability (official summary, last update 19 August 2025): eur-lex.europa.eu/EN/legal-content/summary/defective-products-liability.html. Digital products/software/AI, global value chains, defect assessment, damage, 10/25 years, 3 years, 9 December 2026. Accessed 8 November 2026.
Data cut-off 8 November 2026; based on official pages and the Directive; not legal advice; specific liability follows the PLD, national law and court practice.