product liability directive

The Product Liability Directive is not a compliance regime. Nobody certifies you against it, no authority supervises it and it sets no fines. It decides one thing: when a defective product harms a person, who has to pay compensation, and what that person has to prove. The liability does not depend on fault. If the product was defective and caused the damage, the operator answers, however careful it was.

The directive binds member states, which write it into national law. It sets one level for the whole EU: national law may not be stricter or softer, except where the directive allows. Only natural persons can claim. A business customer cannot use it for its own losses, though its staff can if a product injures them.

What you can do is keep records that show what your product was when it left your hands, keep an update policy you can defend, and check your supplier terms and your insurance. The plan for this area is built from those steps.

A product is any movable, and the definition names software outright. The Commission’s page lists applications, operating systems and AI systems. According to the recitals, it does not matter how the software is supplied: installed on a device, reached over a network or the cloud, or sold as a service. A developer of software, including an AI system provider, is treated as a manufacturer. Information is not a product, so the content of digital files and the mere source code of software are left out.

A related service is a digital service built into or connected with a product so that the product cannot perform one of its functions without it. The recitals give examples: a service that monitors and regulates the temperature of a smart fridge, or a voice assistant that controls products. It counts as a component of the product when it is within the manufacturer’s control. The manufacturer’s control also covers updates and third-party components it supplies, authorises or consents to, and it continues as long as the manufacturer can still supply software updates, itself or through someone else.

Free and open-source software developed or supplied outside a commercial activity is out of scope. If you build such software into a product you sell, you answer for it as part of your product, even though its authors do not.

A product is defective when it does not give the safety a person is entitled to expect, or the safety that EU or national law requires. A court looks at all the circumstances. For software and connected products several of them matter in particular:

• how the product is presented: labelling, design, technical features and the instructions for installation, use and maintenance
• reasonably foreseeable use, and the effect of other products expected to be used with it, including by connection
• any ability to keep learning or to gain new features after release
• the moment the product was placed on the market or, where the manufacturer keeps control afterwards, the moment it left that control
• product safety requirements, including safety-relevant cybersecurity requirements
• recalls and other safety interventions by an authority or by an operator

According to the recitals, a cybersecurity vulnerability can make a product defective, for example where the product does not meet safety-relevant cybersecurity requirements. A product is not defective only because a better product, or an update, comes out later.

The manufacturer of the defective product answers first. That includes anyone who has a product designed or made and anyone who puts their own name or trademark on it. The manufacturer of a defective component answers too, where its component was built into or connected with the product within the manufacturer’s control and made it defective. The product’s manufacturer still answers for that component.

When the manufacturer is outside the EU, the importer and the authorised representative answer as well. Where there is neither, the fulfilment service provider answers: a business that offers at least two of warehousing, packaging, addressing and dispatching without owning the product. If no liable operator in the EU can be found, a distributor answers unless, within one month of being asked, it names one or names its own supplier. The same rule reaches online platforms that let consumers buy from traders, under the conditions of the Digital Services Act.

Anyone who substantially modifies a product outside the manufacturer’s control and then sells it or puts it into service counts as its manufacturer.

Several liable operators answer jointly and severally, and the one who pays can turn to the others under national law. When someone else, such as an attacker exploiting a vulnerability, also caused the damage, your liability is not reduced. It can be reduced where the injured person’s own fault contributed. The recitals give the example of a user who negligently did not install an update that would have prevented the damage.

Compensation covers three kinds of damage:

• death or personal injury, including medically recognised damage to psychological health
• damage to or destruction of property, except the defective product itself, a product damaged by a defective component the manufacturer built in, and property used only for professional purposes
• destruction or corruption of data that are not used for professional purposes

All material losses from that damage are covered. Non-material losses are covered as far as national law allows. According to the recitals, the cost of recovering or restoring data counts, but there is no material loss where the data can be retrieved at no cost, for example from a backup. Data used for professional purposes, even partly, are left out. A data leak is a different thing: the directive leaves the EU rules on personal data as they are.

An injured person who presents enough facts and evidence to make the claim plausible can ask the court to order you to disclose relevant evidence you hold. The court limits the order to what is necessary and proportionate and weighs everyone’s interests, including trade secrets, which it can protect during and after the case. It can also require the evidence to be presented in an easily accessible and understandable form. According to the recitals, that can include documents you have to compile from what you hold. The defendant can ask for the claimant’s evidence in turn.

The claimant still has to prove the defect, the damage and the causal link. The directive eases this with presumptions, which you can rebut:

• the defect is presumed if you do not disclose the evidence the court ordered
• the defect is presumed if the product breaks a mandatory EU or national safety requirement meant to protect against that kind of damage
• the defect is presumed if the damage came from an obvious malfunction during reasonably foreseeable use
• the link is presumed once a defect is established and the damage is of a kind typically consistent with it
• where technical or scientific complexity makes proof excessively difficult, the court presumes the defect, the link or both if the claimant shows they are likely

According to the recitals, a product that lacks the means to log its operation where the law requires that is an example of breaking a mandatory requirement.

An operator escapes liability if it proves one of these: it did not place the product on the market; the defect probably did not exist when the product was placed on the market or put into service, or came into being later; the defect is due to complying with legal requirements; the state of scientific and technical knowledge at the time could not reveal it; a component maker shows the defect comes from the design of the product or the instructions it was given; or a modifier shows the defect sits in a part it did not change.

The second defence has a hard limit for software makers. It does not work where the defect comes from something still within the manufacturer’s control: a related service, software including its updates, a lack of the software updates needed to keep the product safe, or a substantial modification. According to the recitals, the directive itself does not oblige anyone to provide updates. Member states may also keep or introduce rules that take away the state-of-the-art defence for some products.

A claim has to be brought within three years of the injured person learning of the damage, the defect and who is liable. The right ends 10 years after the product was placed on the market or put into service, or 25 years where a personal injury stayed hidden. A substantial modification starts a new 10-year period. Updates that are not substantial modifications do not, according to the recitals.

• 18 November 2024. The directive was published in the Official Journal. The Commission says it entered into force on 8 December 2024.
• 9 December 2026. Member states must have their national laws in force. The 1985 directive is repealed from that day.
• After 9 December 2026. Products placed on the market or put into service from then on fall under the new rules. Products placed earlier stay under the 1985 directive, as written into your national law.

The text says the new rules apply to products placed on the market after 9 December 2026, while the Commission’s page says from that date. Ask your lawyer how your national act treats a product released on the day itself. Check your national act for its own wording and its date.

The directive does not name the Cyber Resilience Act. It works through two openings. A court weighs safety-relevant cybersecurity requirements when it judges a defect, and it presumes a defect where a product breaks a mandatory safety requirement meant to protect against the damage suffered. Whether a given CRA requirement is such a requirement is a question the courts will settle. Read the two laws side by side all the same: the CRA’s duty to handle vulnerabilities during the support period, including with security updates, meets the rule that a missing safety update keeps you liable.

The records overlap too. Under the CRA a manufacturer keeps the technical documentation for at least 10 years or the support period, sets and states a support period, and reports actively exploited vulnerabilities. Under the PLD a claim can be brought up to 10 years after the product was placed on the market, and a court can order you to disclose relevant evidence. The same file answers both: release records, test results, the component list, the vulnerability record with dates, the update history and the support period decision.

Insurance is a decision for your board. The directive asks the Commission to report on the availability of product liability insurance, and nothing more. Whether your cover reaches software, related services and data loss is a question for your broker.