European UnionProduct Liability Directive, liability for defective products including software
Area: Product and AI liability law, also in Cybersecurity law.
A product liability rule binding private bodies.
- Private right of action
- Yes
As of .
What it requires
- The Directive does not apply to free and open-source software that you develop or supply outside the course of a commercial activity (Art. 2(2)).
- If you develop or produce software, or have it developed under your name or trademark, and make it available in the course of a commercial activity, you answer as its manufacturer for damage it causes by a defect (Arts. 4(1), 4(10) and 8(1)(a)).
- Keep supplying the software updates and upgrades needed to keep the product safe while it is within your control; a defect caused by their absence, or by software, updates or upgrades within your control, is not excused because it arose after you placed the product on the market (Art. 11(2)(b) and (c)).
- Meet the product safety requirements that apply to your product, safety-relevant cybersecurity requirements included: they count in deciding whether it is defective (Art. 7(2)(f)), and failing a mandatory product safety requirement that protects against the damage suffered presumes it defective (Art. 10(2)(b)).
- Account for what your product learns or acquires after release: the effect of any ability to continue to learn or acquire new features after it is placed on the market is weighed in deciding whether it is defective (Art. 7(2)(c)).
- Keep technical documentation you could produce if a court orders disclosure; failing to disclose presumes the product defective (Arts. 9(1), 10(2)(a)).
- If you are outside the EU, the importer or your authorized representative answers for the product in your place (Art. 8(1)(c)).
- If you substantially modify a product outside its manufacturer's control and then make it available on the market or put it into service, you are treated as its manufacturer (Art. 8(2)).
- Do not count on a contract term to limit or exclude your liability to an injured person; Article 15 bars it.
- Be able to show when you placed the product on the market or put it into service: you are not liable if you prove you did not, or that the defect probably did not exist at that time (Art. 11(1)(a) and (c)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Settledness
- As of
- Open questions
- How far does a 'related service' in Article 4(3), a digital service whose absence would prevent the product from performing one or more of its functions, reach a cloud backend that a mobile app calls?
- When is free and open-source software supplied 'outside the course of a commercial activity' under Article 2(2) where its developer also takes donations or sells support?
What this law does
Article 1 lays down common rules on the liability of economic operators for damage suffered by natural persons and caused by defective products. Article 4(1) defines a product to include software. Recital 13 says software is a product irrespective of the mode of its supply or usage, whether it is stored on a device, accessed through a communication network or cloud technologies, or supplied through a software-as-a-service model.
Recital 13 says a developer or producer of software, including an AI system provider within the meaning of Regulation (EU) 2024/1689, should be treated as a manufacturer. Article 2(1), as corrected by a corrigendum published on , applies the Directive to products placed on the market or put into service after .
Article 2(2) provides that the Directive does not apply to free and open-source software that is developed or supplied outside the course of a commercial activity. Recital 14 says the Directive applies where software is supplied in exchange for a price, or for personal data used other than exclusively for improving the security, compatibility or interoperability of the software.
Article 7(2)(f) counts relevant product safety requirements, including safety-relevant cybersecurity requirements, among the circumstances taken into account in assessing the defectiveness of a product. Article 9(1) requires a defendant to disclose relevant evidence at its disposal when the claimant has presented facts and evidence sufficient to support the plausibility of the claim for compensation.
Article 10(2)(a) presumes the product defective where the defendant fails to disclose relevant evidence under Article 9(1). Article 10(2)(b) and (c) also presume defectiveness where the claimant demonstrates non-compliance with mandatory product safety requirements intended to protect against the risk of the damage suffered, or that the damage was caused by an obvious malfunction of the product during reasonably foreseeable use or under ordinary circumstances.
Article 10(3) presumes the causal link where it has been established that the product is defective and that the damage caused is of a kind typically consistent with the defect in question.
Article 10(4) requires a national court to presume defectiveness or the causal link, or both, where, despite the disclosure of evidence under Article 9, the claimant faces excessive difficulties, in particular due to technical or scientific complexity, and demonstrates that it is likely that the product is defective or that there is a causal link.
Article 8(1) makes liable the manufacturer of a defective product and the manufacturer of a defective component that was integrated into or inter-connected with a product within the manufacturer’s control and caused that product to be defective. Where the manufacturer is established outside the Union, Article 8(1)(c) makes the importer, the authorized representative and, where there is neither, the fulfilment service provider liable.
Article 8(2) treats a person that substantially modifies a product outside the manufacturer’s control and thereafter makes it available on the market or puts it into service as its manufacturer. Article 8(4) applies the distributor rule of Article 8(3) to a provider of an online platform that allows consumers to conclude distance contracts with traders and is not an economic operator, where the conditions of Article 6(3) of Regulation (EU) 2022/2065 are fulfilled.
Article 6(1) covers death or personal injury, damage to or destruction of property except the defective product itself, a product damaged by a defective component integrated into or inter-connected with it by its manufacturer or within that manufacturer’s control, and property used exclusively for professional purposes, and the destruction or corruption of data that are not used for professional purposes.
Article 11(1)(e) exempts an economic operator that proves the objective state of scientific and technical knowledge at the time the product was placed on the market or put into service, or during the period in which it was within the manufacturer’s control, was not such that the defectiveness could be discovered.
Article 11(2) removes the exemption of Article 11(1), point (c), for a defect that did not exist when the product was placed on the market or came into being afterwards, where the defectiveness is due, within the manufacturer’s control, to a related service, software including updates or upgrades, a lack of software updates or upgrades necessary to maintain safety, or a substantial modification.
Article 15 bars limiting or excluding an economic operator’s liability to the injured person by a contractual provision or by national law. Article 16 sets a limitation period of three years from the day the injured person became aware, or should reasonably have become aware, of the damage, the defectiveness and the identity of the economic operator that can be held liable.
Article 17(1) ends the right to compensation on the expiry of 10 years from the date the defective product was placed on the market or put into service, or, for a substantially modified product, made available on the market or put into service after the modification, unless the injured person has in the meantime initiated proceedings against an economic operator that can be held liable.
Article 17(2) extends that period to 25 years where the injured person could not initiate proceedings within 10 years because a personal injury was latent. Article 3 forbids Member States from maintaining or introducing provisions diverging from the Directive, including more stringent or less stringent provisions, unless the Directive provides otherwise.
Article 18(1) lets a Member State maintain, by derogation from Article 11(1)(e), existing measures under which economic operators are liable even if they prove that the state of scientific and technical knowledge did not allow the defectiveness to be discovered, if it notifies the text of the measures to the Commission no later than .
Article 21 repeals Directive 85/374/EEC with effect from , and that Directive continues to apply to products placed on the market or put into service before that date. Article 22(1) requires Member States to bring into force the laws, regulations and administrative provisions necessary to comply with the Directive by . Article 23 provides that the Directive enters into force on the twentieth day following that of its publication in the Official Journal. The Directive was published in the Official Journal on .
When LexLint raises it
When your app profile says your app crawls the web, trains models, generates content with AI, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, publishes adult content, operates a social platform, serves under-18s, operates an app store, ships a mobile app, reuses other publishers' content, distributes a software product, records calls, records text chat or tracks devices.