Overview
Directive (EU) 2024/2853 can bring software, AI, digital manufacturing files, and function-critical digital services into no-fault product liability. The series follows safety and control from classification through operators, damage, proof, defences, and time, while preserving exclusions, other legal routes, and fact-sensitive outcomes.
Learning outcomes
- Software and AI can be products or components even when delivered through cloud or SaaS; delivery format alone is not decisive.
- Defectiveness follows expected safety across foreseeable use, interconnection, learning, cybersecurity, updates, and controlled post-market change.
- Responsibility can span software providers, manufacturers, supply-chain operators, platforms, distributors, and substantial modifiers, but statutory conditions remain decisive.
- Compensation remains limited to specified personal injury, qualifying property damage, and non-professional data destruction or corruption.
- The corrected application boundary is after 8 December 2026; transposition, repeal, limitation, expiry, and modification operate on separate clocks.
Keywords
Preview every chapter · Unlock full text, audio, and video from chapter 4
PlansFAQ
When can software or AI count as a product under Directive (EU) 2024/2853?
Under Directive (EU) 2024/2853, software and AI can count as products or components even when delivered through cloud or SaaS; a digital service can be related when its absence prevents a product function. Mere content, source code, general internet access, and non-commercial open-source supply remain bounded or excluded.
Who may be liable for a defective connected AI product?
Potentially liable operators include the software or AI provider, product or component manufacturer, importer, authorised representative, fulfilment service provider, distributor, platform, or substantial modifier, but only when the statutory role, defect, damage, causation, and control conditions fit.
What digital harms does the Directive compensate?
It can cover death or personal injury, medically recognised psychological injury, qualifying private or mixed-use property damage, and destruction or corruption of non-professional data caused by a defective product. Pure economic loss, privacy breaches, discrimination, professional-use losses, and data breaches do not automatically fit this route.
How do claimants prove defect in an opaque AI system?
They generally must prove defectiveness, damage, and causation, but after making a claim plausible they may seek proportionate disclosure, and defined triggers can support rebuttable presumptions, including excessive technical difficulty when defect or causation is likely.
What are the key time limits under Directive (EU) 2024/2853?
Claims generally have a three-year limitation period from knowledge of damage, defect, and the liable operator, plus a ten-year expiry from market placement or service; latent personal injury can extend expiry to twenty-five years, and substantial modification may create a new reference point.