Who Stands Behind the Product?

Directive (EU) 2024/2853 does not assign responsibility simply to the company whose name appears on a login screen or to the person who wrote the most code. This chapter asks how the Directive follows manufacture, integration, market access, presentation, control, and substantial modification across a software-enabled product chain. The practical result is a way to identify candidate operators without assuming that every participant is liable or that a distributed architecture has no legally reachable actor.

Manufacturer is a functional role

The Directive starts with the manufacturer of the defective product. Article 4 defines a manufacturer as a natural or legal person who develops, manufactures, or produces a product; has a product designed or manufactured and presents themselves as its manufacturer by putting their name, trademark, or another distinguishing feature on it; or develops, manufactures, or produces a product for their own use. The role is therefore broader than the factory that assembled a physical object. It follows who creates the product, commissions it under their identity, or presents themselves as responsible for it.

That matters for software. The Directive’s recital says that a developer or producer of software, including an AI system provider in the sense used by the Union’s AI legislation, should be treated as a manufacturer. The recital is not a substitute for the facts required by the operative provisions, but it makes the intended connection clear: an AI system is not legally weightless because its provider delivers it through a remote interface. If the software is a product or a component and its defect causes covered damage, the developer or provider may be part of the manufacturer analysis.

The same product can also contain more than one manufacturer-relevant layer. Article 8 makes the manufacturer of a defective product liable. It also makes the manufacturer of a defective component liable when the component was integrated into or interconnected with a product within the product manufacturer’s control and caused that product to be defective. The product manufacturer’s liability also covers damage caused by a defective component within its control. A claimant therefore need not choose between the whole-product maker and the component maker merely because the same defect can be described at both levels.

Imagine a connected appliance whose hazard-detection application is developed by one company and integrated into hardware sold under another company’s name. The application provider may be relevant as the software manufacturer. The appliance maker may be relevant as the manufacturer of the finished product and as the actor that integrated or presented the application. Whether both are liable in a particular case would depend on defect, damage, causation, integration, and control. The important point is that the legal chain can follow the interface between the software and the product rather than stop at the first corporate boundary.

This is different from saying that every vendor in a technology stack is a manufacturer. A cloud host may provide infrastructure without developing or presenting the safety-relevant software. An independent application may be compatible with a product without being integrated into it. A data supplier may influence performance without supplying a product or component under the Directive’s definitions.