A Product-Liability Map for a Connected AI System
The Directive’s product definition, lifecycle test, and operator chain become useful only when they are applied together. This checkpoint connects those already-established ideas through one hypothetical connected AI system, then asks what can be concluded and what still requires evidence. The goal is not to declare a winner in an imagined lawsuit. It is to practise the more valuable judgment: classify the system, trace control over time, identify candidate operators, and stop where the facts do not support a legal conclusion.
One system, several legal layers
Assume a company sells a connected kitchen appliance designed to detect dangerous cooking conditions and send alerts. The appliance contains sensors and embedded software. A separately developed AI model analyses sensor data in a cloud environment. A digital alert service sends messages to the user and can trigger a safety response in the appliance. The product is sold through an online marketplace. The appliance maker is established outside the Union, while the AI provider and the marketplace have different corporate identities. After launch, the appliance maker authorises a software update supplied by a third party. The model also continues learning from later operation.
These facts describe one commercial system, but they do not make every part the same legal object. The physical appliance is plainly a movable product. The embedded software and the AI model may be software products in their own right or components of the appliance, depending on how they are supplied and integrated. The alert service may be a related service if the appliance cannot perform one of its functions without it. The fact that all three are reached through a cloud interface does not decide the question; functional dependence does.
The system may also contain items that are not products under this Directive. A dashboard may display digital content. A user’s stored cooking video or written instructions may be information rather than a product. A general internet connection that carries the messages is not automatically a related service. Those exclusions do not mean the overall appliance is outside the regime. They mean that the analysis must identify the specific thing whose defect is alleged and the way it affects the product.
The first useful statement about the system is therefore not “the AI is liable” or “the cloud provider is safe.” It is a structured description: a physical product contains or depends on software; a digital service may be a component if the product cannot perform a function without it; ordinary connectivity is a separate boundary; and content carried through the system is not automatically part of the product. The classification is already more precise than the commercial label “AI kitchen platform.”
Classification by function
The product boundary can be tested with four questions.
What performs the safety-relevant work? If the model analyses sensor data and determines whether the appliance should enter a protective state, the model is not merely decorative content. It performs an operational function that can affect safety. The Directive’s recital expressly includes AI systems within software and says a developer or producer of software, including an AI system provider in the relevant Union sense, should be treated as a manufacturer.
What is necessary for the appliance to perform a function? If the alert service is needed for the appliance’s promised protective response, its absence may prevent a product function.