Defences, Time Limits, and the Corrected Transition Date

Directive (EU) 2024/2853 gives injured persons a no-fault route, but it does not make an operator liable in every case or leave exposure open forever. This chapter examines the two sets of boundaries that remain after a plausible claim has been assembled: what an operator can prove to avoid or reduce liability, and which legal clock controls the claim. The distinction between an exemption, a victim-facing limit, limitation, expiry, repeal, and transposition is essential for analysing long-lived software and AI systems.

Defences follow control and proof

Article 11 allows an economic operator to avoid liability by proving defined circumstances. The first group concerns whether the relevant market event happened at all. A manufacturer or importer can show that they did not place the product on the market or put it into service. A distributor can show that they did not make it available. These are straightforward but important boundaries: an entity should not be liable under the Directive for a product it did not release into the relevant chain.

A second defence concerns timing. An operator can show that it is probable that the defect causing the damage did not exist when the product was placed on the market, put into service, or made available by a distributor, or that the defect arose later. In a static product model, this can separate a manufacturing defect from later misuse or deterioration. In a digital product model, the timing question is more demanding because software, related services, updates, and learning can change the product after launch.

The Directive narrows the ordinary timing defence where the later cause remains within manufacturer control. Article 11 identifies a related service, software including updates or upgrades, a lack of software updates or upgrades needed to maintain safety, and a substantial modification. If the defect is due to one of those matters and it is within the manufacturer’s control, the operator cannot simply say that the product was safe when it first left the factory or server.

This does not create liability by label. The claimant still needs a defect, covered damage, and causation. The operator can dispute whether the software or service was within its control, whether the update was necessary to maintain safety, whether the change was substantial, and whether the alleged defect caused the loss. The rule changes which timing argument is available; it does not decide the underlying facts.

Legal compliance and development risk

An operator can also prove that the defect was due to the product’s compliance with legal requirements. The defence recognises a difficult situation in which an operator followed a mandatory rule and that compliance is precisely why the product had the relevant characteristic. Compliance is not a universal answer to a defect claim; the operator must show the connection between the legal requirement and the defect that caused the damage.

Article 11 includes the development-risk defence. An operator can prove that the objective state of scientific and technical knowledge at the relevant time was not such that the defectiveness could be discovered. The standard is objective and refers to the most advanced level of knowledge accessible during the relevant period, not merely to what this particular operator happened to know. A small company cannot claim ignorance as a substitute for the state of knowledge itself.