- Directive (EU) 2024/2853, published on 18 November 2024, replaces the 1985 directive on liability for defective products.
- It expressly includes software and AI systems and widens compensable harm, also to data and psychological health.
- States must transpose it before 9 December 2026; it will apply to products placed on the market afterwards.
The Official Journal of the European Union published on 18 November 2024 Directive (EU) 2024/2853 of 23 October on liability for damage caused by defective products. It repeals and replaces the 1985 Directive, which for almost forty years has been the basis of the European regime. Its aim is to harmonise the rules of the Member States, protect consumers and adapt liability to digital products and artificial intelligence.
Member States must transpose it into their law by 9 December 2026 at the latest. The new liability will apply to products placed on the market or put into service after that date, while those placed on the market earlier will remain subject to the previous regime. In Spain it will mean reforming the consumer legislation that governs this matter today. The directive sets a common minimum, so national rules will have to align with its definitions, although States keep some room on matters such as the calculation of compensation or procedural rules.
What counts as a product
The directive expressly includes software, understood as any operating system, program, application or artificial intelligence system, except open-source software developed or supplied outside a commercial activity. It also covers digital manufacturing files, such as those used in 3D printing, digital services integrated into a product, such as the traffic data of a navigation system, and intangible products such as gas, water or electricity.
The concept of defect remains the lack of the safety a person is entitled to expect, but criteria are added to assess it: the ability to learn or acquire new features after being placed on the market, interconnection with other products, the control the manufacturer retains through updates, cybersecurity vulnerabilities, product recalls and the lack of means to record how the product operates where the law requires it. In practice, a connected product that receives updates or learns with use will remain the manufacturer’s responsibility while it keeps control over that software.
Who is liable and for what harm
Liability remains strict: the producer answers without the injured person having to prove fault. The circle of those liable widens to include the manufacturer of the defective component, the provider of a related digital service, anyone who substantially modifies a product and, in certain circumstances, the importer, the authorised representative, the logistics provider, the distributor and online platforms.
Compensable harm is also widened: it includes the destruction or corruption of data not used for professional purposes, with the cost of recovering it, and medically recognised damage to psychological health. The three-year period for bringing a claim and the ten-year long-stop are maintained, the latter rising to 25 years when a personal injury is slow to appear.
Evidence and preparation
The directive makes proof easier for the injured person. A defect is presumed if the defendant fails to disclose evidence in its possession, if the product breaches mandatory safety requirements or if the harm results from an obvious malfunction; and a causal link is presumed when the harm is typical of that defect. Both may also be presumed when technical complexity makes proof excessively difficult.
For companies, this calls for reviewing contracts, general terms, instructions and warnings, strengthening the processes for detecting and correcting defects and for updating software, and keeping records and traceability that allow information to be produced before a court. Distributors and platforms should also know that under certain conditions they may be liable too, for example if they fail to identify the manufacturer when asked. It is also worth checking with your insurer that policies cover these new risks, since the directive sets no financial cap on liability.
Software is no longer a field outside product liability.
This article is general information. It is not legal, tax or investment advice, and it does not take anyone’s particular circumstances into account.
