EU Product liability rules: what tech companies must know

A new era of accountability for digital innovation

Software updates, AI systems and even 3D printing files can now trigger legal liability, just like traditional machines or physical tools. With the EU’s new directive, the rules of the game have changed for developers, manufacturers, distributors and platforms alike.
This shift affects everyone in the value chain. Whether you build, integrate or modify digital products, your legal exposure has likely increased. The good news is that, with the right preparation, you can turn compliance into a competitive advantage.
 

What is Directive 2024/2853?

On 18 November 2024, the European Union published Directive 2024/2853 in its Official Journal. It entered into force on 9 December 2024. EU Member States have until December 2026 to implement the directive into national law.
The new rules replace the original product liability directive from 1985 a time when digital products barely existed. The updated framework now recognises the complex, hybrid nature of modern products and aims to ensure consumer protection in a digital-first economy.
 

What has changed in the EU product liability rules?

1. Software and AI are now considered products
The directive removes all doubt: digital products are now officially covered. That includes:

• Embedded software in machines and devices
• Standalone applications and programs
• AI systems and machine learning models
• Software updates and upgrades
• Digital files that control devices (e.g. 3D printing files)

If any of these elements cause harm, the responsible company can be held liable.
Note: Open-source software provided outside of commercial activities is excluded.
 

2. Broader definition of damage
Previously, only physical injury and property damage were covered. The new directive adds:

• Medically recognised psychological harm
• Loss or corruption of non-professional personal data
  This reflects the growing importance of data integrity and user well-being in today’s economy.
   

3. More parties can be held accountable
Liability now extends beyond the traditional manufacturer. The following parties may also be held responsible:

• Software and AI developers
• Importers and authorised representatives
• Fulfilment service providers (e.g. warehouses, logistics)
• Distributors and retailers
• Online platforms acting as sellers
• Any party that modifies a product after market placement

If a third-party update or patch introduces a defect, the party responsible for that modification can be liable too.
 

4. Easier path for victims to prove harm
Victims still need to prove that:

• A product was defective
• The defect caused damage
• The damage occurred

However, the directive introduces mechanisms to make this easier:

• Courts may assume a product is defective if it clearly fails
• In complex technologies (e.g. AI), courts may presume causality if the victim lacks access to technical details
• Courts can demand internal documentation from companies unless it would reveal trade secrets
   

What should tech companies do now?

The EU product liability rules are not just a legal update—they are a call to action for tech companies. Consider the following steps:

• Review your product  portfolio
  Audit if your products are connected devices ,  are or include  software or AI (and related  updates thereof) and check who places those products  on the EU market.
• Update contracts
  Clarify responsibilities between developers, partners, importers and sellers.
• Track all product changes
  Keep a log of patches, upgrades and modifications, even post-sale.
• Build in security and safety
  A failure to address known vulnerabilities can now lead to liability.

By making these actions part of your daily operations, you reduce legal risk and boost trust in your digital offering.
 

Final thoughts: turning regulation into opportunity

The new EU product liability rules bring clarity to a fast-moving digital landscape. Software, AI and other digital innovations are now treated as full products under the law. That means stronger protection for consumers and greater responsibility for businesses.
If you develop, sell or distribute digital goods in Europe, now is the time to act. Understanding the directive and adapting your practices today will help you reduce risk, protect your customers and position your company as a trustworthy innovator in tomorrow’s market.