AI Liability in the EU: Product Liability Directive (EU) 2024/2853 and the Withdrawn AI Liability Directive

Directive (EU) 2024/2853 on liability for defective products is the EU liability law that covers software and AI systems placed on the market or put into service after 9 December 2026, while the AI Liability Directive proposal COM(2022) 496 was withdrawn (OJ C/2025/5423, 6 October 2025). The new directive replaces Council Directive 85/374/EEC for those products.

The AI Act itself, Regulation (EU) 2024/1689 (OJ L, 2024/1689, 12.7.2024), in force since 1 August 2024 and amended by Regulation (EU) 2026/1744 (in force since 27 July 2026), sets no rule on compensation for damage. The EU AI Act sets duties before and after an AI system reaches the market, and those duties produce documents a court can read once a claim for damage is brought (our reading).

What Happened to the AI Liability Directive?

The AI Liability Directive never became law: the Commission proposed it on 28 September 2022 (COM(2022) 496, procedure 2022/0303(COD)) and withdrew it in 2025, and the Parliament's legislative observatory lists the procedure as "Procedure lapsed or withdrawn".

What the 2022 Proposal COM(2022) 496 Would Have Done

COM(2022) 496 would have set two rules for non-contractual fault-based claims: disclosure of evidence on high-risk AI systems and the burden of proof (Article 1(1)). Three provisions carried the design:

• Scope (Article 1(1)): claims in which the injured person must prove fault.
• Disclosure (Article 3): courts could order disclosure of evidence on high-risk systems, and a refusal would have led to a presumption of non-compliance.
• Presumption of causality (Article 4): a rebuttable presumption of a causal link between the defendant's fault and the output of the AI system.

The proposal tied fault to the AI Act. A provider's fault for the causality presumption would have been limited to breaches of AI Act requirements, cited in the numbering of the Commission's 2021 AI Act proposal, because the AI Act had not yet been adopted in 2022.

From COM(2025) 45 to OJ C/2025/5423: The Withdrawal Step by Step

The withdrawal took three formal steps: the Commission announced it in its 2025 work programme on 11 February 2025 (COM(2025) 45, Annex IV, item 32), approved it at its 2533rd meeting on 16 July 2025 and published it in the Official Journal on 6 October 2025 (C/2025/5423). The work programme gives the reason in one line: "No foreseeable agreement - the Commission will assess whether another proposal should be tabled or another type of approach should be chosen."

The proposal has no legislative standing since the withdrawal, so any reference to the AI Liability Directive as "pending" or "proposed" describes the period before 6 October 2025. The overview of the AI Act compared with product liability, GDPR, ISO/IEC 42001, NIST AI RMF and US AI laws places the withdrawn proposal next to the instruments still in force.

How Directive (EU) 2024/2853 Covers AI Systems and Software

Directive (EU) 2024/2853 makes manufacturers liable for damage caused by defective products, and it counts software, and so AI systems, as products. It is a maximum harmonisation act: Member States may not keep or introduce more or less stringent provisions unless the directive provides for it (Article 3). Our reading: liability under the directive does not depend on proof of the manufacturer's fault, which sets it apart from the fault-based claims the withdrawn proposal addressed.

Software and AI System Providers: Article 4(1) and Recital 13

Article 4(1) defines a product as all movables, including electricity, digital manufacturing files, raw materials and software. Our reading: an AI system, as software, therefore counts as a product. The directive does not apply to free and open-source software developed or supplied outside the course of a commercial activity (Article 2(2)).

Recital 13 states that AI system providers within the meaning of Regulation (EU) 2024/1689 should be treated as manufacturers. Under Article 3(3) of the AI Act, a provider develops an AI system or a general-purpose AI model, or has it developed, and places it on the market or puts it into service under its own name or trademark, whether for payment or free of charge. Our reading: the provider role under the AI Act roles is therefore the entry point for liability as manufacturer, while a deployer under Article 3(4) uses an AI system under its authority, except in a personal non-professional activity.

Who Is Liable along the Supply Chain: Article 8

A person who substantially modifies a product outside the manufacturer's control becomes its manufacturer under Article 8(2) of Directive (EU) 2024/2853. For distributors, Article 8(3)(b) sets an identification period of one month.

The AI Act has a parallel rule. From 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I systems, Article 25(1) names three cases in which another operator becomes the provider of a high-risk AI system: it puts its name or trademark on a high-risk system already placed on the market or put into service, makes a substantial modification so that the system remains high-risk, or modifies the intended purpose of a system not classified as high-risk so that it becomes high-risk. A substantial modification under Article 3(23) is a change not foreseen or planned in the initial conformity assessment that affects compliance with Chapter III, Section 2, or modifies the assessed intended purpose. Our reading: these role changes along the value chain under Article 25 and the Article 8(2) rule can point to the same company.

Defectiveness, Self-Learning and Missing Updates: Articles 7 and 11(2)

Courts assessing whether an AI system is defective take into account its ability to continue to learn or acquire new features after it was placed on the market (Article 7(2)(c)). The same assessment considers relevant product safety requirements, including safety-relevant cybersecurity requirements (Article 7(2)(f)).

Article 11(2) closes the later-defect defence for software. The exemption in Article 11(1)(c) is unavailable where the defect is due to related services, software including its updates, the lack of software updates necessary to maintain safety, or a substantial modification within the manufacturer's control.

Presumptions That Ease the Burden of Proof: Article 10

Directive (EU) 2024/2853 eases the burden of proof through presumptions, and Article 10(2) presumes a product defective in three situations:

• Non-disclosure of relevant evidence by the defendant.
• Non-compliance with mandatory product safety requirements.
• Damage caused by an obvious malfunction of the product.

Article 10(4) adds a presumption for cases of technical or scientific complexity. Where the claimant faces excessive difficulties because of that complexity, the court presumes defectiveness, the causal link or both, provided the claimant shows that they are likely.

Damage, Limitation and Expiry: Articles 6, 16 and 17

Directive (EU) 2024/2853 compensates three types of damage: death or personal injury, including medically recognised damage to psychological health; damage to property other than the product itself and property used exclusively for professional purposes; and destruction or corruption of data not used for professional purposes (Article 6(1)). Three periods limit how long a claim stays open:

When Does the New Product Liability Directive Apply?

Directive (EU) 2024/2853 applies to products placed on the market or put into service after 9 December 2026 (Article 2(1)); it entered into force on 8 December 2024 and must be transposed by 9 December 2026 (Article 22(1)). The directive runs on these dates:

The AI Act follows separate dates, and a product liability date never changes an AI Act duty. The EU AI Act timeline sets the act's own application dates, such as 2 August 2026 for Article 50 transparency and 2 December 2027 for Chapter III, Sections 1 to 3, for Annex III systems.

Products placed on the market or put into service before 9 December 2026 stay under Council Directive 85/374/EEC of 25 July 1985 (OJ L 210, 7.8.1985, p. 29), which continues to apply to them (Article 21 of Directive (EU) 2024/2853).

AI Act vs Product Liability Directive: Side-by-Side Comparison

The AI Act sets duties before and after an AI system reaches the market and fines breaches, while Directive (EU) 2024/2853 decides who pays compensation once a defective product has caused damage. The two instruments and the withdrawn proposal differ on eight points:

Our reading: a fine and a compensation claim can follow the same defect. Article 99(3) to (5) set the maximum fines that national penalty rules lay down under Article 99(1), and the tiers of EU AI Act penalties run independently of any damages a court awards under the directive.

The third column is history: no court applies COM(2022) 496, and the comparison shows only which gaps the proposal targeted.

Where AI Act Duties Feed a Product Liability Claim

Six AI Act duties produce the evidence a court reads under Directive (EU) 2024/2853, and a breach of the AI Act's mandatory requirements can trigger the Article 10(2) presumption of defectiveness (our reading). Every mapping is our reading:

• Documentation retention (Article 18(1)): providers of high-risk AI systems keep the technical documentation, quality management documentation, changes approved and decisions issued by notified bodies, and the EU declaration of conformity for 10 years after placing on the market or putting into service, matching the 10-year expiry of Article 17(1).
• Log retention (Article 19(1)): providers keep automatically generated logs for at least six months, unless Union or national law provides otherwise; logs are relevant evidence under the disclosure presumption of Article 10(2).
• Role changes (Article 25(1)): the deemed-provider triggers mirror the substantial modifier rule of Article 8(2).
• Post-market monitoring (Article 72): providers actively and systematically collect, document and analyse performance data over the system's lifetime, the record a court reads for self-learning under Article 7(2)(c) and for missing updates under Article 11(2).
• Serious incident reporting (Article 73): providers report serious incidents to the market surveillance authority within 15 days, within 2 days for critical infrastructure or a widespread infringement and within 10 days in the event of death, and the reports show when the provider knew of an incident.
• Cybersecurity (Article 15): high-risk AI systems meet cybersecurity requirements that a court can weigh as safety-relevant cybersecurity requirements under Article 7(2)(f).

The record of the AI Act conformity assessment, whether internal control under Annex VI for Annex III points 2 to 8 or the Annex VII notified-body procedure for Annex III point 1 where harmonised standards or common specifications are not applied in full, is a record a court can read when it assesses defectiveness (our reading).

The AI Act keeps other liability law intact. It is without prejudice to the rules of other Union acts on consumer protection and product safety (Article 2(9)), and participants in an AI regulatory sandbox remain liable under Union and national liability law for damage to third parties, even where good-faith compliance with the sandbox plan protects them from administrative fines (Article 57(12)).

One Compliance Programme for the AI Act and Product Liability

Six steps let one compliance programme serve both the AI Act and a product liability defence.

1. Map each AI system to its AI Act role under Article 3(8) and to the manufacturer role of recital 13 of Directive (EU) 2024/2853.
2. Date every version and release against the directive's application date, because earlier products stay under Directive 85/374/EEC (Article 21).
3. Keep documentation for 10 years and logs for at least six months (Articles 18(1) and 19(1)); longer keeping for the 25-year latent-injury horizon of Article 17(2) is our reading.
4. Control updates and substantial modifications, since Article 11(2) removes the later-defect defence for software updates and missing safety updates.
5. Feed post-market monitoring and serious-incident data (Articles 72 and 73) into the liability file.
6. Allocate duties in a written value-chain agreement under Article 25(4), whose first subparagraph Regulation (EU) 2026/1744 replaced, noting that it does not cover third parties making tools, services, processes or components, other than general-purpose AI models, accessible to the public under a free and open-source licence.

EN 18286:2026 on the quality management system is, as of 24 October 2026, the only harmonised standard cited under the AI Act, by Commission Implementing Decision (EU) 2026/2274 (OJ L, 2026/2274, 14.10.2026). The EU AI Act checklist sorts the underlying obligations by role and date.

The steps give an orientation on what the two acts require; they do not decide whether a specific AI system is defective, high-risk or covered.

Which Other EU Rules Touch AI Liability?

Three further EU acts meet AI liability at its edges: the General Product Safety Regulation, the Cyber Resilience Act and the GDPR.

Each touches a different element of Directive (EU) 2024/2853: product safety requirements, cybersecurity requirements or damage to data (our reading).

The full set of the AI Act compared with other EU rules covers the GDPR, ISO/IEC 42001, the NIST AI RMF and US AI laws alongside product liability.

General Product Safety as a Safety Net (Recital 166)

Recital 166 of the AI Act states that Regulation (EU) 2023/988 on general product safety applies as a safety net for AI-related products that are not high-risk. Our reading: its requirements can inform defectiveness under Article 7(2)(f) of Directive (EU) 2024/2853.

The Cyber Resilience Act Interface

Article 7(2)(f) of Directive (EU) 2024/2853 counts safety-relevant cybersecurity requirements among the product safety requirements that inform defectiveness, and Article 42(3) of the AI Act deems high-risk AI systems that meet the Cyber Resilience Act's Article 12(1) conditions to comply with the Article 15 cybersecurity requirements. The Cyber Resilience Act is Regulation (EU) 2024/2847 (OJ L, 2024/2847, 20.11.2024), in force since 10 December 2024.

Personal Data and the GDPR

Destruction or corruption of non-professional data is compensable damage under Article 6(1) of Directive (EU) 2024/2853, while unlawful processing of personal data by an AI system is a GDPR question. A single incident can raise both claims. The overlap of the AI Act and the GDPR shows where the two regulations apply in parallel.

AI Liability in the EU: Related Questions

The withdrawal notice C/2025/5423, Articles 2(1), 2(2) and 10(2) of Directive (EU) 2024/2853 and Article 2(12) of the AI Act answer the most frequent questions.

Frequently Asked Questions

Is the AI Liability Directive in force?

No: COM(2022) 496 was withdrawn; the notice was published in the Official Journal on 6 October 2025 (C/2025/5423). The Commission stated in COM(2025) 45 that it "will assess whether another proposal should be tabled or another type of approach should be chosen".

Does the Product Liability Directive apply to AI today?

Not yet: Directive (EU) 2024/2853 applies to products placed on the market or put into service after 9 December 2026. Earlier products stay under Directive 85/374/EEC (Article 21).

Does AI Act compliance rule out product liability?

No: the AI Act sets no rule on compensation for damage, so a claim under Directive (EU) 2024/2853 turns on defectiveness rather than on AI Act compliance (our reading). Non-compliance with mandatory product safety requirements is one trigger of the Article 10(2) presumption, and counting AI Act requirements among them is our reading.

Is open-source AI software covered?

Not when developed or supplied outside a commercial activity (Article 2(2) of Directive (EU) 2024/2853). The AI Act's own exclusion for open-source AI in Article 2(12) does not cover high-risk, Article 5 or Article 50 systems.

Compiled by the AIActGuide.net Editorial Team from the Official Journal text; how we check every statement: methodology.