New Product Liability Rules: What Will Change for Your Business?
Software, AI and updates are explicitly covered by the revised product liability framework. What does this mean for manufacturers, software suppliers and others in the supply chain?
Why Are Product Liability Rules Changing?
Products no longer consist of physical parts alone. Machines rely on software, devices receive regular updates and artificial intelligence increasingly shapes operations. But who is responsible when a product causes harm?
Directive (EU) 2024/2853 modernises Europe's product liability regime. It may affect manufacturers, importers, distributors, software providers and companies modifying products. For management, the question is how it affects products, suppliers and internal risk controls.
In this article
Who Is Liable When a Product Causes Damage?
Consider a Dutch machine builder supplying an automated packaging machine with third-party software. Following an update, a safety mechanism fails and an employee of the customer is injured. Is the machine builder, software provider or update contractor liable?
The manufacturer of the finished product may be liable for a defective component, including software. A component manufacturer may also be liable, including where the component was integrated under the finished-product manufacturer's control and made the product defective. Outsourcing components does not automatically remove responsibility.
A product is defective if it fails to provide the safety a person is entitled to expect or that EU or national law requires. Presentation, reasonably foreseeable use and relevant cybersecurity requirements matter.
Are Software and AI Covered by Product Liability?
Yes. Software, including AI systems, is explicitly a product under the Directive, whether supplied separately or embedded in machinery. Related digital services can also count where the product cannot perform one or more functions without them, such as a cloud service essential for remote control.
This affects technology businesses, AI-enabled agricultural machinery and food manufacturers selling equipment under their own brands. Free and open-source software developed or supplied outside commercial activity is excluded. Not every digital service qualifies.
Who Bears Responsibility Across the Supply Chain?
A business marketing a product under its own name or trademark is treated as a manufacturer. Under specified conditions, importers, authorised representatives, fulfilment service providers and distributors can also be liable.
For non-EU products, an EU importer or authorised representative may be liable. Where neither exists, a fulfilment service provider may be relevant. A distributor may be liable if it fails to identify the relevant economic operator or its own supplier within a month of a request. Online platforms can also be liable in particular circumstances when consumers are led to believe the platform itself supplies the product.
Who designs, specifies, integrates and imports the product? Actual roles matter. Supplier contracts remain essential for information and recourse, but cannot eliminate statutory liability towards an injured claimant.
What Changes When Software Is Updated?
Software changes after delivery; security vulnerabilities may require updates. The Directive recognises that products can remain under manufacturer control after being marketed. The manufacturer cannot always rely on the fact that an update-related defect arose later, and failure to provide necessary safety updates under its control may matter.
A person substantially modifying a product outside the original manufacturer's control and then making the modified product available or putting it into service may be treated as a manufacturer. Not every update creates new liability. For our packaging machine, records of approvals, testing and responsibility are crucial.
Who Can Claim and What Loss Is Covered?
The Directive gives natural persons who suffer damage caused by a defective product a right to compensation. Others may also bring a claim under certain conditions, for example where they have succeeded to the injured person's rights or are authorised to act on their behalf.
The following types of damage are eligible for compensation:
Death and personal injury, including medically recognised psychological harm.
Property damage, excluding, among other things, the defective product and property used exclusively professionally.
Destruction or corruption of data not used professionally.
For the packaging machine in the example, this means that the injured employee can claim compensation for personal injury. Damage to the machine used exclusively for professional purposes, however, falls outside this regime.
The former €500 property-damage threshold is removed and no general liability cap is imposed. Pure economic loss falls outside this special regime, although other causes of action may apply.
How Do the Evidence Rules Change?
In principle claimants must prove loss, defect and causation. The Directive provides for court-ordered disclosure and rebuttable presumptions.
Disclosure of Evidence
A claimant may request a court order for relevant evidence after presenting sufficient facts to make the claim plausible. Disclosure must be necessary and proportionate, with safeguards for trade secrets. There is no general obligation to supply every document proactively. Defendants can also seek evidence from claimants, and other legal or contractual disclosure duties may apply.
When Do Presumptions Apply?
A defect can be presumed where a business breaches a disclosure order, relevant mandatory safety requirements are not met, or an obvious malfunction causes harm during foreseeable use. Causation may be presumed where an established defect typically causes the damage concerned. Exceptional technical complexity can support further presumptions. All are rebuttable: this is not a general reversal of the burden of proof.
System logs, test results, change records and update approvals may help reconstruct the packaging machine's safety checks.
How Long Can a Business Be Held Liable?
Claims are generally time-barred three years after the claimant knew or reasonably should have known the damage, defect and liable party. A ten-year long-stop applies from marketing or putting into service; substantial modification may restart it. Latent personal injuries may qualify for a 25-year period under specific conditions. Reliable change records matter.
What Does This Mean for Suppliers, Contracts and Insurance?
Product liability involves engineering, procurement, quality, IT, legal and compliance teams. Their cooperation matters when products depend on software and digital services.
Supplier agreements: clarify safety, updates, information and contractual recourse.
Documentation and processes: record changes and safety checks.
Evidence management: keep technical and commercial records accessible, preserved and protected.
Insurance: check general, product-liability and cyber cover against actual activities.
The GPSR, Cyber Resilience Act and AI Act impose separate requirements within their respective scopes, some already applicable and others phased in. Preventive product safety duties are distinct from civil liability.
When Will the New Rules Apply?
Member States must transpose the Directive by 9 December 2026. The Dutch House of Representatives adopted Bill 36 906 on 15 October 2026; the legislative process was not complete at the article's publication date. Following the corrigendum of 7 May 2026, the revised regime concerns products placed on the market or put into service from 9 December 2026. Earlier products generally remain under the previous regime.
Businesses should review contracts, software dependencies, records and insurance ahead of December. Other product-safety obligations may already apply.
What Does This Mean for Your Business and How Can DUFINCO Help?
The rules call for clarity on products, supply-chain roles and ownership of risk. DUFINCO identifies applicable obligations and legal exposure, then translates these into supplier agreements, governance, compliance and practical internal controls.
To discuss what preparations your business needs, contact info@dufinco.nl or +31 (0)6 512 47 217.
