EU Product Liability Directive 2024 — AI Systems (Directive 2024/2853): AI Compliance Requirements
Directive (EU) 2024/2853, published in the Official Journal 2024-11-18 and entered into force 2024-12-08/09 (20 days after publication), explicitly classifies AI systems as "products" under EU product liability law, replacing the 1985 PLD. EU Member States must transpose into national law by December 9, 2026; the new rules apply to products placed on the EU market from that date (products placed on the market before that date remain subject to the old 1985 regime). Key changes for AI: (1) AI software — standalone or embedded — is now a "product" subject to strict liability. (2) Manufacturers are liable for defects arising from post-deployment machine learning updates or autonomous evolution. (3) A cybersecurity vulnerability or missing security update constitutes a product defect. (4) Claimants benefit from rebuttable presumptions: if they show damage likely caused by the AI system, the burden shifts to the manufacturer to disprove a defect. (5) The new Directive ABOLISHES two limits that existed under the old 1985 regime: the €500 minimum threshold for property-damage claims, and the (nationally-variable, up to ~€85M in some Member States) aggregate liability cap for personal-injury claims arising from identical items with the same defect — both are now uncapped/threshold-free. This sits alongside — not replacing — the EU AI Act; high-risk AI systems face BOTH frameworks.
Summary of publicly-available regulatory text as of 2026-08-22. Verify against current official sources before relying on this for compliance decisions. Not legal advice.
Key Facts
November 18, 2024
December 9, 2026
Civil liability to harmed individuals for personal injury (no cap), property damage (no minimum threshold — the old €500 floor was abolished), and certain medically-recognized psychological harm.
What Your Business Must Do
3 compliance requirements identified. Critical requirements carry the highest risk of enforcement action.
AI Product & Software Inventory (EU PLD Scope)
High PriorityIdentify every AI system, application, or software component you place on the EU market. Under Directive 2024/2853, each constitutes a "product" for strict liability purposes. Document for each: manufacturer, version at EU market placement, subsequent updates, and the mechanism by which it could evolve post-deployment. This inventory is the foundation of your EU PLD compliance.
Deadline: December 9, 2026
Directive (EU) 2024/2853, Art. 4 (definition of "product")AI Defect & Update Policy
High PriorityAny post-deployment update that introduces a defect — including via machine learning — creates manufacturer liability. Document: (1) Your release and update testing protocols. (2) How you monitor AI model drift or performance degradation. (3) Your security update cadence and patch policy. A missing security update is itself a "defect" under Article 7(1). Establish a formal vulnerability disclosure and patching schedule.
Deadline: December 9, 2026
Directive (EU) 2024/2853, Art. 7Technical Documentation (Burden of Proof)
Medium PriorityClaimants can invoke a disclosure order requiring manufacturers to produce technical documentation. Prepare and maintain: training data descriptions, model architecture, testing and validation reports, performance metrics, known limitations, and risk mitigations. Courts may presume a product is defective if manufacturers unreasonably refuse disclosure. Maintain this documentation for 10 years after each product/version placement on the market.
Deadline: December 9, 2026
Directive (EU) 2024/2853, Art. 9-10Who Does This Apply To?
Applies to: manufacturers (and, in defined circumstances, importers, authorised representatives, fulfilment service providers, and economic operators that substantially modify a product) of any 'product' placed on the EU market — and under Directive (EU) 2024/2853 the definition of product now expressly includes software, including standalone and embedded AI systems. It is a civil strict-liability regime, not a registration or size-gated obligation: any business whose AI product causes covered harm can be liable. Key features for AI: liability can arise from defects introduced by post-deployment machine-learning updates or autonomous behaviour; a missing security update or exploited cybersecurity vulnerability can constitute a defect; and claimants benefit from rebuttable presumptions that shift the burden of proof to the manufacturer where the case is technically complex. Member States must transpose by 9 December 2026, and the new rules apply to products placed on the market from that date. This sits alongside the EU AI Act — a high-risk AI system can face both. Remedy is civil compensation for personal injury (no cap), property damage, and certain data/psychological harm.
Recent Regulatory Guidance
European Commission — Q&A on the new Product Liability Directive (2024/2853) and AI systems (2024-2025)
Commission Q&A clarified the AI-specific implications of the new PLD: (1) AI software is explicitly a 'product', whether standalone or embedded; (2) defects can arise from post-deployment machine learning updates or autonomous behavior — manufacturers remain liable for foreseeable evolution within the product's intended use; (3) cybersecurity vulnerabilities and missing security updates constitute defects; (4) rebuttable presumptions ease the claimant's burden where the AI system's complexity prevents proof of specific defect; (5) the directive operates alongside — not in place of — the EU AI Act, GDPR, and the Cyber Resilience Act. High-risk AI systems face all four frameworks simultaneously.
Member State transposition progress (as of mid-2026)
With the 9 December 2026 transposition deadline approaching, adoption is uneven: Germany (draft bill published Sept 2025, revised Dec 2025, targeting a close one-to-one transposition), the Netherlands, Denmark, Finland, Czech Republic, Slovakia, and Sweden had published transposition bills by April 2026, and Hungary had already adopted its transposing law. France and Italy had NOT yet transposed as of this cycle, with significant delays expected in France. AI manufacturers should track their specific target Member States' transposition status individually rather than assume uniform EU-wide readiness by the December deadline.
Key Case Law & Precedent
Boston Scientific Medizintechnik v. AOK Sachsen-Anhalt (CJEU C-503/13 + C-504/13)
Court of Justice of the European Union · 2015Foundational CJEU ruling on the original 1985 PLD's definition of 'defect' as encompassing units in a production series with potential failure modes, even without per-unit proof of defect. The 2024 PLD codifies and extends Boston Scientific's reasoning to AI systems — population-level defect characterizations apply where AI exhibits failure modes consistent with a model class. The Commission's Q&A explicitly cites Boston Scientific as the doctrinal anchor for the new directive's evidence-disclosure and rebuttable-presumption provisions.
Outcome: Population-level defect classification confirmed; manufacturer liability for preventive replacements established
Case referenceIndustry Playbooks covering EU Product Liability Directive 2024 — AI Systems (Directive 2024/2853)
These industry playbooks include jurisdiction-specific checklist items and guidance for EU Product Liability Directive 2024 — AI Systems (Directive 2024/2853).
Frequently Asked Questions
Does EU Product Liability Directive 2024 — AI Systems (Directive 2024/2853) apply to my business?
Directive (EU) 2024/2853, published in the Official Journal 2024-11-18 and entered into force 2024-12-08/09 (20 days after publication), explicitly classifies AI systems as "products" under EU product liability law, replacing the 1985 PLD. EU Member… Use Aegis Firma's free scanner to get a personalized assessment in under 5 minutes.
What is the penalty for non-compliance?
The maximum penalty under EU Product Liability Directive 2024 — AI Systems (Directive 2024/2853) is: Civil liability to harmed individuals for personal injury (no cap), property damage (no minimum threshold — the old €500 floor was abolished), and certain medically-recognized psychological harm.. Fines are typically scaled by company size, severity of violation, and whether violations were willful or accidental.
How do I comply with EU Product Liability Directive 2024 — AI Systems (Directive 2024/2853)?
The 3 requirements above cover the core obligations. The fastest path to compliance is: (1) conduct an AI risk assessment, (2) document your AI systems, (3) implement transparency disclosures where required. Aegis Firma generates all required documents automatically.
Official Source
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024L2853Last updated: 2026-08-22 — verify at source before relying on this information.
Don't leave compliance to chance
Aegis Firma scans your AI tools, tells you exactly which regulations apply, and generates all required documents — in 30 minutes.
Start your free compliance scan