Product Liability
Product Liability
EU Legislation in Progress
Introduction
The transformation to a digital economy and society is changing the economic reality of the single
market. New emerging technologies (e.g. cleaning robots and medical health apps) already benefit
our society and economy, but also present potential risks.
Certain features of digital technologies, such as the intangibility of digital products, their
dependence on data, their complexity and connectivity, pose challenges in applying liability rules.
So do features specific to artificial intelligence (AI), such as autonomous behaviour, continuous
adaptation, limited predictability and opacity. This creates legal uncertainty for businesses and may
make it difficult for consumers and other injured parties to obtain compensation for damage caused
by products and services that use these technologies. 1
The transition to a circular economy – extending the life of materials through upgrading and
repairing digital products and components – will benefit the environment. However, it raises
questions about liability for any subsequent damage. Circular business models in which products
are repaired, recycled, refurbished or upgraded are increasingly common and central to the EU's
efforts to achieve sustainability and waste-reduction goals. In its 2020 circular economy action plan,
the European Commission announced a sustainable product policy to provide high-quality,
functional and safe products designed for reuse, repair, manufacturing and recycling. However,
existing product liability rules do not define who should be liable for defects resulting from changes
to products after they are put into circulation.
Modern supply chains sometimes involve economic operators whose novel form (e.g. fulfilment
service providers, 2 such as e-commerce platforms) means that they do not fit easily into traditional
supply chains under the existing liability legal framework. One of the challenges is creating a level
playing field between EU and non-EU manufacturers by making sure compensation is available to
consumers for defective products imported directly from outside the EU.
Existing situation
When the Product Liability Directive (PLD) was adopted in 1985, the Commission saw a need to
harmonise the fragmented legal protection on damage caused by defective products. The PLD
introduced a common set of rules enabling harmonisation and an equal level of protection for
consumers throughout the single market, using the concept of no fault-based producer liability for
damage caused by defective products. No fault-based liability means that the liability does not
depend on manufacturer fault or negligence (also called 'strict liability', where producers are
responsible for defective products, regardless of whether the defect is their fault). This form of
liability differs from fault-based liability regimes where an injured person can make a claim for
damage caused by products and services based on a person's conduct by generally proving:
(i) existence of damage, (ii) fault of the liable person, and (iii) causality between that fault and the
damage. To be compensated under the PLD no-fault liability regime, the burden of proof for the
injured person consists in showing only that:
the product was defective;
damage was suffered;
a causal link exists between the damage and the product's defectiveness.
The existing PLD sets an EU liability regime for financial compensation claims for death, personal
injury, or material damage caused by an item or product intended for private use above a certain
threshold (set at €500 today). It allows Member States to impose a maximum compensation limit,
which may not be less than €70 million (Article 16(1)). The injured person has three years within
which to seek compensation from the date on which they became aware of the damage, the defect
and the identity of the producer. An expiry period protects the producer, who is no longer liable
once 10 years have elapsed since the product was put on the market.
2
New Product Liability Directive
3
EPRS | European Parliamentary Research Service
4
New Product Liability Directive
intelligence (AI act) 8 currently under negotiation – do not meet the safety requirements set in the AI
act, the revised PLD would apply if the defective product causes physical harm, property damage or
data loss. The same can be said of the recently proposed cyber-resilience act, which builds on
existing rules to encourage manufacturers and software developers to mitigate cybersecurity risks
through respect for essential cybersecurity and vulnerability handling requirements.
The revised PLD makes clear that all these mandatory safety requirements should be taken into
account when a court assesses if a product is defective. 9
Scope
The revised PLD sets a wider definition of 'product' (Article 4(1)) and a broader scope of liable parties
(Articles 4(16) and 7), than the existing PLD.
To adapt to the digital age, the proposal covers:
Software (including software updates) – whether embedded or standalone,
including AI systems. 10
Digital manufacturing files – enabling the automated control of machinery or tools,
such as 3D printers.
Digital services – where these are necessary for products to function as components
of the product with which they are interconnected or integrated (e.g. navigation
services in an autonomous vehicle).
Whether software (including apps) was covered under the existing PLD has always been controversial.i For
instance, there is controversy as to whether software should qualify as a product in the sense of the
directive,ii or whether it is part of either the services or of the intangible goods category,iii which falls
outside the scope of the existing PLD.iv
D. Wuyts, The product liability directive – more than two decades of defective products in Europe, 2014,
i)
and BEUC position paper on the Review of Product Liability Rules, 2017.
See Article 2 of the existing PLD. A product has to be distinguished from a service and must be understood
ii)
and administrative provisions of the Member States concerning liability for defective products, 2018: 'The
definition of "product" as per article 2 of the Directive is related to the concept of "movable". This has been
interpreted as meaning that only tangible goods shall be considered products [...] the non-tangible nature
of some new technological developments (software, applications, Internet of Things, Artificial Intelligence
systems) makes it difficult to classify them as products rather than services'.
iv)
K. Alheit, The applicability of the EU Product Liability Directive to software, 2001.
With the aim of not hampering innovation: (i) free and open-source software developed or supplied
outside the course of commercial activity, as well as (ii) the source code of software, should be
excluded from the definition of products covered under the proposal (Recital 13). As far as the
broader scope of the proposal compared to the existing PLD on liable parties is concerned, Article 7
of the revised PLD lists the types of 'economic operators' which can be held liable for defective
products, by introducing a layered approach to liability depending on the different qualification of
the economic operator. Among the list of economic operators are: (i) the manufacturer of a product
or component, (ii) the provider of a related service, (iii) the authorised representative, (iv) the
importer, and (v) the fulfilment service provider or the distributor (Article 4(16)). The manufacturer
should be liable for damage caused by a defect in their product or components. An innovation
introduced in the revised PLD is considering any economic operator who has substantially
modified the product outside the control of the manufacturer liable for any defect. Such a party is
then considered as a manufacturer.
5
EPRS | European Parliamentary Research Service
When a manufacturer is established outside the EU, the revised PLD would further attribute
liability for a defective product to the importer and the authorised representative in the EU. As a
last resort, the fulfilment service provider (offering at least two of the following services:
warehousing, packaging, addressing and dispatching of a product, without having ownership of the
product), will be held liable when the importer and authorised representative in the EU are based
outside the EU (Article 7(3)).
Distributors of a defective product (offline and online sellers) can also be held liable upon request
by a claimant and when the distributor fails to identify any of the above operators.
Online platforms should be liable in respect of a defective product on the same terms as such
economic operators when performing the role of manufacturer, importer or distributor. According
to the Digital Services Act, online platforms will not enjoy the conditional liability exemption for
merely playing an intermediary role in the sale of goods between traders and consumers when 'they
present the product, or otherwise enable the specific transaction in question, in a way that would
lead an average consumer to believe that the product is provided either by the online platform itself
or by a trader acting under its authority or control'. In keeping with this principle, when online
platforms act as intermediaries, it should be possible to hold them liable in the same way as
distributors under the revised PLD (Recital 28).
Main provisions
The nature of damage: psychological health and loss or corruption of data
Under the existing PLD, the producer is liable for defective products which have caused death,
personal injury, or material damage.
The revised PLD would expand the definition of damage (Article 4(6)), by including material losses
resulting from:
death or personal injury, including medically recognised harm to psychological
health;
property damage, while removing the threshold of €500 and the possibility for
Member States to impose a financial ceiling of €70 million; and
loss or corruption of data that is not used exclusively for professional purposes.
The revised PLD also extends the 10-year liability period to 15 years for latent health injuries
(Article 14(2) and (3)).
EU Member States would need to lay down the rules on compensation for such damage.
Product defects
In certain circumstances, liability would continue to apply when a defect came into being after a
product has already been placed on the market or put into service (Recitals 37 and 38). This entails:
(i) software updates under the manufacturer's control, (ii) failure to address cybersecurity
vulnerabilities, and (iii) machine learning. This differs from the exclusion of liability under Article 7(b)
of the existing PLD, which exempts the manufacturer from liability when 'it is probable that the
defect which caused the damage did not exist at the time when the product was put into circulation
by him or that this defect came into being afterwards'.
In short, developers would continue to be responsible for emerging technologies that learn
independently and for deployment updates or lack thereof.
6
New Product Liability Directive
However, Article 8 of the revised PLD obliges the manufacturer to disclose necessary information in
court when the injured person has presented facts and evidence sufficient to support the
'plausibility of the claim for compensation'. This obligation on the manufacturer is always subject
to protection of trade secrets and confidentiality. In addition, Article 9 of the revised PLD eases the
burden of proof for the injured person by establishing a presumption of defectiveness and causal
link under certain conditions.
Defectiveness is presumed when:
a manufacturer fails to comply with the obligation to disclose information;
a product does not comply with mandatory safety requirements;
damage is caused by an obvious product malfunction.
A causal link is presumed when:
damage is typically consistent with the defect in question; or
technical or scientific complexity causes excessive difficulty in proving liability (e.g.
'black box' AI systems).
The manufacturer retains the right to contest the existence of difficulties in achieving the burden of
proof, or to rebut the presumptions.
Advisory committees
Although it has not yet published an opinion on the revision of the PLD, the European Economic
and Social Committee (EESC) has, on several occasions, called for revision of the product liability
rules and to adapt them to economic and societal changes.
The European Committee of the Regions (CoR) has not published an opinion on the revision of the
PLD specifically. Nevertheless, the need to revise and update safety and liability rules is mentioned
in several CoR opinions – for example, in the opinions on the new industrial strategy for Europe and
the European approach to artificial intelligence.
National parliaments
The subsidiarity deadline for national parliaments to issue opinions on the proposal was
12 December 2022. In its contribution, the German Bundesrat praises the alleviation of the burden
of proof and the facilitated access to evidence in favour of the injured party. However, the Bundesrat
stresses the requirement of excessive evidentiary difficulties for the reduction of 'the standard of
proof' should be specified in more detail in the procedure. In addition, the Bundesrat advocates a
7
EPRS | European Parliamentary Research Service
more precise definition of the required security level of software and an exemption from product
liability for free and open-source software developed or provided outside a commercial activity.
Stakeholder views 11
Scope and type of damage
The EU consumer protection organisation, BEUC, welcomes the fact that software is included as a
product and that data loss can be considered as damage for which manufacturers can be liable. The
Irish Council for Civil Liberties favours the inclusion of software as a product, stressing how
consumers could finally hold companies liable for damage caused by software, including third party
software. The Software Alliance (BSA) stresses how the proposed inclusion of a provision on 'loss or
corruption of data' might create confusion and overlaps with the GDPR. Furthermore, BSA believes
the provision on 'medically recognised harm to psychological health' must be clarified by including
what claimants must prove to claim such damage (e.g. diagnosis by any medical professional and/or
defined categories of conditions). The Computer and Communications Industry Association (CCIA)
stresses that it is wrong to consider software as a product, considering it tends to evolve over time
and has never caused any physical harm in itself. The CCIA also warns that non-material damage
such as loss of data or psychological harm should not be part of the revised PLD's liability regime.
Product defectiveness
As no product can ever be fully cyber-secure, Orgalim (representing Europe's technology industries)
recommends that a product should be considered defective under the PLD for cybersecurity
vulnerabilities only when it does not comply with mandatory cybersecurity requirements under EU
or national law. In addition, it requests to delete the reference to 'foreseeable misuse' of a product
because it extends the scope of liability for manufacturers and might bring legal uncertainty. The
Software Alliance (BSA) also asks for clarification of the concept of defectiveness and suggests
aligning the timeline related to the responsibility of manufacturers for defects that should have
been solved via updates with the proposed CRA (e.g. expected product lifetime or a period of five
years, whichever is shorter). According to BSA, this solution would reflect realities of software
development and maintain consistency between the PLD and CRA.
8
New Product Liability Directive
the existing liability rules can also be applied to AI and other emerging technologies. Representing
European companies in the mechanical engineering industry, the Verband Deutscher Maschinen-
und Anlagenbau e.V. (VDMA) argues that the existing technology-neutral liability regime already
solves issues with current AI use cases. New liability rules should therefore target only specific and
high-risk use cases.
Academic views
Inclusion of software under the product liability coverage
A report by the Centre on Regulation in Europe (CERRE) favours the inclusion of software under the
scope of the revised PLD. Indeed, CERRE warns that differentiating between tangible (e.g. hardware)
and intangible (e.g. software) products does not make sense in the digital age. For example, if
software is stored on a tangible medium, such as a disc or flash-drive, it qualifies as a product under
the current PLD. However, if the software is downloaded, the application of the current PLD is
unclear. 12 Cabral shares the same concern by advocating the extension of the PLD to cover software
in general. Indeed, Cabral states that software plays a necessary part in the functioning of certain
products today and should probably be considered part of such products. 13 Wagner praises the
proposal to extend the product concept to software, including 3D printing programmes and
product-related digital services, as necessary changes to adapt the current PLD to the digital age.14
Dheu et al. welcome the clear integration of software and digital manufacturing in the scope of the
proposal as a positive outcome of the revised PLD. According to the authors mentioned above, the
proposal has taken account of the specificities of internet of things (IoT) products that include
software as components. The qualification of software as a product also seems to cover AI products,
even though the proposal does not mention AI directly. 15
In opposition with this view, but recognising a lack of clarity, Koch et al. take the position that the
existing PLD already extends to products with digital content, such as when operating software is
installed on a physical item; 16 case law and jurisprudence has largely taken this approach. It could
be argued that a product does not need to be tangible, considering that the existing PLD already
covers electricity. 17 Nonetheless, Koch et al. acknowledge the existing PLD's lack of clarity and its
9
EPRS | European Parliamentary Research Service
possible application gaps regarding standalone software which is bought separately from any
tangible items such as apps installed on tablets or smartphones.
Scope of damage
Dheu et al. support the inclusion of harm to psychological health and of loss or corruption of data –
including when not used exclusively for professional purposes – as part of damage suffered by
natural persons under the coverage of the revised PLD. Wagner underlines how the inclusion of
digital data within the scope of protection of the revised PLD is a welcome acknowledgment of the
changing landscape of property in the digital era. Cabral stresses the importance of compensating
non-pecuniary damage (e.g. psychological health), considering how close the new emerging
technologies will work to human beings. On this point, Koch et al. clarify that the revised PLD regime
on non-pecuniary damage should explicitly state that such damage should always be linked to pain
and suffering triggered by bodily injury, and not to stand-alone immaterial harm, such as purely
emotional distress.
Against the limited €500 threshold for compensation of damage under the existing PLD, Cabral
proposes the implementation of a quicker and simpler procedure to settle claims regarding small
values under the revised PLD.
10
New Product Liability Directive
A European Law Institute Innovation Paper proposes introducing mandatory insurance schemes for
economic operators or compensation funds in the proposed product liability package. 21 According
to Dheu et al., such schemes might solve the potential insolvency problem for the liable party and
ensure victims receive effective compensation.
Legislative process
In Parliament, the file has been assigned jointly (under Rule 58) to the Committee on Internal
Market and Consumer Protection (IMCO) and the Committee on Legal Affairs (JURI). Vlad Botoș
(Renew, Romania) and Pascal Arimont (EPP, Belgium) have been appointed as rapporteurs. The
co-rapporteurs unveiled their draft report on 5 April 2023; their amendments to the Commission
proposal concern, inter alia:
The notion of damage – the co-rapporteurs removed the loss or corruption of data from the scope
because they considered that it was already covered by other EU laws (e.g. GDPR). In addition, the
draft report clarified that medically recognised harm to psychological health should be confirmed
'by a court-ordered medical expert'.
Concept of defectiveness – the co-rapporteurs specified that cybersecurity vulnerabilities in a
product qualify as a defect only when the product does not comply with mandatory cybersecurity
requirements set in EU or national law. The draft report aligned the liability for defects due to lack
of software updates with the proposed cyber-resilience act (e.g. expected product lifetime or five
years, whichever is shorter).
Reversal of the burden of proof – the co-rapporteurs opposed a general reversal of the burden of
proof for highly complex products (e.g. AI systems) by removing the presumptions and adding that
the defendant must prove that it is highly likely that 'the product was defective in such a way that
the defectiveness is highly likely the cause of the damage'.
Collection of evidence – the co-rapporteurs narrowed down the conditions for court-ordered
disclosure of evidence putting safeguards to assure confidentiality of the information. In addition,
the draft report gave the manufacturers the possibility to request access to the evidence of the
claimant.
In the Council, the Working Party on Civil Law Matters discussed a compromise text on the new
Product Liability Directive on 17 March 2023 and 19 April 2023.
OTHER SOURCES
Liability for Defective Products, Legislative Observatory (OEIL), European Parliament.
European Commission, Proposal for a Directive on Liability of Defective Products, COM(2022) 495.
European Commission, Adapting liability rules to the digital age, the circular economy and global value
chains, June 2021.
European Parliament, Committee on Legal Affairs draft report with recommendations to the Commission
on a Civil liability regime for artificial intelligence, 2020/2014 (INL).
11
EPRS | European Parliamentary Research Service
ENDNOTES
1
European Commission report, Liability for artificial intelligence and other emerging technologies, 2019.
2
Article 4(7) of the revised PLD defines fulfilment service providers as any natural or legal person offering, in the course
of commercial activity, at least two of the following services: warehousing, packaging, addressing and dispatching of
a product, without having ownership of the product, with the exception of postal services.
3
Under Article 225 Treaty on the Functioning of the EU, Parliament can ask the Commission to submit a legislative
proposal on matters on which it considers a Union act is necessary in order to implement the Treaties.
4
See T. Madiega, Artificial intelligence liability directive, EPRS, European Parliament, January 2023.
5
See Explanatory Memorandum in Section 1.2.
6
Contractual liability is liability arising from a refusal or neglect to honour the commitments made under a contract.
Not fulfilling, or only partially fulfilling, obligations results in harm (or damage).
7
I.e. replacement, repair or reimbursement.
8
AI systems are defined in the draft AI act as software developed with certain techniques and approaches (machine
learning, logic- and knowledge-based approaches, statistical approaches, etc.) that can, for a given set of human-
defined objectives, generate outputs such as content, predictions, recommendations, or decisions influencing the
environments with which these systems interact.
9
See European Commission, Questions and answers on the revision of the Product Liability Directive,
28 September 2022.
10
Ibid.
11
This section aims to provide a flavour of the debate and is not intended to be an exhaustive account of all different
views on the proposal. Additional information can be found in related publications listed under 'European Parliament
supporting analysis'.
12
CERRE report, EU Liability Rules for the Age of Artificial Intelligence, March 2021.
13
T. Cabral, Liability and artificial intelligence in the EU: Assessing the adequacy of the current Product Liability Directive,
2020.
14
G. Wagner, Liability Rules for the Digital Age – Aiming for the Brussels Effect, 2023.
15
O. Dheu et al., The European Commission's Approach To Extra-Contractual Liability and AI – A First Analysis and
Evaluation of the Two Proposals, 6 October 2022.
16
A. Koch et al., Response of the European Law Institute to the Public Consultation on Civil Liability – Adapting Liability
Rules to the Digital Age and Artificial Intelligence, 2022.
17
M. Ebers, Liability For Artificial Intelligence And EU Consumer Law, 2021.
18
C. de Meeus, The Product Liability Directive at the Age of the Digital Industrial Revolution: Fit for Innovation?, 2019.
19
R. de Bruin, Autonomous Intelligent Cars on the European Intersection of Liability and Privacy, 2016.
20
Ibid.
21
European Law Institute Innovation Paper, Guiding Principles for Updating the Product Liability Directive for the Digital
Age, January 2021.
Second edition. The 'EU Legislation in Progress' briefings are updated at key stages throughout the legislative
procedure.
12