Short answer
No single EU rule answers the whole question. The Artificial Intelligence Act and product-safety legislation mainly govern whether an AI-enabled product may be placed on the market, how risks must be controlled, and when authorities can require corrective action or a recall. Product-liability law and national contract or tort law determine whether an injured person receives compensation.
The dates matter. Regulation (EU) 2026/1744, effective since 27 July 2026, postponed the AI Act's Chapter III regime for Article 6(1)/Annex I products to 2 August 2028. Regulation (EU) 2023/988 on general product safety (GPSR) already applies, but only fills gaps left by more specific Union safety law. Directive (EU) 2024/2853 modernises no-fault product liability for software, connected services and certain data loss, but Member States have until 9 December 2026 to transpose it. The previous product-liability regime continues for products placed on the market or put into service before that date.
A regulatory breach or recall can be powerful evidence, but it does not automatically establish civil liability. The product date, type of loss, sector rules, operator roles and evidence connecting defect to damage all affect the result.
Start by separating prevention from compensation
The first legal layer is preventative. Sectoral rules for machinery, medical devices, vehicles, radio equipment and other regulated products set safety and conformity requirements. The AI Act adds requirements where an AI system falls within its scope. It classifies an AI system as high-risk under the product route only if both parts of Article 6(1) are satisfied:
“the AI system is intended to be used as a safety component of a product, or the AI system is itself a product, covered by the Union harmonisation legislation listed in Annex I”.
—
The second condition is that the product, or the AI system as a product, must undergo third-party conformity assessment under the listed legislation. Classification can bring risk management, documentation, human oversight, performance, conformity-assessment and post-market duties into the regulatory file. For an embedded system, the product manufacturer may have provider obligations.
The 2026 Digital Omnibus adds an important sector boundary. For products in Section B of Annex I, amended Article 2(2) generally leaves only Article 6(1), a new regulatory-sandbox provision and Articles 102–112 of the AI Act applicable; AI-specific safety requirements instead need to be integrated into sector law. Machinery Regulation (EU) 2023/1230 was moved from Section A to Section B, with delegated machinery requirements due to apply by 2 August 2028. An AI-enabled machine therefore cannot be analysed from the original AI Act text alone.
This compliance layer can reduce harm and preserve evidence, but it does not create a freestanding right to damages. Compensation still needs a recognised cause of action.
Which product-safety rule applies?
For a regulated product, begin with its sector-specific Union legislation. The GPSR is a safety net for consumer products, not a replacement for every specialised rule.
“Where products are subject to specific safety requirements imposed by Union law, this Regulation applies only to those aspects and risks or categories of risks which are not covered by those requirements.”
—
An AI-enabled medical device may therefore be governed principally by medical-device legislation for covered safety risks, alongside the AI Act when its conditions and dates are met. The GPSR may still apply to an uncovered aspect, subject to its detailed scope and chapter carve-outs. For consumer products generally, its safety assessment expressly considers relevant cybersecurity, interconnection, and evolving, learning and predictive functionality. Those points are especially important where a safe physical product can become unsafe through an update, dependency failure, model behaviour or malicious interference.
Safety authorities can act before a court decides compensation. Article 43 GPSR says a restriction, withdrawal or recall does not settle liability under applicable national law. Conversely, no recall does not prove that a product was not defective.
Which product-liability directive governs the claim?
The dividing line is when the product was placed on the market or, where relevant, put into service—not simply when the accident or loss occurred.
For products before 9 December 2026, national legislation implementing Directive 85/374/EEC remains relevant. It establishes producer liability without proof of fault, but requires the injured person to prove damage, defect and causation. Its harmonised damage categories centre on death or personal injury and damage to private-use property other than the defective product itself. It was written before connected software became central to product safety.
For products after that date, Directive (EU) 2024/2853 applies through Member State transposition. It expressly treats software as a product, including software supplied through a network or cloud service. A connected digital service can be a component where its absence prevents a product performing a function. “Manufacturer's control” can continue after sale where the manufacturer supplies, authorises or can provide updates or upgrades. Manufacturers, component manufacturers and specified Union-based supply-chain actors can therefore face liability under different conditions; a person substantially modifying a product may also be treated as its manufacturer.
The new Directive covers death or personal injury, property damage and destruction or corruption of non-professional data. Pure economic loss, damage to the defective product itself and exclusively professional property or data remain outside important parts of this route, although another legal basis may address them.
What does national tort or contract law still do?
The new Directive fully harmonises matters within its scope unless it provides otherwise, so a Member State cannot simply create a stricter or weaker duplicate defect-based product-liability regime. But it deliberately preserves genuinely different national claims:
“This Directive does not affect ... any right which an injured person has under national rules concerning contractual liability or concerning non-contractual liability on grounds other than the defectiveness of a product as provided for in this Directive”.
—
That may leave room for claims based on negligence, breach of a statutory duty, warranty, failure to warn, professional responsibility or another national ground. The precise elements, defendants, limitation rules, recoverable loss and burden of proof vary by Member State. Contract law may address repair, replacement, price reduction or consequential loss between contracting parties. Tort law may be crucial for pure economic loss, business property, damage outside the Directive's categories, or fault by a deployer that used a product contrary to instructions.
The routes can overlap factually without becoming identical. National procedure may permit alternatives, but not double recovery. Contribution between responsible actors is also shaped by national law and their contracts.
How can safety non-compliance affect proof?
Under the new product-liability regime, the claimant still starts with defect, covered damage and causation. The Directive then responds to technically complex products with disclosure and rebuttable presumptions. In particular, defectiveness is presumed if the claimant shows non-compliance with a mandatory Union or national product-safety requirement intended to protect against the risk that caused the damage. A court may also presume defect or causation where technical or scientific complexity creates excessive proof difficulties and the claimant establishes the required likelihood.
This gives AI Act and product-safety records a second function. Risk files, logs, testing, post-market monitoring, incidents, updates and recalls may reveal whether the product met mandatory requirements and how the harmful output occurred. Yet a breach aimed at a different risk will not necessarily trigger the presumption, and a presumption can be rebutted. Covered damage and the link to the relevant defect remain separate issues.
Existing case law also warns against mechanical conclusions. In Joined Cases C-503/13 and C-504/13, Boston Scientific, the Court allowed products in the same series as potentially defective life-sustaining medical devices to be classified as defective without proving the individual device's defect. The holding reflects vulnerable users and exceptionally high safety expectations; it does not make every model anomaly a product defect.
A practical sequence for analysing a loss
- Identify the physical product, software, model, connected service, update and person who controlled each element.
- Fix the market-placement or putting-into-service date and the date and Member State of the loss.
- Identify the sector-specific safety legislation, then check whether the AI Act and any residual GPSR provisions apply to the risk.
- Classify the loss: personal injury, property, data, damage to the product itself, pure economic loss or non-material harm.
- Map possible defendants and roles: product and component manufacturers, software provider, importer, modifier, distributor, deployer and contracting party.
- Preserve versions, logs, warnings, instructions, conformity records, incident reports, update history, regulatory notices and evidence of foreseeable use.
- Test the harmonised product-liability route and the distinct national contractual or tort routes without assuming that a recall proves liability.
- Check national transposition, procedure, limitation, insurance, contribution and recoverability rules.
Conclusion
An AI-enabled product loss is a layered problem. The AI Act and applicable product-safety legislation define preventative duties and may generate important evidence. Product-liability law supplies a harmonised no-fault compensation route, with a major transition on 9 December 2026 and broader treatment of software, updates and data under the new Directive. National contract and tort law remain relevant where they rest on different grounds or address losses and actors outside that route.
The sound analysis therefore fixes the product date, applicable safety regime, type of damage, operator roles and evidence chain before choosing a claim. Regulatory non-compliance, defect, causation and compensable loss are connected questions, but they are not interchangeable.
Sources
This article provides general legal information, not advice for a specific matter. Laws, facts and procedural deadlines may change the result. Follow the linked primary sources and obtain local advice before acting.