Short answer
Responsibility depends on the harm and each actor's role. Under the Consumer Rights Act 2022, the trader who sold goods or supplied digital content or a digital service is responsible to the consumer for contractual conformity. The seller cannot ordinarily send the consumer away merely because a manufacturer caused the defect.
For injury or qualifying property damage, the Liability for Defective Products Act 1991 imposes no-fault product liability on producers, own-branders and importers from outside the EU. A supplier can become liable if the producer cannot be identified and the supplier fails to identify the responsible person or its own supplier after a timely request.
Regulation (EU) 2023/988, the General Product Safety Regulation (GPSR), separately imposes preventive and corrective duties on manufacturers, authorised representatives, importers and distributors. Every covered product placed on the EU market needs an EU-established responsible economic operator. Ireland's S.I. 726/2024 empowers market-surveillance authorities and creates offences.
An online marketplace is not automatically the seller or producer, but it has its own Consumer Rights Act, GPSR and Digital Services Act duties. These include identifying traders, enabling safety information, processing notices and orders, warning affected consumers and co-operating on recalls. The contractual, tort, safety and platform regimes can apply together.
The seller answers for contractual conformity
The Consumer Rights Act 2022 allocates the immediate consumer contract to the “trader”: the business that sold the goods or undertook to supply the digital product. Goods must meet subjective promises and objective standards, including description, ordinary purpose, quality, durability, safety and updates where digital elements are involved. The consumer may use the statutory sequence of termination, repair, replacement or price reduction without first pursuing the manufacturer.
Where non-conformity appears within 12 months of delivery, section 22 generally presumes it existed at delivery unless the trader proves otherwise or the presumption is incompatible with the goods or defect. For continuous digital supply within goods, the trader bears the conformity burden during the agreed supply period.
Digital content and services have an equally direct allocation:
“the trader shall be liable to the consumer for any failure to supply the digital content or digital service”
—
That liability includes non-conformity at supply for one-off digital products and during the contractual period for continuous supply. Functionality, interoperability, security and required updates can therefore be contractual issues even where the code originated with a developer upstream. The trader may have recourse against that developer or distributor, but the consumer's statutory claim remains against the trader.
Product liability addresses injury and property damage
Contract remedies repair the bargain; product liability compensates defined damage caused by a safety defect. Under the Liability for Defective Products Act 1991, a product is defective when it fails to provide the safety a person is entitled to expect, considering presentation, reasonably expected use and the time it entered circulation. The claimant need not prove negligence, but must prove damage, defect and causation.
The core rule is:
“The producer shall be liable in damages in tort for damage caused wholly or partly by a defect in his product.”
—
“Producer” includes the finished-product, raw-material and component manufacturer; a person presenting itself as producer through its name or trade mark; and a business importing from outside the EU for supply. If the producer cannot reasonably be identified, a supplier can be treated as producer after failing a timely request to identify the producer or its own supplier. Multiple responsible persons may be jointly and severally liable.
The 1991 Act covers death or personal injury and certain damage to consumer property, subject to its property-damage threshold and exclusions. It does not compensate damage to the defective product itself. Statutory defences include not putting the product into circulation, absence of defect at circulation, mandatory-law compliance and the state of scientific and technical knowledge. Liability cannot be excluded by contract.
Proceedings generally must start within three years of accrual or later knowledge of the damage, defect and producer. The Act also extinguishes the right ten years after the actual product entered circulation unless proceedings began in time. Contract, negligence and other rights are not displaced, so the causes of action and deadlines should be analysed separately.
Directive (EU) 2024/2853 will modernise EU product-liability rules, expressly addressing software, AI-related products, digital manufacturing files and related services. Member States must transpose it by 9 December 2026, and its new regime applies to products placed on the market or put into service after that date. At the review date, the Irish 1991 Act remains the operative regime for current claims; the Directive should not be treated as already transposed Irish law.
Product-safety duties follow the supply chain
The GPSR applies from 13 December 2024 to non-food consumer products where no more specific EU safety regime governs the same risk. It requires only safe products to be placed or made available on the market. A product may still be unsafe despite contractual conformity, and a dangerous product may trigger regulatory action without anyone first suffering compensable damage.
Manufacturers must conduct an internal risk analysis, prepare technical documentation, ensure traceability and contact information, provide intelligible instructions and warnings, investigate complaints, and take corrective measures such as withdrawal or recall. They must report dangerous products and qualifying accidents through EU gateways.
Importers must verify key manufacturer compliance before placing a product on the market, show their contact details, maintain compliant storage and transport conditions, and act where danger or non-compliance emerges. Distributors must exercise due care, verify required markings and documentation, avoid supplying a product they know or should know is non-compliant, and pass safety information upstream and to authorities. A distributor or importer that markets under its own name, or substantially modifies the product in a safety-relevant way, can assume manufacturer obligations.
Article 16 requires an EU-established responsible economic operator for every covered imported product. Online offers must display the manufacturer, the EU responsible person where necessary, product identification and warnings. These details cannot simply be postponed until the parcel arrives.
Ireland's European Union (General Product Safety) Regulations 2024, S.I. 726/2024, designate the CCPC for general non-food products and preserve sector-specific surveillance authorities. Authorised officers can inspect, test, purchase under cover identity, require records and issue corrective, prohibition and content-removal notices. Contraventions by manufacturers, importers, distributors, responsible persons and marketplaces are offences; indictment can result in a fine up to €500,000, imprisonment up to two years, or both.
Marketplaces have their own duties but are not always the seller
Section 107 of the Consumer Rights Act requires an online marketplace to tell the consumer whether the third-party offeror declares itself a trader, warn when EU consumer rights do not apply to a consumer-to-consumer sale, explain how contractual obligations are shared and disclose main ranking parameters. The allocation statement cannot erase responsibility imposed by other law. Whether the platform itself became the contracting trader depends on presentation, promises, payment, fulfilment and the overall transaction—not its preferred label alone.
GPSR Article 22 adds product-safety systems. Marketplaces must register contact points, accept consumer safety communications, build listing fields for manufacturer/responsible-person identification and warnings, process product-safety notices within three working days, act on authority orders within two working days and suspend repeat non-compliant traders. They must co-operate in recalls and directly notify identifiable purchasers of recalls or safety warnings.
The Digital Services Act complements those duties. Its “know your business customer” rules require covered marketplaces to collect and make best efforts to assess trader identity and traceability information. Interfaces must enable traders to provide legally required product and safety information. Hosting immunity can protect a platform from liability for stored third-party information where it lacks the required knowledge and acts expeditiously on obtaining it; it is not a general immunity from the platform's own GPSR, DSA, consumer-contract or product role.
Match the evidence and defendant to the claim
A consumer or injured person should preserve:
- the listing, seller and marketplace identity, order, invoice and payment path;
- product model, serial or batch number, packaging, warnings and EU responsible-person details;
- photographs, the product itself, update/version information and any repair or modification history;
- injury, medical and property-loss evidence, and the chronology connecting the defect to the damage;
- complaints, notices, recall messages and the names of every supply-chain actor.
For contractual non-conformity, complain to the selling trader and specify the Consumer Rights Act remedy. For an unsafe product, stop use where appropriate and report it to the CCPC or relevant sector authority; Safety Gate can reveal EU alerts. Injury or major loss usually requires prompt legal advice before the product is altered or discarded. A marketplace notice should identify the exact listing, product, risk and supporting evidence so the statutory notice systems can operate.
Conclusion
Irish law does not place every product problem on one defendant. The seller owns the consumer's conformity claim; producers, own-branders and importers may carry strict liability for injury or property damage; every economic operator has role-specific prevention and recall duties; and marketplaces have independent traceability and safety obligations. The same incident can engage all four layers, so the remedy, evidence, defendant and limitation period must be mapped separately.
Sources
This article provides general legal information, not advice for a specific matter. Laws, facts and procedural deadlines may change the result. Follow the linked primary sources and obtain local advice before acting.