Short answer
The applicable regime depends first on when the particular product was placed on the market or put into service. For products placed on the market before 9 December 2026, Directive 85/374/EEC continues to govern through each Member State's implementing law. It makes the producer strictly liable for injury and qualifying private-property damage caused by a defect. The claimant must prove damage, defect and causation. Other national claims may also be available.
Directive (EU) 2024/2853 modernises that system, but it is not a directly applicable regulation. Member States must transpose it by 9 December 2026, and its rules apply to products placed on the market or put into service after 9 December 2026. It expressly covers software, including AI systems, digital manufacturing files and safety-relevant updates. Depending on the supply chain, the manufacturer, component maker, importer, authorised representative, fulfilment provider, distributor, substantial modifier or, conditionally, an online platform may be liable.
The new regime covers personal injury, eligible property damage and non-professional data loss, but generally not the defective product, exclusively professional property or pure economic loss. Liability still requires defect, covered damage and causation; new disclosure rules and rebuttable presumptions address evidential difficulty.
Which regime applies?
The date of the product's first EU marketing or first relevant use controls, not simply the accident date. The states the original rule:
The producer shall be liable for damage caused by a defect in his product. —
That directive is implemented in national law. It remains the framework for products placed on the market before 9 December 2026, even if injury occurs later. “Producer” includes the finished-product manufacturer, raw-material or component producer, own-brander and commercial importer. An unidentified producer can expose a supplier unless it identifies the producer or its supplier within a reasonable time.
The entered into force on 8 December 2024, but entry into force is not the same as application to a private claim. Article 22 requires national transposition by 9 December 2026, while Article 2 says:
This Directive shall apply to products placed on the market or put into service after 9 December 2026. —
Article 21 repeals the old directive from 9 December 2026 while preserving it for products placed on the market before that date. Because the two provisions use “before” and “after”, the relevant national implementing law should be checked for a product first placed or put into service on 9 December itself. A directive cannot, merely by itself, be treated as imposing these new horizontal liabilities on a private defendant before or without proper national transposition.
Product, defect and covered damage
Under the 1985 regime, a product is defective when it does not provide the safety a person is entitled to expect, considering its presentation, reasonably expected use and circulation date. The claimant proves damage, defect and causation. Covered damage is death or personal injury and property damage above the directive's threshold where the property is ordinarily intended and mainly used for private purposes; the defective product itself is excluded. National law determines the remedy and may preserve contractual, negligence and other non-contractual claims.
The new directive broadens the product concept:
‘product’ means all movables, even if integrated into, or inter-connected with, another movable or an immovable; it includes electricity, digital manufacturing files, raw materials and software; —
Its recitals confirm that software includes operating systems, firmware, applications and AI systems, including cloud and software-as-a-service models. A developer or AI-system provider may therefore be a manufacturer. Free and open-source software supplied outside commercial activity is excluded, but commercial open-source supply is not automatically exempt.
Defect remains a safety test, not proof of poor performance. Relevant circumstances include foreseeable use, presentation, users' needs, safety and cybersecurity requirements, product interactions, recalls, and an AI product's ability to learn. A better update alone does not make the earlier product defective.
Covered damage under Article 6 includes death, personal injury (including medically recognised psychological harm), damage to property other than specified exclusions, and destruction or corruption of non-professional data. The defective product itself, property used exclusively for professional purposes, and ordinary pure financial loss remain outside this harmonised route. Other national causes of action may fill some gaps.
Who may be liable under the new regime?
Article 8 creates a supply-chain order:
- The manufacturer of the defective product is the primary defendant. A defective-component manufacturer may also be liable if its component caused the product to be defective.
- If a manufacturer is outside the EU, the EU importer or authorised representative may be liable; if neither exists, the fulfilment service provider may be liable.
- A person who substantially modifies a product outside the original manufacturer's control and then markets or puts it into service is treated as its manufacturer. This can include a qualifying software update or change to a continuously learning AI system.
- If no relevant EU-established operator can be identified, a distributor can become liable after failing, within one month of the injured person's request, to identify that operator or its own supplier.
- An online marketplace is not automatically liable because the sale occurred on its site. The distributor rule extends to a platform facilitating consumer distance contracts only where the Digital Services Act Article 6(3) presentation would lead an average consumer to believe that the product came from the platform or from a trader under its authority or control, and the platform then fails to identify the relevant operator.
If two or more operators are responsible for the same damage, national transposition must permit joint and several liability, leaving contribution between them to national law. A contract cannot exclude the injured person's directive-based rights.
Software responsibility also follows control. A manufacturer may remain responsible where defectiveness arises after marketing from a related service, software or update, a missing safety update, or a substantial modification, if it was within that manufacturer's control. That does not make every app developer liable for every downstream integration: component design, integration, instructions, control, timing and causation still matter.
Evidence, causation and defences
Under both regimes, strict liability is not automatic compensation. The claimant must connect covered damage to a safety defect. Under the new directive, a court may order necessary and proportionate disclosure once the claimant presents facts and evidence supporting a plausible claim, with safeguards for confidentiality and trade secrets.
Article 10 preserves the basic burden but creates rebuttable presumptions. Defect may be presumed after non-disclosure, breach of a relevant mandatory safety requirement, or an obvious malfunction in foreseeable use. Causation may be presumed where an established defect typically produces the kind of damage suffered. Where technical or scientific complexity creates excessive proof difficulty, the court may presume defect or causation if the claimant shows it is likely. The defendant can rebut each presumption.
Defendants retain specified defences, including that they did not market the product, that the defect probably did not exist then, compliance with legal requirements, and in defined circumstances the state of scientific and technical knowledge. The post-marketing software-control rule limits the “defect arose later” defence. Member States may also maintain or introduce, under Article 18's conditions, stricter treatment of the development-risk defence.
The limitation period is generally three years from actual or reasonably expected knowledge of damage, defect and the liable operator. The new regime also has a ten-year expiry period from marketing or relevant substantial modification, extended to 25 years where latent personal injury prevented an earlier claim. Suspension, interruption and procedure depend on national law.
What the Court of Justice has already clarified
The leading judgments interpret the 1985 directive and remain important for claims under that regime. They are persuasive background for the modernised safety test, but do not decide the untested provisions of Directive 2024/2853.
In Boston Scientific Medizintechnik, Joined Cases C-503/13 and C-504/13, the Court addressed high-risk pacemakers and defibrillators:
where it is found that products belonging to the same group or forming part of the same production series, such as pacemakers and implantable cardioverter defibrillators, have a potential defect, such a product may be classified as defective without there being any need to establish that that product has such a defect. —
The Court also held that medically necessary replacement surgery could constitute compensable personal-injury damage. In W and Others v Sanofi Pasteur, C-621/15, it accepted that national courts may infer defect and causation from serious, specific and consistent evidence even without scientific consensus, but rejected automatic predetermined presumptions that disregard the claimant's Article 4 burden.
Conclusion
Start with the product's first marketing or service date and the implementing law of the relevant Member State. For pre-transition products, identify the producer, importer and any supplier exposed under the 1985 regime. For products placed on the market after 9 December 2026, map every operator that made, imported, represented, fulfilled, distributed, substantially modified or presented the product. Then separate the defective product from the claimed damage, preserve technical and update records, and test defect, causation, presumptions, defences and limitation periods. Software, AI and marketplaces are within the new architecture, but none is liable merely because it is digital or involved in the transaction.
Sources
This article provides general legal information, not advice for a specific matter. Laws, facts and procedural deadlines may change the result. Follow the linked primary sources and obtain local advice before acting.