EU Product Liability Rules: What U.S. Companies with AI Products Must Know
By Rita Dienes
US companies with products with ordinary AI features
Most published guidance on the EU Product Liability Directive is written for US companies that already have a statutory duty to build an EU AI Act technical documentation file to evidence their AI system’s compliance with the laws and regulations of the European Union. BigLaw guidance is aimed at those clients and serves them well.
The far larger group of US companies, however, has products with ordinary AI features. Think of a smart home maker whose thermostat, camera or robot vacuum operates on an AI model; a wearables company whose watch or ring detects heartbeat or sleep and suggests activity; a consumer app that backs up, sorts or edits photos and can lose them; an e-bike or scooter maker whose speed and power are set by software; a SaaS vendor whose AI chatbot or assistant can delete or overwrite a user’s files; a fintech company whose budgeting tool flags unusual spending; a retailer whose app recommends to customers what to buy next.
Those companies also have AI documentation needs. That is because the EU Product Liability Directive makes no exception for them and applies to those companies as well. It is easy not to recognize that, because those US companies fall outside of the EU AI Act high-risk category (meaning the way they use AI is not considered high-risk by the European Union) and so they do not have the specific high-risk technical documentation obligations set out by the EU AI Act; however, they do have different documentation needs: sized to their product (and its AI component) and built by counsel that knows the company.
What the December 9, 2026 deadline set by the revised EU Product Liability Directive means to those US companies
From 9 December 2026, every US product that:
- has AI in it, and
- is first offered for sale in the EU (placed on the market or put into service in the EU) on or after the above date
falls under the revised Product Liability Directive, Directive (EU) 2024/2853. (This Directive is often called the new Product Liability Directive. The accurate term is revised Product Liability Directive, because it replaces the original Directive of 1985, as explained below.) For example, an AI-enabled product manufactured by a US company first sold in Berlin this month (November 2026) is not regulated by the revised 2024 Product Liability Directive, but the new rules apply to the same product offered for sale in January 2027.
If you are asking what happens to products with AI that were made available to EU customers before December 9, 2026: the answer is that they belong to the remit of the original EU Product Liability Directive (Council Directive 85/374/EEC) in force since 1985, which was the basis of product liability law in each and every EU Member State up to and including December 8, 2026, which is when it is repealed and from December 9 onwards the revised Product Liability Directive will apply. The one exception to this rule is substantial modification: if a product that was supplied to users in the European Union before December 9, 2026 is substantially modified after that date, outside the original manufacturer’s control (which means by a third party, such as a company that is not the original manufacturer), it is treated as a “new” product, from the date is was offered for sale as modified. The result is that the substantially modified product with AI in it will belong to the remit of the revised Product Liability Directive.
The single most important reason the revised EU Product Liability Directive is so important for the AI industry: the 1985 EU Product Liability Directive, understandably, says nothing about AI and does not cover standalone software. The revised Product Liability Directive (of 2024) does and so extends its rules to every AI system and every AI-enabled product offered for sale in the European Union, regardless of who makes it or where it is made.
The concept at the centre of the revised EU Product Liability Directive is strict liability. That means the claimant does not have to prove fault. (This is by the way not new: the 1985 EU Product Liability Directive applied the same rule). The claimant must prove 1. defect 2. damage and 3. a causal link between the two. Fault on the manufacturer’s side is not an element of the claim and the manufacturer answers in court even if it took every reasonable care in designing, testing and documenting its product.
Let us look at this through an example. A US smart home manufacturer sells a smart (AI-enabled) thermostat in the EU through a Danish importer and a network of online retailers. One unit is installed in a home in the old historic district of Copenhagen that features a 100-year-old wooden floor and valuable antique pieces stored in the house’s basement. The AI model learns the household’s routine and sets the heating. The US manufacturer tested the AI model, documented the tests, and warned the users in the product manual to check the settings during sudden drops in outside temperatures, and followed the industry’s own safety guidance. The family leave for their second home in Southern Spain for the winter holidays. A December software update introduces a glitch in the AI component: the smart thermostat begins treating the frost-protection threshold as a target it can undercut when it predicts the house will stay empty. The heating stays off during a cold snap, a pipe bursts and the wooden floor is ruined; so are the antiques in the basement. A thermostat that undercuts its frost-protection threshold after a manufacturer’s update is a defective product. Why it failed is irrelevant under the revised EU Product Liability Directive (whether the cause was a bug in the AI model’s code, a problem in the training of the AI model, or a wrong design choice in the energy-saving logic etc.). The original Directive (1985) would have let the manufacturer argue that the product was not defective when it was placed on the market. The revised Directive (2024) takes that defense away where the defect is caused by software, an update or a related service under the manufacturer’s control. Danish law (not the EU Directive) sets the measure of damages, and the US manufacturer cannot argue that it did not foresee an expensive house: strict liability does not depend on the foreseeability of the extent of the loss.
Let’s talk about the liability chain here for a moment. Because the manufacturer is established outside the European Union (in the US, in our example), the Danish importer is liable alongside it. Had there been no importer, an authorized EU representative of the US company or, failing that, the fulfilment service provider (the warehouse and shipping provider that stored and dispatched the AI-enabled thermostat; in our hypothetical example, say Fulfilled by Amazon) would be liable alongside the US manufacturer instead of the importer. The online retailer that sold the product is not liable at first, but if it fails to name the US manufacturer or Danish importer within one month of the claimant’s request (which, under the revised EU Product Liability Directive (2024), can be addressed to any distributor and typically arrives through the shop or the website), it becomes liable itself. The rule in the Directive requires the Danish retailer to name an EU-established operator; in our example that is the Danish importer, who placed the product from outside the European Union on the EU market for the first time.
And, the claimant can still sue the US manufacturer directly under the revised EU Product Liability Directive. In our example, a court in Copenhagen (where the damage occurred) has jurisdiction to decide the claim, and its judgment is enforceable in every EU Member State.
Litigation consequences of the revised European product liability rules after December 9, 2026
The revised EU Product Liability Directive (2024) operates on 3 facts. It does not allocate liability according to the severity of the risk that an AI component in a product can cause, the location of the manufacturer or whether the company has an EU office. It does not even ask whether the EU AI Act applies to the product yet. Instead, the Directive looks at three questions: (1) was the product defective, (2) was there damage, and (3) did the defect cause the damage.
And what follows is the part that changes the economics of the claim. The revised EU Product Liability Directive goes further than European product law has gone before and gives the claimant a right of access to the manufacturer’s files: the design records, test results, logs, instructions for use, update history and post-market monitoring reports that show what the manufacturer knew about its product and on what date it had that knowledge. For the first time in EU civil procedure, the injured person can obtain the manufacturer’s own records to answer the three questions (defect, damage, causation) that decide liability for the harm an AI-enabled product did to a consumer in the EU.
To have the file ready before the first request for information by a claimant, a US company selling an AI-driven product in the European Union needs two records in place:
- the name of every operator in its supply chain, to be given within one month from when the injured person’s request is received
- the records that prove that its product was not defective, producible on a court order.
As regards the second, there is again a powerful legal tool in the revised EU Product Liability Directive: the presumption of defect. In defined cases the court must (“shall”, in the Directive’s words) presume that the product was defective. One such case is where the manufacturer fails to produce documentation the court has ordered, whether because the file is patchy or unfavorable or because it was not built. In a complexity case the court must presume defect, causation or both.
Complexity cases are ones in which the claimant faces excessive difficulty in proving defect or causation, in particular because of technical or scientific complexity. Here the claimant does not have to explain why the AI-enabled product failed; a showing that the product was probably defective and probably caused the harm is sufficient. Products with an AI component are the category the European drafters had in mind: the revised EU Product Liability Directive names AI systems, alongside pharmaceutical products and products whose components depend on each other, as the cases where technical or scientific complexity justifies the presumption.
Every presumption is rebuttable under the Directive. From the moment a presumption applies, the manufacturer of an AI-enabled product has the burden of proof. The only documentation that can discharge that burden (rebut the presumption of defectiveness) is the manufacturer’s own record (which is, as listed above, the manufacturer’s design decisions, test results, logs, instructions for use, software or AI model version history and post-market monitoring). A manufacturer with no record cannot rebut the presumption.
Civil law systems of continental Europe have no general pre-trial discovery. A claimant in an EU Member State gains access to the other party’s documents only through narrow, court-controlled mechanisms. Many EU Member States have declared under Article 23 of the Hague Evidence Convention that they will not execute US-style pre-trial discovery requests.
From December 9, 2026, the revised EU Product Liability Directive changes that for product claims in all 27 Member States. For the first time in Europe, a claimant anywhere in the EU can obtain the kind of internal information that was previously available only through discovery or disclosure in the United States.
The European disclosure mechanism works as follows from December 9, 2026:
- Once the claimant presents facts and evidence sufficient to support the plausibility of the claim, the court can order the defendant to disclose relevant evidence at its disposal.
- Disclosure is limited to what is necessary and proportionate, and the court must protect confidential information and trade secrets.
- The sanction for non-compliance is the presumption of defect.
- Disclosure under the revised Product Liability Directive covers documents and data only, with no depositions and no interrogatories.
Conclusion
The same technical file built by the manufacturer of a product with an AI component is now reachable from both sides of the Atlantic.
In an EU claim, the technical file is produced once the claimant shows a plausible case. In a US claim, it is produced in ordinary discovery. Documentation prepared for one proceeding serves the other, and a file produced in one case will be read by the opposing counsel in the other, subject to the GDPR’s limits on transfers to US courts.
