Does the new EU product liability law apply to my small business if I use AI?

The short version

There is a European law on defective products that dates from 1985. It was written for kettles, cars and medicines, and its text never said whether software was a product at all. The replacement, Directive (EU) 2024/2853, says so in terms. Its definition of product now reads that it includes electricity, digital manufacturing files, raw materials and software. The recitals go further and name AI systems as an example of software, say that it makes no difference whether the software sits on a device, is reached through the cloud or is supplied as software as a service, and say that a developer or producer of software, including the provider of an AI system under the EU AI Act, should be treated as a manufacturer.¹

The Directive is already in force as a piece of European law. What happens on 9 December 2026 is that it starts to bite: it applies to products placed on the market or put into service after that date, the 1985 directive is repealed from that date, and every EU country has until that date to write the new rules into its own national law.²

Product liability is liability without fault. The injured person does not have to show that anybody was careless. They have to show that the product was defective, that they suffered damage, and that the one caused the other. That is why the question of who counts as the manufacturer matters so much, and why a small business should work out now which side of that line it stands on.

If you only use the AI, you are not its manufacturer

Most small businesses reading this use AI that somebody else built. A chatbot on the website from a vendor. A transcription tool. A general assistant used for drafting. An AI feature inside the accounting package.

The Directive lists who is liable for a defective product. The manufacturer of the product. The manufacturer of a defective component. Where the manufacturer is outside the EU, the importer and the manufacturer's authorised representative, and where there is neither, the fulfilment service provider. As a last fallback, a distributor who cannot name its own supplier within a month of being asked.³ A business that buys a tool and uses it to do its own work appears nowhere in that list.

That does not mean you carry no liability for what the tool does. It means this particular law is not the route. The Directive says it does not affect any right an injured person has under national rules on contractual liability, or on non-contractual liability on other grounds.⁴ If your chatbot promises a customer something untrue and the customer relies on it, the customer's claim is against you, under the ordinary law of contract, consumer protection or negligence in your country. We have covered that position at length in who is liable when an AI agent makes a mistake and in whether you must compensate a customer for wrong AI advice. None of that changes in December.

Four ways a small business becomes the manufacturer

The line moves when you stop being only a user. There are four common ways a small business crosses it, and each comes straight from the Directive's definitions.

You built it. A manufacturer is anyone who develops, manufactures or produces a product. If your company wrote the AI application it sells, even on top of somebody else's model, your company developed a product. The model provider may be the manufacturer of a component. You are the manufacturer of the thing the customer received.

Your name is on it. The definition also catches anyone who has a product designed or manufactured and then presents themselves as its manufacturer by putting their name, trademark or other distinguishing feature on it.⁵ White-labelling is the everyday case. If you take a vendor's AI assistant, brand it as your own and supply it to your clients, the Directive treats you as having presented yourself as the manufacturer.

You brought it into the EU. An importer is whoever places a product from a third country on the Union market. If you resell an AI product from a supplier established outside the EU, and that supplier has no authorised representative in the EU, the injured person can come to you. The fuller treatment of that chain, written for the non-EU vendor's side of it, is on our global desk at agentliability.co, on the importer and representative chain.

You changed it, substantially, and passed it on. Anyone who substantially modifies a product outside the original manufacturer's control, and then makes it available or puts it into service, is treated as the manufacturer of the modified product. Where product safety rules set no threshold, a modification is substantial if it changes the product's original performance, purpose or type in a way the manufacturer's initial risk assessment did not foresee, and it changes the nature of the hazard, creates a new hazard or increases the level of risk.⁶ Ordinary configuration within what the vendor intended is a different thing from retraining a tool for a purpose the vendor never designed it for. Where your own use sits between those two is a question to put to your vendor in writing, because the vendor's instructions for use are what define the foreseen purpose.

One exclusion is worth knowing. The Directive does not apply to free and open-source software developed or supplied outside the course of a commercial activity. That protects the volunteer who publishes a library. It does not protect a business that takes the library and sells a product built on it.

What kind of harm this law is about, and what it leaves out

This is the part most summaries skip, and for a small business it is the most reassuring part of the text.

Only a natural person can claim. A company cannot. And the right to compensation covers only three kinds of damage: death or personal injury, including medically recognised damage to psychological health; damage to or destruction of property, except the defective product itself and except property used exclusively for professional purposes; and destruction or corruption of data that are not used for professional purposes.⁷

Read that list against what AI tools in small businesses usually get wrong. A quotation with the wrong price. A refund policy that does not exist. A contract summary that misses a clause. An invoice sent to the wrong customer. Those are financial losses, usually to another business or to a consumer's wallet. None of them is personal injury, none is damaged household property, and none is a consumer's destroyed data. They are real claims, as the Air Canada chatbot case showed in Canada, but they are not product liability claims under this Directive.

Where the Directive does reach AI is where software can hurt a person or damage their belongings or their personal files: AI that controls a physical device, a health or wellbeing application, software in a vehicle or a machine, a consumer app that wipes a user's photographs. If what you sell sits anywhere near that territory, this law is about you, and the rest of this article matters more.

Three rules that catch software businesses out

You cannot contract out of it. The Directive requires that liability to the injured person is not limited or excluded by a contractual provision.⁸ The limitation clause in your terms of service still works between you and a business customer for ordinary contract claims. It does nothing against an injured consumer bringing a product liability claim.

It was fine when we shipped it is a weaker defence for software. A manufacturer can normally escape liability by showing the defect probably did not exist when the product was placed on the market. For software the Directive removes that escape where the defect is due to software, including updates or upgrades, to a lack of the updates needed to maintain safety, or to a related service, so long as it is within the manufacturer's control.⁹ Shipping an update that breaks something, or failing to ship a safety update you were able to ship, is your defect. When assessing defectiveness a court also takes into account the effect of any ability of the product to continue to learn after it is placed on the market, and safety-relevant cybersecurity requirements.

The court can ask to see your evidence, and silence counts against you. A claimant who shows a plausible case can ask the court to order the defendant to disclose relevant evidence. If the defendant fails to disclose, the product is presumed defective. A court can also presume defect or causation where the claimant faces excessive difficulty because of technical complexity, and the recitals give the inner workings of an AI system as an example.¹⁰ The practical meaning for a ten-person software company is simple: keep your records. Version history, test results, what you told users about limits, and what changed in each release. We set out a workable minimum in documenting AI decisions for insurance purposes.

There is also one rule written in favour of small software makers. If your company is a microenterprise or a small enterprise and your software is integrated as a component into a larger manufacturer's product, the two of you may agree by contract that the larger manufacturer will not seek recourse against you if your component turns out to be defective. The Directive expressly allows that waiver.¹¹ It does not happen by default. It has to be in the contract, so ask for it.

What this means for your insurance

The Directive contains no obligation to insure. The only place it mentions product liability insurance is in the instruction to the European Commission to report, by 9 December 2030 and every five years after, on how the Directive is working, including the availability of that insurance.¹² Nobody is going to ask you for a certificate on 9 December.

What changes is the question to put to your broker. Small technology companies often carry professional indemnity and cyber cover and no product liability cover at all, on the reasoning that they do not make a physical product. If you fall into one of the four manufacturer situations above, and what you supply could injure a person or damage a consumer's property or personal data, ask in writing which of your policies would respond to a no-fault product liability claim for bodily injury or property damage caused by your software. Do not assume the answer. Policies differ, this desk has not read yours, and the honest position is that only the wording tells you. Our guide to what to tell your broker about AI agents has the rest of that conversation.

If you are purely a user of other people's AI, your insurance question is the one it always was: does my professional indemnity or liability cover respond when the tool I used gives a customer a wrong answer. That is covered in does my business insurance cover AI errors.

Four things to do before 9 December 2026

Work out which side of the line you are on. For each AI tool: did we build it, is our name on it, did we bring it into the EU, or have we changed it beyond what the vendor intended and passed it on? Four times no means you are a user, and this Directive is your vendor's problem before it is yours.

Ask your vendor two questions. Who is your importer or authorised representative in the EU? And will you confirm in writing that the way we configure and use your product is within its intended purpose? The first tells you whether an injured person has somebody other than you to go to. The second tells you whether you risk being treated as having substantially modified it.

If you are the manufacturer, start the evidence file now. The product you place on the market after 9 December 2026 is the one the new rules apply to. The records a court could one day ask for are the records you create in the ordinary course of building it. For the rules on which regime applies to a product that is already on the market on the date, see agentliability.eu, on which regime applies to AI already on the market.

Check your own country's version. A directive works through national law, and each EU country writes its own implementing act. This desk has not read the national measures and does not describe them. Your trade association, your lawyer or your national consumer authority can tell you where your country stands.

Questions

Does the new EU Product Liability Directive apply to software and AI?

Yes. Directive (EU) 2024/2853 defines product so that it includes software, and its recitals name AI systems as an example, state that the mode of supply makes no difference (on a device, through the cloud or as software as a service), and say that the provider of an AI system should be treated as a manufacturer. It applies to products placed on the market or put into service after 9 December 2026. Free and open-source software developed or supplied outside the course of a commercial activity is excluded.

I only use an AI tool in my business. Am I liable under the Directive?

Not as a user. The Directive places liability on the manufacturer, the manufacturer of a defective component, the importer, the authorised representative, the fulfilment service provider and, as a fallback, a distributor who cannot identify its supplier. A business that buys a tool and uses it for its own work is not in that list. You can still be liable to your customers under ordinary contract, consumer or negligence law for what the tool does, because the Directive leaves those routes untouched.

When does a small business count as the manufacturer of an AI product?

In four common situations. When it develops the product itself, including an application built on somebody else's model. When it puts its own name or trademark on a product made by somebody else. When it imports a product from a supplier outside the EU. And when it substantially modifies a product outside the original manufacturer's control and then makes it available or puts it into service.

Can a customer use this law to claim money lost because my chatbot gave wrong information?

No. Only natural persons can claim, and only for death or personal injury including medically recognised psychological harm, damage to property that is not used exclusively for professional purposes, and destruction or corruption of data not used for professional purposes. A purely financial loss from a wrong answer is outside that list. The customer may still have a claim against you under contract, consumer protection or negligence law.

Can I exclude product liability in my terms and conditions?

Not against the injured person. Article 15 of the Directive requires Member States to ensure that an economic operator's liability under the Directive is not limited or excluded, in relation to the injured person, by a contractual provision or by national law. A limitation clause can still operate between businesses for other kinds of claim.

Does the Directive require me to buy insurance?

No. The Directive contains no insurance obligation. Its only reference to product liability insurance is in Article 20, which asks the European Commission to report by 9 December 2030, and every five years after, on the application of the Directive, including the availability of product liability insurance. Whether your existing policies would respond to a product liability claim for software is a question for your broker and your policy wording.

Sources

1. Directive (EU) 2024/2853 of the European Parliament and of the Council of 23 October 2024 on liability for defective products, Article 4(1) (definition of product) and recital 13 (software, AI systems, mode of supply, AI system providers treated as manufacturers, information not a product). Read in the Official Journal text served by the Publications Office of the European Union at publications.europa.eu on 18 September 2026. Every article and recital cited below was read in the same text on the same date.
2. Directive (EU) 2024/2853, Article 2(1) (application to products placed on the market or put into service after 9 December 2026), Article 21 (repeal of Directive 85/374/EEC with effect from 9 December 2026, which continues to apply to products placed on the market or put into service before that date) and Article 22(1) (transposition by 9 December 2026).
3. Directive (EU) 2024/2853, Article 8(1) and 8(3) (economic operators liable, and the distributor fallback where no operator established in the Union is identified within one month of a request).
4. Directive (EU) 2024/2853, Article 2(4)(b) and Article 6(3).
5. Directive (EU) 2024/2853, Article 4(10) (manufacturer) and Article 4(12) (importer).
6. Directive (EU) 2024/2853, Article 8(2) and Article 4(18) (substantial modification), and Article 2(2) (free and open-source software outside a commercial activity).
7. Directive (EU) 2024/2853, Article 5(1) (natural persons) and Article 6(1) (types of damage).
8. Directive (EU) 2024/2853, Article 15.
9. Directive (EU) 2024/2853, Article 11(1)(c) and 11(2), and Article 7(2)(c) and (f).
10. Directive (EU) 2024/2853, Article 9(1), Article 10(2)(a) and 10(4), and recital 48.
11. Directive (EU) 2024/2853, Article 12(2) and recital 54. The size definitions are those of the Annex to Commission Recommendation 2003/361/EC, to which the Directive refers; this article does not restate the thresholds.
12. Directive (EU) 2024/2853, Article 20.
13. This article does not describe the national law of any Member State, the status of any national transposition measure, or the terms of any insurance policy. The descriptions of how professional indemnity, cyber and product liability covers are commonly arranged for small technology businesses are general and are not attributed to any insurer.
14. No relationship exists between Future Proof Intelligence and any authority, institution or company named in this article.