Comply.Land
Product Liability Directive (PLD)
The Product Liability Directive is being revised to address the realities of the modern digital economy, particularly taking into account cybersecurity threats which did not exist in 1985 - including software, artificial intelligence, and connected products now in use by most consumers.
Originally adopted in 1985, the directive is now being modernized to ensure that consumers are fairly compensated when defective digital products cause harm, even if no fault can be proven.
This is a major legal shift: under the new rules, software and AI systems can trigger product liability just like physical goods.
Why it matters
The revised PLD complements the Cyber Resilience Act by tackling what happens after a digital product is already on the market — specifically, when it malfunctions, causes damage, or fails to behave as expected.
Software developers, vendors, and integrators may be held responsible for:
- Defects introduced through updates
- Faulty AI decision-making
- Security flaws that cause data loss or physical injury
Unlike traditional liability laws, the PLD introduces strict (no-fault) liability, meaning a company can be held responsible even if it was not negligent.
🔍 What types of products are affected?
- Embedded software in physical products
- Standalone software and applications
- AI systems that make autonomous decisions
- Products updated over-the-air (OTA)
- Digital services with physical effects (e.g., medical software, robotics)
Key principles of the revised PLD
- Strict liability: Consumers do not need to prove fault, only that the product caused damage
- Extended scope: Includes software, AI models, and updates as part of the product
- Expanded damage: Covers not only physical injury and property damage, but also data loss and certain psychological harms
- Shared responsibility: All economic operators in the supply chain can be held jointly liable
- 10 years of evidence retention required from the date the product is placed on the market
What about open-source and non-commercial tools?
According to current drafts:
- Open-source software without commercial activity is excluded
- But if an open-source component is used in a commercial product, liability may still apply
- Developers and maintainers may face new expectations for documentation and transparency
This is especially relevant for AI models, data processors, or platforms that rely on community-led components.
What software teams need to know
If your company places digital products or systems on the EU market, you should:
- Review and document update processes and versioning
- Clarify responsibilities with vendors, integrators, and partners
- Prepare for claims related to AI misbehavior, data loss, or security flaws
- Reassess insurance and contractual coverage
As Daniel Thompson-Yvetot puts it:
“Under the revised PLD, code is no longer neutral — it’s potentially liable.”
Further reading
For a product-focused perspective on how the PLD, CRA, and AI Act intersect, check out the book Manufacturing European Software — built for developers, founders, and policy navigators in the EU digital space.
Regulated in Malta by the mdia
