EU Product Liability Directive: Transposition Tracker and Guidance

EU Product Liability Directive Transposition: Why National Laws Matter

The EU Product Liability Directive does not apply to companies directly. What matters in a liability claim is the national law that implements it, and that law is still being written in most Member States.

Member States must transpose Directive (EU) 2024/2853 by 9 December 2026. The Product Liability Directive (PLD) applies to products placed on the market or put into service after the threshold stated in Article 2, so products launched end of 2026 will fall under the national rules.

Under the Rome II Regulation, the law that applies to a product liability claim generally depends on a hierarchy of connecting factors, which can include the injured person’s habitual residence, where the product was acquired, where damage occurred and whether the product was marketed in the relevant country. A company selling into several Member States may create cross-border exposure under several national laws.

In cases where a given Member State misses the deadline or adopts its law late, operators have less time to adjust contracts, insurance and documentation. Monitor both EU-level rules and the official legislative position in each relevant Member State; do not assume that a missed deadline means the new rules automatically apply unchanged to private parties.

Indemnities between manufacturers, importers and Authorised Representatives, and product liability cover should be reviewed against the national position before products ship, not after a claim. Contractual indemnities and rights of recourse between economic operators may allocate commercial risk, but cannot automatically remove liability to an injured person under the PLD. Review arrangements with qualified counsel and insurers.

Product Liability Directive Implementation by Country: What Can Differ?

The PLD is largely a maximum harmonisation directive; Member States cannot add stricter or looser liability rules at their own will. However, differences may remain in a few areas that matter.

Normally a manufacturer is not liable if the state of scientific and technical knowledge at the time could not reveal the defect. Member States may keep or, in some cases, introduce national rules that remove this defence. Where they do, operators lose a key defence in that market. This is the main point of divergence rated by our tracker.

Non-material losses linked to death, personal injury or damage to property are compensated only insofar as national law allows it. The same defect can lead to different amounts of compensation in different countries.

How disclosure of evidence is ordered, how confidential information is protected, whether collective actions are available and how costs are allocated all follow national procedural rules.

The Directive sets the three-year and ten-year periods, but when those periods are suspended or interrupted is governed by national law.

Claimants can still rely on national contractual or fault-based liability, and on special liability systems that already existed, alongside the PLD. These vary by country.

Member States transpose at different speeds and in their own legal language, which can create gaps or differences of interpretation during the transition.

Who Is Liable Under the New EU Product Liability Directive?

The revised Product Liability Directive expands and clarifies the categories of economic operators that may be held liable for damage caused by defective products. Article 8 establishes a framework covering manufacturers and, in specified circumstances, other operators involved in supplying products to the European Union.

Manufacturers and software developers

Manufacturers remain the primary economic operators responsible under the PLD. The framework can also apply to software developers, manufacturers of connected devices and businesses supplying products under their own name or trademark. Manufacturers should consider how product design, cybersecurity, software updates, component traceability and technical documentation may affect potential liability.

Importers

Where a manufacturer is established outside the EU, an importer may be held liable for damage caused by a defective product under the conditions established by Article 8. Importers should understand their position within the supply chain and review access to technical information, contractual indemnities and product liability insurance.

EU Authorised Representatives

An EU Authorised Representative may face liability under the new Product Liability Directive where the manufacturer is established outside the European Union and the conditions of Article 8 are satisfied. An Authorised Representative performs specified regulatory tasks on behalf of a manufacturer under a written mandate. However, the mandate does not automatically exclude liability arising under the PLD. This distinction is particularly important for non-EU manufacturers considering how to structure their EU market presence. Manufacturers and Authorised Representatives should consider the implications for insurance, contractual recourse, product documentation and the allocation of responsibilities.

Fulfilment service providers and distributors

In certain circumstances, fulfilment service providers and distributors may also be held liable. The applicable provisions depend on their role in the supply chain and whether other responsible economic operators can be identified.

How Does the EU Product Liability Directive Affect Software and Connected Products?

The new Product Liability Directive expressly recognises software as a product, making the framework particularly relevant to developers of software, AI systems, connected devices and products with digital elements. Product defectiveness may arise not only from physical design or manufacturing issues but also from software behaviour, cybersecurity weaknesses and failures relating to necessary updates.

Cybersecurity vulnerabilities and product liability

Under the revised PLD, cybersecurity characteristics may be considered when determining whether a product provides the safety that a person is entitled to expect. A cybersecurity vulnerability does not automatically make a product defective or establish liability. The assessment depends on the circumstances, including the expected level of safety, qualifying damage and causation.

Missing software and security updates

A failure to provide necessary software or security updates may contribute to product defectiveness where the relevant software remains within the manufacturer’s control. Businesses should therefore consider how they document vulnerability handling, update decisions and responsibilities for maintaining product safety.

Artificial intelligence and software components

AI systems and software components can fall within the PLD framework. Where products depend on third-party software or connected services, contractual responsibilities, component traceability and access to relevant technical evidence can become particularly important.

Technical documentation and evidence

The Directive introduces mechanisms for disclosure of relevant evidence and presumptions that may apply in technically complex cases. Manufacturers and other economic operators should consider whether their documentation provides a reliable record of product safety decisions, cybersecurity measures, software changes and supplier responsibilities.

How Comply.Land Supports EU Product Regulatory Compliance

The Tracker tells you where the rules are heading. We help you prepare for them, by building the CRA compliance and evidence that PLD claims will test.

CRA Consultancy

If you sell into markets with higher exposure, the priority is reducing the risk of a defect and documenting what you did. We provide product-specific support on classification, gap assessment, vulnerability management and technical documentation, including how CRA obligations interact with the PLD.

Explore CRA consultancy

CRA Workshops

Liability questions sit between engineering, legal and leadership teams. Our tailored workshops bring these teams together, with the CRA-PLD interplay and the national picture available as a topic.

Explore CRA workshops

EU Authorised Representative

For manufacturers outside the EU, an authorised representative that understands both the CRA obligations and the PLD liability that come with the mandate, market by market.

Learn more about EU Authorised Representative

Why Comply.Land?

European standards expertise. Comply.Land was established by professionals involved in European standards development, including ETSI Rapporteurs.

EU-based operations. Based in Malta, Comply.Land operates from an English-speaking European Union Member State.

Integrated regulatory support. Our focus on EU product regulation, cybersecurity requirements and economic-operator arrangements enables organisations to address connected compliance challenges.

How the PLD Connects to the Cyber Resilience Act

The CRA sets the cybersecurity requirements for products with digital elements. The PLD decides who pays when a product causes damage. The two are designed to work together.

Failure to meet mandatory product safety requirements is one of the circumstances in which a court shall presume a product is defective. CRA requirements are likely to be relevant here once they apply.

The CRA requires manufacturers to handle vulnerabilities and provide security updates throughout the support period. Under the PLD, a manufacturer cannot escape liability by arguing that a defect arose after the product was placed on the market where the defect results from a lack of software updates or upgrades necessary to maintain safety and the update was within the manufacturer’s control (Article 11(2)). The PLD itself does not create an obligation to provide updates; that obligation comes from the CRA.

The technical documentation, risk assessment and vulnerability-handling records required by the CRA are also the evidence a manufacturer will need if a liability claim arises.

The PLD applies to products placed on the market after 9 December 2026, a year before the CRA’s main obligations apply on 11 December 2027.