Does the new EU Product Liability Directive cover AI apps and chatbots, and what evidence will an AI company need if someone says its AI caused them harm?

What should I check, step by step?

1. List which of your AI products and features are offered in the EU, and which will be placed on the market or put into service after 9 December 2026. A substantial modification to an older product after that date can bring it under the new rules.

2. Keep a release history: which model and version, system prompt, tool set and safety settings were live in each release, and when each update went out. The Directive treats software updates and machine-learning behaviour as part of the product while it stays within your control.
3. Keep per-run records for outputs that could cause harm: a hash of the input, the model and settings, a hash of the output and the time. If you're ordered to disclose evidence about one incident, that's what you'll need to find.
4. Be ready to produce evidence in a form a court can follow. Article 9(6) lets courts require disclosed evidence to be presented in an easily accessible and easily understandable manner.
5. Separate what you'd disclose from your trade secrets. Disclosure is limited to what's necessary and proportionate, and courts can protect confidential information, but training data, algorithms and monitoring data could still be in scope.
6. Keep shipping security fixes. The defence that a defect arose after release isn't available where it comes from software, including updates or a lack of updates needed to keep the product safe, that's within your control.
7. Map your supply chain: model provider, your app, integrators, resellers and any EU importer or authorised representative. Distributors that can't name the responsible operator within a month of a request can be held liable themselves.
8. Review contracts with model and tool providers for who bears what. Where several operators are liable for the same damage, the one that pays can seek recourse from the others under national law.
9. Keep records for as long as a claim can be brought. The Commission says operators stay liable for 10 years after the product is placed on the market (25 years in some health cases), and victims have 3 years to bring a claim.
10. Watch the national law in each country you sell into. Germany's government published its draft bill on 17 December 2025, and details can still vary by country. Talk to a lawyer about your products.

Does the EU Product Liability Directive apply to AI software and SaaS?

The Directive's recitals say software, such as operating systems, firmware, computer programs, applications or AI systems, is a product, irrespective of whether it is stored on a device, accessed through a communication network or cloud technologies, or supplied as software as a service. The recitals also say information itself isn't a product, so the rules don't apply to the content of digital files such as media files or e-books, or to the mere source code of software. How that line applies to an AI system's outputs hasn't been tested in court.

• Article 2 says it applies to products placed on the market or put into service after 9 December 2026, and doesn't apply to free and open-source software developed or supplied outside the course of a commercial activity. Products placed on the market earlier stay under the 1985 Directive.
• Article 6 limits compensation to death or personal injury, including medically recognised damage to psychological health; damage to property, except the defective product itself and property used exclusively for professional purposes; and destruction or corruption of data not used for professional purposes. The Commission notes that the Directive doesn't cover claims where the victim is a company, though some countries have similar rules for companies.
• When judging whether a product is defective, Article 7 tells courts to consider all circumstances, including the effect on the product of any ability to continue to learn or acquire new features after it's placed on the market, and, where the manufacturer keeps control after release, the moment the product left that control.

Can a court make an AI company disclose evidence under the EU Product Liability Directive?

Under Article 9, once a claimant has presented facts and evidence sufficient to support the plausibility of the claim, a court can order the defendant to disclose relevant evidence at its disposal. The defendant can ask for the same from the claimant. Courts must keep disclosure to what is necessary and proportionate and can protect trade secrets.

• Article 10 keeps the burden of proof on the claimant, then adds rebuttable presumptions. Defectiveness is presumed if the defendant fails to disclose relevant evidence as ordered, if the product breaks mandatory safety requirements meant to protect against that risk, or if the damage came from an obvious malfunction during reasonably foreseeable use. Causation is presumed once a defect is established and the damage is of a kind typically consistent with it. Where the claimant faces excessive difficulties, in particular due to technical or scientific complexity, the court shall presume defect, causation or both if the claimant shows it is likely. The defendant can rebut any of these.
• Freshfields, writing about Germany's draft law in January 2026, notes that under the draft, failing to comply with a disclosure order presumes a defect regardless of whether the defendant was at fault, and that disclosure could conceivably extend to algorithms, training data or product monitoring data for AI products.
• Article 11 keeps a development-risk defence, for defects the objective state of scientific and technical knowledge couldn't reveal while the product was within the manufacturer's control, and lets countries limit it under Article 18.

What happened to the EU AI Liability Directive?

The Commission proposed a separate AI Liability Directive in September 2022, with its own disclosure rules and a presumption of causality for fault-based claims. It listed the proposal for withdrawal in its February 2025 work programme, saying no agreement was foreseeable, and the withdrawal was published in the Official Journal on 6 October 2025. The Commission said it would assess whether to present a new proposal or take another approach.

• That leaves the Product Liability Directive as the EU-wide no-fault route, with fault-based claims about AI still governed by each country's own law.

What records should an AI company keep for EU product liability claims?

Both sides of a claim will turn on the same facts: what the system was given, which version answered and what it produced. A claimant usually has only a screenshot. If the company can't produce its own record of that run, it may face the presumption that follows a failure to disclose, or a court presuming defect because the system is too complex for the claimant to explain.

• A record made at the time, with a hash of the input and output and the model and version, lets you show what happened without handing over the whole system. It doesn't decide whether the output was defective; it fixes the facts the argument is about.