EU’s New Rules Clarify AI Liability for Consumer Damages

The EU is making it simpler for individuals to sue the manufacturers of artificial intelligence systems that harm them, part of the bloc’s broader push to enact consumer-friendly tech laws.

The new rules, which complement the bloc’s AI Act, aim to ensure that “whatever happens, there is always a business within the EU that can be held liable,” said Alexander Kennedy, tech knowledge director for Continental Europe at Clifford Chance.

The European Union on Dec. 8 updated its Product Liability Directive, a roadmap the Union’s 27 member states must follow in enacting their own legislation. The update ensures technological products are covered, and give individuals who suffer certain harms a way to seek compensation. They also clarify where the liability falls: on the manufacturer who controls and is responsible for continued updates to its products.

For an individual looking to sue, the directive streamlines the process, said Barry Scannell, a partner at William Fry in Dublin. “You no longer need to prove negligence, but rather can simply demonstrate that the product was defective and caused harm.”

Only harms to individuals and their property are covered. Those include physical damage to people or property—for example, if a program that monitored physical infrastructure went haywire, leading to a building being flooded; psychological damages—for example, a chatbot that induced a user to self-harm; and the loss of digital data. The rules don’t help companies bring suits.

The rules will take effect by Dec. 9, 2026, once elements have been incorporated into the national law of individual EU states.

The EU’s efforts to nail down rules about artificial intelligence reflect its proactive approach to regulation. That makes for a marked contrast with the US, where Congress has taken virtually no action, leaving federal agencies and a few state legislatures—and, the courts—to forge a path.

While most of the major players in the sector are American, in the absence of meaningful legislation in Congress, Europe’s AI Act is currently the closest thing to a universal standard regulating use of the technology.

Tech Reaction

The directive doesn’t address some big AI risks that have vexed policymakers over the last few years, like bias in the workplace. The EU’s landmark AI Act, approved earlier this year, requires safeguards for high-risk uses of AI, but isn’t focused on liability. The EU is currently working on further legislation, an AI Liability Directive, to help answer more questions about who’s responsible when AI hurts people.

The tech industry, which had urged the EU to move cautiously on the liability initiative, warned that the impact of the legislation remains unclear.

That is especially the case, “when it comes to the interpretation of the notion of defectiveness or the application of the alleviations to the burden of proof,” Marco Leto Barone, policy director of the Information Technology Industry Council, said in a statement. ITI represents many of the world’s biggest tech companies, including AI giants like Alphabet, Microsoft, and Meta.

He said the EU should consider withdrawing the additional proposed AI Liability Directive, as EU countries’ liability laws are already up to the job. And he warned that raising developers’ liability risks “will make investments in AI innovation more complex and costly and generally harm the EU’s competitiveness.”

Company Impact

One of the most important changes in the updated directive makes manufacturers responsible for products not just at the moment they put them on the market, but on an ongoing basis.

Companies will need to carefully monitor the software and AI they’ve designed. Under the new rules they can be found liable not just for something being defective when it’s put on the market, but “actually, for the lack of updating it or monitoring the risks,” said Dessislava Savova, who leads the global consumer goods and retail sector groups and the tech sector group in Europe for Clifford Chance.

For non-EU-based companies trying to understand if they’ll be affected, it’s “a bit of a yes-and-no answer,” said David Kidman, a partner at Simmons and Simmons in London who focuses on product liability disputes.

On one hand, the EU product legislation aims to give claimants someone to sue within Europe. But companies should also keep sight of the big picture, Kidman said: The EU is serious about consumer-friendly legislation around AI.

“It mustn’t be forgotten that a key reason for this overhaul was a concern around claimants being able to bring claims against AI producers and others in the supply chain"—an approach that is echoed in other EU legislation, including the AI Act, Kidman said. “When you start piecing together all of those different legislations and the sentiments behind them, I think it’s important not to be too complacent if you are an AI producer or someone else in the supply chain.”

Companies should closely review their contracts to make sure they’re watertight as they wait for further AI liability legislation and parse out what the updated product liability rules mean for them, advisors said.

“The big thing we’re saying around this is your representations, your warranties, your liability clauses, limitations in liability, exclusions of liability, your indemnities—these are all really important,” and in most organizations, they aren’t frequently updated, Scannell said.

Companies should now rethink how they’re approaching their AI contracts, he added. “Your end-user license agreements, your acceptable use policies, all of the contractual protections that you have—the game has changed, and have you responded to that?”