EU Product Liability Directive: who pays for a defective product, and from when

What you do:

1. Sort your stock by the date the product was placed on the market. A product placed on the EU market or put into service after 9 December 2026 falls under the new Directive (Art. 2(1)Directive (EU) 2024/2853, Product Liability DirectiveArticle 2, paragraph 1Click opens the article on EUR-Lex.). One placed before that date stays under Directive 85/374/EEC (Art. 21Directive (EU) 2024/2853, Product Liability DirectiveArticle 21Click opens the article on EUR-Lex.).
2. Find the EU-established operator your product already has. If you make the product outside the EU, its importer, your authorised representative and, only where neither is in the EU, a fulfilment service provider are each liable alongside you (Art. 8(1)(c)Directive (EU) 2024/2853, Product Liability DirectiveArticle 8, paragraph 1, point (c)Click opens the article on EUR-Lex.). The injured person can claim the whole amount from any one of them (Art. 12(1)Directive (EU) 2024/2853, Product Liability DirectiveArticle 12, paragraph 1Click opens the article on EUR-Lex.).
3. If your name or trademark is on the product, you are its manufacturer for this Directive, whoever made it (Art. 4(10)(b)Directive (EU) 2024/2853, Product Liability DirectiveArticle 4, point 10, point (b)Click opens the article on EUR-Lex.).
4. Count the software and its updates as part of the product, and connected services within your control as components of it (Art. 4(1)Directive (EU) 2024/2853, Product Liability DirectiveArticle 4, point 1Click opens the article on EUR-Lex., Art. 4(3)Directive (EU) 2024/2853, Product Liability DirectiveArticle 4, point 3Click opens the article on EUR-Lex., Art. 4(4)Directive (EU) 2024/2853, Product Liability DirectiveArticle 4, point 4Click opens the article on EUR-Lex.). A defect that came into being after sale through software or a missing update you control is not a defence (Art. 11(2)Directive (EU) 2024/2853, Product Liability DirectiveArticle 11, paragraph 2Click opens the article on EUR-Lex.).
5. Keep the records a court can order you to hand over: the technical documentation, risk analysis, test reports and instructions. A defendant that fails to disclose relevant evidence is presumed to have sold a defective product (Art. 9(1)Directive (EU) 2024/2853, Product Liability DirectiveArticle 9, paragraph 1Click opens the article on EUR-Lex., Art. 10(2)(a)Directive (EU) 2024/2853, Product Liability DirectiveArticle 10, paragraph 2, point (a)Click opens the article on EUR-Lex.). GPSR technical documentation covers what a manufacturer must hold.
6. The Directive requires no insurance, and neither a contract term nor national law can cap what you owe the injured person (Art. 15Directive (EU) 2024/2853, Product Liability DirectiveArticle 15Click opens the article on EUR-Lex.).
7. A clause that tries to exclude or limit your liability for injury or damage to a person has no effect against the injured person (Art. 15Directive (EU) 2024/2853, Product Liability DirectiveArticle 15Click opens the article on EUR-Lex.).

Products placed on the market after 9 December 2026 fall under it

The Directive applies to a product placed on the market or put into service after 9 December 2026 (Art. 2(1)Directive (EU) 2024/2853, Product Liability DirectiveArticle 2, paragraph 1Click opens the article on EUR-Lex.). It repeals Directive 85/374/EEC “with effect from 9 December 2026” but says that Directive “shall continue to apply with regard to products placed on the market or put into service before that date” (Art. 21Directive (EU) 2024/2853, Product Liability DirectiveArticle 21Click opens the article on EUR-Lex.). Countries must have their own law in force by 9 December 2026 (Art. 22(1)Directive (EU) 2024/2853, Product Liability DirectiveArticle 22, paragraph 1Click opens the article on EUR-Lex.).

“Put into service” covers a product first used in the Union in the course of a commercial activity without having been placed on the market before, such as a lift, a machine or a medical device (Art. 4(9)Directive (EU) 2024/2853, Product Liability DirectiveArticle 4, point 9Click opens the article on EUR-Lex., recital 26). A product supplied free of charge counts too, if it is supplied in the course of a commercial activity (Art. 4(7)Directive (EU) 2024/2853, Product Liability DirectiveArticle 4, point 7Click opens the article on EUR-Lex.).

A manufacturer outside the EU is liable, and so are the EU operators behind it

Under Art. 8(1)Directive (EU) 2024/2853, Product Liability DirectiveArticle 8, paragraph 1Click opens the article on EUR-Lex. the following are liable for the damage a defective product causes:

The importer, the authorised representative and the fulfilment service provider are liable “without prejudice to the liability of that manufacturer” (Art. 8(1)(c)Directive (EU) 2024/2853, Product Liability DirectiveArticle 8, paragraph 1, point (c)Click opens the article on EUR-Lex.). The manufacturer outside the EU stays liable too.

What this means for the EU Responsible Person you may already have. An EU Responsible Person that holds a written mandate from you fits the wording of an authorised representative, and recital 37 names product safety legislation as a source of such tasks. On that wording, a business that holds that role for your product can be a defendant when the product injures someone. The Directive gives an operator that paid compensation a right of recourse against the other liable operators, under national law (Art. 14Directive (EU) 2024/2853, Product Liability DirectiveArticle 14Click opens the article on EUR-Lex.). Who the role-holders are, and what the product needs under GPSR, is in EU Responsible Person.

The Directive does not oblige you to have any of these. GPSR makes one a condition of sale: a product covered by it “shall not be placed on the market unless there is an economic operator established in the Union” responsible for the tasks in Article 4(3)Regulation (EU) 2019/1020, Market Surveillance RegulationThe whole regulationClick opens the law on the EU Publications Office. of Regulation (EU) 2019/1020Regulation (EU) 2019/1020, Market Surveillance RegulationThe whole regulationClick opens the law on the EU Publications Office. (Art. 16(1)Regulation (EU) 2023/988, General Product Safety RegulationArticle 16, paragraph 1Click opens the article on EUR-Lex. of Regulation (EU) 2023/988Regulation (EU) 2023/988, General Product Safety RegulationThe whole regulationClick opens the law on the EU Publications Office.). The Product Liability Directive makes liability follow whichever of these exists, and sends it to the distributor or the platform where none can be named.

A distributor or platform that cannot name an EU operator within one month is liable itself

This is the last line of the chain. It runs in this order (Art. 8(3)Directive (EU) 2024/2853, Product Liability DirectiveArticle 8, paragraph 3Click opens the article on EUR-Lex.):

1. No EU-established manufacturer, importer, authorised representative or fulfilment service provider can be identified for the defective product.
2. The injured person asks a distributor to name “an economic operator” from that list that is based in the EU, or “its own distributor that supplied it with that product”.
3. The distributor does not do so “within one month of receiving the request”.

From then on, that distributor is liable. A distributor that names an EU-established operator, or its own distributor that supplied the product, within the month does not meet the third condition.

An online platform gets the same rule, with two further conditions. It must allow consumers to conclude distance contracts with traders and not itself be an economic operator, and the conditions of the Digital Services Act hosting rule must be met (Art. 8(4)Directive (EU) 2024/2853, Product Liability DirectiveArticle 8, paragraph 4Click opens the article on EUR-Lex.). That rule disapplies a platform’s hosting exemption, for liability under consumer protection law, where it “presents the specific item of information or otherwise enables the specific transaction at issue in a way that would lead an average consumer to believe that the information, or the product or service that is the object of the transaction, is provided either by the online platform itself or by a recipient of the service who is acting under its authority or control” (Art. 6(3)Regulation (EU) 2022/2065, Digital Services ActArticle 6, paragraph 3Click opens the article on EUR-Lex.).

Software and digital manufacturing files are products; connected services within your control are components

The Directive defines a product as “all movables, even if integrated into, or inter-connected with, another movable or an immovable”. It “includes electricity, digital manufacturing files, raw materials and software” (Art. 4(1)Directive (EU) 2024/2853, Product Liability DirectiveArticle 4, point 1Click opens the article on EUR-Lex.). The old Directive named electricity and not software.

• Software counts “irrespective of the mode of its supply or usage”: stored on a device, reached over a network or the cloud, or supplied as software-as-a-service (recital 13). Operating systems, firmware, applications and AI systems are all named. A developer or producer of software, including an AI system provider, is treated as a manufacturer.
• Digital manufacturing files are products. The Directive defines them as a digital version of or template for a movable “which contains the functional information necessary to produce a tangible item by enabling the automated control of machinery or tools” (Art. 4(2)Directive (EU) 2024/2853, Product Liability DirectiveArticle 4, point 2Click opens the article on EUR-Lex.). Recital 16 gives the example of a defective design file used to make a 3D-printed good that causes harm, where the file is developed or supplied in the course of a commercial activity.
• Related services are components of the product where they are within the manufacturer’s control, and not otherwise (Art. 4(4)Directive (EU) 2024/2853, Product Liability DirectiveArticle 4, point 4Click opens the article on EUR-Lex.). A related service is a digital service “integrated into, or inter-connected with, a product in such a way that its absence would prevent the product from performing one or more of its functions” (Art. 4(3)Directive (EU) 2024/2853, Product Liability DirectiveArticle 4, point 3Click opens the article on EUR-Lex.). Recital 17 names a navigation system’s traffic data, a smart fridge’s temperature control and a voice assistant as examples, and says internet access is not one.
• Content is not a product. Recital 13 says the Directive does not apply to “the content of digital files, such as media files or e-books or the mere source code of software”.
• Free and open-source software developed or supplied outside the course of a commercial activity is out of scope (Art. 2(2)Directive (EU) 2024/2853, Product Liability DirectiveArticle 2, paragraph 2Click opens the article on EUR-Lex.). Recital 14 says it is in scope where it is supplied for a price, or for personal data used for more than the software’s security, compatibility or interoperability.

A software defect cannot be blamed on the time after sale. An economic operator can normally escape liability by proving that the defect probably did not exist when the product was placed on the market, or arose afterwards (Art. 11(1)(c)Directive (EU) 2024/2853, Product Liability DirectiveArticle 11, paragraph 1, point (c)Click opens the article on EUR-Lex.). That defence is shut where the defect is due to a related service, software including updates or upgrades, a lack of software updates or upgrades necessary to maintain safety, or a substantial modification, provided that it is within the manufacturer’s control (Art. 11(2)Directive (EU) 2024/2853, Product Liability DirectiveArticle 11, paragraph 2Click opens the article on EUR-Lex.). A product stays within the manufacturer’s control where the manufacturer can supply software updates or upgrades itself or through a third party (Art. 4(5)Directive (EU) 2024/2853, Product Liability DirectiveArticle 4, point 5Click opens the article on EUR-Lex.).

The damage covered: injury, psychological harm, property and lost data

Only a natural person can claim (Art. 5(1)Directive (EU) 2024/2853, Product Liability DirectiveArticle 5, paragraph 1Click opens the article on EUR-Lex.). The person need not be the buyer: the Directive speaks of “any natural person who suffers damage caused by a defective product”. A person who takes over the claim, or a person acting for one or more injured persons under Union or national law, can bring it (Art. 5(2)Directive (EU) 2024/2853, Product Liability DirectiveArticle 5, paragraph 2Click opens the article on EUR-Lex.).

The right to compensation applies “in respect of only the following types of damage” (Art. 6(1)Directive (EU) 2024/2853, Product Liability DirectiveArticle 6, paragraph 1Click opens the article on EUR-Lex.):

Compensation covers “all material losses” that result, and non-material losses where national law allows (Art. 6(2)Directive (EU) 2024/2853, Product Liability DirectiveArticle 6, paragraph 2Click opens the article on EUR-Lex.).

A product is defective when it lacks the safety a person is entitled to expect

A product is defective “where it does not provide the safety that a person is entitled to expect or that is required under Union or national law” (Art. 7(1)Directive (EU) 2024/2853, Product Liability DirectiveArticle 7, paragraph 1Click opens the article on EUR-Lex.). The second half is new: failing a legal safety requirement is itself a defect test.

A court takes “all circumstances” into account (Art. 7(2)Directive (EU) 2024/2853, Product Liability DirectiveArticle 7, paragraph 2Click opens the article on EUR-Lex.), including:

• the presentation and characteristics of the product, including its labelling, design, technical features, composition, packaging and the instructions for assembly, installation, use and maintenance;
• reasonably foreseeable use, and the reasonably foreseeable effect of other products used with it, including connected ones;
• any ability to keep learning or to acquire new features after it is placed on the market;
• relevant product safety requirements, including safety-relevant cybersecurity requirements;
• any recall or other safety intervention by an authority or an economic operator;
• the specific needs of the group of users the product is intended for;
• for a product whose purpose is to prevent damage, any failure to do so.

A product is not defective for the sole reason that a better one, including an update or upgrade, was or is later placed on the market (Art. 7(3)Directive (EU) 2024/2853, Product Liability DirectiveArticle 7, paragraph 3Click opens the article on EUR-Lex.). A recall is a factor and not a verdict: recital 34 says such interventions should “not in themselves create a presumption of defectiveness”. What GPSR requires in a product recall is on its own page.

Courts can order disclosure of your evidence and presume a defect

The injured person still has to prove “the defectiveness of the product, the damage suffered and the causal link” (Art. 10(1)Directive (EU) 2024/2853, Product Liability DirectiveArticle 10, paragraph 1Click opens the article on EUR-Lex.). Two tools lighten that burden.

Disclosure of evidence. Where a claimant “has presented facts and evidence sufficient to support the plausibility of the claim”, the defendant “is required to disclose relevant evidence that is at the defendant’s disposal” (Art. 9(1)Directive (EU) 2024/2853, Product Liability DirectiveArticle 9, paragraph 1Click opens the article on EUR-Lex.). The disclosure is limited to “what is necessary and proportionate” (Art. 9(3)Directive (EU) 2024/2853, Product Liability DirectiveArticle 9, paragraph 3Click opens the article on EUR-Lex.). Courts must weigh confidential information and trade secrets and can take measures to protect them (Art. 9(4)Directive (EU) 2024/2853, Product Liability DirectiveArticle 9, paragraph 4Click opens the article on EUR-Lex., Art. 9(5)Directive (EU) 2024/2853, Product Liability DirectiveArticle 9, paragraph 5Click opens the article on EUR-Lex.). The same duty runs the other way: a defendant that shows its need for evidence can have the claimant disclose (Art. 9(2)Directive (EU) 2024/2853, Product Liability DirectiveArticle 9, paragraph 2Click opens the article on EUR-Lex.).

Presumptions. Each can be rebutted by the defendant (Art. 10(5)Directive (EU) 2024/2853, Product Liability DirectiveArticle 10, paragraph 5Click opens the article on EUR-Lex.).

What a manufacturer already holds under GPSR is what a court would look at: a manufacturer must draw up technical documentation, including an analysis of the possible risks, before placing the product on the market, and keep it for 10 years after (Art. 9(2)Regulation (EU) 2023/988, General Product Safety RegulationArticle 9, paragraph 2Click opens the article on EUR-Lex., Art. 9(3)Regulation (EU) 2023/988, General Product Safety RegulationArticle 9, paragraph 3Click opens the article on EUR-Lex. of Regulation (EU) 2023/988). A defendant that holds no papers has nothing to set against a presumption of defectiveness (Art. 10(5)Directive (EU) 2024/2853, Product Liability DirectiveArticle 10, paragraph 5Click opens the article on EUR-Lex.).

The time limits: three years to sue, 10 years to expiry, 25 for a latent injury

• Three years to bring a claim, counted from the day the injured person became aware, or should reasonably have become aware, of the damage, the defect and the identity of the operator that can be held liable (Art. 16(1)Directive (EU) 2024/2853, Product Liability DirectiveArticle 16, paragraph 1Click opens the article on EUR-Lex.).
• 10 years to expiry. The right to compensation ends 10 years after the defective product was placed on the market or put into service, unless the injured person has started proceedings against a liable operator in the meantime. For a substantially modified product the 10 years run from when it was made available or put into service after the modification (Art. 17(1)Directive (EU) 2024/2853, Product Liability DirectiveArticle 17, paragraph 1Click opens the article on EUR-Lex.).
• 25 years where the injury is latent. Where the injured person could not start proceedings within 10 years because the personal injury was slow to emerge, the period is 25 years (Art. 17(2)Directive (EU) 2024/2853, Product Liability DirectiveArticle 17, paragraph 2Click opens the article on EUR-Lex.).

Contract terms cannot exclude or cap the liability

Liability under the Directive “is not, in relation to the injured person, limited or excluded by a contractual provision or by national law” (Art. 15Directive (EU) 2024/2853, Product Liability DirectiveArticle 15Click opens the article on EUR-Lex.). A disclaimer in your terms and conditions, a seller agreement or a customer notice has no effect against a person injured by the product. A country cannot cap it either: recital 56 names “financial ceilings” as an example. The old Directive let a country cap total liability for death or personal injury caused by identical items with the same defect, at no less than 70 million ECU (Art. 16(1) of Directive 85/374/EEC). The new text has no such option.

What changed from Directive 85/374/EEC

What happens if you do nothing

The Directive sets no fine and names no penalty. What follows is a claim for compensation by the injured person, in a national court, against you or against any other operator on the list above. Three of its rules work against a business with nothing prepared:

• A defendant that does not disclose evidence a court orders is presumed to have sold a defective product (Art. 10(2)(a)Directive (EU) 2024/2853, Product Liability DirectiveArticle 10, paragraph 2, point (a)Click opens the article on EUR-Lex.).
• A product that breaks a mandatory safety requirement meant to protect against the risk of the damage suffered is presumed defective once the claimant shows it (Art. 10(2)(b)Directive (EU) 2024/2853, Product Liability DirectiveArticle 10, paragraph 2, point (b)Click opens the article on EUR-Lex.).
• With no EU-established operator named, a distributor or platform that supplied your product can carry the liability, and the Directive lets an operator that paid pursue the others under national law (Art. 8(3)Directive (EU) 2024/2853, Product Liability DirectiveArticle 8, paragraph 3Click opens the article on EUR-Lex., Art. 14Directive (EU) 2024/2853, Product Liability DirectiveArticle 14Click opens the article on EUR-Lex.).

Nothing in the Directive requires insurance. The Commission must report by 9 December 2030, and every five years after, on how the Directive works, including “the availability of product liability insurance” (Art. 20Directive (EU) 2024/2853, Product Liability DirectiveArticle 20Click opens the article on EUR-Lex.).