Innovations

9 min read
15/9/2025

AI and liability: the contributions of the directive on defective products

Adopted in 1985, Directive 85/374/EEC on liability for defective products was, in its day, a major milestone in consumer protection in the European Union.

It was based on a solid principle: the no-fault liability of the producer, which allowed the victim of damage caused by a defective product to be compensated without having to demonstrate negligence.

However, nearly forty years later, this legal framework has proved to be inadequate to the profound changes in the market and to the challenges posed by the digital revolution.

In a 2018 report evaluating the effects of the 1985 directive, the European Commission noted the increasing obsolescence of certain central concepts, such as those of “product”, “producer”, or even “defect” and “damage”.

It also highlighted a worrying imbalance in the distribution of costs between consumers and producers, especially when the burden of proof becomes particularly complex, for example, in disputes involving digital technologies or pharmaceutical products.

To take account of these limitations and the changing context, the European Union adopted Directive (EU) 2024/2853, which repeals and replaces the 1985 text. Entered into force on December 9, 2024, this new directive will apply to products placed on the market or put into service as of December 9, 2026.

It aims to respond to contemporary challenges: the development of electronic commerce, increased circulation of goods on a global scale, and the rise of digital products, software and artificial intelligence.

In the words of the co-rapporteur of the Committee on Legal Affairs, this reform aims to” finding the right balance between the need to provide an effective instrument for victims of defective products while ensuring legal certainty for economic operators in rapidly changing markets ”.

She introduces as well as mechanisms to ensure the responsibility of software, applications or even artificial intelligence systems, while maintaining the innovative capacity of businesses, especially technological start-ups.

First, we present the fundamental contributions of Directive (EU) 2024/2853, without pretending to be exhaustive, by focusing on the new criteria for assessing the defect of a product. The concept of “product” itself is being rethought by being expanded to include software, digital files and other intangible components that play a decisive role in the functioning of goods.

Second, we study adjustments relating to the burden of proof, which tend to rebalance the plaintiff's position by facilitating the establishment of the defect and the causal link, especially in complex cases involving innovative technologies.

Finally, we describe how this no-fault liability regime coexists with other liability bases as long as they are clearly distinct and compatible with legal certainty requirements.

Taking into account new criteria to assess the defect of a product.

The expansion of the legal definition of the product now includes categories that were previously excluded by the 1985 directive, leading to the recognition of forms of damage hitherto not taken into account.

A new definition of “product” in the digital age :

One of the major innovations of Directive (EU) 2024/2853 lies in the updating of the concept of “product”, which has now been expanded to take account of technological realities.

While the 1985 directive limited this definition to tangible personal property, excluding agricultural raw materials and hunting products, the new directive explicitly integrates intangible elements such as software, digital manufacturing files, or even certain digital services closely linked to the use of the product.

Thus, software integrated into a connected object, or a defective digital file used in a 3D printer can now fall within the scope of responsibility for defective products. This evolution reflects a clear desire to encompass the new risks associated with emerging technologies.

However, the aim of the directive is not to hinder innovation or research: free and open software, when developed outside the framework of a commercial activity, remains excluded from its scope of application (Article 2.2 of Directive (EU) 2024/2853). However, their integration into a product placed on the market may involve the responsibility of the manufacturer of this product.

Towards a finer understanding of defect, adapted to digital products:

The directive not only extends the definition of the product: it also renews the criteria for assessing its defect, in order to better correspond to the characteristics of digital products. Indeed, the concept of defect remains based on the lack of security that a user is entitled to expect.

However, in accordance with Article 7 of Directive (EU) 2024/2853, this assessment by the judge must now include new parameters, reflecting the evolution of technologies and uses.

It is now understood that the manufacturer maintains some control over its product even after it is placed on the market, in particular thanks to software updates or the machine learning of artificial intelligence systems.

Therefore, the assessment of the defect is not limited to the situation at the time the product was put into circulation: the manufacturer may be held liable for a defect even after marketing, because he maintains a form of control over the product.

For example, if a digital product, through updates, changes its behavior significantly, the product may be deemed defective due to this change, even after it has been put on the market, so the manufacturer may incur liability.

In addition, interconnected products, such as those used in home automation or smart objects, should also be taken into account in this assessment, with particular attention paid to the foreseeable impact of their interaction.

Cybersecurity requirements are now an essential element in assessing the security of digital systems and must be an integral part of defect analysis.

A decisive shift towards the intangible:

By extending the definition of “product” to include intangible components and associated digital services, the 2024 directive radically modernises the liability regime for defective products.

It extends the scope of responsible persons, including actors who have hitherto been little or not involved, software developers, artificial intelligence publishers, intelligent service providers.

In doing so, it establishes a subtle balance between increased consumer protection and the need to ensure an environment conducive to technological innovation in the European digital economy.

In any event, this development puts an end to an old debate that had long limited the application of no-fault liability to material goods only..

By legally enshrining the possibility of an intangible element, such as software, a file or a digital service, being qualified as a product, the text opens the liability regime to a new generation of risks, while maintaining the exclusion of individual developers acting outside a commercial framework.

An adjustment of the probationary regime for the benefit of the victim: towards a better effectiveness of the right to compensation.

The 2024 Directive introduces substantial changes to the evidence regime in disputes based on liability for defective products.

While the principle remains that the victim must prove the damage, the defect in the product and the causal link (Article 8.1 of Directive (EU) 2024/2853), the text expressly recognizes that this requirement may become excessively burdensome for a claimant who does not have the technical means or the knowledge necessary to understand the manufacture or operation of a product, especially when it comes to complex technologies such as artificial intelligence.

Supervised but reinforced presumptions:

To facilitate the burden of proof, the Directive establishes a series of presumptions that make it possible to alleviate the demands placed on the victim, in particular in disputes of high technical or scientific complexity.

In order to alleviate the burden of proof for the victim, the Directive establishes a series of presumptions which aim to facilitate the establishment of the defect of the product, in particular in complex technical or scientific disputes.

In accordance with Article 10 of Directive (EU) 2024/2853, several situations make it possible to presume the defect of a product, such as:

  • The defendant does not disclose relevant evidence in accordance with section 91;
  • The applicant demonstrates that the product does not comply with mandatory product safety requirements under Union or national law which are intended to protect against the risk of damage suffered by the injured party occurring; or the applicant demonstrates that the damage was caused by an obvious malfunction of the product during reasonably foreseeable use or under ordinary circumstances.
  • When the product is defective and the nature of the damage is generally compatible with this defect.

Finally, in the most complex cases, a double presumption may be invoked by the victim, concerning both the defect and the causal link.

Indeed, if the victim faces excessive difficulties related to the complexity of the case, and if he shows that it is probable that the product is defective and that there is a link between this defect and the damage, then this double presumption will be accepted.

This presumption relates to complex products, such as pharmaceuticals, medical devices, or products that incorporate machine learning.

This presumption applies as long as the manufacturer maintains some control over the product, even after it has been placed on the market, especially when changes are made, such as software updates or adjustments related to machine learning.

However, once the product is no longer under the manufacturer's control, it is up to the victim to prove the defect in the product and to establish the causal link between this defect and the damage.

These presumptions, although rebuttable, mark a significant shift in favor of the victim, and reflect a desire to adapt liability law to the realities of evolving technologies.

A targeted restriction of the causes of exemption:

The directive also reviews the cases in which the manufacturer can exempt himself from liability. If the classic causes are retained, such as the defect that occurred after marketing, compliance with legal standards, or even the risk of development, they are regulated more strictly, in particular when the defect results from elements under the manufacturer's control, such as software or its updates.

Thus, a manufacturer will no longer be able to excuse himself by invoking a defect that occurred after introduction into circulation if this defect results from a component that he controls., such as an integrated AI system.

This reference to manufacturer control is nevertheless questionable, in a context where some artificial intelligences can evolve independently, making their behavior at least partially unpredictable.

Preventively, this risk of loss of control is taken into account in the obligation established by the IA Act, which requires the manufacturer to rigorously monitor the management of risks associated with the AI model placed on the market.

A rebalancing in the face of information asymmetry: The establishment of a mechanism for the disclosure of evidence

Inspired by the discovery mechanism in force in Anglo-Saxon systems, the directive allows an aggrieved person, as long as it makes his request “plausible”, to ask the judge to order the defendant to disclose the relevant evidence in his possession.

This power of injunction is a major advance, especially in terms of accessing essential technical information, such as learning data from an AI system or internal reports on identified defects. Moreover, this device then makes it possible to correct the asymmetry of information between the victim and the manufacturer formerly identified.

This mechanism is particularly effective for the plaintiff, as it prevents the defendant from being too easily exempted by claiming, for example, that he did not know about the defect in the product or that the state of technical and scientific knowledge at the time did not allow this defect to be detected.

This mechanism allows the applicant, when this exemption is invoked, to request the disclosure of evidence.

This mechanism is reciprocal: the defendant can also ask the judge to order the disclosure of relevant elements by the plaintiff, if he has credible evidence to support his defense.9.

However, in order to maintain a balance between the rights of the parties, the directive imposes clear limits on this disclosure: it must remain necessary and proportionate, and respect the legitimate interests of the parties, in particular the protection of confidential information or information covered by trade secrets (articles 9.3 and 9.4 of Directive (EU) 2024/2853).

In this context, the use of a specialized lawyer is of strategic importance in order to anticipate the risk of manufacturer liability being questioned. Indeed, this makes it possible, from the development phase of the project, to set up legal and technical documentation aimed at preventing this asymmetry of information.

This proactive approach not only helps to secure contractual relationships, but also to protect the interests of the company in the event of litigation.

The non-exclusive nature of the regime established and the possibility of using other grounds of liability

The liability regime for defective products introduced by the Directive is not intended to replace the ordinary or special liability regimes provided for by national legislation.

It is added to them, without crowding them out. Indeed, victims retain the possibility of invoking other liability regimes, as long as the required conditions are met and the legal bases invoked are distinct.

Article 6 (3) of the directive expressly confirms this by specifying that it “does not affect national law relating to the compensation of damage under other liability regimes”.

In French law, this means that the victim can act, cumulatively or alternatively, on various grounds such as: extracontractual liability for fault (article 1240 of the Civil Code), the guarantee of hidden defects (article 1641 of the Civil Code), contractual liability for breach of a security or information obligation, or even liability for the fact of things (article 1242 of the Civil Code).

Thus, depending on the nature of the relationship between the parties and the procedural strategy adopted, the victim may:

Take a trip In a contractual framework, invoke the guarantee against hidden defects, contractual liability under ordinary law, or even the special regime provided for by the directive;

Take a trip In an extra-contractual framework, choose between liability for the manufacturer's fault, liability for things, or the special regime provided for by the directive.

However, for this action to be admissible before French judges, the action for compensation must be based on different foundations.

So, to illustrate our point, let's take the example of liability action for manufacturer fault:

While the objective regime of liability for defective products is based on the lack of safety expected from the product, nothing prevents the victim from acting in the area of liability for fault, as long as this fault constitutes an autonomous basis, distinct from the simple lack of safety.

A manufacturer's fault, such as maintaining a product on the market despite a proven knowledge of its danger, may constitute blameworthy conduct involving the personal responsibility of the producer, regardless of the assessment of the defect of the product.

Thus, such action does not disregard the scope of application of the special regime, but is based on a different triggering fact, fully compatible with the common law of liability.

It also makes it possible to respond to situations where the manufacturer's attitude aggravates or reveals an existing defect, or where its passivity in the face of a known danger contributes directly to the occurrence of the damage.

However, this reading gave rise to doctrinal reservations. Indeed, some authors were able to criticize the character optional recourse to the special regime, considering it a factor of legal uncertainty and an achievement of the objective of European harmonization.

In any event, the European directive does not intend to establish an exclusive but complementary regime, offering victims a simplified way of compensation in the event of probationary difficulties.

Other articles that may interest you

See all articles

Compliances

12/2/2025

8 min read

RGPD vs IA: The challenges of protecting personal data in the implementation of AIS

At a time when the first provisions of the artificial intelligence regulation are coming into force, the compliance of AI systems is becoming an essential issue.

Artificial intelligence (AI) is defined by Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 as follows:A system designed to work with elements of autonomy and capable, for a given set of human-defined goals, of generating results such as content, predictions, recommendations, or decisions that influence the environments with which it interacts.” The regulation distinguishes between artificial intelligence systems (AIS) and general-purpose AI models.

AIS are AI applications designed for specific tasks or areas, such as medical diagnostic support systems. In contrast, general-purpose AI models are versatile systems, capable of being used in a variety of contexts and for a variety of applications. For example, a natural language processing model can be adapted to perform machine translation.

Artificial intelligence raises complex issues, especially in the area of personal data protection. Indeed, artificial intelligence systems operate using a large or even massive quantity of data, justifying the establishment of a rigorous framework governing their use and processing, while ensuring respect for the fundamental rights of individuals, including respect for privacy.

The challenges are multiple : how to ensure that algorithms do not compromise the privacy of individuals? How can we ensure that the data analysis carried out by AI systems remains ethical and in accordance with the principles of transparency, fairness and accountability?

To face these challenges, which are not the same in the design phase and in the deployment phase, data protection authorities, such as the CNIL in France and the EDPS at the European level, must constantly reassess and adjust their doctrines to inform actors in the field on the compliance procedures to be carried out by integrating technological developments. Here we provide an overview of recent developments in this doctrinal and/or regulatory framework relating to AI and the RGPD.

Read the article

Innovations

13/1/2025

10 min read

AI ACT : Protection of rights and artificial intelligence

For several years, the European Union has sought to oversee the development of artificial intelligence in order to reconcile innovation and the protection of fundamental rights. In this context, Regulation EU 2024/1689 (AI Act) was adopted by the European Parliament and the Council on 13 June 2024, prior to its publication in the Official Journal of the European Union on 12 July 2024.

This text establishes regulations based on a risk-based approach, prohibiting certain practices and imposing strict requirements, especially for high-risk AI systems. The application of this regulation is particularly significant in the field of health, where AI promises major advances while requiring compliance with numerous European laws, such as the RGPD and the MDR regulation.

Read the article

Contracts

6/1/2025

13 min read

Software & unilateral price revision: between contractual freedom and legal framework

Through this article, we want to share with you several feedback that can help you prevent the emergence of disputes and, therefore, to secure your commercial relationships.

We will not mention relationships between traders, governed by the Commercial Code. We will focus on a particular, although relatively common, situation, namely commercial relationships between a software publisher and a professional customer.

Read the article

CONTACT

In need of customized
support ?

* Mandatory fields. We collect this data in order to send you the answers you have requested by email. To find out more about the management of your personal data and to exercise your rights, refer to our privacy policy.

Merci, votre message a bien été envoyé !
Veuillez réessayer d'envoyer votre message ou directement nous contacter par téléphone !