Independent research study — not client work
VerifiedRS-07 • Law and accountability • checked 4 September 2026
A reading of the two enacted EU texts themselves. The directive is notable less for naming a defendant than for shifting proof: it obliges disclosure of evidence and lets a court presume defectiveness or causation where a claimant faces excessive difficulties because of technical complexity — with machine learning named in the recitals as such a case.
Section 01
When an AI-assisted decision or product causes documented harm, which party does enacted law make answerable — the developer, the deploying organisation, or someone else in the chain?
In the European Union two enacted instruments now answer parts of this. Directive (EU) 2024/2853 of 23 October 2024 brings software expressly within no-fault product liability and makes the manufacturer of a defective product — and, where the manufacturer sits outside the Union, the importer, authorised representative or fulfilment service provider — liable; anyone who substantially modifies a product outside the manufacturer's control becomes its manufacturer. Regulation (EU) 2024/1689 works the other way round for AI systems: a distributor, importer or deployer who puts its name on a high-risk system, substantially modifies it, or turns a non-high-risk system into a high-risk one becomes the provider and takes on the provider's obligations. Neither instrument was read here as settling professional negligence, and no non-EU regime was examined.
Section 02
Section 03
Open the Official Journal text of each instrument and read the operative articles in full rather than the recitals alone.
Record who the article names as liable, and record separately what it changes about proof.
State the transposition deadline explicitly, so no reader takes the directive to be already applicable national law.
Exclude any instrument that was withdrawn, proposed or not yet adopted.
Section 04
Article 4(1) of Directive (EU) 2024/2853 defines 'product' as all movables, even if integrated into or inter-connected with another movable or an immovable, and states that it includes electricity, digital manufacturing files, raw materials and software. Recital 6 confirms the intent that no-fault liability apply to software, including when integrated into other movables.
Article 8(1) makes liable the manufacturer of a defective product; the manufacturer of a defective component integrated within the manufacturer's control; and, where the manufacturer is established outside the Union, the importer, the authorised representative, and — failing both — the fulfilment service provider. Article 8(2) treats any person who substantially modifies a product outside the manufacturer's control and then makes it available as the manufacturer of that product.
Article 9 requires a defendant to disclose relevant evidence where a claimant has presented facts sufficient to make the claim plausible. Article 10(2) presumes defectiveness where the defendant fails to disclose, where the product breached mandatory safety requirements, or where damage followed an obvious malfunction; Article 10(3) presumes causation where the damage is of a kind typically consistent with the defect. Article 10(4) requires a court to presume defectiveness or causation where the claimant faces excessive difficulties, in particular due to technical or scientific complexity, and shows that defectiveness or causation is likely. The recitals name machine learning and the inner workings of an AI system as examples of such difficulty, and add that the claimant need not prove those difficulties. Article 10(5) preserves the defendant's right to rebut every presumption.
Article 22(1) requires Member States to bring the implementing measures into force by 9 December 2026; Article 23 provides that the directive enters into force on the twentieth day after publication. It repeals and replaces Council Directive 85/374/EEC, whose regime continues to govern products placed on the market before the changeover date.
Article 25(1) of Regulation (EU) 2024/1689 provides that a distributor, importer, deployer or other third party is considered a provider of a high-risk AI system, and takes on the provider's Article 16 obligations, where it puts its name or trademark on the system, substantially modifies it, or modifies the intended purpose of a system — including a general-purpose AI system — so that it becomes high-risk. Article 25(2) then removes that status from the initial provider for that specific system, while requiring cooperation and information.
Article 26 requires deployers of high-risk systems to use them in accordance with the instructions for use, to assign human oversight to competent and adequately supported natural persons, to ensure input data within their control is relevant and sufficiently representative, and to monitor operation and notify the provider and market surveillance authority of risks. Article 99(3) sets fines of up to EUR 35 000 000 or 7 % of worldwide annual turnover for breach of the Article 5 prohibitions, and Article 99(4) up to EUR 15 000 000 or 3 % for other operator infringements, whichever is higher in each case.
Section 05
European Union — EUR-Lex • Done at Strasbourg, 23 October 2024
Full Official Journal HTML retrieved; Articles 4, 8, 9, 10, 22 and 23 read in place, together with the recital passages on software and on excessive difficulties.
Open sourceEuropean Union — EUR-Lex • Adopted 13 June 2024; OJ 12 July 2024
Official Journal HTML retrieved; the value-chain, deployer-obligation and penalty articles read verbatim before summary.
Open sourceSection 06
| Query | Engine | Logged | Outcome |
|---|---|---|---|
| site:eur-lex.europa.eu directive 2024/2853 product liability official journal | Direct fetch | 4 September 2026 | HTML retrieved (HTTP 200); the operative articles were located and read for findings F1 to F4. |
| product liability directive software artificial intelligence burden of proof presumption | Direct read of the retrieved text | 4 September 2026 | Article 10(4) and the accompanying recital on machine learning were located inside the fetched text rather than through a search engine. |
| site:eur-lex.europa.eu regulation 2024/1689 Article 25 responsibilities value chain | Direct fetch | 4 September 2026 | Articles 25, 26 and 99 read in the Official Journal text for findings F5 and F6. |
| AI Liability Directive withdrawal Commission work programme | Not completed | 4 September 2026 | No official document was opened on the fate of the proposed AI Liability Directive, so this page says nothing about it. |
Section 07