The new EU Product Liability Directive (EU) 2024/2853
From the 1985 Directive to the digital age: key provisions, what has changed, open questions and how to prepare
1. At a glance
Directive (EU) 2024/2853 on liability for defective products (the new PLD) repeals and replaces Council Directive 85/374/EEC (the 1985 Directive). It applies to products placed on the EU market or put into service after 9 December 2026, which is also the deadline for Member States to transpose it into national law. The 1985 Directive continues to govern products placed on the market or put into service before that date, so two regimes will run side by side for many years.
The new PLD keeps the core idea of the 1985 Directive – liability without fault for damage caused by defective products – but materially widens almost every element of it:
The new PLD is also a maximum harmonisation measure: Member States may not maintain or introduce provisions that are more or less stringent, unless the Directive itself allows it.
2. Timeline
| Date | Event |
|---|---|
| 25 July 1985 | Council Directive 85/374/EEC adopted. |
| 7 May 2018 | European Commission evaluation of the 1985 Directive. |
| 28 September 2022 | Commission proposal for a new directive (COM(2022) 495). |
| 12 March 2024 | European Parliament adopts its first-reading position. |
| 23 October 2024 | Directive (EU) 2024/2853 adopted. |
| 18 November 2024 | Publication in the Official Journal; entry into force twenty days later, in December 2024. |
| 9 December 2026 | Transposition deadline and repeal of the 1985 Directive; the new PLD applies to products placed on the market or put into service after this date. Deadline for Member States to notify any existing development-risk derogations. |
| 9 December 2030 | First Commission evaluation, and every five years thereafter. |
3. The starting point: the 1985 Directive
Although the 1985 Directive imposed liability without fault, its drafters built in a number of limits that softened its effect for producers: the defect test looked at the position when the product was put into circulation, the development risks defence was available, property claims were subject to a minimum threshold and Member States could cap total liability. In outline:
- Strict liability of the producer. Liability without fault applied to industrially produced movables (including electricity). The "producer" included the manufacturer of a finished product, component or raw material, any own-brander, and the importer into the Community, with suppliers liable as a fallback where the producer could not be identified.
- Defect. A product was defective when it did not provide the safety that a person is entitled to expect, taking all circumstances into account, including its presentation, its reasonably expected use and the time it was put into circulation. A product was not defective merely because a better product was later put into circulation.
- Defences (Article 7). The producer escaped liability if it proved that it did not put the product into circulation; that the defect probably did not exist when it did so; that the product was not made for an economic purpose or in the course of business; that the defect was due to compliance with mandatory regulations; the development risks defence (the state of scientific and technical knowledge did not enable the defect to be discovered); or, for component manufacturers, that the defect was attributable to the design of the finished product or the manufacturer's instructions.
- Damage (Article 9). Recoverable damage was limited to death and personal injury, and to damage to property other than the product itself, subject to a 500 ECU lower threshold and only where the property was of a type intended for, and mainly used for, private use or consumption. Non-material damage was left to national law.
- Time limits. A three-year limitation period ran from when the claimant knew or should reasonably have known of the damage, the defect and the identity of the producer. Rights were extinguished ten years after the producer put the product into circulation, unless proceedings had been started.
- Member State options. Member States could derogate from the development risks defence and could impose an overall cap on liability for death or personal injury caused by identical items with the same defect, of not less than 70 million ECU.
- No contractual exclusion. Liability to the injured person could not be limited or excluded by contract.
In the United Kingdom the 1985 Directive was implemented by Part 1 of the Consumer Protection Act 1987 (CPA) in Great Britain and by the Consumer Protection (Northern Ireland) Order 1987.
The 1985 Directive was amended only once, by Directive 1999/34/EC. In the recitals to the new PLD, the EU legislature describes the 1985 Directive as an effective and important instrument, but one that needed revision because new technologies (including AI), circular economy business models and global supply chains had created inconsistencies and legal uncertainty, particularly about what counts as a "product”. The recitals also record that injured persons had found it hard to obtain compensation, owing to restrictions on claims and to the difficulty of gathering evidence in technically and scientifically complex cases.
4. The new PLD: key provisions
4.1 Scope and the definition of "product" (Articles 2 and 4)
A "product" now means all movables, even if integrated into, or inter-connected with, another movable or an immovable, and it expressly includes electricity, digital manufacturing files, raw materials and software.
- Software is a product irrespective of how it is supplied or used – whether stored on a device, accessed via a network or the cloud, or supplied as software-as-a-service. Developers and producers of software, including AI system providers under the AI Act, are treated as manufacturers. Information as such (for example the content of media files or e-books, or the mere source code of software) is not a product.
- Free and open-source software developed or supplied outside the course of a commercial activity is excluded. A manufacturer that integrates such software into a commercial product may still be liable for it.
- Digital manufacturing files – digital templates containing the functional information needed to produce a tangible item through automated control of machinery (for example 3D printers) – are products.
- Related services – digital services integrated into or inter-connected with a product such that their absence would prevent it performing one or more functions (for example traffic data for navigation, health monitoring, smart-fridge temperature control or voice assistants) – are treated as components where they are within the manufacturer's control. Internet access services are not related services.
- "Manufacturer's control" covers integration, inter-connection or supply of components (including software updates) that the manufacturer performs, authorises or consents to, and the manufacturer's ability to supply software updates or upgrades itself or via a third party.
4.2 Damage (Article 6)
Compensation is available to natural persons only, for:
- death or personal injury, including medically recognised damage to psychological health;
- damage to or destruction of property, except the defective product itself, a product damaged by a defective component integrated within the manufacturer's control, and property used exclusively for professional purposes (so mixed-use property is now covered);
- destruction or corruption of data not used for professional purposes, including the cost of recovering or restoring the data.
All material losses resulting from such damage are recoverable, and non-material losses (such as pain and suffering) are recoverable in so far as national law permits. The 500 ECU property threshold has gone and Member States may no longer set financial ceilings. Pure economic loss, privacy infringements and discrimination do not by themselves trigger liability under the Directive. Claims may also be brought by successors, subrogated insurers and persons acting on behalf of injured persons, including through representative actions.
4.3 Defectiveness (Article 7)
A product is defective where it does not provide the safety that a person is entitled to expect or that is required under Union or national law. The assessment is objective, by reference to the safety the public at large is entitled to expect. The non-exhaustive list of relevant circumstances is considerably longer than in 1985 and includes:
- presentation and characteristics (labelling, design, technical features, composition, packaging and instructions);
- reasonably foreseeable use (including misuse that is not unreasonable);
- the effect of any ability to continue to learn or acquire new features after placing on the market;
- the reasonably foreseeable effect of other products used with it, including by inter-connection;
- the moment the product was placed on the market or, where the manufacturer retains control, the moment it left the manufacturer's control;
- relevant product safety requirements, including safety-relevant cybersecurity requirements;
- any recall or other safety intervention by a competent authority or economic operator;
- the specific needs of the intended user group; and
- for products whose purpose is to prevent damage (such as a smoke alarm), any failure to fulfil that purpose.
A product is not defective merely because a better product, including an update or upgrade, is placed on the market. The recitals confirm that warnings cannot make an otherwise defective product safe, and that a court may find a product defective where it belongs to the same production series as a product already proven defective.
4.4 Who can be liable (Article 8)
Liability attaches to "economic operators" through a cascade designed to ensure there is always an EU-based defendant:
- the manufacturer of a defective product, and the manufacturer of a defective component integrated within the product manufacturer's control;
- where the manufacturer is established outside the EU: the importer and the manufacturer's authorised representative and, where neither is established in the EU, the fulfilment service provider (a business offering at least two of warehousing, packaging, addressing and dispatching without owning the product);
- any person who substantially modifies a product outside the manufacturer's control and then makes it available or puts it into service, who is treated as a manufacturer;
- distributors, where no EU-based economic operator can be identified and the distributor fails, within one month of a request, to identify one or its own supplier; and
- online platforms Online platforms. Online platforms are not automatically liable merely because they facilitate sales between traders and consumers. However, the Directive imports the approach developed in the Digital Services Act. Where a platform presents a product, or otherwise enables a transaction, in a manner that would lead an average consumer to believe that the product is supplied by the platform itself or by a trader acting under its authority or control, the platform may be treated in the same way as a distributor. In those circumstances, the platform can incur liability if it cannot identify a relevant EU-based economic operator in response to a request. This creates a potentially significant exposure for marketplace operators whose branding, presentation, fulfilment arrangements or customer-facing interfaces blur the distinction between the platform and the underlying seller. The practical focus is likely to fall on how the transaction appears to the average consumer rather than on the formal contractual allocation of responsibility.
4.5 Disclosure of evidence (Article 9)
Where a claimant has presented facts and evidence sufficient to support the plausibility of the claim, the court must be able to order the defendant to disclose relevant evidence at its disposal. The recitals indicate this can include documents that must be created afresh by compiling or classifying available evidence. Defendants have a reciprocal right to seek disclosure from claimants. Disclosure must be limited to what is necessary and proportionate, taking account of the legitimate interests of all parties, including confidentiality and trade secrets, and courts may order evidence to be presented in an easily accessible and easily understandable manner. National pre-trial disclosure rules are unaffected.
4.6 Burden of proof and presumptions (Article 10)
The claimant must still prove defectiveness, damage and causation. However:
- Defectiveness is presumed where the defendant fails to disclose relevant evidence under Article 9(1); where the product does not comply with mandatory product safety requirements intended to protect against the risk of the damage suffered; or where the damage was caused by an obvious malfunction during reasonably foreseeable use or under ordinary circumstances.
- Causation is presumed where the product is defective and the damage is of a kind typically consistent with the defect in question.
- Defectiveness, causation or both are presumed where, despite disclosure, the claimant faces excessive difficulties, in particular due to technical or scientific complexity, and demonstrates that defectiveness or causation is likely. The recitals give innovative medical devices, machine learning, and links between pharmaceutical or food products and health conditions as examples, and state that a claimant need only advance arguments demonstrating excessive difficulties and need not formally prove them.
- All presumptions are rebuttable by the defendant.
4.7 Exemptions from liability (Article 11)
The 1985 defences broadly survive, with important changes. Economic operators can escape liability if they prove, among other things, that they did not place the product on the market; that the defect probably did not exist at that time; that the defect is due to compliance with legal requirements (no longer limited to "mandatory" regulations); the development risks defence (now assessed by reference to the "objective" state of knowledge, which the recitals describe as the most advanced level of accessible knowledge); the component manufacturer's defence; or, for substantial modifiers, that the defect relates to a part of the product not affected by the modification.
Critically, under Article 11(2) the "defect arose later" defence is not available where the defect is due to a related service, software (including updates or upgrades), a lack of software updates or upgrades necessary to maintain safety, or a substantial modification – in each case provided it is within the manufacturer's control. The Directive does not itself impose an obligation to supply updates.
4.8 Multiple defendants, contribution and contracting out (Articles 12 to 15)
- Economic operators liable for the same damage are jointly and severally liable, subject to national rules on contribution and recourse.
- A manufacturer integrating software from a micro or small enterprise may contractually waive its right of recourse against that software supplier.
- Liability is not reduced by the acts or omissions of third parties (for example a hacker exploiting a vulnerability), but may be reduced for the injured person's own fault (for example negligently failing to install an update).
- Liability to the injured person cannot be limited or excluded by contract or by national law.
4.9 Limitation and expiry (Articles 16 and 17)
The three-year limitation period is retained, running from awareness of the damage, the defectiveness and the identity of the liable economic operator. The ten-year expiry period now runs from placing on the market or putting into service or, for a substantially modified product, from when it is made available again after the modification. Where an injured person could not start proceedings within ten years because of the latency of a personal injury, the expiry period is extended to 25 years.
4.10 Development risks derogation, transparency and review (Articles 18 to 20)
Member States may keep existing measures excluding the development risks defence (notifying them by 9 December 2026) or introduce new ones only if limited to specific product categories, justified by public interest objectives and proportionate, following notification to the Commission and a six-month standstill. Member States must publish final appellate and supreme court judgments under the Directive, and the Commission must maintain a public database of them. The Commission will evaluate the Directive by 9 December 2030, including the availability of product liability insurance.
5. What has changed: a side-by-side comparison
| Issue | 1985 Directive | New PLD (2024/2853) |
|---|---|---|
| Harmonisation | Partial; several Member State options. | Maximum harmonisation, save where expressly permitted. |
| Product | Movables and electricity; status of software unclear. | Adds software (including AI and SaaS), digital manufacturing files, raw materials and related services as components. |
| Liable persons | Producer, own-brander, importer; supplier as fallback. | Manufacturers, component and related-service providers, importers, authorised representatives, fulfilment service providers, substantial modifiers, distributors and online platforms. |
| Damage | Death, personal injury, private property above 500 ECU. | Adds medically recognised psychological harm and non-professional data loss; mixed-use property covered; no threshold. |
| Caps | Optional cap of at least 70 million ECU. | No caps permitted. |
| Defect test | Safety a person is entitled to expect; three listed factors. | Adds safety "required under Union or national law"; nine listed factors including learning, inter-connection, cybersecurity and recalls. |
| Evidence | Left to national procedural law. | Court-ordered disclosure on a plausibility threshold; rebuttable presumptions of defect and causation. |
| Relevant time | When the product was put into circulation. | Also when the product left the manufacturer's control; no "defect arose later" defence for software, updates or related services within control. |
| Development risks | Defence available; Member States may exclude it. | Defence retained on an objective standard; derogation only on conditions and notification. |
| Long-stop | 10 years, no exceptions. | 10 years, restarting on substantial modification; 25 years for latent personal injury. |
6. Assessment: the likely impact
Taken together, the changes make claims easier to bring and harder to defend. Defendants should plan for disclosure applications at an earlier stage of proceedings, larger legal and expert budgets, and a stronger incentive to settle where the cost of defending a claim approaches its value. Claimants will also have more potential defendants to choose from, which is likely to prompt contribution disputes between businesses in the same supply chain. The Directive expressly leaves representative actions under Directive (EU) 2020/1828 and national collective redress schemes unaffected, so group claims are a realistic prospect, particularly where third-party funding is readily available.
With no minimum threshold for property damage, even small losses can now be claimed, and these become commercially significant when many similar claims are pursued together. Because Member States can no longer impose a ceiling on liability, a single design or software fault reproduced across a large installed base could give rise to very substantial aggregate exposure.
The greatest change affects businesses whose products contain or consist of code. The Directive treats software as a product whatever the delivery model. It lists safety-relevant cybersecurity requirements among the factors relevant to defect, and it removes the “defect arose later” defence where the defect results from software, a related service or a missing safety update within the manufacturer’s control. Because Article 7 refers to the safety “required under Union or national law” and Article 10(2)(b) presumes defect where the product does not comply with mandatory product safety requirements (intended to protect against the risk of the damage suffered), a breach of EU product safety legislation (including digital and sector-specific rules) is likely to become a central issue in litigation.
Importers, authorised representatives, fulfilment service providers, distributors and online platforms now sit within the liability cascade in Article 8. For distributors and qualifying platforms, liability is secondary: it arises only if they cannot, within one month of a request, identify an EU-based economic operator or their own supplier. Accurate supply-chain records are therefore their first line of defence. Businesses that may be primarily liable, such as fulfilment service providers acting for non-EU sellers, should review their insurance and contractual protections.
Several features of the Directive extend the period during which a claim can arise: the 25-year expiry period for latent personal injury, a fresh expiry period following a substantial modification, and continuing responsibility while a product remains within the manufacturer’s control. Technical documentation will need to be kept for correspondingly long periods. The longer the gap between supply and claim, the harder it becomes for either side to reconstruct the product’s condition, which may in practice increase reliance on the Article 10 presumptions.
The new heads of damage (psychological harm and loss of non-professional data), the wider range of defendants, the absence of caps and the longer expiry periods all bear on insurance. Policies written with the 1985 regime in mind may not clearly respond to claims about software or data, and exclusions in liability and cyber policies may overlap or leave gaps. Notably, Article 20 requires the Commission’s evaluation of the Directive to address the availability of product liability insurance.
Article 3 requires Member States not to depart from the Directive’s level of protection, but significant matters remain for national law. These include compensation for non-material loss, suspension and interruption of limitation, rights of contribution, and the procedural matters that recital 43 leaves outside the Directive (pre-trial procedure, how specific a disclosure request must be, third parties, declaratory actions and sanctions). Development-risk derogations under Article 18 may also differ. Outcomes may therefore vary depending on where a claim is brought.
As a Directive, the new PLD has to be implemented through each Member State's own law rather than applying directly, so claimants will generally be able to rely on its rules in a given country only once that country has transposed it. Although every Member State must do so by 9 December 2026, transposition in practice may happen at quite different times, which could leave an uneven picture across the EU for some time
The new PLD applies to UK businesses supplying products into EU Member State markets. In Great Britain, the CPA continues to reflect the 1985 Directive and there is no obligation to adopt the new regime. Northern Ireland, however, applies the new PLD under the Windsor Framework to products placed on the Northern Ireland market or put into service on or after 9 December 2026, so two parallel regimes will operate within the UK.
The Law Commission of England and Wales is reviewing Part 1 of the CPA, with a particular focus on digital products and AI. Its terms of reference include the definitions of product, defect and producer, the range of liable economic operators, the long-stop, the development risks defence, the burden on claimants and whether damage should extend to data.
In a position paper published on 8 October 2026 the Law Commission revealed extensive proposals for far reaching changes to the law. These borrow heavily from the new PLD, with limited divergence, and are broadly favourable to claimant interests. A consultation period will follow. Final recommendations to the Government on a new law are unlikely to be made until late 2027.
7. Areas of interpretive uncertainty
Many of the new concepts are undefined or loosely defined, and their meaning will be settled only through national case law and, ultimately, references to the Court of Justice of the European Union. The Commission database of appellate judgments will help, but consistency across 27 Member States will take years. Key areas to watch include the following.
8. Practical preparatory steps for businesses
With the application date imminent, businesses placing products on the EU (or Northern Ireland) market should consider the following.
9. Concluding remarks
Directive (EU) 2024/2853 replaces a regime that has applied, largely unchanged, since 1985. It brings software and digital services within strict liability, extends the period of exposure and gives claimants new procedural tools. Much of its practical effect will depend on national implementing laws and early court decisions. Businesses that review their products, records, contracts and insurance before the regime applies will be in a stronger position.
This guide is a general summary for information purposes only, reflects the position as at October 2026 and does not constitute legal advice. Specific advice should be sought on particular circumstances and on the law of each relevant Member State.
EU Product Liability Directive
The EU is reforming product liability and safety rules to address emerging technologies, digital products, AI, software, connected devices, evolving supply chains and consumer expectations.