Product Liability Directive: AI software developers' and producers' liability

Almost 40 years after adopting Directive 85/374/EEC on product liability, on 12 March the European Parliament approved the new directive aimed at updating the discipline in the light of developments linked to new technologies, in particular AI.

The Product Liability Directive (PLD) is part of the package of European measures aimed at supporting the promotion of AI. If the AI Act contains rules aimed at reducing safety risks and protecting fundamental rights, the Directive regulating liability in the event of damage is the other side of the coin, since safety and liability apply at different times and reinforce each other.

To meet the needs dictated by the technical and scientific complexity of products in the digital age, the Directive establishes a simplified system that provides the injured party with more appropriate means to obtain compensation for damage caused by defective products.

 

Software as a “product” and the developer as a “producer”

The Directive defines products as software – such as operating systems, firmware, computer programs, applications and AI systems – regardless of how they're delivered or used. They can be embedded in a device, used via a communication network or cloud technologies, or delivered through a software-as-a-service model.

But information cannot be considered as a product, so the liability rules don't apply to the content of digital files (such as multimedia files, e-books or software source codes). In any case, free and open source software is excluded from the scope of the Directive to promote research and innovation in the European market and because, by definition, software that's not developed or made available as part of a commercial activity is not placed on the market. On the other hand, where software is provided for remuneration or personal data is used in the course of a commercial activity, the Directive applies.

In view of the fact that digital services can be integrated into or connected to products, strict liability also applies to related services.

The Directive specifies that software producers or developers, including AI system providers, are to be considered as the manufacturer. They could also be liable for updates, improvements or machine learning algorithms, as digital technologies such as AI allow manufacturers and developers to exercise control over products even after they've been placed on the market or put into service.

 

Intangible damage

The grounds for compensation also include destruction or corruption of data, duly distinguished from data leakage or breaches of protection rules (so a person isn't precluded from obtaining compensation for damage resulting from a breach of the GDPR on the side of damage resulting from defective products, if the grounds exist). Personal injury also includes medically recognised and certified psychological damage and non-material damage, such as pain and suffering.

 

Defectiveness of a product

The defectiveness of a product must be determined based on a number of factors. They include the lack of safety of the product which the public may reasonably expect with regard to its reasonably foreseeable use, the presentation of the product, its objective characteristics and its properties. For AI, the ability of systems to continue to learn and acquire new characteristics even after they've been placed on the market or put into service and the effect this could have on safety is also relevant.

 

Simplifying the burden of proof

The Directive provides for a lightening of the burden of proof in favour of the plaintiff. It recognises the clear disadvantage of an injured person seeking compensation compared to the producer in terms of obtaining and understanding information on how products are manufactured and how they work.

As regards the proof of damage, the defect of the product and the causal link between the defect and the damage, the Directive provides for a rebuttable presumption to reduce the plaintiff's burden of proof. Defectiveness should be presumed where the defendant (who could be the AI system developer) fails to comply with the obligation to disclose the relevant information; where there is an obvious malfunction during a reasonably foreseeable use of the product; where the plaintiff finds it excessively complicated to prove the defect, particularly in view of the complex nature of the technology used (the plaintiff, for example, would not have to explain the inner workings of an AI system). The plaintiff would have the burden of proving the existence of the excessive difficulty, but not to the extent of producing evidence in this regard: for example, they wouldn't have to explain the characteristics of the AI system or how its characteristics make it difficult to prove causation.

 

Supporting the innovative capacity of micro-enterprises

The Directive pays particular attention to the innovative capacity of micro and small software companies. To support and not discourage this capacity, it's possible for these companies to contractually agree with manufacturers who integrate their software into a product that the manufacturers themselves will not exercise their right of recourse in the event of damage caused by a defective component. The rationale behind this provision is that the manufacturer of the product as a whole is liable for defects in the product that affect the components.

 

The extended liability period

As a result of scientific and technological progress, products are subject to increasingly sudden and elusive changes, but it would be unreasonable to make manufacturers liable for product defects for an unlimited period. The duration of liability is set at ten years from the date of placing the product on the market, without prejudice to any pending legal action that the injured party may have brought against the producer. However, so as not to exclude the possibility of compensation for damage caused by a defective product whose effects manifest themselves over a longer period of time, the liability period is extended to 25 years in cases where medical evidence indicates that the symptoms of personal injury manifested themselves at a later stage.