The AI Liability Directive was withdrawn: what protects you and what does not in the EU
The EU was going to have a specific rule for claiming damages caused by AI. It was withdrawn. That does not leave companies without risk: the new Product Liability Directive remains, which includes software and AI, along with national liability rules.
What it was and what happened
In 2022 the Commission proposed an AI Liability Directive to make it easier for a victim of AI-caused harm to claim, with rules on access to evidence and presumptions. In its 2025 work programme (COM(2025) 45), the Commission announced it was withdrawing it, and the withdrawal was published in the Official Journal dated October 6, 2025. Parliament’s internal market committee had called the proposal “premature and unnecessary” at that stage.
What it does not mean
It does not mean there is no liability. It means there will be no specific EU rule on fault-based liability for AI: those cases are decided under each country’s civil law. Product liability still exists, and it has just been renewed.
The new Product Liability Directive (EU) 2024/2853
- Dates: it entered into force on December 8, 2024; Member States must transpose it before December 9, 2026 and it applies to products placed on the market from that date.
- Software and AI are “products”. They are expressly included, so a defective AI system can give rise to liability even though it is not a physical object.
- Liability without proving fault: it is enough to show the defect, the damage and the link between them.
- Access to evidence and presumptions: a court can order the manufacturer to disclose technical documentation and, if it refuses, presume the defect. In highly complex cases, such as AI cases, defect or causation can be presumed.
- Long periods: 3 years from when the damage is known, 10 years from placing on the market and up to 25 years for latent injuries.
- After the sale: a product can be defective for lack of updates or security if those are within the manufacturer’s control.
What else can apply
- National damages law: fault-based and contractual liability.
- GDPR (Art. 82): compensation for damage caused by unlawful processing of personal data.
- AI Act: it does not create a right to compensation, but having the documentation, oversight and logs it requires is your best proof of diligence.
What to do in practice
- Document each system: purpose, data, testing, versions and changes. It is the evidence a court could ask you for.
- Control updates and security while the product is on the market.
- Review supplier contracts: who answers if the defect comes from the model or a third-party component.
- Keep records and evidence for as long as your exposure lasts (it can be up to 10 years).
- Talk to your insurer: ask whether your policy covers harm caused by AI.
Frequently asked questions
Can I be liable for harm my AI causes?
Yes. If the AI is part of a product or service, product liability and national damages law can apply.
Who is liable if I use a supplier’s AI?
It depends on the case and the contract. That is why you should agree responsibilities and warranties clearly with the supplier.
Does the withdrawal change my AI Act obligations?
No. The AI Act keeps its timeline; the withdrawal only affects the route for claiming damages.
Informational content, not legal advice. AI regulation changes quickly: always check the current official text before deciding. Information reviewed as of October 14, 2026.
This gives you the overview. If you want the finished document: AI Systems Registry Template.
What's your Data Governance maturity?
Free assessment with your priority gaps, plus the self-assessment quiz and savings calculator on the Data Governance path.