Software becomes a product: the new product liability rules for AI from 9 December 2026

From 9 December 2026 software is a product. That includes an AI system, an app and an AI agent, regardless of whether the software is downloaded, embedded in a device or run as a cloud service. Strict liability for defective products, which EU member states have applied since the 1985 directive, then extends to software. The manufacturer is liable for damage a defect causes to natural persons, without the injured person having to show that the manufacturer was at fault.

The new rules come from Directive (EU) 2024/2853 and apply to products placed on the market or put into service on or after 9 December 2026. Member states must transpose the directive by that date. The Netherlands does so through the Implementation Act for the revised Product Liability Directive (parliamentary file 36906). The House of Representatives adopted it on 15 October 2026 as a formality item, the Senate on 10 November 2026. The date of entry into force will be set by royal decree. The rules will sit in the existing product liability section of Book 6 of the Dutch Civil Code, from Article 6:185.

For anyone building, selling or embedding AI agents, this is the most important liability change in years. The European AI Liability Directive has been withdrawn and the AI Act itself contains no rules on compensation. That makes this directive the only European strict liability regime that expressly covers AI. National liability law and, for damage from processing personal data, Article 82 GDPR continue to apply alongside it.

What changes

Software and AI as a product

The directive reads the concept of software broadly. According to the Dutch explanatory memorandum, it covers operating systems, firmware, computer programs, applications and AI systems, regardless of how they are supplied or used. An AI agent offered as a cloud service is as much a product as a smart thermostat.

Two exceptions matter. Free and open-source software developed or supplied outside a commercial activity is excluded. Services as such are not covered either, but a digital service so connected to a product that the product cannot perform a function without it counts as a component. The memorandum gives the example of a voice assistant used to control devices.

When is AI defective?

The core of the test stays: a product is defective if it does not provide the safety a person is entitled to expect or that is required under Union or national law. What is new is that the court must expressly take into account the product's ability to continue to learn or acquire new features after it is placed on the market, the reasonably foreseeable effect of other products used together with it, and relevant safety requirements, including cybersecurity requirements. For AI agents, which by definition work with other systems and adapt their behaviour, those are exactly the points that matter.

Updates and self-learning systems: the manufacturer stays responsible

Under the old rules a producer could argue that the defect did not exist when the product was put into circulation. For software that no longer works while the manufacturer retains control over the product, which is the case if it can supply updates or upgrades itself or through someone else. If the defect is due to software, an update, a related service or the lack of an update needed to maintain safety, the manufacturer remains liable, even if the defect arose after the sale.

On top of that, anyone who substantially modifies a product outside the original manufacturer's control and then makes it available or puts it into service becomes a manufacturer. And according to the explanatory memorandum, a product substantially modified by an update or by the continuous learning of an AI system is treated as placed on the market at the moment of that modification. On our reading, a system launched before 9 December 2026 can therefore still fall under the new rules after that date.

Who is liable in the AI value chain?

The directive uses a tiered system. The injured person first turns to the manufacturer, of the end product or of the defective component. An organisation that integrates an AI model as a component into its own agent and markets that agent under its own name is the manufacturer of the end product. The provider of the underlying model can be liable as the manufacturer of a component. If the manufacturer is outside the EU, the importer or the authorised representative can be held liable, and failing them the fulfilment service provider. Only if none of them can be identified does the distributor come into the picture, and it escapes liability if it names another liable operator or its own supplier within one month.

Several liable parties are jointly and severally liable and can seek recourse against each other. That recourse can be arranged by contract. The directive itself contains one exception: a manufacturer that integrates software from a micro or small enterprise as a component can agree to waive recourse against that small supplier. Towards the injured person, liability cannot be excluded or limited by contract.

Evidence: disclosure and presumptions

This is the part that hits AI hardest. An injured person who presents facts and evidence sufficient to support the plausibility of the claim can ask the court to order the defendant to disclose relevant evidence. A defendant who refuses faces a presumption of defectiveness. A product is also presumed defective if it does not comply with mandatory product safety requirements intended to protect against the risk of the damage suffered, or if the damage was caused by an obvious malfunction during reasonably foreseeable use or under ordinary circumstances. Once the defect is established and the damage is of a kind typically consistent with it, causation is presumed.

For technically complex cases the directive goes further. If the injured person, despite the disclosure of evidence, faces excessive difficulty proving the defect, causation or both, for instance because nobody outside can see how a model arrived at an action, it is enough to show that the defect or the causal link is likely. The defendant can rebut every presumption, but only with its own evidence. Logging and documentation thus become the manufacturer's defence.

What does not change

The development risk defence remains: the manufacturer is not liable if the objective state of scientific and technical knowledge did not allow the defect to be discovered when the product was placed on the market, or during the period it was within the manufacturer's control. For software, which stays under control through updates, that moment moves along. The Netherlands is not using the option to derogate from it. The rules protect natural persons; damage to property used exclusively for professional purposes is excluded. And the directive leaves claims on other grounds untouched, such as breach of contract and tort. How courts have dealt with AI on those grounds so far is set out in our overview of the case law on AI agent liability.

How it relates to the EU AI Act

The AI Act and product liability interact without replacing each other. The AI Act sets requirements in advance and allocates duties between providers and deployers; product liability governs compensation afterwards. The link is in the evidence: non-compliance with mandatory product safety requirements that protect against the risk of the damage suffered leads to a presumption of defectiveness. For high-risk AI, whose core obligations for Annex III systems apply from 2 December 2027, it is to be expected that the AI Act's requirements will weigh in that assessment. The transparency duties of Article 50 have applied since 2 August 2026.

What to arrange before 9 December

All our pieces on AI agents and responsibility are on the agentic AI governance theme page. If you want your AI contracts reviewed for liability and recourse, you can request a signed assessment.