Artificial intelligence and liability: Key takeaways from recent EU legislative initiatives

The Revised PLD

The Revised PLD was adopted by the European Parliament in March 2024 and is awaiting approval by the European Council. There are several major amendments to the PLD proposed as part of the Revised PLD that are designed to ensure that the underlying regime can respond to the specific features of AI systems as a consumer product.

Definition of “product”

This will include software, which includes AI systems. However, free and open-source software that is developed or supplied outside the course of commercial activity is expressly excluded in an effort to avoid hampering innovation or research. However, manufacturers that integrate free and open-source software into their products may be potentially liable for any defects that arise as a result. Such integration will therefore need to be carefully considered and managed.

Definition of “defect”

The concept of defect now encompasses the “effect on the product of its ability to continue to learn or acquire new features after is has been placed on the market or put into service”. 

This means that an AI systems’ ability to self-learn and acquire new features will be relevant to considering if an AI system is defective, and the recitals to the Revised PLD specifically state that consumers can expect AI systems to be designed so as to prevent hazardous product behaviour. Accordingly, manufacturers that design a product that develops unexpected behaviours will remain liable in the event that such behaviour causes harm.  

Additionally: 

• A product’s ability to comply with cybersecurity requirements and/or any cybersecurity vulnerability it may have will be relevant to the assessment of defectiveness. 
• A recital to the Revised PLD states that manufacturers should be liable for damage caused where the defect arises as a result of failures to supply software and/or security updates or upgrades in response to evolving cybersecurity risks. 
• Where third parties exploit cybersecurity vulnerabilities, the liability of the manufacturer will not be reduced or disallowed (unless the consumer has failed to take steps to maintain cybersecurity, such as to install updates).

It is important to note that a product will not be considered defective simply because a better product, including updates or upgrades, has since been put into service. 

Defendant’s disclosure obligation 

Where an injured party has presented facts and evidence to support the “plausibility of the claim for compensation”, the Revised PLD places an obligation on the manufacturer to disclose information that is relevant to the claim. This is intended to assist claimants in proving claims that involve technically complex products, such as AI systems.

However, the Revised PLD incorporates a corresponding obligation for claimants to disclose relevant evidence where a defendant demonstrates it is required for the purposes of making a counterclaim.

Presumption of defectiveness and causation

To further assist claimants in proving a defect in products that are technically complex and inherently difficult to understand without specialist knowledge, the Revised PLD imposes a presumption of defectiveness where any of the following conditions is met:

• The defendant fails to comply with its obligation to disclose relevant evidence (as set out above).
• The product does not comply with mandatory safety requirements intended to protect against the risk of damage that has been suffered by the claimant.
• It is demonstrated that the damage has been caused by an obvious malfunction of the product during reasonably foreseeable use or under ordinary circumstances.

In respect of causation, where defectiveness has been established and the damage caused is typically consistent with the defect in question, a causal link between defect and damage will be presumed.

Finally, where a claimant can demonstrate that it is likely that the product is defective and/or that a causal link between the defect and the damage exists but it faces excessive difficulties in proving either of those things because of technical or scientific complexity, then a court shall presume either defectiveness or causation, or both. 

Exemptions from liability

The Revised PLD includes certain specific exemptions from liability, one of which is where a defect in a product did not exist at the time it was placed on the market. 

However, that exemption will not apply where it relates to digital services integrated into a product, software (including upgrades or updates), a lack of software required to maintain safety, or a substantial modification of the product. 

This means that manufacturers or providers of AI systems will remain liable for defects arising after the system is placed on the market where that defect arises as a result of:

• A software upgrade that it has retained responsibility for providing.
• An AI system’s ability to continuously learn. 

These outcomes are linked to the expanded definition of defect (discussed above).

The AILD

The AILD adopts many of the definitions contained in the AI Act and relates to non-contractual fault-based claims for damage caused by:

• The output of an AI system; or 
• The failure of an AI system to produce an output. 

Disclosure of evidence and presumption of non-compliance

A provider, a person subject to the obligations of a provider, or a user (as defined in the AI Act) can be ordered to disclose evidence in relation to a specific “high-risk AI system” that is suspected of having caused damage where a claimant has asked for such evidence but it has not been provided.  For a discussion of the meaning of high-risk AI systems under the AI Act, see our AI Act overview.

However, a claimant must be able to prove the plausibility of the claim before the order for disclosure will be made. A defendant has the right to rebut the presumption.

Presumption of causation

• The claimant has demonstrated that the defendant is at fault (i.e. it failed to comply with a duty of care to protect against the damage that has occurred) or that fault has been presumed (as set out above).
• It can be considered reasonably likely that the fault has influenced the AI system’s output or failure to produce an output.
• The claimant has demonstrated that the AI system’s output or failure to produce an output gave rise to the damage. 

However, the above presumption will only apply in relation to non-high-risk AI systems (for the meaning of such systems, see our  AI Act overview) where it is considered excessively difficult for the claimant to prove a causal link.  

In respect of high-risk AI systems, the presumption will not apply where sufficient evidence and expertise is reasonably accessible for the claimant to prove the causal link itself. 

In summary, the AILD appears to be designed to assist claimants in overcoming some of the technical complexities that could make establishing non-contractual fault-based claims in respect of AI systems more difficult. However it has recently been subject to the criticism that its introduction may result in “over-regulation”. As set out above, a decision as to its future will be taken following a review of the of the proposed directive by the European Parliamentary Research Service. 

What next?

The ability of AI systems to self-learn and develop means that the concept of defect and fault will now extend beyond the point at which the product is placed on the market and is not within the direct control of the manufacturer or supplier.  This means businesses will have to engage with the nuances of the new liability regime and be prepared to both explain and defend the technical complexities of all AI products they place on the market.

It is also clear from the various presumptions included in both the Revised PLD and AILD that the European Commission is keen to ensure that claimants are not unfairly disadvantaged by the sophistication of AI technology and the large knowledge gap that will exist between economic operators involved in the supply of AI systems and end-users. The presumptions and obligations of disclosure therefore seek to level the playing field in relation to compensation claims for defective AI systems.

It is important that:

• Businesses involved in the manufacture and supply of AI systems in any capacity identify if there are areas of potential liability under either the Revised PLD and/or the AILD. 
• Compliance systems are implemented to mitigate the risks of liability.
• Businesses ensure that, where potential liability does arise, they can gather relevant information and evidence quickly to help defend against any claim(s) brought against them.

Want more information?

For more information on:

• AI in general, see our portal, Artificial intelligence
• The EU AI Act, see our article, Artificial Intelligence Regulation
• The regulation of technology, see our portal, Tech Regulation 
• Background on the Revised PLD and AILD, see our article, European commission considers new civil liability rules for the digital age and artificial intelligence