EU Product Liability Directive: what it means for software-driven robots

Directive (EU) 2024/2853 treats software, including AI systems, as a product. A robot maker can therefore be held liable without fault when code, an update or a missing safety patch makes a humanoid or robot dog unsafe. The rules apply to products placed on the EU market from 9 December 2026, and they make it easier for an injured visitor to prove a defect.

Why this matters now

The new Product Liability Directive replaces Directive 85/374/EEC, which has governed defective products in the EU since 1985. According to the European Commission's page on liability for defective products, the new directive entered into force on 8 December 2024 and applies to products placed on the market as of 9 December 2026. Member states must bring it into national law by the same date.

That deadline is now close, and national laws are arriving. Germany's Federal Ministry of Justice lists its law modernising product liability as promulgated, and the Federal Law Gazette shows it was published on 27 October 2026 as BGBl. 2026 I Nr. 321. Other member states are at different stages.

The change is practical for anyone who brings robots into crowded halls: humanoids and robot dogs depend heavily on software, sensors and cloud connections, and they keep changing after they are sold.

Software is now a product in its own right

The final text adopted by the European Parliament and the Council (PE-CONS 7/24) defines a product as any movable item, even when it is built into or connected to something else, and states expressly that this includes software. The Commission adds that all types of software are covered, including applications, operating systems and AI systems.

Two further definitions matter for robots:

• A component can be tangible or intangible, so a navigation module, a speech model or a control app can be a component of a robot.
• A related service is a digital service without which the product could not perform one of its functions, such as a cloud service a robot needs to navigate or answer questions.

There is one notable exclusion. Free and open-source software that is developed or supplied outside a commercial activity falls outside the directive. However, a manufacturer's liability also covers damage caused by a defective component integrated into its product under its control, so the maker of a commercial robot still answers for the finished machine.

When is a robot defective?

Under Article 7, a product is defective when it does not provide the safety a person is entitled to expect, or the safety required by EU or national law. Courts must weigh all the circumstances. Several of the listed factors read as if they were written with modern robots in mind:

• the effect of any ability to keep learning or to acquire new features after the product was placed on the market;
• the reasonably foreseeable effect of other products used together with it, including through inter-connection;
• relevant product safety requirements, including safety-relevant cybersecurity requirements;
• reasonably foreseeable use, and the specific needs of the users the product is intended for.

A product is not defective simply because a better version or a newer update appears later.

The mandatory safety requirements come from other legislation, such as the machinery rules covered in our article on the EU Machinery Regulation 2027 and the obligations set out in our EU AI Act timeline for robots. A breach of such a requirement can trigger a presumption of defect.

Updates after sale: liability does not end at delivery

The new text introduces the idea of manufacturer's control. A manufacturer is in control when it carries out, authorises or consents to the integration of components, including software updates or upgrades, or to modifications of the product. It is also in control when it is able to supply updates itself or through a third party.

This matters in two ways. First, where the manufacturer keeps control after sale, defectiveness can be assessed at the moment the product left that control, not only at the moment of sale. Second, a manufacturer normally escapes liability by proving that the defect probably did not exist when the product was placed on the market. Article 11(2) removes that defence where the defect is due to a related service, to software including updates or upgrades, to a lack of updates or upgrades needed to maintain safety, or to a substantial modification, in each case where this is within the manufacturer's control.

In plain terms: if a robot maker pushes an update that makes a robot dog misjudge a step, or fails to supply a safety patch it could have supplied, it cannot simply argue that the robot was fine on the day it was sold.

The development risk defence survives. A manufacturer can still escape liability by proving that the objective state of scientific and technical knowledge, when the product was placed on the market or while it was under the manufacturer's control, did not allow the defect to be discovered. Member states may, under conditions, remove this defence nationally.

Easier proof for injured people

The injured person still has to prove the defect, the damage and the causal link between them. What changes is how they can do it.

1. Disclosure of evidence. If a claimant makes the claim plausible, a court can order the defendant to disclose relevant evidence, limited to what is necessary and proportionate, with trade secrets protected. Defendants can make a similar request.
2. Presumption of defect. A court presumes the product was defective if the defendant fails to disclose relevant evidence, if the claimant shows a breach of mandatory safety requirements intended to protect against the harm suffered, or if the damage was caused by an obvious malfunction during reasonably foreseeable use or ordinary circumstances.
3. Presumption of causation. Once a defect is established and the damage is of a kind typically consistent with that defect, the causal link is presumed.
4. Complex cases. Where technical or scientific complexity makes proof excessively difficult, a court presumes defect, causation or both if the claimant shows that they are likely.

The defendant can rebut every one of these presumptions. The complexity rule is likely to matter in AI and robotics cases, where explaining why a learning system acted as it did can be hard even for its developers.

Who pays when a robot injures a visitor

Any natural person who suffers damage from a defective product can claim, and the Commission confirms that this includes bystanders and family members, not only buyers.

Compensable damage covers death or personal injury, including medically recognised damage to psychological health; damage to property, except the defective product itself and property used exclusively for professional purposes; and the destruction or corruption of data not used for professional purposes.

The directive names the liable parties:

• the manufacturer of the robot, and the manufacturer of a defective component integrated under its control;
• for manufacturers outside the EU, also the importer and the authorised representative, and the fulfilment service provider where neither exists;
• a distributor, if no EU-based operator can be identified and the distributor does not name one, or its own supplier, within one month of being asked.

Anyone who substantially modifies a robot outside the manufacturer's control and then makes it available or puts it into service is treated as a manufacturer. Broadly, that means unforeseen changes to performance, purpose or type that create a new hazard or raise the risk. The directive gives no robot-specific examples, so where the line falls for custom programming and choreography will be settled case by case.

Where several operators are liable, they are liable jointly and severally, and their liability towards the injured person cannot be limited or excluded by contract. Liability may be reduced if the injured person was at fault.

Claims must be brought within three years of the injured person becoming aware of the damage, the defect and the liable operator. The right to compensation expires ten years after the product was placed on the market, or 25 years where a latent personal injury prevented earlier proceedings.

What the directive does not change

• Older robots stay under the old rules. Directive 85/374/EEC continues to apply to products placed on the market or put into service before the new rules start. A robot that joined a supplier's fleet in 2025 stays under the old regime.
• Other liability routes remain. Claims based on contract or on fault, such as negligent operation or poor crowd management, are not affected.
• Only individuals claim. The directive covers damage suffered by natural persons. Damage to property used exclusively for professional purposes, such as an exhibitor's stand equipment, falls outside it.

This article is general information, not legal advice. The exact position depends on the national law that applies and on the facts of an incident.

What this means for event organisers

• Ask suppliers who the EU-based manufacturer, importer or authorised representative of each robot is, and whether the unit was placed on the EU market before or after 9 December 2026.
• Agree which software version will run on the day, who approved recent updates and whether safety-relevant patches are current.
• Keep logs, video and incident records. Under the new disclosure rules, they can become evidence for either side.
• Product liability sits alongside fault-based claims, which the directive leaves untouched. Check your own cover with our guide to insurance and liability for robot hire.
• Liability rules compensate after harm; they do not prevent it. Plan barriers, staffing and visitor flow with our guide to robot safety at public events.

Frequently asked questions

Does the new Product Liability Directive apply to robots already in use?

Not directly. The directive applies to products placed on the market or put into service after 9 December 2026. Robots that entered the EU market before that date remain covered by the 1985 directive as implemented in national law. In both cases, contract and fault-based claims under national law are unaffected, so an incident with an older robot can still lead to claims against the parties involved.

Is AI software itself covered, or only the robot hardware?

Both. The directive defines software as a product, and the European Commission states that applications, operating systems and AI systems are covered. Software can also be a component of a robot, so a defective control or navigation program can make the whole robot defective. Free and open-source software that is developed or supplied outside a commercial activity is excluded from the directive.

Can a rental contract exclude product liability towards an injured visitor?

No. Under the directive, the liability of an economic operator towards the injured person cannot be limited or excluded by a contractual provision or by national law. Businesses that are liable for the same damage can pursue each other under national law after compensating the injured person. Organisers should take legal advice on how their own contracts interact with the national rules that apply.

Who is liable if a robot made outside the EU injures someone?

The manufacturer remains liable, but the directive also makes the importer and the manufacturer's authorised representative liable, and the fulfilment service provider where neither exists. If no EU-based operator can be identified, a distributor becomes liable unless it names a responsible operator or its own supplier within one month of the injured person's request.

How this article was made: written by the humanoid4rent editorial team with AI assistance; every factual statement was checked against the sources listed below on 2026-10-31. Spotted an error? Write to info@humanoid4rent.com.