The Directive widens the definition of a product to take in software, updates, AI systems and digital manufacturing files, and spreads liability across the manufacturer, the importer, the EU authorised representative and, in defined cases, online platforms. A court may order a defendant to disclose evidence, and non-compliance triggers a presumption of defect. Recoverable damage now includes psychological harm and the loss of non-professional data. Where personal injury is latent, the limitation period extends to 25 years.
Software and AI systems
Standalone and embedded software, updates and AI systems now count as products, as do digital manufacturing files.
EU importers and representatives
Importers, EU authorised representatives and, in defined cases, fulfilment service providers carry strict liability.
Turkish manufacturers
A manufacturer outside the EU remains the manufacturer; claims land on the EU link and return through the supply contract.
- 01Keep a disclosure-ready technical file at all times; ignoring a disclosure order triggers a presumption of defect.
- 02Deliver security updates across the product’s expected lifetime; a missing safety update can itself amount to a defect.
- 03Reopen supply contracts before 09.12.2026; importers and authorised representatives now demand back-to-back indemnities.
- 04Align records and insurance with the 25-year tail, covering psychological harm and the loss of non-professional data.
Overview
Directive (EU) 2024/2853 replaces the forty-year-old regime of Council Directive 85/374/EEC. Adopted 23.10.2024 and published in the Official Journal 18.11.2024, it entered into force on 08.12.2024. Member States must transpose it by 09.12.2026 (Art. 22), when 85/374/EEC is repealed (Art. 21).
On artificial intelligence the position is settled: the proposed AI Liability Directive (COM(2022) 496) was withdrawn — decided 16.07.2025, notified in the Official Journal 06.10.2025. There is no dedicated EU liability regime for AI; such harm runs through this Directive, which treats AI systems as products, and through national tort law.
Scope and thresholds
No turnover or size threshold applies; what matters is placement on the EU market. “Product” now expressly covers software — standalone, embedded and AI systems alike — digital manufacturing files, electricity and raw materials (Art. 4). Integrated digital services count where essential to the product’s functions; open-source software supplied outside a commercial activity is excluded (Art. 2(2)).
Failing to supply safety-critical updates can itself render a product defective where that stays within the manufacturer’s control; a substantial modification outside it makes the modifier liable as a manufacturer.
The critical point for Turkish exporters
The new regime applies only to products placed on the market after 09.12.2026 (Art. 2(1)); anything placed before that date stays under 85/374/EEC, so the two regimes run side by side for years. But a substantial modification or update after that date pulls a legacy product into the new regime — making your update policy for the installed base a liability decision.
Key obligations
The liability cascade in Art. 8 is the crux: it reaches the manufacturer, the maker of a defective component, the importer, the EU authorised representative and, where none can be identified in the Union, the fulfilment service provider. A distributor that fails to name the relevant operator within one month of a request becomes liable itself, as do online platforms that present a product as their own or withhold supplier details beyond a month.
Where a claimant presents facts supporting the plausibility of a claim, the court may order the defendant to disclose relevant evidence (Art. 9), limited to what is necessary and proportionate, with trade secret safeguards.
Liability, proof and limitation
Recoverable damage is wider (Art. 6): death and personal injury, including medically recognised damage to psychological health; property damage, excluding the product itself and property used exclusively for professional purposes; and the destruction or corruption of data not used professionally. Pure economic loss, privacy infringements and discrimination stay outside.
Presumptions shift the burden (Art. 10): defectiveness is presumed where the defendant ignores a disclosure order, where the product breaches mandatory product safety requirements protecting against the risk that materialised, or where damage arose from an obvious malfunction in foreseeable use. Causation is presumed where the damage is typically consistent with the defect; where complexity makes proof excessively difficult the court may presume either on a showing it is likely. All are rebuttable.
The defences have not been swept away: the development risk defence survives (Art. 11(1)(e)). What closes is the separate defence that the defect did not exist on placing — unavailable where the defectiveness is due to a related service, software or its updates, a missing safety update, or a substantial modification within the manufacturer’s control (Art. 11(2)). Limitation runs three years from knowledge of the damage, defect and liable operator, with a ten-year longstop from placing on the market — extended to twenty-five years for latent personal injury (Arts. 16–17).
What this means for Turkish companies
A Turkish manufacturer with no EU establishment is still the “manufacturer”, but claimants sue the EU-based link — the importer or authorised representative — who then turns to it under the supply contract. The first effect is therefore not litigation but the negotiating table: those operators carry strict liability and are pushing back-to-back indemnities, insurance and evidence-cooperation clauses into supply contracts. Renegotiate before 09.12.2026.
Second, documentation: Art. 9 plus the failure-to-disclose presumption mean a thin technical file converts directly into a presumption of defect. Keep design, testing, risk-assessment and post-market surveillance records producible for twenty-five years wherever latent injury is conceivable, and settle in advance which trade secrets to withhold.
Third, updates: promising security updates across a product’s expected lifetime and actually delivering them is now a liability control, because a defect traced to an update forecloses the “not defective on placing” defence. Refurbishers assume manufacturer-level liability for their modifications, and insurance should cover psychological harm, data loss and the twenty-five-year tail.
On the Turkish side nothing has moved. Product liability still rests on the Ayıplı Malın Neden Olduğu Zararlardan Sorumluluk Hakkında Yönetmelik (Regulation on Liability for Damage Caused by Defective Goods, Official Gazette 13.06.2003/25137), read with Law No. 6502 on Consumer Protection. Modelled on the now-repealed 85/374/EEC, it keeps the three- and ten-year structure and is silent on software, AI, data loss and disclosure. A divergence therefore opens from 09.12.2026.
Finally, the live uncertainty is transposition: Member States may diverge on disclosure procedure and on whether to extend liability for specific products. (As of July 2026) no amendment has been proposed, so track national implementing laws in your main export markets.
Related content
For the “mandatory product safety requirements” behind the presumption of defect, see our GPSR record; for AI as products, our EU AI Act record. See also our Artificial Intelligence and International E-Commerce focus areas.
Entry into force & amendment history
- 09.12.2026
Transposition deadline
Member States must transpose the Directive; 85/374/EEC is repealed and the new regime applies to products placed on the market after this date.
- 06.10.2025
AI liability proposal withdrawn
The withdrawal notice was published in the Official Journal, following the Commission decision of 16.07.2025. There is no dedicated EU liability regime for AI.
- 08.12.2024
Directive entered into force
The text published in the Official Journal on 18.11.2024 took effect and the transposition period began.
- 23.10.2024
Directive adopted
The new instrument was adopted, repealing Council Directive 85/374/EEC.
Official Sources
Directive text · EUR-Lex eur-lex.europa.euAI Liability Directive file · European Parliament europarl.europa.euGPSR record · Legislation Radar Köksal
