AI liability: who pays when AI causes harm?

Short answer: The AI Act sets out how you place an AI system on the market safely, but not who pays for the damage if it goes wrong anyway. That civil-law question is governed mainly by the revised Product Liability Directive (PLD, Directive (EU) 2024/2853), which treats software and AI explicitly as a "product" and lightens the burden of proof for claimants. The separate proposal for an AI Liability Directive was withdrawn by the Commission in 2025.

Two sets of rules not to confuse

The AI Act is public-law product regulation: risk classification, conformity assessment, supervision and fines. It gives an injured party no right to compensation. That is the domain of liability law: the rules that decide who bears the financial cost of damage suffered. An organisation can therefore be fully AI Act compliant and still be held civilly liable — and vice versa.

The revised Product Liability Directive

The old 1985 product liability directive fitted software and AI poorly. The revised PLD (Directive (EU) 2024/2853) fixes that on three points that are crucial for AI:

• Software and AI are "products". Standalone software, AI systems and digital services that determine how a product works fall under strict (no-fault) liability.
• Updates and self-learning behaviour count too. A product can become defective through a missing security update or through behaviour it teaches itself after sale; the manufacturer can remain liable.
• Lighter burden of proof. For complex or opaque systems a court can order disclosure of evidence and may presume defectiveness or causation where the claimant could otherwise barely prove it. That removes the "black box" hurdle.

Member States must transpose the directive by 9 December 2026; it applies to products placed on the market after that date.

Why the AI Liability Directive disappeared

Alongside the PLD there was a proposal for an AI Liability Directive (AILD), aimed at fault-based liability (for example, careless use) independent of a product defect. The Commission withdrew that proposal in 2025 for lack of agreement. The result: fault-based liability for AI runs for now through the national law of each Member State — with the familiar divergence that entails.

Sharpest for agentic AI

The liability question becomes hardest with agentic AI: systems that act independently and cause irreversible consequences. Does responsibility lie with the provider of the agent, the organisation deploying it, or the supplier of the underlying model? The PLD offers a product route, but the boundary between those parties is exactly what still has to crystallise in contracts and case law.

What to do

• Allocate responsibilities contractually with suppliers of AI systems and models — see AI in contracts.
• Keep evidence: logging, technical documentation and version control will determine whether you can rebut a presumption of defectiveness.
• Stay on top of updates: an omitted security update can render a product defective.
• Review your insurance: does your business or product liability policy cover harm from AI behaviour?

AI compliance and AI liability are two separate worlds. Steering on the AI Act alone secures the licence but not the risk.