All commercial software falls under incoming rules

Businesses should review their product portfolios, insurance, and contractual arrangements ahead of the revised Product Liability Directive taking effect in December, a Mason Hayes & Curran (MHC) webinar has heard.

The directive extends liability to digital products, expands the pool of potentially liable parties, and introduces new measures to help consumers prove claims.

Although Ireland has yet to transpose the directive ahead of the 9 December deadline, the new rules will apply to products placed on the market or put into service from that date.

In their webinar on preparing for the revised directive (28 October), the products team at MHC outlined key changes and practical steps businesses should take.

Hugh Horan identified technological advances, global trade and e-commerce, the circular economy and sustainability, and difficulty proving claims as key drivers for the revision of the 1985 directive.

Under the revised directive, the physical product boundary is gone.

Medical apps

Joanne Poland explained that “all commercial software” – including stand-alone medical apps and AI diagnostics, cloud applications, digital manufacturing files, and AI systems – would be included.

The definition of a defect has also been updated to reflect connected and adaptive technology.

Courts must consider factors including cybersecurity vulnerabilities, self-learning AI, interconnectedness, and reasonably foreseeable use or misuse.

This means a software flaw or security vulnerability may be relevant to whether a product is defective, even where the problem lies in a digital component, rather than the physical device.

The scope of recoverable damage has widened to include medically recognised psychological harm as personal injury and compensation for the destruction or corruption of data, provided it is not used purely for professional purposes.

Joanne Poland noted that defective software updates or inadequate cybersecurity measures that corrupt patient-tracking data may result in actionable claims.

Psychological harm

Psychological harm caused by a defective device or medical app may also qualify where it amounts to a medically recognised condition, even without physical injury.

The revised directive introduces an EU-wide framework for court-ordered disclosure of relevant evidence, alongside rebuttable presumptions of defectiveness and causation in specified circumstances.

Jamie Gallagher highlighted the significance of the disclosure rules for manufacturers in member states where claimants have traditionally had more limited access to evidence.

Claimants must demonstrate a plausible claim and the relevance of the information sought, but the new framework could give them access to substantial amounts of technical material.

For software and AI businesses, that may include commercially sensitive information about algorithms, models, and product design.

Courts can order protective measures, such as confidentiality rings, but Gallagher warned that these “aren't always a complete solution”.

Disclosure can also be expensive and time-consuming, particularly when it involves hundreds of thousands, or even millions, of documents and files.

The presumptions may apply in circumstances including failure to comply with a disclosure order, non-compliance with relevant safety requirements, or an obvious malfunction during normal use.

Gallagher also noted that technical complexity might also make it easier for claimants to establish presumptions where proving precisely how a product caused harm would be excessively difficult.

Audit trails

As the presumptions are rebuttable, preserving technical documentation, audit trails, and post-market surveillance records is particularly important.

In the revised directive, potential liability extends beyond manufacturers and component suppliers. 

For products made outside the EU, Joanne Poland described “a clear waterfall of liability to ensure someone in Europe is on the hook”.

In specified circumstances, this can include related service providers, authorised representatives, fulfilment service providers, parties making substantial modifications, and online platforms.

Digital services integrated with products may also be treated as components.

Giving the example of a smart lock using third-party cloud-based facial recognition, Poland illustrated how both the manufacturer and service provider could face liability if a failure left the lock vulnerable to burglary.

Liability may also arise when products are substantially modified and re-released onto the market.

Jamie Gallager also drew attention to the scalability of liability exposure where the revised directive interacts with the Collective Redress Directive (implemented in Ireland through the Representative Actions Act, 2023). 

Combining an action on behalf of the collective interests of a group of consumers with disclosure and rebuttable presumptions could lead to “much larger-scale litigation”, he said.

Single defect

A single defect in an algorithm could affect many users simultaneously.

In her overview of the event, product team leader Michaela Herron (pictured) suggested several practical steps for businesses:

• Review product portfolios to identify what now carries product liability exposure, particularly stand-alone software, related services, and products subject to substantial modification.
• Review product warnings and disclaimers in light of the expanded definition of damage – including the risk of data corruption or loss,
• Check product-liability insurance to ensure cover reflects the new regime – including the expanded range of products and types of damage in scope.
• Review contracts with commercial partners involved in manufacturing, supply, and on-market support to ensure adequate liability and indemnity provisions, particularly where third-party service providers perform tasks that may still fall within the manufacturer's control.