AI Liability Directive Withdrawal Leaves EU Fault-Based Gap

What happened

The European Union's plan for a dedicated civil liability regime for artificial intelligence is dead. The European Commission signalled the end of the proposed AI Liability Directive (AILD) in its 2025 work programme, adopted on 11 February 2025, a move one law firm described as surprising 1. The proposal was first tabled in September 2022 as the civil liability companion to the EU AI Act 24.

The Commission formally withdrew the text on 6 October 2025 3. Then, on 3 December 2025, the European Parliament's Legal Affairs Committee voted against a proposal to take the Commission to court over the withdrawal 3. That rejection effectively closed off the last institutional route for reviving the directive in this legislative term.

The timeline is worth getting right. Some coverage treats February 2025 as the withdrawal date. Others point to the formal October action. The February work programme announced the intention, and the October decision made it official.

Why it was dropped

Accounts of the motive differ in emphasis. One reading presents the withdrawal as part of a broader deregulatory turn aimed at simplifying EU rules and improving competitiveness 1. The same work programme also discarded other files, including the long-delayed ePrivacy Regulation 1. Critics of the AILD had argued that national legal systems, combined with existing EU instruments, could already handle AI-related harm 1.

Other analyses frame the decision in more procedural terms. In this view, the Commission accepted that the text would not pass in the current term 2, and legislators simply could not agree on its wording despite broad consensus that liability rules needed updating 4.

These explanations are compatible. A proposal that lacks political momentum is easy to drop when the institutional mood favours fewer rules. Still, the competitiveness framing suggests the Commission saw little reason to fight for the AILD.

What the directive would have done

The AILD targeted non-contractual, fault-based civil liability for harm involving AI systems 1. Its main contribution was to address causality and fault, with the aim of making it easier for injured people to win compensation 34. It was also designed to stop the 27 member states from developing conflicting approaches to AI liability 1.

That harmonisation goal is now gone. Claimants who need to prove fault will rely on national tort law, with all the variation that brings 24.

What still applies

One compliance-focused analysis warns of a common misreading in both directions. Some teams still cite AILD provisions as though they were law. Others assume AI liability rules have vanished altogether 2. Neither is accurate.

The revised Product Liability Directive (PLD) brings software, including AI, within its strict liability regime from December 2026 2. Member states must transpose it by 9 December 2026 5. Under strict liability, an injured party does not have to prove the producer was negligent. Liability under the PLD also cannot be excluded by contract 2. That point matters for vendors who assumed they could shift risk through licence terms.

The Cyber Resilience Act, expected to apply in 2027, adds a further layer of security obligations for products sold in Europe 5.

The gap that remains

The PLD and the AILD were built to do different jobs. The PLD covers defective products. The AILD would have helped people pursue fault-based claims, such as harm caused by how an AI system was deployed or supervised, rather than by a defect in the product itself 4. With the AILD gone, those specific fault-based protections no longer exist at EU level 4. Cases outside the PLD's scope will depend on whichever national law applies 2.

The practical effect is visible in emerging problems like "vibe coding," where AI tools generate much of an application's code. Security researchers cited by Bloomberg Law found that among more than 380,000 scanned vibe-coded web assets, about 2,000 apps were exposing sensitive data with no authentication 5. Breaches involving unsanctioned "shadow AI" reportedly cost an average of $4.63 million, about $670,000 more than the baseline 5. The same reporting says 63% of breached organisations had no AI governance policy 5.

Attorneys quoted in that coverage expect breach defences to turn on documented prompts, review processes and "reasonable security" standards, not on blaming the AI 5. Once the PLD applies, they argue, "the AI wrote it" will be a costly excuse for companies selling in Europe 5.

Our reading

The withdrawal does not mean AI escapes liability in Europe. It means liability will be uneven. Product-style failures will face a strict, uniform regime that cannot be contracted away. Fault-based harms will fall back on 27 national systems.

For compliance teams, the sensible approach is to:

• prepare for the PLD deadline as a fixed obligation;
• document development and oversight practices thoroughly; and
• assume fault-based exposure will vary by jurisdiction.

The Commission chose simplicity at the EU level. In practice, that choice is likely to create more complexity for companies operating across member states.