AI Liability in the EU: Directive Gone, Strict Rules Coming

What happened

The European Union's plan for a dedicated, fault-based liability regime for artificial intelligence is officially dead. The European Commission formally withdrew the proposed AI Liability Directive in October 2025 after lawmakers failed to reach agreement on it 2. In December 2025, the European Parliament's Legal Affairs Committee rejected a bid to take the Commission to court over the withdrawal, closing off the most obvious route to reviving it 2.

It would be easy to read this as deregulation, a sign that Brussels is easing off AI accountability. Both accounts of the story reject that reading. One argues that the exposure left behind is actually larger than what the directive would have created 1. The other says the result is a fragmented, uneven legal landscape that compliance teams are underestimating 2. These are different emphases, but they point in the same direction: liability risk for AI and software makers in Europe is rising, not falling.

The strict-liability net still tightens

The withdrawal does not leave a vacuum. The revised Product Liability Directive (PLD) extends strict liability to software and AI, with the new rules taking effect in December 2026 1. The specific date given is December 9, 2026 2. Strict liability means a claimant generally does not need to prove the producer was negligent, only that a defective product caused qualifying harm. For an industry used to treating software as a service shielded by licence terms, that is a significant change.

The revised PLD lands alongside the Cyber Resilience Act (CRA), which imposes its own security obligations on products with digital elements 2. Taken together, the two instruments mean that a defect in AI-assisted or hastily generated code could trigger both regulatory scrutiny and product liability claims. The legal500 analysis applies this directly to "vibe-coded" software, meaning code produced quickly with AI tools and limited human review, and to the security breaches it can cause 2.

Where the gap opens

The complication is scope. According to the legal500 analysis, the revised PLD covers strict-liability claims for defects causing physical harm or data loss, but it excludes pure economic loss and business-to-business claims 2. That carve-out is substantial. Many of the most expensive AI failures, such as a flawed automated decision that costs a company money or a breach whose damage is mainly financial, may fall outside it.

The AI Liability Directive was designed to cover that kind of territory. It would have harmonised fault-based claims and eased the burden on victims trying to prove how an opaque system caused their harm. Without it, there is no EU-wide fault-based regime for AI harms 2. Victims whose claims fall outside the PLD must instead rely on the national tort law of 27 member states, each with its own standards of proof, causation rules and approach to negligence 2.

Why fragmentation may be worse than harmonisation

This is where the two accounts meet. Basilpuglisi.com frames the outcome as larger exposure 1. Legal500 frames it as fragmentation risk, warning that "reasonable security" defences will be argued unevenly across member states even as the PLD and CRA raise the baseline 2. Read together, the larger exposure comes from both layers at once: a strict-liability floor for certain harms, and an unpredictable patchwork of fault-based claims for everything else.

For companies, a single harmonised rule, even a demanding one, is often easier to manage than 27 different ones. A directive would have given compliance teams one standard to design against. Now a firm shipping an AI product across the bloc has to consider how courts in different jurisdictions might assess whether its security practices were reasonable, and those answers may not line up. National courts, rather than Brussels, are likely to shape much of the practical meaning of AI fault liability in Europe over the coming years. That will produce divergent rulings before any consensus forms.

The takeaway

The sensible conclusion is that the directive's withdrawal shifted AI liability risk rather than removing it. The December 2026 PLD deadline is fixed and close, and it brings strict liability to software for the first time 12. Outside its scope, the absence of a common fault standard creates legal uncertainty that may prove harder to plan for than the rule Europe abandoned.

Organisations that treated the withdrawal as a reprieve should revisit that assumption. Documenting secure development practices, especially where AI tools generate code, now matters on two fronts: meeting the CRA and PLD, and building a defence that holds up in whichever national court ends up hearing the case.