The EU formally withdrew its dedicated AI Liability Directive on October 6, 2025, thinking it was cutting red tape. But the bloc’s Product Liability Directive—which treats software and AI systems as products subject to strict, no-fault liability—takes effect December 9, 2026. That’s 62 days away. SMBs aren’t facing less regulation; they’re facing it without the rebuttable causality framework that was supposed to accompany it.
Here’s what happened, and why it matters: In September 2022, the European Commission proposed an AI Liability Directive that would have introduced a rebuttable presumption of causality. Simple translation: if you could show an AI system probably caused your harm, the vendor or operator would have to prove otherwise. That shifts burden in a meaningful way for victims.
That directive was shelved during AI Act negotiations. Then on October 6, 2025, the Commission formally withdrew it, citing lack of consensus and pressure to cut red tape. Industry groups cheered. MEPs grumbled. The conversation moved on.
The problem: nobody was paying attention to what was already locked in.
Strict liability is already coming—and it’s broader than you think
The Product Liability Directive (2024/2853) becomes enforceable on December 9, 2026. Full stop. It applies to any AI system or software product placed on the EU market from that date forward. And it’s not a gentle framework.
Under strict liability, you’re liable for damage caused by a defective AI product even if you weren’t negligent. No fault required. The burden is on you to prove the system wasn’t defective, or that harm didn’t occur, or that there’s no causal link. (The only exception: if you can show excessive technical complexity made causation impossible to establish—but good luck proving that for your machine learning model.)
What changed from the withdrawn AI Liability Directive? Everything. That directive’s rebuttable presumption would have said: “If the claimant shows a breach of duty of care and the AI output caused damage, the defendant proves causation wasn’t there.” Without it, the burden stays where it always has been—mostly on the claimant to establish the chain from defect to harm.
Except now the Product Liability Directive creates strict liability. So you’re liable for defects without negligence, but the victim still has to prove the defect caused the harm. It’s the worst of both worlds for deployers.
What this means for your business right now
Imagine a 40-person logistics distributor that deployed an AI inventory optimization system six months ago. That system now sometimes recommends stock levels that create stockouts, leading to lost sales for one of their key clients. Under the new regime starting December 9, if that harm is traced to the system, liability is strict—the distributor doesn’t have to be negligent for the vendor and potentially the distributor to be on the hook. And proving causation? That’s still a legal fight.
The real compliance cost hits here:
Supply chain traceability: You need documented chains from your AI vendor through every system layer to your deployment. Who built the model? Who fine-tuned it? Who deployed it? If something breaks, you need to identify liable parties fast, or you’re the fall guy.
Technical documentation: Risk assessments, cybersecurity measures, update policies, monitoring logs. All of it. Centralized. Because a claimant will demand it, and regulators will expect it. If you can’t produce it, courts assume defectiveness.
Contractual clarity: Your vendor agreements need explicit allocation of liability, indemnification, and responsibility for monitoring and updates. “We provide the model” isn’t enough. You need to specify who’s liable for what, or you inherit it all.
Ongoing monitoring: You can’t just deploy an AI system and walk away. Courts and regulators will look at whether you maintained, monitored, and updated it. Neglect shifts liability toward you.
Why Sam Altman’s recent position actually matters
In recent remarks, OpenAI’s CEO rejected what he called a zero-scams trade-off. Asked whether he’d accept guarantees of no major hacks, no misuse, and zero scams in exchange for restricting AI deployment, he said: “I wouldn’t take a trade of saying, like, we’ll make sure there’s no major hacks, there’s no kind of, like, misuse of this technology, there’s zero scams, there’s zero all the other bad things that will happen.” His argument: the benefits far outweigh harms, and society should accept bounded risks.
That’s a vendor’s pragmatic stance on regulation. It’s not unreasonable. But it doesn’t change the fact that deployers—you—are now in the liability chain too. The Product Liability Directive holds both vendors AND economic operators (that’s you, the deployer) accountable. Altman’s position is one thing; your contractual exposure is another. When harm occurs and regulators come calling, they won’t ask whether you philosophically agreed with risk. They’ll ask whether you monitored and documented responsibly.
What to do before December 9
You have about two months. Three priorities:
First: audit every AI system you’ve deployed or plan to deploy. Document the supply chain from model source through your infrastructure. If you can’t trace it, you can’t defend it.
Second: tighten your vendor contracts now. Demand explicit liability allocation, indemnification for defects, and vendor commitments to monitoring and updates. Get it in writing before the new regime takes effect.
Third: establish a monitoring and logging discipline. Courts will ask: how did you know the system was performing correctly? What safeguards did you put in place? If you can show diligent oversight, you move closer to limiting your own liability and placing it on the vendor, where it belongs.
The withdrawal of the AI Liability Directive looked like deregulation. It was actually the opposite: it left SMBs bearing strict liability without the causality presumption that was supposed to make it fair. Prepare now, or spend 2027 defending harm you can’t trace.
0 Comments