EU Directive 2024/2853 holds AI developers strictly liable for damages from defective products, including SaaS agents, with liability extending to mental health harm but not economic losses.
EU directive on AI product liability
The EU Directive 2024/2853 introduces strict liability for companies that develop or sell AI agents. This means a company is responsible for damages caused by a defective product regardless of whether negligence is proven. The directive applies to products placed on the market after December 9, 2026.Software as a product
The directive defines software as a product, regardless of how it is supplied or used. This includes software offered through a subscription model like SaaS. AI system providers are also classified as manufacturers under the AI Act.Who is considered a manufacturer
A manufacturer is defined as the entity that develops a product or presents itself as such by branding it. This includes banks, insurers, or merchants that offer AI agents under their own name. Even companies that modify a product significantly can become manufacturers.Types of damages covered
The directive covers damages related to death, bodily injury, and medically recognized mental harm. It excludes purely economic losses, privacy violations, and discrimination. Employees of clients are also considered physical persons under this framework.Limitation of liability
Article 15 of the directive prohibits contractual or legal provisions that limit liability. However, suppliers' contracts may block recourse. Companies like OpenAI and Google Cloud have terms that cap liability to the amount paid over twelve months.Post-sale defect liability
A product modified by updates or AI learning is considered placed on the market at the time of modification. The absence of a patch does not protect against liability. Suppliers cannot claim exemption if the defect arises from a lack of necessary updates.Evidence and liability
Judges may require defendants to provide relevant evidence, such as execution logs and model versions. If evidence is not provided, the defect is presumed. The agent's logs become part of the legal case file.Financial liability and AI agents
JPMorgan Chase stated that clients are responsible for actions taken by AI agents using their identifiers. CEO Jamie Dimon warned of uncontrolled AI agents. Elon Musk, on the other hand, said SpaceX would compensate users for errors made by Grok Bot, though this is not yet tested.Payment law and liability
According to French law, a payment requires the payer's consent, and strong authentication alone is not enough. The payment service provider must prove gross negligence to hold the client liable.France's transposition delay
As of October 2026, no transposition text had been found in France’s legislative records. The Keeper of the Seals mentioned a dedicated text is being considered but did not specify its form or content.Civil code updates
A transposition table submitted in January 2026 modifies several articles of the French Civil Code. However, it does not explicitly address liability for software components integrated into other products, such as model providers.Preparation steps for December 9
Before December 9, companies must clarify their role as manufacturers, renegotiate with model providers, ensure logging and evidence preservation, draft update policies, and review civil liability insurance. Insurers may introduce exclusions for AI in general liability policies.
