Reforming the UK's product liability rules for an AI world

The Law Commission has published a Consultation proposing reforms to the UK’s statutory product liability regime to make it fit for the digital age. While many of the proposals echo recent changes made in the EU under the new EU Directive on Liability for Defective Products (“PLD”) (discussed in a previous Lens post), they take a different approach in several key areas. 

In this blog, we highlight the Law Commission’s key proposals, noting where these differ from the EU position. 

The current regime

Under the Consumer Protection Act 1987 (“CPA”), which implemented the 1985 EU Product Liability Directive, a producer, own-brander, importer or (in some circumstances) supplier is strictly liable for damage caused by a defective product. 

But the CPA faces a number of issues in today’s digital world. For example:

• products have changed since the 1980s, and it is currently unclear whether “product” extends to digital technologies such as software and AI systems; and
• it can be difficult for claimants to show that a digital product is defective and demonstrate the necessary causal link in technically complex claims, where defendants often hold all the relevant information and expertise.

What does the Law Commission propose?

Key provisional proposals include:

• Expanded scope: Software and AI systems, whether embedded in physical goods or supplied digitally, would be expressly brought in scope through changes to the definitions of “product” and “supply”. Design components of social media and other online platforms (such as algorithms, infinite scroll and “likes”) would be expressly identified as products, and there would be a new catch-all for anything designed or developed to perform a specific function for users.

  How does this compare with the EU? While expanding the scope to include software and AI systems would be consistent with the PLD, expressly identifying social media and other online platforms would go further.

  Another difference is the treatment of open-source software. The PLD has an open-source exemption which is not mirrored in the UK’s proposals. Non-commercial software would generally fall outside the regime, but open-source software supplied in the course of business or for profit would be caught even if users do not pay for it directly.

  “Related services” integrated into or interconnected with a product are also covered by the PLD but would be out of scope in the UK proposals.

• Wider range of persons potentially liable: The definition of “producer” would expand to include the product’s developer, and a person who substantially modifies a product outside the original producer’s control would be liable as producer of the modified product where it is commercially supplied. 

  New categories of defendant would be introduced:

  • Fulfilment service providers (offering at least two of warehousing, packaging, addressing and dispatching) would be liable where no UK producer, own-brander, importer or authorised representative can be identified.
  • Core participants would be liable where no UK producer, own-brander, importer, fulfilment service provider or authorised representative can be identified. A core participant is a person who plays a significant role in bringing the product to the UK market, benefits financially from doing so and has control or decisive influence over manufacture or distribution.
  • UK authorised representatives of producers, own-branders, importers, fulfilment service providers or core participants established outside the UK would be liable, helping claimants find a UK defendant and avoid out-of-jurisdiction claims.

  How does this compare with the EU? Bringing developers and modifiers in scope is consistent with the PLD. The fulfilment service provider and UK authorised representative categories are broadly consistent with the EU approach, but the UK focus on whether an appropriate UK defendant can be identified would provide a simpler route to redress, and the authorised representatives category is broader.

  A key difference is the proposed core participants category, which has no PLD equivalent. Aimed at online marketplaces, the category is defined by function to capture evolving marketplaces and novel operators.

• Principles for assessing defects: Non-exhaustive principles (such as expected use, information and warnings) would guide the defect test, alongside a list of relevant circumstances (such as the producer’s continuing control through updates) and a statutory statement of the regime’s purpose. 

  How does this compare with the EU? The PLD has no equivalent guiding principles but takes a broadly consistent approach to relevant circumstances and contains a similar statement of purpose.

• Evidential presumptions: There would be a rebuttable presumption of defect where it is arguable that the product is defective, the facts relied on are not fanciful, the claimant faces exceptional evidential difficulties due to limited availability of evidence, and the risk of harm is not so widely known as to be socially accepted.

  Under a risk-sharing mechanism, a defendant could elect to accept the alleged defect or assume responsibility for rebutting the presumption. Where the defendant accepts the defect, the court should apportion the risk, starting from an award of 50% of the damages that would have been recoverable had the defect been established. There would be no reduction if the defendant unsuccessfully seeks to rebut the presumption.

  How does this compare with the EU? The proposed approach differs from the PLD, which contains a rebuttable presumption of defect but no corresponding risk-sharing mechanism. Unlike under the PLD, no rebuttable presumption of causation is proposed; however, the consultation seeks views on a rebuttable presumption relating to specific and discrete facts.

• Damages: Destruction or corruption of data would be recoverable, excluding data used exclusively for professional purposes. Recognised psychiatric illness would be compensable, and personal injury claims would require a minimum threshold of material harm.

  How does this compare with the EU? Unlike the PLD, the proposals would compensate mixed-use data (i.e. data used for both professional and non-professional purposes, although damages would be reduced for the professional use element) and impose a personal injury threshold.

• Defences: Existing defences would be retained but adapted for digital products, which is generally consistent with the PLD.
   
• Extended long-stop: The current rules include a 10-year long-stop which generally runs from the date of supply. Under the proposals, this would reset on a substantial modification and extend to 25 years for latent personal injuries that could not have been pursued within 10 years. Again, this is consistent with the PLD.

Next steps

The consultation closes on 14 January 2027, with final recommendations expected in late 2027. The Law Commission will also shortly begin its project on consumer class actions (discussed in a previous Lens post).