Editor's note.
The provisions of Directive (EU) 2024/2853 described here were read in the Official Journal text served by the Publications Office of the European Union on 18 September 2026. The descriptions of claims-made and occurrence triggers, retroactive dates, extended reporting periods and run-off are general descriptions of how liability insurance is commonly structured. They are not attributed to any insurer, no policy wording was read for this article, and no insurer is named in it. Whether a given policy responds is a matter of its wording.
- Under Article 16 of Directive (EU) 2024/2853 an injured person has three years to initiate proceedings, running from awareness of the damage, the defectiveness and the identity of the liable operator. Under Article 17(1) the right to compensation ends ten years after the product was placed on the market or put into service. Under Article 17(2) that becomes twenty five years where a personal injury was latent.
- For a substantially modified product the ten years run from the date it was made available or put into service following the modification (Article 17(1)(b)). Recital 40 states that a substantial modification can be made by a software update or by the continuous learning of an AI system. For a product that keeps changing, the long stop keeps moving.
- A claims-made policy responds to claims first made during the policy period, usually for acts after a retroactive date. A ten year exposure therefore needs ten years of unbroken cover with a retroactive date no later than the placing on the market, or run-off cover once the product or the business ends. A gap, or a retroactive date reset on a change of insurer, can leave an old product uninsured for a new claim.
- Liability to the injured person cannot be limited or excluded by contract (Article 15), and several liable operators are liable jointly and severally (Article 12(1)). A manufacturer can be pursued for the whole loss and left to its recourse, which Article 12(2) allows a small software component maker to have waived.
- The Directive contains no insurance obligation. Article 20 asks the Commission to report by 9 December 2030 on its application, including the availability of product liability insurance.
Section 1. Three clocks
The Directive sets three periods, in Articles 16 and 17, and each does a different job.
Three years from awareness. Article 16(1) requires a limitation period of three years for initiating proceedings. It runs from the day on which the injured person became aware, or should reasonably have become aware, of all of three things: the damage, the defectiveness, and the identity of the relevant economic operator that can be held liable under Article 8. For a software product, the third element can take time to establish. Article 16(2) leaves national rules on suspension and interruption of that period untouched.
Ten years from the market. Article 17(1) ends the right to compensation on the expiry of ten years, unless the injured person has initiated proceedings in the meantime. The period runs from the date on which the defective product that caused the damage was placed on the market or put into service.
Twenty five years for latent injury. Article 17(2) provides that where an injured person has not been able to initiate proceedings within the ten years because of the latency of a personal injury, the right ends at twenty five years.
The 1985 directive also had a three year limitation period and a ten year expiry period, in its Articles 10 and 11. The durations are therefore not what is new. What is new is that the text now puts software on those clocks in terms, and provides expressly for the ten year clock to restart.
Section 2. The clock that restarts
Article 17(1)(b) provides that in the case of a substantially modified product, the ten years run from the date on which that product was made available on the market or put into service following its substantial modification. Recital 40 applies that to software in terms: where a substantial modification is made through a software update or upgrade, or due to the continuous learning of an AI system, the substantially modified product should be considered to be made available or put into service at the time the modification is actually made.
Article 4(18) defines substantial modification. Where product safety rules lay down no threshold, a modification is substantial if it changes the product's original performance, purpose or type without that change having been foreseen in the manufacturer's initial risk assessment, and changes the nature of the hazard, creates a new hazard or increases the level of risk. Recital 39 states that repairs and other operations that do not involve substantial modification should not attract liability under the Directive. A new model generation with new capabilities, or a system retrained for a purpose its original risk assessment did not describe, may be inside it.
For physical goods the expiry period gives a manufacturer and its insurers a horizon: a product sold in 2027 is off risk under the Directive at the end of 2037, latent injury aside. For an AI product that is substantially modified every year or two there is no such horizon while the product lives. The exposure ends ten years after the last substantial modification, and that date is unknown until the product is retired. The analysis of how modification also moves a product between the 1985 regime and the new one is at agentliability.eu, on which regime applies to AI already on the market.
Section 3. Why the basis of cover matters: occurrence and claims-made
Liability insurance is commonly written on one of two bases. An occurrence policy responds to injury or damage that occurs during the policy period, whenever the claim is later made. A claims-made policy responds to claims first made against the insured during the policy period, and commonly only where the act, error or defect giving rise to the claim happened after a retroactive date stated in the schedule. Public and products liability have traditionally been associated with the first basis, and professional indemnity, technology errors and omissions and cyber liability with the second. Practice varies by market and by insurer, and a buyer should read the basis of cover off its own schedule.
The distinction decides who carries the tail. Under an occurrence policy, the year in which the injury happened stays responsible for it, however late the claim. Under a claims-made policy, a claim arriving in 2034 about an injury in 2029 caused by a product released in 2027 is a matter for the policy in force in 2034, if there is one, and if its retroactive date reaches back to 2027.
Software businesses are more likely than manufacturers of goods to hold their liability cover on a claims-made basis, because their historic exposure was financial loss to clients and not bodily injury. The Directive brings a long-tail bodily injury and property damage exposure to a class of insured whose cover is commonly built for short-tail financial loss. That mismatch is the subject of this article. How the different covers divide AI losses more generally is set out in the E&O, cyber and PI coverage framework and in first-party and third-party AI liability coverage.
Section 4. The retroactive date and continuity
On a claims-made basis, a ten year exposure is insured only by ten consecutive years of cover, each of which reaches back far enough. Two things break that chain.
The first is a gap. A year without cover is not only a year in which new incidents are uninsured. It is a year in which any claim arriving about any earlier product is uninsured, because no policy was in force when the claim was made.
The second is a reset retroactive date. When a buyer changes insurer, or buys a new type of policy for the first time, the new policy may carry a retroactive date equal to its own inception. Everything placed on the market before that date is then outside it. A company that launched an AI product in January 2027 and first bought suitable cover in 2029, with a 2029 retroactive date, has no cover for a defect in the 2027 release even though the policy is in force when the claim arrives. The mechanics are covered in retroactive dates and prior acts in AI liability cover.
A related point concerns what the retroactive date has to reach. Under the Directive the relevant moment is when the defective product was placed on the market or, within the manufacturer's control, when a defective update was supplied or a needed safety update was not. Article 11(2) removes the later-defect defence for software, updates and missing safety updates within the manufacturer's control. A buyer should be able to say, for each product, which date its retroactive date needs to precede, and the answer may be earlier than the latest release.
Section 5. When the product or the business ends
The expiry period does not stop when a product is withdrawn. A product retired in 2030 remains exposed until ten years after it was last placed on the market or substantially modified. Three events turn that into a run-off question.
Retiring a product. If the business continues and keeps buying cover, the retired product stays insured so long as the policy continues to cover discontinued products and its retroactive date does not move. Both points should be confirmed in writing at the renewal after retirement. The evidence side of retirement is at agentcertified.eu, on decommissioning evidence.
Selling the business or the product line. Liability under the Directive attaches to the economic operator that placed the product on the market. Who carries that liability after a transaction, and whose policy responds, depends on the structure of the sale and on national law, and this article does not describe either. The insurance point is that a seller whose cover stops at completion has a claims-made policy that will never see the claims. Extended reporting periods and run-off policies exist for this situation. Their length is a commercial term, and a buyer should compare the length on offer with the ten years in Article 17.
Ceasing to trade. Article 8(5) recognises the case where victims fail to obtain compensation because the liable persons are insolvent or have ceased to exist, and permits Member States to use or establish compensation schemes, preferably not funded by public revenue. It does not require them to. A founder closing a company that placed AI products on the Union market should ask what run-off cover is available and for how long. Personal exposure of directors is a separate question under national law, discussed for smaller operators at insureyouragent.com, on personal liability.
Section 6. Joint liability, subrogated claimants and recourse
Four provisions shape how a loss moves between parties and their insurers.
Article 15 requires that an economic operator's liability under the Directive is not, in relation to the injured person, limited or excluded by a contractual provision or by national law. The limitation of liability clause in a software licence does not bind an injured consumer. It may still allocate the loss between the businesses in the chain.
Article 12(1) provides that where two or more economic operators are liable for the same damage they can be held liable jointly and severally. An injured person can recover the whole loss from the AI product's manufacturer even where a component supplier's model was the cause. Article 14 then gives the operator that has paid the right to pursue remedies against other liable operators, in accordance with national law.
Article 12(2) qualifies that recourse. A manufacturer that integrates software as a component has no right of recourse against the manufacturer of the defective software component where that manufacturer was a microenterprise or small enterprise when it placed the component on the market and the integrating manufacturer contractually agreed to waive the right. An insurer's subrogated recovery can be no better than its insured's right, so a waiver of that kind reduces what the integrating manufacturer's insurer can recover. It belongs in the disclosure to underwriters, alongside the other contract terms discussed in subrogation and AI vendor contracts.
Article 5(2)(a) allows a claim to be brought by a person that succeeded, or was subrogated, to the right of the injured person by virtue of Union or national law or contract. The claimant in a product liability action against an AI manufacturer may therefore be an insurer or other payer that has already compensated the injured person, and it will arrive with more resources than an individual would. Article 9 disclosure and the Article 10 presumptions are available in those proceedings in the same way. The evidence consequences are at agentcertified.eu, on disclosure, presumptions and the evidence file.
Section 7. What a Directive claim looks like to a policy
Article 6 confines the right to compensation to three types of damage suffered by natural persons: death or personal injury, including medically recognised damage to psychological health; damage to or destruction of property, other than the defective product itself and property used exclusively for professional purposes; and destruction or corruption of data that are not used for professional purposes. Article 6(2) adds that compensation covers all material losses resulting from that damage, and non-material losses in so far as national law compensates them.
Two observations for placement. First, pure financial loss caused by a wrong AI output is not within Article 6. That exposure remains where it was, in contract and negligence, and in professional indemnity and errors and omissions cover. The Directive adds an injury and property exposure on top of it and does not replace it. Secondly, the third head of damage is new. Whether the destruction or corruption of a consumer's data is bodily injury, property damage or neither under a given liability wording is a wording question, and wordings written before the Directive were not drafted with that head of damage in mind. It should be asked expressly. The general position on exclusions is covered in AI exclusions in cyber and E&O policies and the earlier overview of the Directive is in Directive 2024/2853 and AI coverage readiness.
Section 8. Eight questions to settle at the renewal before 9 December 2026
- Which of our policies responds to a no-fault product liability claim for bodily injury, property damage or destruction of a consumer's data caused by our software, and on what basis is it written, occurrence or claims-made?
- If claims-made, what is the retroactive date, and does it precede the date each of our AI products was first placed on the market?
- Does the retroactive date survive renewal and a change of insurer, and is that stated in the policy?
- Does the policy cover products we have withdrawn, and for how long after withdrawal?
- What extended reporting period or run-off cover is available if we sell the product line, sell the company or cease trading, and how does its length compare with the ten years in Article 17 of the Directive?
- Is software, or an AI system, within the policy's definition of product, and does any exclusion for software, data, professional services or AI remove the cover the definition appears to give?
- How does the policy treat the destruction or corruption of a third party's data where there is no physical damage?
- Do any of our contracts waive recourse against a component supplier, or oblige us to indemnify a customer for product liability claims, and have those terms been disclosed?
The fifth question is the one most often left until a transaction forces it. It is easier to negotiate run-off terms into a programme at renewal than to buy them from a standing start during a sale. The broader renewal agenda is in what changes at the 2026 renewal.
Questions
How long can an AI product give rise to a claim under the revised Product Liability Directive?
Under Article 17(1) of Directive (EU) 2024/2853 the right to compensation ends ten years after the defective product was placed on the market or put into service, unless proceedings have been initiated in the meantime. Article 17(2) extends that to twenty five years where the injured person could not initiate proceedings within ten years because of the latency of a personal injury. Within those periods, Article 16 gives the injured person three years from awareness of the damage, the defectiveness and the identity of the liable economic operator.
Does a software update restart the ten year period?
It does if the update is a substantial modification. Article 17(1)(b) provides that for a substantially modified product the ten years run from the date the product was made available or put into service following the modification, and recital 40 states that a substantial modification can be made through a software update or upgrade or due to the continuous learning of an AI system. Article 4(18) defines when a modification is substantial.
Why is a ten year exposure a problem for claims-made cover?
A claims-made policy responds to claims first made during its policy period, commonly only for acts or defects after a retroactive date. A claim arriving years after a product was released is therefore insured only if a policy is in force when the claim is made and its retroactive date reaches back to the release. A gap in cover, or a retroactive date reset on a change of insurer, can leave an earlier product uninsured. An occurrence policy, by contrast, responds according to when the injury or damage occurred.
What happens to the exposure if the product is withdrawn or the company is sold?
The expiry period continues to run from the date the product was last placed on the market or substantially modified, so the exposure outlives the product. On a claims-made basis, cover for it depends on continuing to buy cover that includes discontinued products, or on an extended reporting period or run-off policy. The length of any run-off cover should be compared with the ten years in Article 17. Who carries the liability after a sale depends on the transaction and on national law.
Can an insurer bring a product liability claim against an AI manufacturer?
Yes. Article 5(2)(a) allows a claim to be brought by a person that succeeded, or was subrogated, to the right of the injured person by virtue of Union or national law or contract. An insurer or other payer that has compensated an injured person may therefore bring the claim, with the benefit of the disclosure rules in Article 9 and the presumptions in Article 10.
Does the Directive require AI manufacturers to hold insurance?
No. The Directive contains no insurance obligation. Article 20 requires the Commission to evaluate the application of the Directive by 9 December 2030 and every five years thereafter, and to report on matters including the availability of product liability insurance. Article 8(5) permits, but does not require, Member States to use or establish compensation schemes where liable persons are insolvent or have ceased to exist.