New EU rules on liability for defective products: What does this mean for fintech and insurtech?

A new Directive of the European Parliament and of the Council, adopted on 24 October 2024, brings a number of changes to liability for defective products. In this article, we will try to outline, which entities will be affected by the changes and how to prepare for them.

In this case, the change in legal regulation is a response to technological development, in particular digitalisation and the advent of artificial intelligence. It fundamentally changes the legal framework and has a significant impact on the fintech and insurtech sectors, which are at the intersection of technology, software and services.

Aim: Modernisation, harmonisation and greater protection

The main motivation for the new Directive is to adapt the legislation to the realities of the 21st century. The existing rules no longer met the needs of complex digital products and smart devices, let alone for AI-based systems. The new legislation seeks to:

• Harmonise the EU internal market – unify rules between Member States to simplify cross-border trade and avoid legal uncertainty.
• Strengthen consumer rights – consumers will have an easier route to redress if they are harmed by a defective product.
• Respond to technological advances – the Directive takes into account new business models and approaches, including AI-based services and products.
• Achieve legal predictability for manufacturers and developers – more precise definitions and obligations are intended to lead to greater clarity of the rules.

Scope of application

The Directive focuses on objective liability for damage caused by defective products, i.e. liability without regard to fault – similar to that provided for in Section 2895 of the Civil Code. This scheme does not replace or limit other legal options available to victims under national or other EU law.

Specifically, the new legislation does not apply to:

• Contractual liability, i.e. claims arising from breach of contract – for example, if the product does not meet the agreed parameters.
• Liability for defects and warranties, whether these are statutory quality warranties or warranties provided by the manufacturer.

In this way, injured parties have the option of simultaneously using different legal regimes to protect their rights and recover damages, which contributes to broader and more flexible protection for consumers and other users of products.

Software as a product? Yes, and often even one with AI

One of the key changes is the extension of the concept of “product”. It now makes it clear that the definition also includes digital production files, raw materials and software, both stand-alone and integrated into other devices. Significantly, the responsibility extends to systems using artificial intelligence. So, for example, if AI within an insurance tool or payment application causes harm due to faulty functionality, the provider may be held liable for product defects.

The only exception is software developed non-commercially, for example within open-source communities with no business purpose. However, once the software enters the commercial ecosystem, full legal liability passes to the provider.

Impacts on fintech and insurtech: Watch out for mistakes and risks

Fintech and insurtech firms, which often build their services on algorithms, AI or data analytics, should pay close attention to the directive. For them, the following recommendations apply in particular:

• Map the products that can be considered as products under the new definition.
• Ensure adequate testing and documentation of software development, including defect detection and correction mechanisms.
• Review contractual relationships with suppliers, especially where software is custom built.
• Update internal risk management and liability insurance processes, should damage to health, property or data occur.

When will the Directive come into force?

The Directive entered into force on 11 January 2025, but Member States have until 9 December 2026 to implement it into national law. This means that companies have approximately two years to prepare and adjust their processes and products.

In conclusion

The new Directive brings a significant change to European law. For companies in fintech and insurtech, it means not only new responsibilities, but also an opportunity to improve the quality of their products and strengthen customer confidence. Those firms that prepare early will gain an advantage in an increasingly regulated market.