Of UNESCO‘s nine regulatory approaches, liability is the one with no soft landing. Principles can be aspirational, standards can be voluntary, sandboxes are explicitly temporary, but a liability regime assigns responsibility and sanctions after the fact, and it does not much care whether the organisation on the other end of the claim thought it was being careful.
The EU’s Product Liability Directive, (EU) 2024/2853, is that approach arriving. From 9 December 2026, software and AI systems count as products in their own right, not only the physical goods they are embedded in, and the regime is strict liability: a claimant has to show the product was defective, that they suffered damage, and that there’s a causal link, nothing more. Where a system’s technical complexity, the black box problem, makes that hard to prove, courts can presume the defect and the causal link instead of requiring the claimant to untangle the model themselves.
What that does in practice is move the evidentiary burden from the claimant’s side of the table to yours.
- Before the transposition date, a claimant carries the weight of proving something went wrong inside a system they do not have access to.
- After it, the organisation is the one expected to produce the risk assessment, the documentation, and the update history that show the defect presumption does not hold, which is precisely the evidence an Article 4 readiness assessment or a Coverage & Exposure Review already builds.
The two obligations were written by different committees for different reasons, treating them as separate projects means building the same evidence twice. Treating them as one exposure, means building it once.