Responsibility follows legal roles
Potential responsibility for defective AI depends on the applicable liability regime and the role each business performed. Under Directive (EU) 2024/2853, relevant actors can include the product manufacturer, a component manufacturer and specified supply-chain operators. The person who uses an AI system is not automatically its manufacturer, and the most familiar technology brand is not necessarily the only relevant actor. The AI product liability framework starts with the product and evidence before reaching responsibility.
This is an EU Directive-level explanation rather than a determination about any named business. Its corrected scope concerns products placed on the market or put into service after 8 December 2026. National transposition is due by 9 December 2026, and national implementing legislation and procedure need examination. An incident date, supplier headquarters or website language cannot alone decide which law applies to a particular product.
The manufacturer of the relevant product
Article 8 first addresses the manufacturer of a defective product. In an AI arrangement, that product could be software supplied on its own or a finished device incorporating software. Article 4's manufacturer definition includes development, manufacture, having a product designed or manufactured, and presenting oneself as manufacturer through a name, trademark or other distinguishing feature. The factual arrangement matters more than an informal description such as platform partner.
Collect product labels, release records, supplier terms and development agreements. Identify who decided the product's intended function, approved its release and presented it under a brand. These records help analyse the statutory definition, although a private contract does not necessarily settle an injured person's rights. A business can also occupy different roles for different products in the same chain, so avoid assigning one permanent label to the whole organisation.
An upstream component supplier
A model or AI software element may be supplied as part of a larger product. Article 8 addresses the manufacturer of a defective component where integration or interconnection within the manufacturer's control caused the finished product to be defective. This does not remove the finished-product manufacturer's liability. The conditions still require identifying the component, its defect and its contribution to the relevant unsafe product.
The component manufacturer's exemption under Article 11 includes a situation where the product's defectiveness is attributable to the finished product's design or instructions given by its manufacturer. That makes interface specifications, permitted uses and integration instructions important evidence. The provider and application developer comparison explains why a defect originating in model behaviour must be distinguished from a defect introduced by the surrounding application.
Actors supplying products from outside the Union
Where the manufacturer of the product or component is established outside the Union, Article 8 identifies an importer and an authorised representative as relevant operators, without removing the manufacturer's responsibility. A fulfilment service provider is addressed where there is no Union-established importer or authorised representative. These are statutory categories with conditions, rather than a general rule that every intermediary is liable.
A distributor can face responsibility under the Directive's identification mechanism where the relevant Union operator cannot be identified and the distributor fails to provide the specified identification within one month of the request. Certain online platforms are subject to a linked rule under defined circumstances. Record the supply route and actual functions. A hosting provider, payment processor or marketplace does not acquire every statutory role simply because the transaction passed through its infrastructure.
Integrators and later modifiers
An integrator may be the final-product manufacturer, a component supplier or another service business, depending on its activities. Article 8 also treats a person who substantially modifies a product outside the manufacturer's control and then makes it available on the market or puts it into service as a manufacturer. A minor configuration change is not automatically a substantial modification, and unauthorised modification requires more than a vague statement that something changed.
Keep the before-and-after purpose, performance and risk profile, the identity of the changer and the subsequent supply or use. Authorisation matters because Article 4's manufacturer-control definition and Article 11's treatment of later software-related defects can affect the analysis. The question is not simply who last touched the system. It is which legal role and causal contribution are supported by the evidence for the product that caused harm.
Several actors do not remove the claim elements
Article 12 provides for joint and several liability where multiple economic operators are liable for the same damage under the Directive. That does not mean every participant in an AI supply chain is liable. Each relevant basis of responsibility must first be established. Recourse between businesses is distinct from the injured person's compensation claim and may involve contracts and national law.
The claimant must still address defectiveness, covered damage and causation, subject to Article 10's conditional rebuttable presumptions. A supplier map cannot substitute for a safety investigation. Link each actor to the product version, decision or component it controlled, then connect that evidence to the alleged defect. Where evidence is missing, distinguish an unresolved role from a proven absence of responsibility. That preserves a useful investigation without predetermining anyone's legal position.
Records that help the review
Use the following as a practical starting point. Select and preserve records appropriate to the product, incident and applicable procedure.
- Incident-time model, application and configuration identifiers
- Relevant inputs, outputs and decision records
- Supplier roles and change-control history
Independent educational information at EU Directive level. National implementing law and procedure require separate review.
Primary sources and legal scope
This page explains the EU Directive framework. Check national implementing law, the corrected temporal scope and relevant procedure before applying it to a case.
- Directive (EU) 2024/2853, consolidated text: Articles 2, 4, 6, 7, 8, 9, 10, 11 ↗
- Official Journal corrigendum, 7 May 2026: Article 2(1) ↗
Source register: corrected scope verified 16 October 2026. Article references identify the legal basis. No qualified legal review or national implementation status is claimed.