E m e r g i n g
L i a b i l i t y
R i s k s :
How AI, Software, and Tech Businesses Can Prepare
LAYTONS ETL Yarnwicke, 119 - 121 Cannon Street, London EC4N 5AT +44 (0)20 7842 8000 www.laytons.com
The Law Commission of England and Wales’s proposals to reform product liability law are likely to have a major impact on AI, software, technology, and social media businesses, and on anyone using their products or services. The proposals extend the entire product liability regime, including its strict liability under the Consumer Protection Act 1987 (CPA), to software and AI systems. If enacted, the proposals will have pervasive effects, modernising legislation originally designed for a world of physical products and adapting it to an economy increasingly built around software, artificial intelligence, and digital services. The review sits against the backdrop of the EU’s New Product Liability Directive (Revised Product Liability Directive (the new PLD)), effective from 9 December 2026. Appendix 2 of the full consultation paper compares the new PLD’s provisions with the Commission’s proposals. It makes far-reaching reforms to its predecessor (Directive 85/374/EEC) to address risks posed by new technologies, including digital products, software, and AI, as well as modern supply chains, including online marketplaces and circular business models. The proposal sets out 7 principles for assessing what constitutes a product defect, including a new presumption of a defect under a risk-sharing mechanism between potential defendants in the supply chain where the claimant faces exceptional evidential difficulties.
The Key Proposed Changes Potentially affected businesses should consider the proposals and respond to the consultation: a simple process that involves answering a series of questions online and, if you wish, providing further comments.
The CPA reform appears increasingly likely, considering the enactment of the Product Regulation and Metrology Act 2025, the enabling legislation designed to modernise the UK’s product safety regulatory framework. The full consultation document is available at Product liability - consultation paper; the questions raised can be viewed from page 196 et seq., and the summary of the proposals is available at Product liability consultation paper summary. The proposals are currently at the consultation stage and remain open until 14 January 2027. The Law Commission is expected to publish its final recommendations later next year.
Technology activities to be “products” not “services” and therefore caught by the legislation Product liability has traditionally concerned companies manufacturing cars, machinery, medical devices, or consumer goods, and therefore most technology businesses have thought themselves outside the regime as they develop software, operate digital platforms, build AI systems, provide SaaS products, or design online services. These activities are currently considered ‘services’ and therefore outside the product liability regime. However, if the proposals go ahead, they will become ‘products’ for product liability purposes and fall within the regime.
Strict (i.e.no fault) liability Product liability under the Consumer Protection Act is a form of strict liability. A claimant does not have to prove that a producer was negligent or at fault. They must prove that a product was defective, damage occurred, and the defect caused the damage.
Software could become a product Arguably one of the most important proposals is to make clear that software can itself constitute a product. That could include software embedded within physical goods, downloaded software, cloud-based software and software supplied as a service. Importantly, AI systems would also expressly fall within the proposed definition. This removes an increasingly artificial distinction between physical and digital products. A defective physical component in a machine is plainly capable of causing harm. Increasingly, however, software, an algorithm, or an AI system may determine that machine’s behaviour rather than the hardware itself. The Law Commission is effectively asking whether the law should continue to treat those differently. The Law Commission’s proposals limit software from being treated as a defective product where the defect relates to the supply of some ancillary service.
Supplied in the course of business and/ or with a view to profit The current product liability regime requires the product to be supplied in the course of a business and/or with a view to profit. Digital products can be monetised in various ways, including subscriptions, advertising, support services, data, or broader commercial relationships. The proposals therefore warrant attention from businesses that may never have regarded themselves as ‘producers’ at all.
Social media platforms may face a new type of exposure. The implications become particularly striking when applied to social media and online platforms. The Law Commission is examining whether platforms could treat features they design and control as products. Examples include recommendation algorithms, infinite scrolling, autoplay, likes and sharing mechanisms, personal notifications, content filters, parental controls, age-verification systems and screen-time tools. Many businesses currently regard these as product design, user experience, engagement, or growth. Existing online safety legislation principally regulates the systems and processes platforms must operate. Product liability law could create a separate route for an individual to seek compensation for harm allegedly caused by a defective feature or system. Significantly, it proposes extending the types of harm for which compensation can be recovered to include psychological harm. For social media, gaming, and other consumer-facing digital businesses, this could make decisions traditionally made by product, UX, and growth teams legally significant in ways they did not previously anticipate.
AI presents a particular problem: how do you prove what went wrong? AI systems present another difficulty for conventional liability rules from the claimant’s point of view. Where a simple mechanical product fails, it may be comparatively straightforward to investigate what went wrong. With a complex AI model, establishing the answer can be much harder, as the relevant information may lie entirely within the developer’s systems. A model may be highly complex, adaptive or difficult to interpret. Even the business operating the system may not be able to reconstruct precisely why a particular output was produced. The Law Commission is therefore considering mechanisms that could make it easier for claimants to establish a defect or causation where evidence is inaccessible or where technical complexity creates an extreme imbalance between the parties. Technology businesses should consider what evidence they can produce if challenged several years after a system caused alleged harm. Model documentation, testing, audit trails, governance records, incident logs, and evidence explaining design decisions may therefore become relevant not only from a regulatory perspective but also from a civil liability perspective.
Software updates
For example, an AI service might involve a foundation-model
Digital products also challenge another assumption built
integrator, a business using the system and a marketplace
into traditional product liability law: that a product is made,
through which the application is distributed. When something
supplied and then remains essentially the same.
goes wrong, each may point to another participant in the
developer, an application developer, a cloud provider, an
supply chain, making contractual risk allocation important. Software, on the other hand, can be patched, updated,
Technology businesses may need to reconsider indemnities,
modified, retrained and integrated with other systems, or even
liability caps, supplier warranties, insurance requirements and
continue to learn or adapt as it operates. The Law Commission
rights to obtain information from upstream providers.
therefore proposes that assessing whether a product is defective should take account of issues such as software’s ability to learn or adapt, cybersecurity, interoperability, and safety-related functionality. Importantly, continuing control over a product may also incur liability. A defective update could potentially create liability after the original product was supplied. Conversely, failing to provide an update necessary to address a safety problem could also incur liability. For businesses accustomed to treating post-launch updates primarily as technical or commercial decisions, this could significantly alter the risk analysis.
Record retention There may also be consequences for record retention and insurance. The consultation proposes amending the existing ten-year limitation framework, including a longer period of twenty-five years for certain latent personal injuries and the possibility of time beginning again after substantial modifications. For businesses operating products that evolve continuously, determining what constitutes a significant modification may itself become an important legal question.
Types of damage recoverable The Law Commission is also considering the types of damage
Insurance policies Traditionally, product liability insurance policies have been available as an “add-on” for businesses. If the proposals are enacted, they will need to be reviewed because additional parties may be responsible, and the scope of product liability may change. It may also be necessary to review or implement professional indemnity insurance policies, as advisers will carry further liabilities.
Questions The proposals raise several questions that businesses may wish to address during the consultation. Regarding legal liability: •
When should an AI model be treated as a product?
•
Who should bear responsibility where several businesses contribute to a digital system?
•
modification? •
psychiatric injury, an issue of obvious relevance where digital platforms or AI systems are alleged to have caused psychological harm. The consultation also considers damage involving the corruption or destruction of data and changes to
somebody else? •
Commercial questions: •
Will appropriate insurance remain available?
•
Will smaller technology businesses face disproportionate compliance costs?
•
Who may be liable?
•
traditional manufacturers but across the technology supply chain, including developers, businesses making substantial modifications, fulfilment providers, and certain other commercial participants. This widens the range of potential defendants.
When should a platform feature be considered defective rather than merely controversial or unpopular?
existing property-damage rules.
The Law Commission is examining liability not only for
How should liability apply to businesses that provide general-purpose technology later configured by
that may be recoverable. This includes medically recognised or recognisable
When does a software update amount to a substantial
Could broad liability discourage useful innovation or cause suppliers to withdraw certain services? Should responsibility fall on the developer, the user or the party with the greatest ability to control the relevant risk?
The businesses most affected may be those that discover too late that the law has begun treating their software, algorithms and AI systems not merely as services, but as products capable of causing legally compensable harm.
Actions for businesses likely to be affected by the proposed changes:
All businesses should ensure they respond to the consultation
For all businesses: Analyse your existing business activity,
If you would like to discuss how these changes could affect
its legal and practical risks in the light of the proposed new
your business or need tailored advice, please contact Paddy
rules. Reduce risks where practical. Lay off risks on others.
Kelly, Commercial Consultant at Laytons, for expert guidance.
Carry appropriate insurance designed to meet the new legal environment and its risks. View opportunities and costs of bringing claims against others to reduce liabilities. Restructure your company group to silo risk where possible, rearrange contracts with others, limit liabilities contractually, engage legal and other professional advisors to do so. Manufacturers with embedded software systems in their physical goods: Review whether the proposed changes will adversely affect their liabilities and what steps they can take to mitigate them. Technology businesses: Reconsider indemnities, liability caps, supplier warranties, insurance requirements, and rights to obtain information from upstream providers. Consider and preserve evidence they can produce if challenged several years after a system caused alleged harm. Model documentation, testing, audit trails, governance records, incident logs, and evidence explaining design decisions may therefore also become relevant from regulatory and civil liability perspectives. Suppliers and developers of AI: A foundation-model developer, an application developer, a cloud provider, an integrator, a business using the system and a marketplace through which the application is distributed may all be swept up into the new product liability regime. They will all need to review and amend contractual limitations of liability and any indemnities they give or receive. Developers of software or agents: AI has reduced the cost, time, and human involvement of developing software. While this has allowed many low-cost entrants into the market, new liabilities will require repricing the software to cover the risks being involuntarily assumed. Social media providers: Features in the design and delivery of social media platforms may carry product liability and product safety risks. Exercise great care when providing recommendation algorithms, infinite scrolling, autoplay, likes and sharing mechanisms, personal notifications, content filters, parental controls, age-verification systems, and screen-time tools.
Paddy Kelly
Consultant | Commercial paddy.kelly@laytons.com +44 (0)20 7842 8018
Our Expertise •
Arbitration
•
Banking & Finance
•
Commercial & Corporate
•
Data Protection & Information
•
Disputes
•
Employment
•
IP & Technology
•
Intellectual Property Disputes
•
Private Wealth & Philanthropy
•
Real Estate Corporate
•
Real Estate Disputes
•
Real Estate Investment & Finance
•
Regulatory Law
•
Restructuring & Insolvency
•
Tax
LAYTONS ETL Yarnwicke, 119 - 121 Cannon Street, London EC4N 5AT +44 (0)20 7842 8000 www.laytons.com