Artificial Intelligence Liability Directive

· About Artificial Intelligence Liability Directive

Key Takeaways

  • The Artificial Intelligence Liability Directive was never enacted; the European Commission proposed it on 28 September 2022, but the proposal was formally withdrawn in 2025 after the EU institutions did not reach agreement[2][5][10].
  • Because the proposal was withdrawn, there is no standalone EU-wide AI liability directive in force as of 6 October 2026, and there are no direct compliance deadlines or fines under this instrument[5][10][13].
  • The proposal would have applied to non-contractual civil liability claims involving AI systems, including rules easing proof for injured parties and allowing courts to order disclosure of evidence about certain AI systems[1][2][8].
  • The Commission’s 2022 proposal said Member States would have to transpose the directive two years after entry into force, but that timetable never became operative because the legislative file was withdrawn[1][15].
  • In practice, AI-related liability in the EU is now governed mainly by the AI Act, national tort law, and the revised Product Liability Directive, especially for software and AI-enabled products[13].
  • For compliance teams, the operative controls remain AI governance, documentation, logging, human oversight, cybersecurity, and vendor management, not any standalone AILD filing or certification regime[2][13].

What It Is

The Artificial Intelligence Liability Directive was a European Commission proposal designed to adapt non-contractual civil liability rules to damages caused with the involvement of AI systems[1][2]. It was intended to complement the EU AI Act by making it easier for injured parties to bring civil claims when AI-related failures cause harm[2][8].

The Commission proposed the directive on 28 September 2022[2]. The proposal was not adopted; Parliament materials now mark the file as withdrawn, and multiple institutional summaries state that the Commission withdrew the proposal in October 2025 after concluding that no agreement was foreseeable[5][7][10].

The proposal text contemplated entry into force 20 days after publication in the Official Journal, with Member States required to transpose it two years after entry into force[1][15]. Because the measure was withdrawn before adoption, those dates never took effect[5][10].

The directive would have applied across the EU’s civil liability framework, focusing on claims for damages linked to AI systems rather than creating a public enforcement regime[1][2]. The enforcement body would have been national courts applying harmonised EU rules, not a dedicated EU AI-liability regulator[1][8].

Who Must Comply

There is no current compliance population for the withdrawn directive, because it is not in force[5][10]. The relevant legal position is therefore that companies must comply with existing national civil liability rules, the AI Act, and the Product Liability Directive where applicable[13].

Had it been adopted, the proposal would have affected parties involved in AI systems where a claimant alleged non-contractual harm and sought to rely on disclosure or presumptions of causality[1][2]. That would have mattered most for providers, deployers, manufacturers, operators, importers, and other actors in the AI supply chain whose conduct or system failures could be linked to damage[2][13].

The proposal was designed to be territorially EU-wide in effect through Member State transposition, with practical impact extending to cross-border disputes involving EU courts and EU-law claims[1][2]. No express sectoral exemption framework is operative because the directive never entered into force[5][10].

For current planning purposes, the closest functional exemptions and carve-outs come from the AI Act’s sectoral structure and from product liability and tort-law exceptions under national law, not from the withdrawn proposal[13].

Core Requirements

  1. Presumption of causality: The proposal would have allowed courts to presume a causal link between an AI system’s fault and the damage suffered when the claimant could show the necessary factual elements, lowering the proof burden in AI cases[2][8].
  2. Disclosure of evidence: Courts would have been able to order disclosure of relevant information about AI systems, especially for high-risk systems, to help claimants substantiate a case[2][8].
  3. Fault-based civil liability alignment: The proposal targeted non-contractual civil liability, not criminal penalties or administrative fines, and it was intended to align liability rules with the AI Act’s risk-based structure[1][2].
  4. Coverage tied to AI involvement: The rules were meant to apply where damage was caused with the involvement of an AI system, including situations where opacity or technical complexity made proof difficult[1][2].
  5. National court application: Enforcement would have taken place through national courts applying harmonised procedural and evidentiary rules, rather than through a central EU enforcement authority[1][8].

Deadlines and Penalties

| milestone | date | what applies | |---|---:|---| | Commission proposal published | 28 September 2022 | Proposal introduced for civil-liability harmonisation for AI systems[2] | | Proposed transposition deadline | 2 years after entry into force | Would have required Member States to implement the directive, but the date never became operative[1][15] | | Proposal withdrawn | October 2025 | Legislative process ended; no directive entered into force[5][10] |

There are no maximum fines, administrative penalties, or other sanctions under this withdrawn directive because it was never adopted[5][10]. Any liability exposure now comes from national damages law, AI Act obligations, and product liability claims, which may include compensation, injunctive relief, and in some regimes costs or procedural sanctions, depending on the forum[13].

How to Comply

  1. Map AI systems and owners: Maintain an inventory of AI systems, use cases, suppliers, and accountable business owners so liability can be traced quickly across the lifecycle.
  2. Align governance to ISO 42001: Use an AI management system to define policy, roles, risk treatment, incident escalation, and internal assurance for high-impact systems.
  3. Embed ISO 27001 controls: Protect model weights, training data, logs, prompts, and output pipelines with access control, encryption, change management, and secure development practices.
  4. Use NIST CSF 2.0 for operational resilience: Structure AI cyber and operational risk around govern, identify, protect, detect, respond, and recover, especially for systems that could trigger safety or legal harm.
  5. Document decision logic and human oversight: Keep records of model purpose, limitations, validation, monitoring, and human review so you can rebut causation or fault allegations.
  6. Preserve logs and evidence: Retain prompts, outputs, versioning, incident records, and deployment history long enough to support internal investigations and litigation holds.
  7. Contract for liability allocation: Align supplier and customer contracts on warranties, audit rights, incident notification, indemnities, and evidence-sharing obligations.
  8. Test incident and claim response: Run tabletop exercises for harmful AI outcomes, including regulator inquiries, litigation holds, and disclosure requests.

Related Regulations

  • EU AI Act: The AI Act is the main horizontal EU AI regime and now carries the operational compliance burden that the withdrawn liability directive was meant to complement[2][11].
  • Product Liability Directive (Directive (EU) 2024/2853): This directive modernises strict product liability for software and AI-enabled products, so it now fills much of the gap that the AILD was intended to address[13].
  • GDPR: GDPR can overlap where AI harms involve personal data, automated decision-making, security breaches, or unlawful processing, but it addresses data protection rather than civil liability for damage[2].
  • National tort law: National negligence, defect, and causation rules remain the primary route for civil claims where the withdrawn directive would otherwise have harmonised evidentiary rules[13].
  • Sectoral safety laws: Product-safety, medical-device, automotive, and financial-services regimes may impose their own liability-adjacent duties that can supersede or supplement general AI rules[13].

FAQ

Does the Artificial Intelligence Liability Directive currently apply to companies outside the EU?

No. The directive proposal was withdrawn in 2025, so there is no operative EU-wide AILD to apply extraterritorially in 2026[5][10]. Non-EU companies still face exposure through the AI Act, product liability rules, and national civil claims where their products or services are used in the EU[13].

Are there any filing, certification, or registration duties under the AILD?

No. The proposal would have created civil-liability rules for courts, not a registration or certification regime[1][2]. Current compliance obligations arise from other instruments, especially the AI Act and related sectoral laws[13].

Did the directive ever enter into force?

No. The Commission proposed the directive on 28 September 2022, but the file was later withdrawn, so the text never became binding EU law[2][5][10]. Any dates in the proposal, including the two-year transposition period, never became operative[1][15].

Would courts have been able to order disclosure of AI information?

Yes, under the proposal, courts would have been able to order disclosure of relevant information about AI systems to help claimants prove fault and causation[2][8]. That mechanism was one of the proposal’s most distinctive features, but it is not currently in force[5][10].

What replaced the AI Liability Directive?

Nothing replaced it as a standalone horizontal civil-liability directive. The practical replacement is a combination of the AI Act, the revised Product Liability Directive, and ordinary national tort law[13]. Compliance teams should therefore focus on evidence retention, governance, and product-safety controls rather than waiting for a new AILD.

Sources

Put it into practice

More compliance guides