The European Commission has published its long-awaited software liability framework, a critical piece of the regulatory architecture underpinning the EU AI Act that will reshape how technology companies design and deploy artificial intelligence systems across the single market.
The framework, released Wednesday, establishes clear chains of accountability for software defects and algorithmic harm, moving beyond the patchwork of national laws that currently govern liability across the 27 member states. Under the new rules, software manufacturers — including AI developers — can be held strictly liable for damages caused by defective products, regardless of whether the harm stemmed from traditional code or machine learning models.
“This represents a fundamental shift in how we think about software accountability,” said Dr. Elena Vasquez, director of the Centre for Digital Regulation at the University of Amsterdam. “For the first time, we are treating AI systems not as abstract tools but as products with real-world consequences that demand the same rigorous liability standards we apply to physical goods.”
The framework introduces a tiered approach to liability. High-risk AI applications — those used in healthcare diagnostics, critical infrastructure, employment decisions, and law enforcement — face the most stringent requirements. Developers in these categories must maintain comprehensive documentation of training data, model architecture, and testing protocols, and they carry the burden of proof when demonstrating compliance.
Industry reaction has been mixed. Major enterprise software firms with established compliance teams have largely welcomed the clarity, while startups and open-source communities have expressed concern about the compliance burden. The Commission estimates that full implementation will require an average investment of €180,000 per affected product line, though it has proposed a dedicated SME support fund to ease the transition.
The framework also addresses the emerging challenge of autonomous decision-making. Where an AI system makes a decision without meaningful human review — such as automated loan denials or medical triage recommendations — the developer bears full liability for the outcome, establishing what legal experts are calling a “responsibility by design” standard.
The rules will be phased in over an 18-month period beginning January 2027, giving companies time to audit existing systems and implement the required documentation and testing infrastructure. Non-compliance carries penalties of up to 6% of global annual turnover, mirroring the enforcement mechanisms of the GDPR.