AI and Digital Health Products – EU Product Liability Reform

Proposed reform of the EU’s product liability landscape will have a significant impact on digital health products and services delivered using technologies such as wearable devices, telemedicine platforms and health apps. Our Products team examines some important proposed product liability reforms. They also explore their possible impact for digital health stakeholders. Additionally, they consider the implications for developers of software medical devices that will be regulated as AI.

As part of its holistic approach to AI policy, the European Commission has proposed a package of reforms to adapt EU product liability rules to the digital age and AI, including through the revision of the Product Liability Directive 85/374/EEC (the PLD). As discussed in our previous article on the PLD, this revised Directive is intended to be complementary in nature to current EU product safety frameworks, such as:

• The EU Medical Devices Regulation (EU) 2017/745 (MDR)
• The In-Vitro Diagnostic Medical Device Regulation (EU) 2017/746 (IVDR), and
• The recently adopted AI Act

These interlinked frameworks give rise to a complex new legislative environment that stakeholders must navigate with care. We highlight some important connections between these frameworks that developers of software medical devices that will be regulated as AI systems should be mindful of.

Broader scope of the PLD

The PLD seeks to update the EU’s strict liability regime applicable to products, including software and by extension, AI systems. Accordingly, claims for damage allegedly caused by AI-enabled digital health products and services will fall within the scope of the PLD. This is because the PLD expands the definition of a ‘product’ to include software:

“‘product’ means all movables, even if integrated into, or inter-connected with, another movable or an immovable; it includes electricity, digital manufacturing files, raw materials and software”.

While the term ‘software’ is not defined in the PLD, the recitals to the PLD make clear that it applies to software of all kinds, including:

• Operating systems
• Firmware
• Computer programmes
• Applications, and
• AI systems

It also acknowledges that software is capable of being placed on the market as a standalone product and may subsequently be integrated into other products as a component. Accordingly, software will be a product for the purposes of applying no-fault liability under the PLD. This applies irrespective of the mode of its supply or usage and whether it is stored on a device or accessed through a communication network, cloud technologies or supplied through a software-as-a-service model.

Insofar as an AI system qualifies as a ‘product’ and ‘software’, it is proposed to fall within the scope of the PLD. At a high-level, this will mean that the PLD will apply to most, if not all, consumer or public-facing systems, or systems that are components of hardware that qualify as a physical ‘product’. Accordingly, digital health products and services delivered using AI-enabled technologies such as wearable devices, telemedicine platforms and health apps will be affected.

Two noteworthy exclusions regarding the scope of the PLD are as follows:

• The new product liability rules contained in the PLD will apply to products placed on the market or put into service 24 months after its entry into force. The current Product Liability Directive 85/374/EEC will be repealed with effect from 24 months after the PLD’s entry into force. However, it will continue to apply to products placed on the market or put into service before that date.

• The PLD will not apply to pure information, such as the content of digital files or the mere source code of software. It will also not “apply to free and open-source software that is developed or supplied outside the course of a commercial activity” unless it is subsequently integrated by a manufacturer as a component into a product in the course of a commercial activity.

Defectiveness

Under the PLD, the criteria for determining the defectiveness of a product, including an AI system, will be expanded. Some of these additional criteria, which are non-exhaustive in nature, are particularly relevant to AI systems and link back to AI Act requirements:

• In the first instance, the PLD provides that a product will be considered defective “if it does not provide the safety that a person is entitled to expect or that is required under Union or national law”. Consequently, an AI system may be deemed defective for the purposes of a product liability claim by virtue of being non-compliant with requirements under the AI Act, the MDR and/or the IVDR.

• Additional defectiveness criteria specified under the PLD include a product’s interconnectedness, self-learning functionality and safety-relevant cybersecurity requirements.

• In reflecting the relevance of product safety and market surveillance legislation for determining the level of safety that a person is entitled to expect, the PLD also provides that, in assessing defectiveness, interventions by competent authorities should also be taken into account. This includes “any recall of the product or any other relevant intervention by a competent authority or by an economic operator as referred to in Article 8 relating to product safety”.

Accordingly, an AI-enabled product’s compliance with requirements under the AI Act, the MDR and/or the IVDR and interventions by competent authorities in respect of same, will weigh in the balance in terms of assessing the ‘defectiveness’ or otherwise of an AI system.

Rebuttable presumption - defectiveness

Under the PLD, the burden remains on a claimant to prove:

• The defectiveness of the product
• The damage suffered
• The causal link between the injury or damage sustained, and the allegedly defective product

These elements must be proven in accordance with the standard of proof applicable under national law in the relevant Member State(s). The PLD acknowledges, however, that injured parties are often at a disadvantage compared to manufacturers in terms of accessing and understanding information about how a product was produced and how it operates, particularly in cases involving technical or scientific complexity. Accordingly, the PLD introduces a rebuttable presumption of defectiveness where:

1. The claimant demonstrates that the product does not comply with mandatory product safety requirements laid down in Union law or national law.
2. The claimant demonstrates that the damage was caused by an “obvious malfunction” of the product during “reasonably foreseeable” use or under ordinary circumstances.
3. A defendant fails to comply with a court order to disclose relevant evidence at its disposal.

In the context of AI systems, the rebuttable presumption of defectiveness triggered under the PLD by a product’s non-compliance with mandatory product safety requirements laid down in Union law or national law could therefore be triggered by an act of non-compliance with requirements under the AI Act, the MDR and/or the IVDR.

Rebuttable presumption - causation

The PLD also provides for the presumption of a causal link between a product’s alleged defectiveness and the damage suffered, where it has been established that the product is defective, and the damage caused is of a kind typically consistent with the defect in question.

A rebuttable presumption will arise where a national court must presume a product’s defectiveness or the causal link between its defectiveness and the damage suffered, or both, where, despite the disclosure of evidence by a manufacturer, and taking all relevant circumstances into account:

• The claimant faces excessive difficulties, in particular due to technical or scientific complexity, in proving the product’s defectiveness or the causal link between its defectiveness and the damage, or both, and

• The claimant demonstrates that it is likely that the product is defective or that there is a causal link between the defectiveness, the damage, or both.
  

On the interpretation of ‘excessive difficulties’, Recital 48 of the PLD refers to AI systems specifically. It provides that in determining technical or scientific complexity, national courts must do this on a case-by-case basis, taking into account various factors, including:

• The complex nature of the technology used, such as machine learning.

• The complex nature of the causal link such as a link that, in order to be proven, would require the claimant to explain the inner workings of an AI system.

It further provides that, in the assessment of excessive difficulties, while a claimant should provide arguments to demonstrate excessive difficulties, proof of these difficulties should not be required. For example, in a claim concerning an AI system, the claimant should neither be required to explain the AI system’s specific characteristics nor how those characteristics make it harder to establish the causal link.

Manufacturer’s control

The PLD introduces various new provisions that recognise that, in the case of technologically sophisticated products, a manufacturer’s responsibilities do not necessarily crystallise at the factory gates. This is particularly significant for connected products, where the hardware manufacturer retains the ability to supply software updates or upgrades to the hardware by itself or via a third party.

The PLD provides that the developer or producer of software, including an AI system provider, should be treated as a manufacturer. While the ‘provider of a related service’ is recognised as an economic operator under the PLD, related services and other components, including software updates and upgrades, are considered within the manufacturer’s control where they are integrated, inter-connected or supplied by the manufacturer or where the manufacturer authorises or consents to their supply by a third party.

A ‘related service’ is defined in the PLD as “a digital service that is integrated into, or inter-connected with, a product in such a way that its absence would prevent the product from performing one or more of its functions”. For example, where a manufacturer consents to the provision by a third party of software updates for its product or where it presents a related service or component as part of its product even though it is supplied by a third party. However, a manufacturer isn’t considered to have consented to the integration or interconnection of software with its product merely by providing for the technical possibility to do so, or by recommending a certain brand or by not prohibiting potential related services or components. Additionally, once a product has been placed on the market, it is considered within the manufacturer’s control insofar as it retains the technical ability to supply software updates or upgrades itself or via a third party.

This means that manufacturers of products with digital elements may be liable for damage arising from changes to those digital elements that occur after the physical product is placed on the market. This is a significant shift to more of a ‘lifecycle’ approach. This aligns with the approach adopted under various pieces of EU product safety legislation, including the MDR, where manufacturers must continuously evaluate the impact of software updates and upgrades in products on the market. The consequence for manufacturers of AI-enabled products is that greater attention will need to be paid to:

• The degree of control it exercises over its products once placed on the market.

• Where its products remain within its control, the extent to which changes like software updates and upgrades impact on not just safety but also product liability exposure.

• What ‘related services’ form part of its products and the level of control exerted over these ‘related services’, including the nature of the relationship with any third-party providers of related services and the potential consequences of same from a product liability perspective.

Substantial modification

The PLD maintains the general limitation period of 3 years for the initiation of proceedings for the recovery of damages. This limitation period runs from the day on which the injured person became aware, or should reasonably have become aware, of all of the following:

1. The damage
2. The defectiveness, and
3. The identity of the relevant economic operator that can be held liable for the damage.

The PLD contains two modifications to the current 10-year longstop provision in the existing Product Liability Directive. First, an extension to 25 years in certain cases involving latent personal injuries unless the injured person has, in the meantime, initiated proceedings against a potentially liable economic operator. Second, where a product has been ‘substantially modified’, the calculation of time runs from the date that the substantially modified product has been placed on the market or put into service.

In that regard, the PLD defines ‘substantial modification’ as the modification of a product after it has been placed on the market or put into service:

1. That is considered substantial under relevant Union or national rules on product safety, or
2. Where relevant Union or national rules do not provide such a threshold, that:

• Changes the product’s original performance, purpose or type without being foreseen in the manufacturer’s initial risk assessment, and
• Changes the nature of the hazard, creates a new hazard, or increases the level of risk.

What amounts to a ‘substantial modification’ can be quite case specific. However, the reference in the definition to modifications that are “considered substantial under relevant Union or national rules on product safety” engages the AI Act. This is because it contains references to substantial modification in the context of ‘high-risk AI systems’, i.e. most software medical devices regulated as AI systems owing to the application of MDR, Annex VIII, Rule 11 and Article 6 of the AI Act. One such example is high-risk AI systems that continue to learn after being placed on the market or put into service.

Where no thresholds are provided under the relevant Union or national rules on product safety, for example in cases involving regulated AI systems that are not high-risk under the AI Act, the threshold is assessed by the extent to which the modification changes the product’s original intended functions or affects its compliance with applicable safety requirements or changes its risk profile. We expect that the practical application of these concepts in the context of AI systems will require complex and case-specific analyses on liability exposure and mitigation.

Irrespective of which threshold criteria is applicable to a specific AI-enabled product, AI system providers and providers of products with AI components, will need to carefully track how relevant AI systems are changing and the legal consequences of those changes.

Conclusion

On one hand, digital health stakeholders of products regulated under the MDR and/or the IVDR may be uniquely well-placed to adapt to these changes given their experience of complying with the sophisticated EU medical device regulatory framework. On the other hand, however, the move to bring the EU product liability regime up to speed with updated product safety legislation is likely to give rise to increased litigation risks that will require careful management, particularly for liability exposure in respect of software as a 'product' for the purposes of product liability claims. To prepare for these incoming changes, digital health stakeholders with products on the EU market should carefully consider their potential liability exposure under the PLD.

We would recommend that they carefully analyse their existing product portfolio to:

• Identify what products would fall within the scope of the PLD, including a review of third-party software and ‘related services’, i.e. digital services embedded in their hardware products.

• Review the warnings and disclaimers provided to users relating to risks or potential harm associated with using their products and related services, particularly having regard to the extended definition of damage.

• Incorporate the necessary screens and protocols into their product roadmaps in order to identify and mitigate EU product liability exposure.

Digital health stakeholders should also review their:

• Product liability insurance to ensure, amongst other things, that their coverage includes all damage envisaged under the PLD. Specifically, they should ensure that coverage extends to destruction or corruption of data and medically recognised damage to psychological health and to ensure that related services are also covered.

• Contractual arrangements with other economic operators to ensure there are adequate liability and indemnity provisions in place. This is particularly important given the new provisions in the PLD around service providers and what is considered to be within the manufacturer’s control – even if a third party is carrying out certain tasks or services on their behalf.

For more information, contact a member of our Product Regulation & Consumer team.

The content of this article is provided for information purposes only and does not constitute legal or other advice.