Who Is Liable Under the New EU Product Liability Directive? A Guide for Importers, ARs, Distributors, and Online Platforms
The new EU Product Liability Directive, Directive (EU) 2024/2853, replaces rules that have been in place since 1985. One of the biggest changes it introduces is not about what counts as a defective product. It is about who can be held responsible when something goes wrong.
Under the old regime, liability fell on the manufacturer and, for non-EU products, on the importer that brought them into the EU. Where a non-EU brand sold directly to EU consumers with no importer, there was often nobody in the EU to claim against. That is no longer the case. The new Directive adds authorised representatives, fulfilment service providers and, in some cases, online platforms to the liability chain.
The new Directive creates a structured liability chain that works its way through every major actor in a product’s journey to market. If you import, distribute, represent, fulfil, or sell through a platform, you need to understand where you sit in that chain and what it means for your business before the rules apply to products placed on the market after 9 December 2026.
The liability hierarchy: how it works
Article 8 of the new Directive sets out a structured liability framework. The purpose is to ensure there is always an EU-established entity that an injured person can bring a claim against, even when the original manufacturer is based outside the EU.
Two important points about how this structure works in practice:
- The chain is not entirely sequential. Where a manufacturer is outside the EU, the importer and AR can each be liable alongside that manufacturer. Not instead of them. Article 8 is explicit that their liability arises “without prejudice to the liability of the manufacturer,” and Article 12 provides that multiple liable operators can be held jointly and severally liable. The chain exists to ensure there is always an EU-established defendant reachable by a claimant, not to shield the original manufacturer.
- The importer and the AR can both be liable at the same time. Article 8(1)(c) lists them side by side, so having an importer does not remove the AR’s exposure. Only the fulfilment service provider is a true fallback: it becomes liable only where neither an importer nor an AR is established in the EU.
In practice, the framework is only as strong as the documentation and traceability behind it.
Manufacturers: the starting point
The manufacturer sits at the top of the chain. Under the new Directive, anyone who places a product on the EU market under their own name or brand is treated as a manufacturer, regardless of whether they made the product themselves. Private label sellers, own-brand retailers, and businesses that commission products from third-party factories all fall into this category.
EU-based manufacturers face direct and primary liability. Non-EU manufacturers are also in scope, but in practice how claims reach them depends on whether an importer or AR is present in the EU.
One important addition: the Directive extends liability to substantial modifications made after a product is placed on the market. If a business modifies a product, including through software updates or configuration changes, outside the original manufacturer’s control, they may be treated as a manufacturer for the purposes of that modification.
Importers: the first line in the EU
An importer is any natural or legal person who places a product from a third country on the EU market. Importers were already liable under the 1985 Directive, and they remain the first EU-based party in the liability chain for products made outside the EU. What has changed is the wider framework around them: more types of damage can be claimed, there are longer liability periods, and courts can order disclosure of evidence.
This matters because many businesses assume their EU distributor handles compliance. Unless that distributor is the first to bring the product into the EU, they are a distributor, not an importer. The distinction is significant. Distributors sit much lower in the hierarchy and face exposure only in specific circumstances.
If you are an EU business purchasing products from outside the EU and selling them on, you are almost certainly the importer. That puts you second in the liability chain, immediately behind the manufacturer.
Importers should consider three things in particular:
- Supplier contracts should include indemnification clauses that shift financial risk back to the non-EU manufacturer if a claim is brought.
- Product documentation needs to be complete. Courts can order disclosure of technical files, test reports, and risk assessments. An importer who cannot produce them is in a weak position.
- Insurance coverage should be reviewed, since policies written before December 2026 may not reflect the new liability exposure.
Authorised Representatives: new liability exposure
Until now, the authorised representative role under GPSR has been primarily administrative. Hold the documentation, liaise with authorities, pass communications through the Safety Business Gateway. The AR has not historically been a target for product liability claims.
The new Directive changes that. If a non-EU manufacturer has appointed an AR, the AR can face direct liability claims for defective products, alongside the manufacturer and any EU importer. Under the old 1985 Directive, the AR was not in scope for this at all.
The AR is no longer just a compliance function. Under the new Directive, they are a named party in the product liability chain.
What this means for your mandate
Most AR agreements were written with GPSR obligations in mind. They set out tasks like holding documentation, liaising with authorities, and passing notifications through the Safety Business Gateway. They were not designed with product liability exposure in the frame.
The most important thing to check is whether your mandate includes indemnification arrangements. If a claim is successfully brought against the AR as a result of a defect in your product, who bears the financial risk? Without a clear indemnification clause, that question is left to interpretation. A well-structured mandate should include a provision where the manufacturer agrees to hold the AR harmless for claims arising from product defects in the mandate’s scope.
Documentation quality
The AR typically holds the technical file. Under the new Directive, courts can order disclosure of that file. If a court orders disclosure and the relevant evidence isn’t provided, the court can presume the product is defective (Article 10). The same presumption can apply where a product doesn’t meet mandatory safety requirements, so missing risk assessments or test reports are a real risk. The AR has a direct interest in making sure what they hold is accurate and current — not just for authority inspections, but as litigation-ready evidence.
Software and post-sale changes
Under the new Directive, software is a product in its own right, including AI systems and software supplied on its own (free, non-commercial open-source software is excluded). If your product includes software, connected features, or receives updates after sale, liability does not end when the product is first placed on the market. A failure to provide security updates needed to keep the product safe can also make it defective. A defect introduced through a post-sale update can trigger a claim, and your AR needs a process for receiving updated documentation from you and keeping the technical file current to reflect those changes.
Five questions to ask your AR now
Before December 2026, it is worth having a direct conversation with your representative covering the following:
1. Does your mandate include indemnification arrangements?
If not, it needs updating before December 2026.
2. Is your technical documentation in a complete and defensible state?
Documentation adequate for a market surveillance inspection may not hold up in litigation. Ask your AR to review what they hold and flag any gaps.
3. How does your AR handle post-sale changes?
If your product receives updates or is modified after sale, there should be a formal process for keeping the technical file current.
4. Does your AR have professional indemnity or product liability insurance?
Not all AR providers do. This is worth asking directly.
5. Has your AR reviewed their mandate terms in light of the new Directive?
A proactive AR will already be doing this. If yours has not raised it, that is worth noting.
Fulfilment Service Providers: subsidiary but real exposure
Fulfilment service providers were not in scope under the old 1985 Directive at all. Under the new rules they sit in fourth position.
For the purposes of the Directive, a fulfilment service provider is any business that offers, in the course of a commercial activity, at least two of the following services in respect of a product it does not own: warehousing, packaging, addressing, and dispatching. A business that only handles one of these functions. For example, purely a warehousing provider — does not meet the definition and is not in scope as an FSP. Standard postal services and parcel delivery services as defined in EU law are also excluded.
Their liability is explicitly subsidiary. They can only be held liable where no manufacturer, importer, or AR established in the EU can be identified. FSPs serving brands with clear EU-established operators should not normally face claims.
Where it becomes relevant is in direct-from-manufacturer e-commerce, where non-EU brands use EU fulfilment centres and have no local importer or AR. In that scenario the FSP becomes the only EU-established operator and the fallback defendant. FSPs should review their client base for this gap and consider what contractual protections and indemnification arrangements are in place with the brands they serve.
Distributors: limited exposure with one important trigger
Distributors sit fifth in the liability hierarchy. In most cases, they are not directly liable — but there is one exception. If a claimant asks a distributor to identify who in the supply chain is responsible for a product, the distributor has one month to provide that information. Fail to do so, and they become liable themselves.
The fix is simple: keep clear records of your suppliers. A distributor who can point to the manufacturer, importer, or authorised representative without delay has nothing to worry about.
Online Platforms: the consumer perception test
Online platforms can be held liable under the Directive, but two distinct conditions must both be satisfied:
- Presentation and perception. The platform must have presented the product, or otherwise enabled the specific transaction, in a way that would lead an average consumer to believe the product is being supplied by the platform itself, or by a trader acting under the platform’s authority or control. A platform that clearly identifies the third-party seller and makes their contact details available to consumers does not meet this condition.
- Failure to identify an upstream operator. Even where the first condition is met, the platform only becomes liable if it also fails to identify an EU-established economic operator within one month of a request from an injured person. A platform that can promptly identify the manufacturer, importer, or AR behind the product avoids liability by satisfying that traceability obligation.
Platforms that handle fulfilment, control the product page, suppress the seller’s identity, or present products under their own branding are at greater risk of meeting the first condition, but can still protect themselves by maintaining clear traceability records and responding promptly to identification requests.
For brands selling through third-party platforms, the practical implication is to ensure the platform clearly identifies you as the seller and discloses your contact details to consumers. Where it does not, the platform absorbs greater liability risk, but depending on your EU establishment status, you may still be reachable as the manufacturer regardless.
What all operators should do before December 2026
Regardless of where you sit in the supply chain, the new Directive rewards good documentation, clear traceability, and contractual protection.
Review your contracts
Indemnification clauses, liability caps, and warranty terms between supply chain parties need to reflect the new framework. Agreements that predate December 2026 were almost certainly not written with this liability structure in mind.
Audit your documentation
Courts can order disclosure of technical files, test reports, risk assessments, and change records. Incomplete or inconsistent documentation creates a gap that claimants can exploit. Every operator in the chain benefits from clean, complete records.
Check your insurance
Product liability insurance needs to be reviewed in light of the expanded scope and new categories of recoverable damage, including medically recognised psychological harm and the destruction or corruption of data not used for professional purposes. The old €500 threshold for property damage is gone, and Member States can no longer cap total liability. Claims can be brought for up to 10 years after a product is placed on the market, extended to 25 years where a personal injury takes time to appear.
Establish traceability procedures
Every operator except the manufacturer has a potential obligation to identify the operators above them in the chain when asked. If you cannot do that within one month, your position in the hierarchy shifts and your exposure increases.
The overlap with GPSR compliance
Good GPSR compliance and the new product liability framework reinforce each other. Under the new Directive, non-compliance with mandatory safety requirements like those in the GPSR can trigger a legal presumption that a product is defective. Brands that have invested in proper technical documentation, risk assessments, and GPSR-compliant labelling are in a better position under the new liability rules as well.
Compliance shortcuts that you might have managed under a market surveillance context become much harder to defend in a product liability proceeding.
How Euverify can help
Euverify provides Authorised Representative and Responsible Person services for brands and manufacturers selling into the EU and UK. We act as EU Authorised Representative and UK Responsible Person for products covered by GPSR, CE and UKCA rules, and REACH.
Our updated representation agreement reflects the new EU Product Liability Directive. From 9 December 2026, every product we represent must be covered by product liability insurance valid in the markets where it is sold. We also check that the documentation we need to represent your product is complete and up to date. Compliance remains the manufacturer’s responsibility. If you are assessing your responsibilities under the new liability framework, we can review your current compliance arrangements and identify any gaps.
Find out more about our EU and UK Authorised Representative Services.
