Who Is Liable Under the New EU Product Liability Directive? A Guide for Importers, ARs, Distributors, and Online Platforms
The new EU Product Liability Directive, Directive (EU) 2024/2853, replaces rules that have been in place since 1985. One of the biggest changes it introduces is not about what counts as a defective product. It is about who can be held responsible when something goes wrong.
Under the old regime, liability focused almost entirely on the manufacturer. Non-EU brands with no EU presence could, in practice, sit outside the reach of EU product liability law. That is no longer the case.
The new Directive creates a structured liability chain that works its way through every major actor in a product’s journey to market. If you import, distribute, represent, fulfil, or sell through a platform, you need to understand where you sit in that chain and what it means for your business before the rules take effect in December 2026.
The liability hierarchy: how it works
Article 8 of the new Directive sets out a structured liability framework. The purpose is to ensure there is always an EU-established entity that an injured person can bring a claim against, even when the original manufacturer is based outside the EU.
Two important points about how this structure works in practice:
- The chain is not entirely sequential. Where a manufacturer is outside the EU, the importer and AR can each be liable alongside that manufacturer. Not instead of them. Article 8 is explicit that their liability arises “without prejudice to the liability of the manufacturer,” and Article 12 provides that multiple liable operators can be held jointly and severally liable. The chain exists to ensure there is always an EU-established defendant reachable by a claimant, not to shield the original manufacturer.
- The importer and AR positions are sequential relative to each other. An AR only becomes the liable EU-established operator where there is no importer in the EU. Likewise, a fulfilment service provider only becomes the fallback defendant where neither an importer nor an AR is established in the EU.
In practice, the framework is only as strong as the documentation and traceability behind it.
Manufacturers: the starting point
The manufacturer sits at the top of the chain. Under the new Directive, anyone who places a product on the EU market under their own name or brand is treated as a manufacturer, regardless of whether they made the product themselves. Private label sellers, own-brand retailers, and businesses that commission products from third-party factories all fall into this category.
EU-based manufacturers face direct and primary liability. Non-EU manufacturers are also in scope, but in practice how claims reach them depends on whether an importer or AR is present in the EU.
One important addition: the Directive extends liability to substantial modifications made after a product is placed on the market. If a business modifies a product, including through software updates or configuration changes, outside the original manufacturer’s control, they may be treated as a manufacturer for the purposes of that modification.
Importers: the first line in the EU
An importer is any natural or legal person who places a product from a third country on the EU market. Under the new Directive, importers move from a secondary compliance role into the primary liability chain for non-EU manufactured products.
This matters because many businesses assume their EU distributor handles compliance. Unless that distributor is the first to bring the product into the EU, they are a distributor, not an importer. The distinction is significant. Distributors sit much lower in the hierarchy and face exposure only in specific circumstances.
If you are an EU business purchasing products from outside the EU and selling them on, you are almost certainly the importer. That puts you second in the liability chain, immediately behind the manufacturer.
Importers should consider three things in particular:
- Supplier contracts should include indemnification clauses that shift financial risk back to the non-EU manufacturer if a claim is brought.
- Product documentation needs to be complete. Courts can order disclosure of technical files, test reports, and risk assessments. An importer who cannot produce them is in a weak position.
- Insurance coverage should be reviewed, since policies written before December 2026 may not reflect the new liability exposure.
Authorised Representatives: new liability exposure
Until now, the authorised representative role under GPSR has been primarily administrative. Hold the documentation, liaise with authorities, pass communications through the Safety Business Gateway. The AR has not historically been a target for product liability claims.
The new Directive changes that. The AR sits in third position in the liability hierarchy. If a non-EU manufacturer has no EU importer and only an AR, the AR can face direct liability claims for defective products. Under the old 1985 Directive, the AR was not in scope for this at all.
The AR is no longer just a compliance function. Under the new Directive, they are a named party in the product liability chain.
What this means for your mandate
Most AR agreements were written with GPSR obligations in mind. They set out tasks like holding documentation, liaising with authorities, and passing notifications through the Safety Business Gateway. They were not designed with product liability exposure in the frame.
The most important thing to check is whether your mandate includes indemnification arrangements. If a claim is successfully brought against the AR as a result of a defect in your product, who bears the financial risk? Without a clear indemnification clause, that question is left to interpretation. A well-structured mandate should include a provision where the manufacturer agrees to hold the AR harmless for claims arising from product defects in the mandate’s scope.
Documentation quality
The AR typically holds the technical file. Under the new Directive, courts can order disclosure of that file. If it is incomplete, outdated, or missing risk assessments and test reports, courts may presume the product is defective once a claim is brought. The AR has a direct interest in making sure what they hold is accurate and current — not just for authority inspections, but as litigation-ready evidence.
Software and post-sale changes
If your product includes software, connected features, or receives updates after sale, liability does not end when the product is first placed on the market. A defect introduced through a post-sale update can trigger a claim, and your AR needs a process for receiving updated documentation from you and keeping the technical file current to reflect those changes.
Five questions to ask your AR now
Before December 2026, it is worth having a direct conversation with your representative covering the following:
1. Does your mandate include indemnification arrangements?
If not, it needs updating before December 2026.
2. Is your technical documentation in a complete and defensible state?
Documentation adequate for a market surveillance inspection may not hold up in litigation. Ask your AR to review what they hold and flag any gaps.
3. How does your AR handle post-sale changes?
If your product receives updates or is modified after sale, there should be a formal process for keeping the technical file current.
4. Does your AR have professional indemnity or product liability insurance?
Not all AR providers do. This is worth asking directly.
5. Has your AR reviewed their mandate terms in light of the new Directive?
A proactive AR will already be doing this. If yours has not raised it, that is worth noting.
Fulfilment Service Providers: subsidiary but real exposure
Fulfilment service providers were not in scope under the old 1985 Directive at all. Under the new rules they sit in fourth position.
For the purposes of the Directive, a fulfilment service provider is any business that offers, in the course of a commercial activity, at least two of the following services in respect of a product it does not own: warehousing, packaging, addressing, and dispatching. A business that only handles one of these functions. For example, purely a warehousing provider — does not meet the definition and is not in scope as an FSP. Standard postal services and parcel delivery services as defined in EU law are also excluded.
Their liability is explicitly subsidiary. They can only be held liable where no manufacturer, importer, or AR established in the EU can be identified. FSPs serving brands with clear EU-established operators should not normally face claims.
Where it becomes relevant is in direct-from-manufacturer e-commerce, where non-EU brands use EU fulfilment centres and have no local importer or AR. In that scenario the FSP becomes the only EU-established operator and the fallback defendant. FSPs should review their client base for this gap and consider what contractual protections and indemnification arrangements are in place with the brands they serve.
Distributors: limited exposure with one important trigger
Distributors sit fifth in the liability hierarchy. In most cases, they are not directly liable — but there is one exception. If a claimant asks a distributor to identify who in the supply chain is responsible for a product, the distributor has one month to provide that information. Fail to do so, and they become liable themselves.
The fix is simple: keep clear records of your suppliers. A distributor who can point to the manufacturer, importer, or authorised representative without delay has nothing to worry about.
Online Platforms: the consumer perception test
Online platforms can be held liable under the Directive, but two distinct conditions must both be satisfied:
- Presentation and perception. The platform must have presented the product, or otherwise enabled the specific transaction, in a way that would lead an average consumer to believe the product is being supplied by the platform itself, or by a trader acting under the platform’s authority or control. A platform that clearly identifies the third-party seller and makes their contact details available to consumers does not meet this condition.
- Failure to identify an upstream operator. Even where the first condition is met, the platform only becomes liable if it also fails to identify an EU-established economic operator within one month of a request from an injured person. A platform that can promptly identify the manufacturer, importer, or AR behind the product avoids liability by satisfying that traceability obligation.
Platforms that handle fulfilment, control the product page, suppress the seller’s identity, or present products under their own branding are at greater risk of meeting the first condition, but can still protect themselves by maintaining clear traceability records and responding promptly to identification requests.
For brands selling through third-party platforms, the practical implication is to ensure the platform clearly identifies you as the seller and discloses your contact details to consumers. Where it does not, the platform absorbs greater liability risk, but depending on your EU establishment status, you may still be reachable as the manufacturer regardless.
What all operators should do before December 2026
Regardless of where you sit in the supply chain, the new Directive rewards good documentation, clear traceability, and contractual protection.
Review your contracts
Indemnification clauses, liability caps, and warranty terms between supply chain parties need to reflect the new framework. Agreements that predate December 2026 were almost certainly not written with this liability structure in mind.
Audit your documentation
Courts can order disclosure of technical files, test reports, risk assessments, and change records. Incomplete or inconsistent documentation creates a gap that claimants can exploit. Every operator in the chain benefits from clean, complete records.
Check your insurance
Product liability insurance needs to be reviewed in light of the expanded scope, longer liability periods, and new categories of recoverable damage under the Directive, including data loss and medically recognised psychological harm.
Establish traceability procedures
Every operator except the manufacturer has a potential obligation to identify the operators above them in the chain when asked. If you cannot do that within one month, your position in the hierarchy shifts and your exposure increases.
The overlap with GPSR compliance
Good GPSR compliance and the new product liability framework reinforce each other. Under the new Directive, non-compliance with mandatory safety requirements like those in the GPSR can trigger a legal presumption that a product is defective. Brands that have invested in proper technical documentation, risk assessments, and GPSR-compliant labelling are in a better position under the new liability rules as well.
Compliance shortcuts that you might have managed under a market surveillance context become much harder to defend in a product liability proceeding.
How Euverify can help
Euverify provides Authorised Representative and Responsible Person services for brands and manufacturers selling into the EU and UK. We support businesses with GPSR compliance, CE and UKCA marking, REACH obligations, and market access.
We are also fully prepared for the new EU Product Liability Directive, with updated services, PLD-compliant insurance, and reviews of technical files and risk assessments. If you are assessing your responsibilities under the new liability framework, we can review your current compliance arrangements and identify any gaps.
Find out more about our EU and UK Authorised Representative Services.
