On 9 December 2026, the deadline passes for EU member states to bring Directive (EU) 2024/2853 into national law. It replaces the product-liability regime that has governed European manufacturers since 1985 — a text written when a product was a physical object that left a factory finished. The new one says a product is also software, and that includes the update a car downloads overnight.
For Tesla, whose vehicles change behaviour by over-the-air update more often than any other carmaker's, this is the most consequential EU rule change of the year that is not about type approval.
What counts as a defect now
The directive extends the definition of "product" to embedded, standalone and cloud-based software: firmware, operating systems, AI systems, and the digital services integrated with a vehicle where their absence would stop it doing its job. Navigation and voice assistants are named examples.
That pulls several things inside the liability perimeter that were previously argued to sit outside it:
| Now capable of being a defect | Previously contested |
|---|---|
| A faulty over-the-air software update | Post-sale changes to a delivered car |
| A known security vulnerability left unpatched | Failure to supply an update |
| Behaviour of an adaptive or self-learning system | Outputs not specified at manufacture |
| A safety-relevant update the maker never shipped | Omission rather than a physical fault |
The liability window is ten years from the moment the product is placed on the market, extended to twenty-five for latent personal injury.
The burden of proof moves
This is the part European lawyers are focused on, and the part Czech outlet auto.cz led its coverage on: until now, a driver claiming an electronic system caused a crash had to prove it.
The directive introduces rebuttable presumptions. Defectiveness can be presumed where the manufacturer fails to disclose relevant evidence a court has ordered, where the product breaches mandatory safety requirements, or where there is an obvious malfunction. Causation can be presumed where the damage is of a kind typically consistent with the defect, and where technical or scientific complexity makes proof excessively difficult for the claimant.
Courts also gain the power to order disclosure of internal records — development documentation, and event-data-recorder telemetry, mandatory on EU cars since 2022. The manufacturer must present technical evidence in an accessible, understandable form.
The practical effect: an owner alleging repeated phantom braking no longer has to reverse-engineer the perception stack. If the malfunction is evident, the maker has to show the system worked as it should.
The limit worth knowing
The directive applies to products placed on the market or put into service after 9 December 2026. Cars already delivered stay under the 1985 regime. Coverage that says carmakers "become liable in December" for their assistance systems generally is overstating the scope.
What is genuinely unsettled is the OTA update itself. A manufacturer that substantially modifies a product after it is on the market can be treated as its manufacturer for liability purposes — which raises, but does not clearly answer, whether a 2026 car receiving a 2028 update pulls that update into the new regime. Expect that to be litigated rather than legislated.
Member states may also drop the "state of the art" defence, under which a maker escapes liability for a defect undiscoverable given the science at the time. Where a country omits it, an autonomous-driving manufacturer loses a significant shield. Transposition is national, so the map will not be uniform on 10 December — compare China, which put manufacturer liability for autonomous systems into road-traffic law this August.