Jigsaw Pieces Falling into Place: Do the Territorial Scopes of the AI Act and the Revised Product Liability Directive Dovetail?

This post has been written by Michiel Poesen, lecturer in private international law at the University of Aberdeen. The author asks the question whether the territorial scope of the European AI Act and the Revised Product Liability Directive are consistent. Both instruments are intended to work in tandem. While the former sets out the obligations that AI systems should meet to enter the EU market, the latter provides an ex post civil remedy to European citizens who suffer certain types of damage caused by AI systems. To truly function as complementary instruments, their respective territorial scopes should be consistent. This blogpost shows that they most likely are.

AI and Product Liability in the EU

The EU has been actively regulating Artificial Intelligence (“AI”) for well over half a decade. Heralded as the first comprehensive legal instrument addressing AI, the EU adopted the so-called AI Act (Regulation 2024/1689), which requires that AI systems meet certain standers before they are placed onto the European market. Subsequently, the EU adopted the Revised Product Liability Directive (“Revised PLD”), which harmonises certain aspects of the civil liability that developers and deployers of AI systems may incur if a system causes harm to property, bodily harm, or loss of data (Article 6(1) Revised PLD). Moreover, the EU adopted the General Product Safety Regulation (GPSR) in 2023, which also covers AI systems, and the Commission proposed the AI Liability Directive, the need for the which is currently under renewed scrutiny. As this post focuses on the complementarity of the AI Act and the Revised PLD, the GPSR and proposed AI Liability Directive will not be discussed any further.

The AI Act aims to create a level playing field and to protect European citizens and societal interests (Recital 1). The Revised PLD is meant to complement the AI Act by ensuring that European citizens have a civil cause of action to obtain redress for certain types of damage caused by defective AI and defective products incorporating AI:

… when AI systems – as defined under the draft regulation on artificial intelligence (AI act) currently under negotiation – do not meet the safety requirements set in the AI act, the revised PLD would apply if the defective product causes physical harm, property damage or data loss. (European Parliament Research Service, p 4; see similarly in the Commission Proposal for the Revised PLD, p 3)

The AI Act and Revised PLD therefore are intended to work in tandem, the former imposing ex ante standards with which an AI system should comply before being allowed onto the European market, and the latter providing an ex post civil remedy for certain types of harm.

The complementarity of the two instruments is reflected by the broadening of the PLD’s subject scope to software such as AI systems (Article 4(1) Revised PLD), the common definition of the notion of “AI system” (Recital 13 Revised PLD), and the presumption that a product is defective if it does not comply “with mandatory product safety requirements laid down in Union or national law that are intended to protect against the risk of the damage suffered by the injured person” such as the AI Act (Article 10(2)(a) Revised PLD).

For the AI Act and Revised PLD truly to work in tandem, their respective territorial scope of application should arguably also be consistent. In other words, harm caused by an AI system which falls within the territorial scope of the AI Act’s regulatory regime should also be covered by the territorial scope of the Revised PLD. Otherwise, harm caused by a failure to comply with the standards set out in the AI Act could be covered by applicable national liability law instead of the Revised PLD. This may lead to awkward situations, as national law might not be as well-equipped to deal with AI-related harm as the Revised PLD.

This issue is not relevant in intra-EU cases, where the damage, victim, and liable person (such as the distributor or deployer of a defective AI system) are all located within the EU: in such intra-EU cases it is safe to assume that the AI Act and Revised PLD (qua national law of the Member States) will apply. The matter becomes more complicated if the harmful AI system was placed onto the EU market by a provider (i.e. a developer) who is established in a Third Country (as will typically be the case). In such a constellation, the AI Act applies extraterritorially due to its broad extraterritorial reach which encompasses providers who place AI systems on the EU market or put them into service there, irrespective of their place of establishment (Art 2(1)(a) AI Act). In contrast to the AI Act, the Revised PLD – just like the old PLD – does not contain a provision on its territorial scope of application in international cases. Instead, the Revised PLD – or rather its national transposition by the Member States – is applicable if the general rules of EU Private International Law (PIL) refer to the law of a Member State.

The general rules of EU PIL that determine which country’s law is applicable to non-contractual obligations, such as product liability claims, can be found in the Rome II Regulation. The Regulation contains a framework of generic rules that apply to non-contractual obligations generally and specific rules for discrete types of obligations. Product liability is one such area for which the Union legislature adopted a specific rule in Article 5 of the Rome II Regulation.

Product Liability in EU Private International Law

Article 5(1), (a)-(c) Rome II contains a cascade rule to determine the law applicable to “non-contractual obligations arising out of product liability”. Priority is given to the law of the place where the person suffering damage has its habitual residence, provided the defective product was marketed there. Failing this, the law of the country where the defective product was purchased applies, provided the product was marketed there. Failing this, the law of the place where the damage occurred applies, provided that the defective product was marketed there. Article 5(1) further contains a foreseeability carveout: the applicable law shall be the law of the country in which the person claimed to be liable is habitually resident if they could not reasonably foresee the marketing of the product in the aforementioned countries.

Moreover, Article 5(2) Rome II provides for an escape clause: where it is clear from all the circumstances of the case that the product liability claim is manifestly more closely connected with a country other than that indicated in Article 5(1), the law of that country shall apply.

Finally, parties are free to choose another law than the law applicable by virtue of Article 5 Rome II, provided that this choice complies with Article 14 Rome II.

Despite containing a special rule for product liability, the Rome II Regulation does not define “product”. The initial Commission Proposal observed that “[for] the definition of product and defective product for the purposes of Article 4, Articles 2 and 6 of Directive 85/374 will apply” (Explanatory Report, p 13). This reference was not incorporated into final the Regulation. Despite the lack of a clear definition of product, the aforementioned quote from the Commission Proposal provides a strong systematic argument that Article 5 Rome II should apply to product liability claims concerning defective AI systems or consumer goods incorporating defective AI.

While, as mentioned above, the AI Act imposes the same standards on EU and third country AI providers, the civil remedies set out in the Revised PLD are only available where the law of a Member State applies as a result of the conflicts rule of Article 5 Rome II. Therefore, this begs the question: when will Article 5 Rome II refer to the law of a Member State, and hence their national transpositions of the Revised PLD, in product liability cases for damage caused by AI systems that are within the territorial scope of the AI Act?

Concurrent extraterritorial application of AI Act and Revised PLD

To determine whether Article 5 Rome II refers to the law of a Member State, and hence its national transposition of the Revised PLD, the fundamental question is whether an AI system was “marketed” in the EU. All connecting factors – the victim’s habitual residence, the place where the defective product was purchased, and the place of damage – in Article 5 Rome II are conditional upon the defective product having been marketed in the respective country where the connecting factor is located.

“Marketed” is not defined by the Rome II Regulation or the Explanatory Report. It is arguable that marketing does not require active efforts such as advertising or purposefully directing commercial activities towards a given country. Merely placing a product into the stream of commerce – either directly or through an intermediary – in a country should suffice. The purpose of Article 5 Rome II is to ensure that the applicable law is reasonably foreseeable to the liable person: the fact that a manufacturer or deployer put its product into the stream of commerce of a country ensures that Article 5 Rome II can operate in a way that achieves this aim.

It seems that Article 5(1) Rome II will point towards the Revised PLD when the AI Act is territorially applicable. Consider the example of a Third-country provider of an AI system that is designed to administer medicine based on a number of patient parameters it monitors, which is sold to hospitals in EU Member State Y. Such a product would be within the territorial scope of the AI Act by virtue of Article 2(1)(a) of the AI Act; it arguably also has been marketed in Member State Y for the purpose of Article 5(1) Rome II. If the AI system causes harm to a patient who is habitually resident in Member State Y, Article 5(1)(a) Rome II would refer to the law of Member State Y. In practice this would lead to the applicability of the national transposition of the Revised PLD in force in Y.

If arguendo the patient travelled to Y from Member State A to receive medical treatment in Y and suffered harm there, then Y’s transposition of the PLD would still apply by virtue of the alternative connecting factors in Article 5(1)(b) or (c) Rome II.

Conclusion

To conclude, Article 5 Rome II ensures that European citizens who suffer damage caused by an AI system placed on the market or put into service in the EU by a Third Country provider are able to seek redress under the Revised PLD. It therefore ensures consistency between the territorial scopes of the AI Act and the Revised PLD, unless parties opt for the law of a Third Country through a choice of law clause. This shows that EU private international law can fulfil a meta-regulatory function by effectively ensuring that the EU’s regulatory and remedial framework for AI is able to function in tandem. In so doing, EU private international law helps establish a level playing field for AI in the EU by ensuring that Third Country providers who place their AI system onto the EU market or put it into service here are subject to a coherent framework of regulation.