The impact of the new EU Product Liability Framework on medtech

Ed Turtle and Anushi Amin, associates at law firm Cooley, analyse the new Product Liability Directive which will enter into force in 2024 and apply from 2026.

On 25 January 2024, the EU published the provisionally agreed text of a new Product Liability Directive (new PLD). The reforms are the biggest change to EU product liability rules in more than four decades, and we expect them to have a significant impact for the medtech industry. Here are five of the biggest changes:

1. More medtech products will be subject to claims

The definition of “product” under the new PLD has been extended beyond hardware, to include software, including standalone software, such as Software as a Medical Device (SaMD), and embedded software embedded.

2. Making it easier for claimants to establish defect

The EU’s existing Product Liability Directive (85/374/EEC) is already deliberately “claimant friendly”, as liability is strict, and claimants do not need to show that the producer was at fault for any damage. As a result, the legal test of establishing that a product is “defective” is usually the biggest hurdle for claimants. 

The EU has rewritten the test in the new PLD to introduce an alternative basis for a product to be considered defective: where the product does not provide the safety required under Union or national law – in other words, where there is a non-compliance with EU product safety regulations.

In addition, to relieve the claimant of the burden of having to prove defect, it has introduced two circumstances in which defect can be presumed:

(1) where there is non-compliance with relevant EU product safety regulations. This means this is both part of the legal test for defect, and a basis for assuming defect, making it critical for medtech manufacturers to ensure regulatory compliance to mitigate their product liability risk; 

(2) where products are “scientifically or technically complex,” with examples given as medical devices and products that use AI. Medtech products are particularly at risk of being subject to this presumption. 

3. Expanded concept of defect

The concept of defect will be expanded to include cybersecurity vulnerabilities, faulty software updates and issues with AI and machine learning. The lack of software updates will also be a basis for defect – placing a greater onus on manufacturers to proactively monitor potential glitches and vulnerabilities.

4. Expanded scope of recoverable damages

The new PLD revises the definition of “damage” to include medically recognised damage to psychological health. There are concerns about how far this extends and whether, for example, anxiety could be recoverable. Destruction or corruption of data is also in scope. At the same time, the reforms also remove minimum thresholds and maximum limits for compensation claims. 

The impact of these changes, particularly when combined with the EU’s new class actions mechanism (which applied from June last year), is an increased risk of mass product liability claims. With the removal of minimum thresholds, these could be brought for relatively trivial data issues, following, for example, cybersecurity incidents or bugs in software updates applied to medtech products. 

5. Extension of the claims period

The period during which claims can be made (the so-called ‘long stop’), will be extended under the new PLD from 10 years to 25 years in cases where symptoms are slow to emerge. This change is specifically targeted at latent damage in medical device and pharma claims. The extension of the claims period will create a longer lability tail for medtech companies and increase the cost and complexity of insurance coverage. It is important for stakeholders to assess coverage under existing policies before the new regime starts to apply in 2026.

Next steps

The text of the new PLD will be formally approved before it is published in the Official Journal of the European Union and enters into force 20 days later. This is expected to be completed in the next couple of months. After that, a 24-month transition period begins. It is crucial that medtech stakeholders use this transition period to review the impact of the new PLD on their business, including on their regulatory compliance, document and insurance procedures, before the new rules start to apply in early 2026.