AI product management · Industry brief

The EU's new Product Liability Directive (EU) 2024/2853, effective December 9, 2026, significantly expands product liability frameworks to address digital technologies and AI systems. The directive broadens the definition of "product" to explicitly include software and AI applications, making developers and providers liable for damages caused by defects. It extends liability to online platforms and fulfillment service providers that exercise significant influence over product sales, and deems any entity that substantially modifies a product to be the manufacturer. The New PLD eases burden of proof for consumers by allowing courts to presume defectiveness in technically complex products, empowering courts to order evidence disclosure, and extending the long-stop period to 25 years for latent damage. Businesses must conduct risk assessments on products with digital elements, perform supply chain due diligence, and maintain comprehensive documentation of design, testing, and quality control processes to demonstrate compliance and defend against claims. [Source: keystonelaw]

The federal government is applying existing authorities to AI products under a fragmented enforcement landscape without comprehensive AI-specific rules. The Department of Justice, through its AI Litigation Task Force and broad criminal and civil authorities, is prioritizing enforcement against AI-enabled fraud, cybersecurity incidents, unauthorized access, and misuse of sensitive data, while simultaneously challenging state AI laws deemed unconstitutional or preempted. The FTC issued a July 1, 2026 policy statement targeting deceptive conduct by AI companies regarding model accuracy, objectivity, and security, requiring companies to substantiate public claims with internal testing and documentation. State attorneys general are emerging as major regulators, with bipartisan coalitions of 44 and 36 states respectively addressing child safety and demanding state authority to enact AI laws, creating compliance risks for companies of all sizes across multiple jurisdictions. Congressional committees are conducting parallel investigations into AI regulation, intellectual property, and industry conduct, with authority to demand broad discovery including internal communications, testing materials, and executive testimony, creating reputational risk before meaningful company response is possible. [Source: holtzmanvoge]

The legal framework governing AI continues to evolve without comprehensive federal law, leaving businesses exposed to risk under existing laws related to consumer protection, employment, privacy, cybersecurity, and industry-specific regulations. AI-driven hiring tools and customer-facing applications face particular regulatory scrutiny for biased outcomes or inaccurate outputs. During M&A due diligence, buyers should assess how AI systems function and whether appropriate governance and oversight mechanisms are in place, including data rights, vendor contractual terms, intellectual property protections, and regulatory compliance issues that may create post-closing liabilities. Transaction documents should include representations and warranties addressing data practices, intellectual property, regulatory compliance, and technology systems, particularly for companies in highly regulated sectors like healthcare and financial services. [Source: bricker]