When a defective AI agent causes damage to a person, Directive (EU) 2024/2853 on liability for defective products determines who pays: the company that developed it or sells it under its brand. This liability is strict: it arises from the product's defect, without any need to prove negligence by the manufacturer. No contract can limit it towards the victim. The text applies to products placed on the market or put into service after 9 December 2026 (Article 2), the date by which member states must have transposed it (Article 22).
Money lost by an agent remains outside this regime. It falls under contracts and payment law, where JPMorgan Chase and Elon Musk took opposite positions on 13 and 15 October.
Software is a product, the company selling it under its brand is the manufacturer
For the directive, software is a product "regardless of the mode of its supply or use", including when it is "supplied within a software-as-a-service model" (recital 13). An agent sold as SaaS therefore falls within its scope. The same recital includes providers of AI systems within the meaning of the AI Act among manufacturers.
A manufacturer is the person who develops the product. It is also the person who, "by putting their name, trademark or other distinguishing features on that product, presents themselves as its manufacturer" (Article 4, point 10). A bank, insurer or retailer that offers under its own name an agent built on a third party's model falls within this definition. The company that develops an agent for its own teams is a manufacturer by virtue of own use (Article 4, point 10, c). Anyone who "substantially modifies a product outside the manufacturer's control" and then makes it available becomes one in turn (Article 8, paragraph 2).
According to ActuIA's reading, the model provider may also be liable, as manufacturer of a component, defined as "any item, tangible or intangible" integrated into a product or interconnected with it (Article 4, point 4). Article 8 targets the manufacturer of a defective component that "caused the defect in the product". Those liable for the same damage may be held jointly and severally (Article 12): the victim can then claim full compensation from any one of them.
Three types of damage covered, all suffered by natural persons
Only a natural person may claim compensation (Article 5). A company cannot therefore invoke the directive for its own losses. Damage other than that in Article 6, "such as purely economic losses, infringements of privacy or discrimination", should not "in themselves" trigger this liability (recital 24).
| Damage caused by a defect | Covered by the directive | Text |
|---|---|---|
| Death, personal injury, medically recognised harm to psychological health | Yes | Article 6, paragraph 1, a |
| Private property damaged | Yes, excluding the defective product | Article 6, paragraph 1, b |
| Data not used for professional purposes, destroyed or corrupted | Yes | Article 6, paragraph 1, c |
| Property exclusively for professional use, professional data | No | Article 6, paragraph 1, b and c |
| Pure financial loss (erroneous purchase, transfer) | No | Recital 24 |
| Infringement of privacy, discrimination | No, other regimes remain applicable | Recital 24 |
An employee remains a natural person. According to ActuIA's reading, the publisher of a professional tool can thus be liable for bodily or psychological injuries caused by a defect to its clients' employees: Article 5 targets "any natural person", and the professional exclusion in Article 6 only concerns property and data.
No clause protects the integrator against the victim
Article 15 prohibits the liability of an economic operator from being "limited or excluded in relation to the injured person by a contractual provision or by national law". The person who has compensated the victim may then seek recourse against the other liable parties (Article 14), according to national law.
This recourse comes up against model providers' contracts. The standard terms of OpenAI, Anthropic and Google Cloud cap the provider's liability to the amounts paid over twelve months and limit its indemnification to intellectual property, as detailed in ActuIA's analysis of agent liability. According to ActuIA's reading, the integrator therefore compensates the victim without being able to invoke its contract against them, and then recovers from the provider only what that contract allows.
A substantial update after 9 December brings the agent within the regime
A software defect is also assessed after sale. Article 7 takes into account "the effect on the product of any ability to continue learning or to acquire new features". A product substantially modified by an update, or by the continuous learning of an AI system, is considered placed on the market or put into service at the time of the modification (recital 40). Read with Article 2, this recital brings within the regime an agent launched before 9 December and then substantially modified after that date.
The absence of a patch does not protect either. An operator cannot exonerate itself on the grounds that the defect appeared after the product was placed on the market when that defect stems, under the manufacturer's control, from "a lack of software updates or upgrades necessary to maintain safety" (Article 11).
The agent's logs become part of the case file. The court may order the defendant to disclose "the relevant evidence at the defendant's disposal" (Article 9). Failing that, defectiveness is presumed (Article 10). According to ActuIA's reading, for an agent, this evidence primarily consists of its execution logs, model versions and system instructions.
Money lost by an agent remains a matter of contracts
JPMorgan Chase set out its position on 13 October, during its quarterly earnings call, according to American Banker and Banking Dive. Its chief financial officer, Jeremy Barnum, was referring to services that move customers' money using their credentials: "It's not safe, so to the extent we can block them, we block them to protect customers and protect ourselves." If the customer entrusts their credentials to an agent that does what they do not want, "that will be on them", he added. CEO Jamie Dimon spoke of a "transfer of responsibility" and warned: "We don't want uncontrolled agents, and there could be thousands of them." These quotes are translated from English.
Elon Musk took the opposite position on 15 October for Grok Bot, SpaceXAI's agent: "If Grok Bot makes a mistake during a purchase or discloses your card (this has never happened yet), SpaceX will compensate you", he wrote on X, according to The Next Web, without specifying the scope. SpaceXAI's terms of service, updated on 12 October, on the contrary exclude its liability for agentic actions: the user "accepts responsibility" for those they command. For European residents, the company states that it does not limit its liability where that would be illegal.
Payment law sets its own rules. According to a response from the Ministry of the Economy published in the Official Journal on 28 May 2024, "the payer's consent is necessary for a payment transaction to be authorised", "the existence of strong customer authentication not being sufficient in itself". The customer's liability may be engaged in the event of gross negligence, "which the payment service provider will have to prove". The response does not address the customer who entrusts their credentials to an agent.
France: transposition draft omits three points, according to the Paris Bar
The directive is addressed to member states (Article 24). In France, its rules will enter domestic law through a transposition text. As of 20 October 2026, none had been found in the legislative files of the National Assembly and the Senate. In a response published in the Official Journal on 12 May 2026, the Minister of Justice indicated that "a dedicated text is envisaged at this stage", without saying whether it would be a law or an ordinance. None of the documents consulted states which regime would apply to products placed on the market after 9 December if this text were published later.
According to a report presented on 24 February 2026 to the Council of the Paris Bar, the Directorate of Civil Affairs and the Seal of the Ministry of Justice submitted on 27 January a transposition table amending Articles 1245 to 1245-17 of the Civil Code. The draft does not explicitly include medically recognised harm to psychological health, nor compensation for non-professional data destroyed or corrupted. It "does not explicitly address the liability of the manufacturer of a software component integrated into another product", a situation that may apply to a model provider.
Five decisions to take before 9 December
- Qualify your role product by product (manufacturer through development, brand or own use, substantial modifier, mere user) for versions released after 9 December.
- Renegotiate recourse, indemnification and cap clauses with the model provider, which only apply between the parties.
- Set up logging and evidence retention: the victim has three years to bring an action, and their right expires after ten years, twenty-five years for latent personal injuries (Articles 16 and 17).
- Write an update policy: guaranteed security patches, documented assessment of versions likely to be substantial.
- Review liability insurance: Howden Re expects many insurers to introduce exclusions for generative and agentic AI in general liability at January 2027 renewals, according to Insurance Business.
Our articles will then appear first in Google Top Stories.