The file that protects you is the one you would already have thrown away

In 2015 the Court of Justice faced an awkward question. A series of pacemakers and implantable cardioverter defibrillators presented a higher-than-expected risk of failure. Nobody had proved that the individual device removed from that patient’s chest was defective: what was known was that the product group was. The Court held that this was enough, and that the manufacturer must also pay for the replacement operation when replacement is necessary (the Boston Scientific judgment of 5 March 2015, Joined Cases C-503/13 and C-504/13).

That decision concerned metal and batteries. From 9 December 2026, the same logic meets products that change after they are sold, and a framework designed to bring them to court with less friction: Directive (EU) 2024/2853 of the European Parliament and of the Council of 23 October 2024 on liability for defective products.

The Directive adds no new compliance duty and requires no document that Regulation (EU) 2017/745 on medical devices — the MDR — does not already require. It changes who is liable, how defect is proved and for how long. The material from which that evidence is built is your technical documentation.

Twenty-five years versus fifteen

Start at the end, where the two legal frameworks look at one another and fail to recognise each other.

The injured person has three years to bring a claim from the time they become aware of the damage, the defect and the identity of the person liable. In any event, they have ten years from the date the device was placed on the market. But where a personal injury was latent and that latency prevented proceedings within those ten years, the period extends to 25 years (Articles 16 and 17 of the Directive).

For the same device, the MDR requires the technical documentation and the EU declaration of conformity to be retained for at least ten years after the last device covered by the declaration was placed on the market, or 15 years for implantable devices (Article 10(8) MDR).

The two periods do not begin at the same time, so the gap is not always ten years. The scenario remains: a claim arrives after the retention duty has expired, and the file that would have shown that that version was safe no longer exists because nobody had a reason to keep it. Retaining it for longer is not a legal duty. It is a risk-management decision, and it should be made by whoever carries that risk on the balance sheet, not by the records department.

What happens when the claim reaches court

The Directive structures proceedings so that the injured person does not have to guess. If the claimant presents facts and evidence sufficient to support the plausibility of the claim, the court orders you to disclose relevant evidence at your disposal. The same tool works in your favour when you need evidence to counter the claim. Disclosure remains necessary and proportionate, and trade secrets are protected. But one detail matters more in practice than it may appear: the court can require the evidence to be presented in an easily accessible and easily understandable manner (Article 9 of the Directive). A file understood only by the person who wrote it is not enough.

If you fail to disclose, defectiveness is presumed. It is also presumed if the claimant shows that the product does not comply with mandatory product safety requirements intended to protect against the risk that materialised, or that the damage was caused by an obvious malfunction during reasonably foreseeable use. And once defectiveness is established, causation is presumed where the kind of damage caused is typically consistent with the defect in question (Article 10(2) and (3) of the Directive).

For a medical device, the second route runs through Annex I to the MDR, the general safety and performance requirements. A formal breach alone is not enough: there must be a link between the requirement infringed and the risk that harmed the patient. The third route is the most insidious because it does not require the defect to be identified, only a showing that the device stopped working as it should.

A further route remains for difficult cases. Where, despite disclosure, technical or scientific complexity makes it excessively difficult to prove defectiveness or causation, the court presumes one or the other, provided the claimant demonstrates its likelihood. Recital 48 of the Directive gives two examples: an innovative medical device and machine learning. Every presumption is rebuttable (Article 10(4) and (5)), and the rebuttal comes from the same documentation.

One common misunderstanding should be removed. For artificial intelligence incorporated into a medical device, the European high-risk obligations arrive later: Chapter III, Sections 1, 2 and 3 of Regulation (EU) 2024/1689 (the AI Act), except Article 6(5), apply from 2 August 2028 (Article 113, first paragraph, point (c)(ii), as amended by Regulation (EU) 2026/1744). Regulation (EU) 2024/2847 (the Cyber Resilience Act) does not apply at all to products covered by the MDR (Article 2(2)(a)). Neither is needed to trigger the presumption: the yardstick is already the MDR, and the MDR applies today.

The product that keeps changing

Manufacturers have a traditional defence: the defect did not exist when the product was placed on the market; it arose later. The Directive preserves that defence (Article 11(1)(c)) but closes it in the circumstances that describe a connected device: where the defectiveness is due to a related service, software or software updates, a failure to supply security updates, or a substantial modification, and the product is within the manufacturer’s control (Article 11(2)). For the Directive, control includes the mere ability to provide software updates (Article 4(5)).

In other words: for as long as you can update that machine, it is still partly yours. The MDR had already made the same point in its own way. It requires software to be developed in accordance with the state of the art, taking account of its life cycle, risk management and information security, and requires minimum IT security measures, including protection against unauthorised access, to be set out (Annex I, Sections 17.2 and 17.4 MDR). From tomorrow, a known vulnerability that was never patched is not only non-compliance: it may be the defect.

And if a third party exploits that vulnerability? The third party’s attack does not reduce your liability towards the injured person. Liability is reduced or disallowed only by fault on the part of the injured person or anyone for whom that person is responsible (Article 13 of the Directive). The vulnerability register is worth rereading with different eyes. If it records only the date of the report, not the assessment, remedy and timeline, it tells only half the story in court.

A device from 2019, updated in 2027

The question always comes: do the new rules affect only what we sell from December, or also the installed base?

The starting rule is clear. They apply to products placed on the market or put into service from 9 December 2026, inclusive — Article 2(1) of the Directive, as corrected by the corrigendum of 7 May 2026, says “after 8 December 2026” — while devices sold earlier remain subject to the 1985 Directive (Article 21). An ordinary update changes nothing: recital 39 excludes people carrying out repairs or other operations that do not involve substantial modifications from the new liability, and recital 58 adds that non-substantial updates do not affect the time limits for the original product.

Everything changes if the modification is substantial. Recital 39 says it plainly: a product that undergoes a substantial modification and is then made available on the market or put into service “is considered to be a new product”. Recital 40 explains that, where the substantial modification results from a software update or the continuous learning of an AI system, the product is considered to be made available when the modification is actually made. The ten-year period also starts again from that moment (Article 17(1)(b)).

A device sold in 2019 and substantially modified in 2027 is, for that version, a new product subject to the new rules. The recitals say so; the provision on scope does not repeat it, so this is an interpretation, not a settled fact.

What remains is to establish when a modification is substantial. The Directive does not decide this by itself: it refers to product safety rules (Article 4(18)). For a medical device, that leads back to the MDR, under which changing the intended purpose or making a modification that may affect compliance causes the person making it to assume the manufacturer’s obligations. In operational terms, the classification of updates already performed by your quality management system — corrective update, improvement, change of intended purpose — becomes the map showing which machines moved into the new regime, and on what date.

What is discovered later

The development-risks defence remains: you are not liable if the objective state of scientific and technical knowledge did not allow the defectiveness to be discovered. The Directive, however, looks not only at the day the product was placed on the market, but also at the period during which it remained within the manufacturer’s control (Article 11(1)(e)), and allows Member States to derogate from this exemption (Article 18).

This raises a question about your post-market surveillance. The MDR requires the active and systematic gathering and analysis of data on quality, performance and safety throughout the device’s lifetime, and requires that data to be translated into preventive and corrective action (Article 83 MDR). The same data also indicates when a particular issue became discoverable. It is reasonable to expect it to form part of the development-risk assessment, but there is no automatic conclusion: the test remains objective and is not the same as what your business actually knew. The person bringing the claim will nevertheless ask for that data.

Who is liable alongside you

The manufacturer of the product is liable and so, jointly and severally, is the manufacturer of a defective component where the component was integrated within your control and caused the device to be defective (Articles 8 and 12 of the Directive). Where the manufacturer is outside the EU, the importer and authorised representative are also liable. The MDR already recognises a related rule: where a manufacturer established outside the Union has failed to comply with its obligations, its authorised representative is legally liable on the same basis as, and jointly and severally with, the manufacturer for defective devices (Article 11(5) MDR).

There is a new clause to look for in contracts with software suppliers. A person integrating software loses its right of recourse against the supplier if, when the component was placed on the market, that supplier was a microenterprise or small enterprise — assessed together with partner and linked enterprises — and if a contractual waiver of recourse had been agreed (Article 12(2) of the Directive). Both conditions are needed: a signature that looks like a formality today may determine who pays five years from now.

In Italy, one text has been published and one has not

The Italian implementing decree has not yet been adopted. The draft is Government Act no. 434, sent to Parliament on 7 August 2026 under Article 1 of Italian Law no. 36 of 17 March 2026. It replaces Articles 114 to 127 of the Italian Consumer Code (Legislative Decree no. 206 of 6 September 2005) and retains the development-risks defence. Parliamentary scrutiny was still in progress on 17 September 2026.

One detail is worth watching. Article 3 of the draft applies the new rules to products placed on the market “after 9 December 2026” and leaves the old rules in place for products marketed “before that date”. This reproduces the EU wording before the corrigendum of 7 May 2026, which moved the threshold to “after 8 December”. As drafted, 9 December falls into neither category. The final text will in all probability be aligned. In the meantime, for products placed on the market that day, it is prudent to proceed on the basis that the new regime already applies.

Businesses incorporating artificial intelligence already have a published Italian text from which to start: Legislative Decree no. 160 of 9 September 2026, published in the Italian Official Journal no. 214 of 15 September 2026 and effective from 30 September. In any claim for damage caused through the use of an AI system — contractual or non-contractual, for any system and not only a high-risk one — the court, at the request of an injured person who makes the claim plausible, orders disclosure of evidence relevant to the system's operation. Article 17 expressly lists logs, risk-management documentation, technical documentation and information on human oversight: documents required by the AI Act for high-risk systems, which cannot be presumed mandatory for every other system.

If a party fails, without justification, to comply with an order concerning those documents, the court, having assessed all other evidence, deems the applicant's allegations admitted. A non-compliant third party is instead subject to a financial penalty of between EUR 1,500 and EUR 10,000 (Articles 16 and 17). If the damage results from breach of an obligation under the AI Act, causation is presumed (Article 18), and compliance, even where certified, is not sufficient to exclude liability (Article 19). The injured person may ask in advance whether insurance exists and bring a direct action against the insurer (Article 20).

Where to start

Not with a project: with four questions, and the answers you already have inside the business.

Does the file explain versions, known risks and update decisions so that someone outside the field can understand them? Does your policy on updates and vulnerability remediation cover the entire period during which you retain control? Are retention periods set by exposure to litigation, or only by the regulatory duty? Do contracts say who controls the software, who retains the evidence and who ultimately bears the cost between the contracting parties?

Then there is the financial coverage the MDR already requires (Article 10(16)). That provision still refers to the 1985 Directive, but from 9 December references to the repealed Directive are read as references to the new one (Article 21), and the new regime prevents liability towards the injured person from being limited or excluded by contract or national law (Article 15). This is not a requirement to carry insurance with no limit. It is a requirement to confront risk, exposure and exclusions, knowing that in AI damage claims the insurer may be sued directly.