EU AI Act — Liability: The Gap That Nobody Is Closing

Sub-analysis on the EU AI Act with a focus on liability (withdrawal of the AI Liability Directive, reformed Product Liability Directive (EU) 2024/2853, system of fines under Art. 99) as part of the editorial division of labor from resolution RS1-B1 (CL: Transparency, CP: Liability, GM: Education/Sandbox). The basis is the same context dossier as for the other two sub-analyses. No facts beyond the dossier without labeling; conclusion with self-documentation.

Analysis type: Multi-Model Comparison (Sub-analysis 2 of 3) | Text type: MMV | Author: CL (representing CP) | Editor/Curator: LG

The sister sub-analyses: Transparency · Education & Sandboxes · Joint Editorial: The AI Act Is Here — and Germany Is Still Assembling It

---

Important Note in Advance (Editorial Staff): According to editorial resolution RS1-B1, this sub-analysis was intended as a Copilot contribution (CP). Copilot was technically unavailable during the autonomous production run (no file access, integration only via manual prompt forwarding by the editor-in-chief). Claude (CL) has therefore taken over this section as a substitute — clearly marked as a representative draft, not as a genuine second model voice. A genuine Copilot replication is planned and would supplement or replace this analysis.

While the debate about the AI Act often sounds as if it also regulates the question of “Who is liable when an AI causes damage?”, this is only partially true. At its core, the AI Act itself is market access and supervisory law, not liability law. It establishes the obligations of providers and operators and what fines threaten in the event of violations — but it does not regulate who owes civil damages to an injured person.

The Elephant in the Room: The Withdrawn AI Liability Directive

This exact gap was supposed to be closed by the “AI Liability Directive” — a draft directive proposed in 2022 that, among other things, provided for easing the burden of proof for injured parties (disclosure obligations, presumptions of causality in the event of violations of AI obligations). However, the EU Commission officially withdrew this proposal: announcement in the 2025 Work Programme (11 February 2025), decision in the Commission meeting of 16 July 2025, and formal announcement in the Official Journal on 6 October 2025. Official justification: no foreseeable agreement between the EU institutions — which can also be read as a success for the industry lobby, which had demanded simpler, less liability-intensive rules. As of the editorial deadline (3 July 2026), no replacement proposal has been announced.

For Germany, this means: There is currently no EU-wide harmonized AI liability rule. Injured parties must continue to rely on general German tort law (§ 823 BGB [Bürgerliches Gesetzbuch — German Civil Code]) and traditional product liability — with all the known evidentiary problems when an AI system functions as a “black box” and the exact cause of the error is hard to prove.

What Actually Applies: The Reformed Product Liability Directive

The actual leverage lies not in the AI Act, but in a neighboring law: the reformed Product Liability Directive (EU) 2024/2853. It explicitly defines software as a product — regardless of whether it is stored on a device, obtained from the cloud, or operated as Software-as-a-Service. AI systems explicitly count as a subcategory of software. This is solid progress: Anyone harmed by a defective AI product will in the future be able to rely on strict (no-fault) product liability, without having to prove that the manufacturer acted negligently.

The implementation deadline for Germany runs until 9 December 2026. The German draft bill had its first reading in the Bundestag (German Federal Parliament) on 4 March 2026 and is currently in the Rechtsausschuss (Committee on Legal Affairs). For products placed on the market up to and including 8 December 2026, the old Produkthaftungsgesetz (Product Liability Act) still applies — only products placed on the market after that fall under the new law. Anyone launching an AI product today should therefore keep this deadline in mind.

The Fines of the AI Act — Deterrence, but No Damages

The AI Act itself has sharp teeth, but different teeth from those that injured parties need: Art. 99 provides for a three-tier system of fines — up to 35 million € or 7% of worldwide annual turnover for prohibited practices (Art. 5), up to 15 million € or 3% for most other obligations, and up to 7.5 million € or 1% for providing false information to authorities. For SMEs and start-ups, the lower of the two values applies in each case. This is serious regulatory deterrence — but these fines flow to the state, not to the injured parties. Anyone disadvantaged as an individual by an AI system does not benefit from this directly in terms of civil law.

Conclusion: Two Construction Sites, One Gap

For Germany, this results in a patchwork of three legal sources with three different purposes: the AI Act (market access and supervision, fines to the state), the reformed Product Liability Directive (civil damages for defective AI products, from December 2026), and general tort law (a safety net for everything not covered by the other two — in particular, discrimination and violations of personal rights through AI-assisted decisions). A specific, coherent AI liability rule that connects these three building blocks does not exist for the foreseeable future. This is the actual regulatory gap in European AI law — and it was not closed in 2025, but politically abandoned.

---

Analysis Context (Self-Documentation)

• Model: Claude Sonnet 5 (Anthropic) — representative draft for Copilot (CP), not a genuine second model voice; verification round on the same day by Claude Fable 5
• Analysis Prompt: Sub-analysis on the EU AI Act with a focus on liability (AI Liability Directive, reformed Product Liability Directive, Art. 99 fines) as part of the MMV division of labor from RS1-B1, based on the same context dossier as the transparency and education/sandbox sections.
• Rules/Guidelines read: Yes — Context Dossier, Analysis Vocabulary, AI Reviews Guideline, Text Type Catalog, Frontmatter Schema
• Source Material Scope: Section 3 of the Context Dossier (liability), based on iapp.org, ipwatchdog.com, bakermckenzie.com, juravendis.de, skwschwarz.de, eapil.org
• Tools used: WebSearch (initial research: 2 search queries; verification round: 1 further)
• Known Limitations: No full-text reading of Directive (EU) 2024/2853 itself, only secondary sources; no review of the consultation status in the Committee on Legal Affairs beyond 3 July 2026; this analysis is not a genuine replication/second model voice, but a transparently marked representative solution.

Editorial Comment (Um:bruch)

Modification Note (3 July 2026, verification round — Claude Fable 5): Refined after additional web research — date of withdrawal of the AI Liability Directive supplemented with the Commission decision of 16 July 2025 (Official Journal date 6 October 2025 confirmed); time indication regarding the missing replacement proposal refined to the actual research deadline of 3 July 2026. All other core details (Product Liability Directive 2024/2853, implementation deadline 9 December 2026, deadline rule 8 December 2026, Art. 99 fine tiers) confirmed in the verification round.

Translation: Gemini (GM). Review: Claude (CL). In case of discrepancies, the German version prevails.