Article 4(1) explicitly includes software (whether embedded or supplied separately) + Article 4(21) cross-references the AI system definition from the EU AI Act. The 2024 PLD therefore covers AI systems as 'products' and AI-system defects as 'product defects'. Article 10(c) singles out the 'effect of any ability of the product to continue to learn after deployment' as a factor in the defectiveness assessment - directly addressing self-learning AI systems whose behaviour changes over their lifecycle. Article 17(2)(c) failure-to-update rule additionally applies: an AI provider that fails to deliver necessary security / safety updates loses the state-of-the-art defence. The European Commission WITHDREW its proposed AI Liability Directive (COM(2022) 496) in February 2025; the 2024 PLD is therefore now the operative civil-liability regime for AI-product damage, supplemented by sectoral product-safety regimes (EU AI Act + MR + MDR + IVDR + CRA) for the regulatory side. National courts may use Article 11(4) technical-complexity presumption to assist plaintiffs in AI-defect cases where explainability is limited.
This control maps to 2 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.