AI, Apps, And Algorithms: The Law Commission's Plan To Overhaul Product Liability

On October 8, 2026, the Law Commission published a consultation paper proposing a wholesale reform of the U.K. product liability framework. The reform is partly justified by the fact that the current law, the Consumer Protection Act 1987 (CPA), predates smartphones, apps, social media, and AI. The proposals aim to bring U.K. product liability law into the digital age, extending strict liability to software, data, and AI-driven harms, and imposing liability on a wider range of actors in the digital economy.

The Law Commission has also used the opportunity to tackle perceived hurdles faced by claimants in product liability claims. If implemented, these changes would reach a much broader range of defendants, including producers of medical devices and pharmaceuticals.

While the Law Commission has clearly taken inspiration from the new EU Product Liability Directive (the “new PLD”), aspects of its proposal are distinct and would diverge from the EU. For example, it would treat the design, components, and features of social media and other online platforms as “products” in their own right, and would impose strict liability on a wider range of online marketplaces.

This article provides an overview of the key proposals, noting areas of convergence and divergence with the new PLD that businesses operating in both jurisdictions should note.

The definition of “product”

The Law Commission's starting point is that the current definition of “product” is too narrow for the digital economy. Its proposals include:

• The extension of the definition of “product” to standalone software and AI systems. This is broadly consistent with the new PLD.

• The definition of “product” expressly includes social media, video games, and other online platform design, components, and features—naming recommendation algorithms, infinite scroll, autoplay, and other engagement-driving features as potential liability triggers. The Law Commission argues this is consistent with the new PLD, relying on an interpretation of the law by the European Law Institute. However, this is not stated expressly in the new PLD.

• A residual “catch-all” category for “any other thing (digital or otherwise)…”. This is not a feature of the new PLD and is an attempt to future-proof the introduction of new “products”.

• The definition of “product” should not include interconnected digital services. The Law Commission notes that the new PLD brings related services (e.g. a cloud service a smart device depends on) within the definition of “product”, but considers this unnecessary since claimants can sue the producer directly.

Potential defendants

The consultation paper points to the changing digital economy as a reason to expand the range of potential defendants, so a claimant is not left without a remedy simply because the producer cannot be sued (for example, because it is based outside the jurisdiction or no longer exists). Proposals include extending liability to:

• The developer of the product. This is consistent with the PLD and an attempt to capture software developers.

• Anyone that substantially modifies the product. This is consistent with the new PLD.

• U.K. authorized representatives and fulfillment service providers. They would be new additions to the U.K. regime, liable only where there is no U.K. producer/own-brander/importer. This is consistent with the new PLD.

• Core participants (including online marketplaces) or their U.K. authorized representatives (if applicable). The Law Commission proposes criteria likely to capture online marketplaces in use today, drafted to future-proof against new supply methods. This diverges from the EU PLD, which extends liability to certain online marketplaces in much narrower circumstances.

Defect and causation

The Law Commission argues that new digital technologies pose a significant challenge to a claimant's ability to prove their case. It recommends a new “purpose” for the PLD based on three core propositions:

• A fair apportionment of the risks inherent in products.

• That risks should be allocated to those who create, control, or benefit from them, and claimants should not need to prove fault to obtain effective compensation.

• Mitigation of evidential difficulties.

In line with this purpose, it proposes a number of changes to the rules around defect and causation:

• The addition of a non-exhaustive list of principles to assess whether a product is safe. The new PLD requires safety to be assessed by “what is required under Union or national law”. The EU General Product Safety Regulation (GPSR) includes similar principles, so while technically a divergence, the overall effect is the same.

• The inclusion of additional circumstances relevant to the level of safety people are entitled to expect. This broadly follows the new PLD.

• The introduction of a risk-sharing mechanism where claimants allege defect under certain criteria, including an arguable case, facts that are not fanciful, and exceptional evidential difficulties. The defendant could accept the alleged defect or challenge it; accepting would reduce their liability to 50% of damages. The new PLD includes no equivalent provision.

• A more limited rebuttable presumption of defect is considered, applying only where there is an asymmetry of information favoring the defendant and it would be fair for the defendant to bear the burden of rebutting the presumption. This differs from the new PLD.

• Unlike the new PLD, the Law Commission does not propose a rebuttable presumption for causation although it does invite consultees' views on the question.

Damage

The Law Commission has also proposed changes to the type of damage recoverable in the U.K., again primarily driven by harms caused by digital technologies. Key proposals include:

• Codifying a minimum “material harm” threshold for personal injury, aligned with negligence case law, whereas the new PLD leaves this to national courts.

• Compensation for psychiatric harm suffered by direct victims should be recoverable where the harm arises from a physical injury or risk of physical injury, or is a medically recognized or recognizable psychiatric illness whose development falls within the natural range of reactions for a person of ordinary fortitude. This diverges from the new PLD, which allows compensation for medically recognized and medically certified damage to psychological health.

• The Law Commission proposes compensation for indirect victims who meet certain criteria, including a “close tie of love and affection” with the direct victim. The consultation paper specifically addresses claims by parents or close family members of a child who suffers psychiatric harm from using social media, chatbots, or other digital products. The new PLD leaves this to national courts.

• The Law Commission proposes compensation for destruction and corruption of data, excluding professional data. This is consistent with the new PLD.

• On mixed private/professional use, the Law Commission would compensate property and data loss pro rata, whereas the new EU PLD compensates mixed-use property in full but excludes mixed-use data entirely.

• The Law Commission proposes removing the lower threshold for property damage of GBP275. This is consistent with the new PLD.

Defences, limitation, and long-stop periods

The Law Commission proposes several changes to the CPA, including:

• The retention of the development risk defence, with clarification that scientific and technical knowledge is to be assessed objectively by reference to accessible knowledge. This is consistent with the new PLD.

• Disallowing defendants from arguing a defect did not exist when the product was placed on the market, where they make or authorize certain modifications to the product or fail to supply software updates. This is broadly consistent with the new PLD.

• Extending the long-stop for latent personal injury from 10 to 25 years and setting proposed criteria for issuing a latent damage claim. While the 25-year extension is consistent with the new PLD, the new criteria is a divergence.

• The Law Commission proposes restoring the courts' discretion to substitute a defendant after the long-stop has expired, including within corporate groups, provided the claimant named the defendant under the correct description but the wrong name. This marks a departure from the new PLD.

Commentary

The Law Commission's proposals broadly track the new PLD, with a new regime designed for the digital world. Standalone software, social media, video games, and AI systems are in scope, and new economic operators can be found liable. Fears of black box AI have encouraged rules that ease evidential burdens for claimants, and psychiatric harms and data loss are now recoverable.

There are some important differences between the two approaches:

• The Law Commission has focused explicitly on social media, whereas the new PLD dealt with it implicitly. By treating platform design and features as “products” in their own right, its proposal creates a direct liability route alongside the Online Safety Act 2023 and Ofcom's powers—meaning platforms may face regulatory investigations and civil damages claims in parallel.

• Online marketplaces operating in the U.K. also face greater risk. The Law Commission's proposals go further than the EU, imposing liability on a wider range of online operators—consistent with the new duties proposed for online marketplaces under the U.K. Government's consultation on the U.K. Product Safety Framework, and signaling that the U.K. wants to lead on regulating online marketplaces.

The consultation paper sits alongside the ongoing consultations under the Product Safety and Metrology Act 2025, part of a wider modernization of U.K. product regulation. With both processes underway, there is an unprecedented opportunity to influence the future shape of U.K. product rules by responding to the consultation.