Consider a hypothetical connected medical device whose software is updated after it reaches a patient. Its performance changes and the patient suffers an injury. The hardware manufacturer, software developer and business supplying the update may each have influenced what happened. Establishing which product was defective, when the defect arose and whom to sue could require several separate investigations.
The example captures the challenge facing product liability law: the object supplied to a customer may continue to change, while responsibility for its operation is spread across different businesses. A claim may turn as much on the history of an update as on the device originally purchased.
The Law Commission’s consultation, launched on 8 October 2026, proposes reform of Part I of the Consumer Protection Act 1987 (CPA) in England and Wales. Its scope extends beyond AI to the organisation of supply chains and the kinds of damage for which compensation should be available. These remain provisional proposals, rather than changes to the law.
Strict liability, difficult proof
The CPA already provides a route to compensation without requiring a claimant to establish negligence. Section 2 imposes liability for damage caused wholly or partly by a defect in a product. Under section 3, the central question is whether its safety falls below what people generally are entitled to expect, taking all the circumstances into account, including its presentation, reasonably expected use and time of supply.
Strict liability does not, however, make the producer an insurer against every adverse outcome. Defect, actionable damage and the causal connection between them remain distinct requirements. An injury associated with a product does not, by itself, establish liability.
That distinction was illustrated in Hastings v Finsbury Orthopaedics Ltd [2022] UKSC 19, a Scottish appeal concerning a metal-on-metal hip replacement. The Supreme Court upheld the conclusion that the claimant had failed to establish a defect. Professional concerns, withdrawal from the market and safety notices did not overcome the evidential findings in that particular case.
Hastings concerned medical technology rather than an AI system, but it exposes an enduring difficulty: removing the need to prove fault does not remove the need for evidence. It also cautions against treating an unsuccessful claim as proof that the legal framework is defective. The outcome may reflect a proper assessment of the evidence, even where the claimant has suffered serious harm.
What counts as a product?
The Commission proposes expressly bringing software and AI systems within the definition of a product, including where supplied digitally or accessed remotely. This would address uncertainty surrounding technology supplied independently of physical goods. It would also reduce the significance of the delivery method when assessing whether the statutory regime applies.
For a claimant, the practical value would be greater clarity about the route into the regime. Yet inclusion would only begin the inquiry. A tool that produces an incorrect answer would not necessarily be a defective product causing compensable harm. Its intended function, presentation and the circumstances of its use would still matter.
The proposals also encompass the design components and features of social media and other online platforms, including recommendation systems. That raises a different question from liability for an unsafe physical device: how should the safety of a system that selects and presents information be assessed?
A claim based on platform design would need a sufficiently precise allegation. Is the complaint about a recommendation feature, an interaction between features, or particular material encountered by the user? Those alternatives could demand different evidence about both safety and causation. Broadening the definition would create a potential legal route; it would not resolve those distinctions.
The Commission also proposes clearer guidance for determining defect. That exercise has particular significance for products whose benefits depend on accepting some risk. Courts would need to distinguish an unacceptable lack of safety from a disappointing outcome within a product’s properly understood limitations.
When the evidence cannot settle the question
The proposed risk-sharing mechanism would require an arguable defect, non-fanciful supporting facts, exceptional evidential difficulties due to limited evidence, and a risk not so widely known as to be socially accepted.
The defendant could contest a presumption of defect or accept the alleged defect. Acceptance would lead, subject to proof of damage and causation and no defence applying, to an adjustable starting award of 50 per cent of otherwise recoverable damages. If the defendant contested the presumption and failed, damages would be assessed in the ordinary way, subject to the other requirements.
This is a response to uncertainty, with a significant consequence for both sides. A claimant who might otherwise recover nothing could receive partial compensation. A defendant could incur liability without a conventional finding, on the evidence, that its product was defective. Equally, a claimant compensated through this route might receive substantially less than full compensation.
The policy argument for intervention is that an injured individual should not necessarily bear the whole loss where the evidence needed to establish a defect is unavailable. The opposing argument is that moving the evidential burden cannot create information that does not exist. A producer may be unable to disprove a defect for reasons just as compelling as the claimant’s inability to prove it.
The proposal attempts to accommodate that problem through the defendant’s choice. Whether it achieves an appropriate balance would depend heavily on how courts interpret the entry conditions and adjust awards. Litigation over those preliminary questions could itself become expensive. Businesses would also need to evaluate the consequences of contesting a presumption before knowing whether they could rebut it.
Separately, the consultation explores presumptions concerning particular facts relevant to defect or causation where information is asymmetrical and shifting the burden would be fair. That is an open question, distinct from the provisional risk-sharing proposal.
For practitioners, the distinction matters. An evidential rule directed at one factual issue could have a much narrower effect than a presumption of defect. Neither should be described as an automatic entitlement to damages whenever a technically complex product causes an injury.
Responsibility after supply
The opening hypothetical also raises a temporal problem. If the alleged lack of safety emerges after an update, a legal analysis confined to the product as originally supplied may miss the event said to have caused the injury.
The Commission proposes rules for substantial modifications, distinguishing changes within the original producer’s control from those made outside it. A person who substantially modifies a product outside that control and commercially supplies the modified product could be treated as its producer. Ordinary AI self-learning would not, in the Commission’s view, itself amount to a substantial modification.
This makes control a central practical question. The relevant evidence could include who specified the change, who approved its deployment and how it altered performance. A contract’s description of a business as a supplier or developer might be less informative than the decisions that business actually made.
The proposed expansion of potential defendants has a related purpose. Fulfilment service providers and a new category of “core participants”, which could capture online marketplaces, would be brought within a structured hierarchy where specified UK defendants cannot be identified. Core participation would depend on matters including commercial benefit, a significant role in bringing the product to market and control or decisive influence over manufacture or distribution.
The benefit for claimants would be a more accessible potential defendant. The difficulty is deciding when commercial involvement justifies responsibility for safety. A business may facilitate a transaction without having the technical knowledge needed to assess the product. Conversely, a business exercising substantial influence over market access may be well placed to require better information from suppliers.
For commercial advisers, the likely consequence would be closer scrutiny of actual supply arrangements. Indemnities, access to technical records and cooperation with claims investigations would deserve attention alongside contractual descriptions of each party’s role.
Damage beyond physical injury
The consultation also addresses psychiatric injury. Its proposals would clarify recovery for medically recognised or recognisable psychiatric illness, with different conditions depending on the claimant’s relationship to the harm. This is particularly relevant to digital products whose alleged effects may arise without physical injury. It should not be equated with compensation for ordinary distress or dissatisfaction.
In a platform claim, recognising a category of injury would still leave substantial questions. Medical evidence might establish illness without resolving whether a particular design feature caused it. The claimant’s wider circumstances and exposure to other products could be relevant. The legal route and the evidential strength of an individual case would remain separate issues.
The Commission also proposes compensation for destruction or corruption of data. This would address a different consequence of defective technology: the loss of information rather than bodily injury or damage to a physical object.
These extensions could affect the kinds of claims businesses and insurers need to assess. They do not establish how frequently successful claims would arise or what they would cost. Those questions require evidence about use, harm and litigation, rather than assumptions based solely on a wider statutory definition.
Reform, restraint and practical preparation
There is already disagreement over the scale of reform. In published commentary on 16 October, Freshfields questioned the empirical basis for treating the existing regime as excessively favourable to defendants and warned that the proposals could move the balance too far against them. That is a challenge to the justification for the package, rather than an argument that digital products present no legal difficulties.
Those objections raise separate questions. Clearer definitions may be justified by uncertainty even without evidence of widespread failed claims. Changes to proof and compensation raise a further question: what evidence supports reallocating losses between parties? The case for one reform does not establish the case for every other proposal.
The international context adds practical urgency. The EU’s revised Product Liability Directive, Directive (EU) 2024/2853, expressly addresses software and AI, updates the range of liable operators and introduces measures to assist access to evidence and proof. Member states must transpose it by 9 December 2026; the European Commission says the new regime applies to products placed on the market from that date, while the earlier directive continues to govern older products.
Businesses operating in both markets could therefore face different rules and implementation timetables. A common product specification would not necessarily produce identical litigation exposure. Advice would need to account for the relevant market, supply history and applicable regime.
The domestic proposals would also affect the duration of exposure. The Commission proposes extending the long-stop to 25 years for qualifying latent personal injury and restarting it following substantial modification. Longer exposure could make access to historic technical records, supplier information and insurance documentation more important.
There are useful questions for clients now, even before any legislation. Can a business reconstruct which software version a customer used at the relevant time? Do its agreements provide access to evidence held by another developer? Can it explain how an update changed a product’s function and who controlled that decision? These are practical issues for investigating a claim, whichever party ultimately bears the burden of proof.
The Commission proposes retaining key defences, including the development risks defence, while adapting them to digital products. Its consultation closes on 14 January 2027, with final recommendations expected in late 2027. The eventual legislative response remains to be determined.
For the patient in the opening example, reform might clarify the potential defendants and provide a different route through an evidential impasse. It would not establish that the update was defective or that it caused the injury. The consultation’s central task is to make those questions answerable where possible, and decide how losses should be allocated where a fair investigation still cannot supply an answer.
Copyright & permissions
-cropped-a0w29ejw.jpg&w=3840&q=60)
