New EU Product Liability Rules
Is Your Medical Device Documentation Ready?
10/12/20263 min read
New EU Product Liability Rules: Is Your Medical Device Documentation Ready?
What 9 December 2026 means for medical device manufacturers, including legacy devices
The revised EU Product Liability Directive (Tuotevastuudirektiivi) (EU) 2024/2853 will bring important changes to the liability framework for defective products, including medical devices, in vitro diagnostic devices and software.
The new rules also apply to devices that fully comply with the MDR or IVDR. CE marking and regulatory compliance do not automatically protect a manufacturer against product liability claims.
The Directive entered into force on 8 December 2024. Member States shall implement it by 9 December 2026, when the new rules begin applying to products placed on the EU market or put into service from that date.
The question is:
Could you provide the evidence needed to explain and defend your product's safety if a compensation claim arises?
Technical documentation may become evidence in court
Under the new rules, a person claiming compensation must generally demonstrate the product's defectiveness, the damage suffered and the causal link between them.
However, courts may require manufacturers or other defendants to disclose relevant evidence when a claim is sufficiently substantiated. Disclosure must be necessary and proportionate and safeguards are provided for confidential information and trade secrets.
If a defendant fails to comply with a court-ordered disclosure requirement, the court must presume the product was defective. This presumption can be rebutted.
This does not mean that the entire technical documentation must automatically be disclosed or that incomplete documentation automatically proves a defect.
Nevertheless, the manufacturer's ability to retrieve and explain its risk assessments, test results, design decisions and product changes may become particularly important.
What about legacy medical devices?
Devices marketed under the MDR or IVDR transitional provisions may also fall under the new liability rules.
The determining factor is not whether a device was certified/declarated under the old Directives, but when the individual product was placed on the market or put into service.
An important note: A device already placed on the EU market before 9 December 2026 does not automatically enter the new regime merely because the customer starts using it later.
Contrary to claims made in some published commentary, the new Product Liability Directive does not require manufacturers to upgrade all legacy-device technical documentation to meet MDR/IVDR requirements. Nor does it introduce a new notified-body review requirement.
Software, cybersecurity and product updates
The revised Directive explicitly includes software within its definition of a product.
It also recognises that manufacturers may retain control over products after placing them on the market, particularly through software updates, connected services and cybersecurity measures.
Defectiveness arising from software under the manufacturer's control, including failure to provide security updates necessary to maintain safety, may therefore have liability consequences.
The Directive does not itself establish a general obligation to supply software updates. Applicable product-safety requirements remain relevant.
What should manufacturers review now?
I recommend a focused review of three areas:
Product traceability: Can you establish when an individual device was placed on the market, identify its configuration and software version and trace relevant economic operators? UDI information may support this, but does not alone prove the placing-on-the-market date.
Safety evidence: Can you retrieve the applicable risk-management records, verification and validation results, design changes, complaint investigations and PMS evidence?
Documentation readiness: Can relevant evidence be identified and explained without unnecessary delay, while protecting confidential information? Are responsibilities and liability insurance arrangements appropriate?
These are practical recommendations, not a new technical-documentation checklist introduced by the Directive.
Finland's implementation
In Finland, the Government submitted HE 190/2026 to Parliament on 24 September 2026. As of 11 October 2026, the proposed legislation remains under parliamentary consideration.
The key message
CE marking is not protection against product liability claims. MDR/IVDR conformity and product liability are different legal questions.
The new Directive does not automatically require a new technical file. However, a well-maintained, traceable technical file can be essential when explaining the safety of a product years after its release.
Do you need help reviewing the regulatory documentation, risk management and traceability for your device or device family?
Official sources:
Directive (EU) 2024/2853
Corrigendum of 7 May 2026
Finnish Ministry of Justice: implementation project
Photo: Carl Campbell / Unsplash
Quality and Regulatory Consulting
Expert services in medical device regulation and quality compliance.
contact information
Karkinen Consulting Oy, Helsinki, Finland
Business ID: 3103786-9
info@karkinen.com
NATO NCAGE code A10CG
© 2026. All rights reserved.
