Law Commission consulting on changes to Product Liability Law to cover harms caused by AI and social media

You have until 14 January 2027 to respond to the Law Commission of England and Wales on their consultation about reforming product liability law. Here is the full consultation:

https://lawcom.gov.uk/project/product-liability/

Key things to know about the proposal:

There is a lot in this consultation, so definitely read the full text, but here are some things I found particularly interesting in the proposal.

Background:

The law they are discussing reforming is the Consumer Protection Act 1987 (the Act), a strict liability regime providing statutory redress for consumers for defective products. This law was implemented off the back of the Thalidomide scandal and in line with reforms which were happening at a European level. The rationale for originally implementing a no-fault regime, rather than relying on contract or tort remedies, was that a)“strict liability facilitates the efficient allocation of losses arising from defective products. Manufacturers are generally better placed than individual consumers to absorb and distribute those losses, whether through insurance or by passing costs across their customer base”; and b) “strict liability addresses the evidential difficulties faced by injured individuals.” There are some defenses in the current regime, designed so as not to inhibit innovation or productivity, such as a development risks defense, where the state of “scientific and technical knowledge at the relevant time was not such as to enable the existence of the defect to be discovered”.

Why Propose Reform

Why do they say they are considering reform? The Law Commission says that consumers are now exposed to a wider range of products such as software embedded in medical devices, autonomous vehicles, AI and social media platforms and that these new products give rise to new forms of harm and a more complex supply chain. Whilst other laws like consumer sales laws have been updated to reflect technological advances, product liability law has not and other jurisdictions like the EU and Australia have already updated their frameworks to encompass emerging technology.

Interesting Things in the Proposal

Amongst the suggestions I found most interesting in the proposal are:

The definition of “product” in the current law is “any goods or electricity and… includes a product which is comprised in another product, whether by virtue of being a component part or raw material or otherwise”. “Goods” includes “substances, growing crops and things comprised in land by virtue of being attached to it and any ship, aircraft or vehicle”. 

The consultation asks whether AI systems, however supplied, including AI systems downloaded from the cloud or internet or otherwise supplied in an intangible form such be considered a “product”. They ask whether AI models should be considered products, as well as AI systems. They also suggest including in the definition of a “product”, 

• “design components and features of social media platforms and other online platforms” and
• “digital manufacturing files and other functional information necessary to produce a tangible product by enabling the automated control of machinery or tools.” 

The consultation also says the definition of “product” needs to be future-proofed for future changes in technology, so it proposes to include a catch-all which says: “any other thing (digital or otherwise) that is designed or developed to perform a specific function for users, irrespective of how it is supplied or made available”. 

When it comes to open-source software, the Law Commission says it would not be excluded from being considered a product just because it's open-source. If it's available commercially or as part of a product supplied commercially, it would be treated the same as other software.

Another interesting proposal is to add those who developed the product to the list of potentially liable actors under the statute. For those of you building on top of AI models, if AI models do come to be considered “products”, the Law Commission's suggestion is that where a defective component product is integrated into a finished product, both the producer of the finished product and the producer of the component could be potentially liable under the Act. The test would rest on whether the producer of the finished product had control. The Law Commission proposes that if the producer, own-brander, importer, fulfillment service provider or core participant is outside the UK, its UK authorized representative shall be liable.  

What does it mean to say a product is “defective”? This is a fascinating concept in the AI space, with advancements happening so quickly. The current test is whether the product's safety falls below the level a person is generally entitled to expect. It covers risks to personal safety as well as risks of damage to property. 

To determine this, you look at the product's marketing, its packaging, instructions and what might reasonably be expected to be done with it. What does that mean with an AI model or system? The Law Commission says the reform might be that a number of principles would be applied to determine if a product is defective. Those principles would be:

1. the product, when used in a manner that could be reasonably expected, caused damage beyond that which was ordinarily and inherently associated with such use; 
2. the product carried a risk of damage, and insufficient information was provided to enable persons to make a decision as to whether to accept that risk; 
3. the product carried a risk of damage that could be avoided and adequate instructions or warnings as to how that risk might be avoided were not provided; 
4. any warning or information provided in respect of a risk of damage posed by the product did not accurately and clearly convey the nature and seriousness of that risk, and/or downplayed or obscured it; 
5. the risk of damage posed by the product at the time of supply could reasonably (taking into account the cost and feasibility of doing so) have been eliminated or materially reduced, without compromising the product’s benefits and, it was not; 
6. the risk of damage posed by the product is not proportionate to, and justified by, the benefits which the product provides, unless that risk of damage is so well known by the public at large as to be considered socially acceptable; or 
7. the product, at the time of supply, posed a materially greater risk of damage than other products then available which would have provided comparable or greater benefits. 

In many of these strands, the warning and information provided to the consumer becomes essential. Will we see a greater use of disclaimers and risk warnings? Will it be enough to write these warnings into your terms and conditions (even if no-one reads them)?

More relevant context for marketeers and UX designers is that the Law Commission says the determination of defectiveness will also include consideration of:

1. The manner in which, and the purposes for which, the product has been marketed and presented; its get-up, labelling, packaging and the use of any mark in relation to the product; the characteristics of the product, including its design, technical features and composition; and any instructions for, or warnings with respect to, doing or refraining from doing anything with or in relation to the product, including in relation to its assembly, installation, use and maintenance. 
2. The specific needs of the group of users for whose use the product is intended.
3. In the case of a product whose very purpose, or a primary purpose, is to prevent damage, any failure of the product to fulfill that purpose. 
4. The product’s ability to acquire new features or continue learning after it has been supplied by the producer to another. 
5. The reasonably foreseeable effect on the product of other products that can be expected to be used together with the product, including by means of inter-connection. 
6. The relevant product cybersecurity guidance, standards, codes of practice and legal requirements. 
7. The time when the product was supplied by its producer to another or, where the producer retains control after supply, the time when that control ceased. 
8. Where the producer retains control after supply, the extent to which that control could have been, and was, exercised by the producer, including the degree to which the product could be modified by update, upgrade or otherwise to address a risk of harm posed by the product. 

Interestingly, the Commission says a product would not be defective if another product supplied later is safer. This must make sense from the supplier's point of view, but do they have an obligation to update their product if it is possible to make it safer?

One of the most interesting parts of the consultation is the potential expansion to cover psychiatric harm. At the moment, the Act allows claims for death, personal injury and certain types of property harm. You cannot claim for pure economic loss, including loss of or damage to the product itself. In the consultation, the Commission proposes that compensable damage would include:

• psychiatric harm; 
• suffered by a direct victim; 
• which is consequential upon physical injury; or 
• arises from an event caused by the defective product in which the claimant was physically imperiled, but not physically injured;  
• when it amounts to a medically recognized or recognizable psychiatric illness.  

There are also proposals around compensating indirect victims for psychiatric harm, including where they have a close tie of love and affection with the victim.

For my cyber friends, it is discussed whether compensable damage should include damage, destruction and corruption of data, subject to an exclusion for data used exclusively for professional purposes and whether loss of access to data help on or accessed via a product should be treated as destruction or corruption of that data.

For the AI community, the Commission says the development risks defense could be updated to reflect that scientific and technological knowledge is to be assessed objectively by reference to accessible knowledge. So, if the big AI labs have knowledge you cannot access, you would not be held to account for complying with that standard?

There is so much more in the consultation. If you would like to discuss submitting a response, please let us know.

Subscribe to receive more articles like this here.