28 September 2026
Software, AI and Aviation Liability: Why the New EU Product Liability Directive Matters for Insurance Buyers
Commercial aviation remains the safest form of long distance travel, but the industry is becoming increasingly dependent on software, data, digital connectivity and artificial intelligence. From predictive maintenance and digital twins to advanced avionics and operational decision-support tools, software now plays a critical role in the safety and efficiency of modern aviation operations.
As technology evolves, so too does the legal framework governing liability when things go wrong. The new EU Product Liability Directive (EU 2024/2853) represents one of the most significant changes to product liability legislation in decades. It has potentially important implications for aviation manufacturers, suppliers, MRO organisations, software developers, airlines, airports and other aviation stakeholders.
While much of the discussion surrounding the Directive has focused on legal reform, aviation risk managers and insurance buyers should also consider the wider implications for their risk management strategies, contractual arrangements and insurance programmes.
The new Directive is not just a legal development. It is an insurance-buying issue for aviation businesses that rely on software, AI and digital updates.
Why the directive matters
The previous EU Product Liability Directive was introduced almost 40 years ago, at a time when products were primarily physical and liability frameworks were designed around tangible goods. Today's aviation environment is fundamentally different. Software updates can alter operational performance, connected systems exchange real-time data, and AI-enabled tools are increasingly supporting maintenance, safety and operational decision-making.
Recognising this shift, the new Directive modernises product liability rules for the digital age by expressly bringing software, AI-enabled functionality, digital services and connected products within the scope of the product liability regime. It will apply to products placed on the market or put into service after 9 December 2026, following implementation by EU member states.
For aviation businesses, this development is significant because software is no longer merely an operational tool. In many cases it has become an integral component of the product itself.
The expansion of product liability into the digital domain
Historically, aviation product liability discussions focused on physical components such as engines, airframes, avionics and other equipment. The new Directive reflects a different reality.
Under the revised framework, software itself can be considered a product. Digital updates, software-driven functions and AI-enabled systems may all form part of the liability analysis when assessing whether a product is defective and whether that defect caused damage.
This is particularly relevant in aviation where operational safety increasingly relies on digital functionality.
- Digital twins used to model engine performance and predict maintenance requirements.
- AI-enabled maintenance and safety analytics.
- Voice communication and incident analysis systems that use machine learning to analyse operational data.
- Future safety-critical avionics applications that may incorporate machine learning technologies.
In such an environment, liability investigations may increasingly involve questions relating not only to physical hardware but also software design, validation, updates, algorithms, data integrity and system integration.
Broader responsibility across the aviation supply chain
Another important development is the potential expansion of liability exposure across the aviation ecosystem.
Modern aircraft and aviation systems are rarely the product of a single organisation. Manufacturers, suppliers, software providers, maintenance organisations and operators all contribute to the delivery and ongoing performance of products and services. The Directive broadens the range of parties that may find themselves drawn into product liability disputes, reflecting the increasing complexity of modern supply chains.
For organisations operating within the European market, another consideration is the potential redistribution of liability across the supply chain. Where manufacturers are located outside the EU, importers, distributors and service providers may face increased scrutiny and potentially greater liability exposure. For aviation businesses, understanding where liability sits within the supply chain may become as important as understanding where operational responsibility sits.
For aviation businesses, this raises several practical questions:
- Who is responsible for software updates after delivery?
- How are responsibilities allocated between OEMs, suppliers and maintenance providers?
- What contractual protection exists if a third-party software issue contributes to a loss?
- How effectively can organisations demonstrate ownership and control of critical safety-related functionality?
These questions will not be answered solely through insurance. They will require careful consideration of governance, contractual risk transfer and operational processes.
The insurance implications
From an insurance perspective, the most important question is not necessarily whether more claims will arise, but how liability exposures may evolve.
The aviation insurance market has traditionally assessed product liability risks through a combination of engineering quality, safety performance, operating controls, claims history and geographical distribution of exposure. The growing importance of software, AI and digital services introduces an additional layer of complexity.
Claims involving software or AI may prove more challenging to investigate and defend than traditional product liability events. Multiple parties may be involved, causation questions may become more complex, and technical evidence may require specialist expertise to interpret.
At the same time, digital systems can generate significant amounts of operational data which may ultimately assist insurers and insureds in understanding causation and defending claims. As with many technological developments, the same innovation that creates new exposures may also provide new tools for managing risk.
AI-enabled monitoring, predictive analytics and real-time operational data may help organisations identify anomalies, accelerate troubleshooting and potentially prevent incidents before they occur. Over time, these capabilities may become increasingly important not only for improving operational resilience, but also for supporting claims investigations, loss analysis and defence strategies when incidents occur.
Insurers are therefore likely to focus increasingly on:
- Software development and governance processes.
- Cybersecurity controls.
- Change management and update protocols.
- Data quality and system validation.
- Third-party supplier management.
- Documentation and audit trails supporting decision-making.
- Regulatory compliance, certification processes and transparency surrounding software development, validation, testing and change management.
Organisations that can demonstrate strong governance in these areas are likely to be better positioned during underwriting discussions and claim investigations.
Potential impact on coverage design
Consideration should be given to how traditional aviation liability insurance interacts with emerging technology-related risks.
As aviation systems become more reliant on software, AI and connected services, the boundaries between product liability, cyber risk and technology liability become increasingly blurred.
As these exposures continue to converge, organisations should consider whether their existing insurance programmes contain areas of overlap, ambiguity or potential gaps in coverage. Particular attention may be required where software-related failures, AI-enabled functionality or cyber events ultimately result in bodily injury, property damage or third-party liability claims.
The industry may see continued evolution in policy wordings, exclusions and specialist products designed to address these emerging exposures.
Risk managers should consider whether existing insurance arrangements provide sufficient clarity around:
• Software-related claims.
• Digital updates and modifications.
• AI-enabled functionality.
• Cyber-related events that lead to bodily injury or property damage.
• Responsibilities arising from third-party technology providers.
The objective should not necessarily be to purchase additional insurance, but to ensure that coverage remains aligned with the organisation's changing risk profile.
Looking ahead
The new EU Product Liability Directive reflects a broader reality; aviation products are increasingly digital, connected and software-driven.
For aviation insurance buyers, the significance of the Directive extends beyond legal compliance. It represents another step in the convergence of product liability, software risk, cyber exposure and operational resilience.
While many questions remain regarding implementation and future regulatory developments, one thing is already clear: organisations that understand their digital exposure, maintain robust governance frameworks, maintain transparency around software development and change management, and regularly review their insurance arrangements will be best placed to navigate the evolving liability landscape. As liability increasingly intersects with software, AI, cybersecurity and complex supply chains, proactive preparation is likely to become a competitive advantage rather than simply a compliance exercise.
The challenge for aviation risk managers is not simply to keep pace with regulatory change, but to ensure that their risk transfer strategies evolve alongside the technologies that are reshaping the industry.
This information is not intended to constitute any form of opinion or specific guidance and recipients should not infer any opinion or specific guidance from its content. Recipients should not rely exclusively on the information contained in the bulletin and should make decisions based on a full consideration of all available information. We make no warranties, express or implied, as to the accuracy, reliability or correctness of the information provided. We and our officers, employees or agents shall not be responsible for any loss whatsoever arising from the recipient’s reliance upon any information we provide and exclude liability for the statistical content to fullest extent permitted by law.
The Walbrook Building 25 Walbrook London, EC4N 8AW
Privacy Policy - Do Not Sell or Share My Personal Information (U.S. Residents Only)
Arthur J. Gallagher (UK) Limited is authorised and regulated by the Financial Conduct Authority. Registered Office: The Walbrook Building, 25 Walbrook, London EC4N 8AW. Registered in England and Wales. Company Number: 119013.