9 December 2026. That's when the new product liability rules start to apply.
The EU Product Liability Directive (Directive (EU) 2024/2853) lets a court presume a product defective in some circumstances, including when the maker will not disclose relevant evidence. Here's what it means in plain English, the three scenarios where it matters most, and what kind of record helps.
Presumptions can shift the burden
If a court orders you to disclose relevant evidence and you do not, the product is presumed defective (Article 10(2)(a)). Where a product is found defective and the harm is of a type typically consistent with that defect, a causal link is presumed too (Article 10(3)). Where the technical complexity makes proof excessively difficult for the claimant, a court can presume defectiveness, causation or both (Article 10(4)). Every presumption can be rebutted. Without one, the claimant must prove defect, damage and causation (Article 10(1)).
AI is now explicitly in scope
Software, including AI systems, is a "product" under the revised Directive (Article 4), an expansion from the previous regime, which was aimed mainly at physical goods. The rules apply to products placed on the market after 9 December 2026.
A contemporaneous record helps
An independent, tamper-evident audit trail for every consequential decision, produced before a dispute exists rather than reconstructed after litigation starts. It can be checked later against the original trace.
What this means in practice
The presumptions matter most in three moments. Each one is easier to handle if you can produce the record now, rather than reconstruct it after the fact.
Customer sues
Your customer claims the agent made a consequential decision that harmed them. They ask the court to order you to disclose the decision trace, context, and reasoning (Article 9). If you don't comply, the product is presumed defective (Article 10(2)(a)). You can still rebut that presumption, but you start from a weaker position.
Regulator asks
A financial regulator, data protection authority, or sector supervisor requests the decision evidence for a specific trace as part of a formal investigation. You have days to respond. If you can't produce a verifiable, contemporaneous record, you have little to show them.
Board asks
Internal audit or your board's risk committee requests a random sample of consequential decisions with full evidence. You need to demonstrate that decisions were made systematically, against defined criteria, with independent audit. Logs reconstructed from application databases are hard to rely on; contemporaneous, hash-chained records are much easier to.
The evidence question: dashboard, report, or logs?
The Directive doesn't mandate a specific format, but a court can order disclosure of relevant evidence (Article 9) and will scrutinise what you produce. Three formats show up in practice. One is much easier to rely on.
Dashboard screenshot
A screen capture of your monitoring platform showing the decision was logged. Problem: anyone can fake a screenshot after the fact. It is hard to verify, especially if the underlying data changed or the dashboard was reconfigured.
Audit report
A contemporaneous, tamper-evident record issued by an independent evaluator when the trace is received. Includes the decision, the criteria evaluated, and the reasoning, hashed into a tamper-evident chain. This is what Jiminy produces: an audit trail showing the decision was evaluated systematically when it mattered, not reconstructed later.
Application logs
Database records of what your application did and when. Weak evidence because logs can be modified, contexts are often implicit, and the reasoning behind a decision isn't captured. Logs alone do not show the decision was evaluated by an independent judge.
Liability under the Directive is strict: the question is whether the product was defective, not whether you were careless. A contemporaneous, independent record helps you meet a disclosure order and rebut a presumption.
A record that no longer exists when a claim is brought answers nothing. Jiminy's standard retention is 6 months; records are retained for 10 years automatically where extended retention applies and for domain profiles we classify as high-risk (see security for the full retention table). If your deployment doesn't fall into one of those categories, the 6-month default is a cost/scope tradeoff, not a claim that every plausible claim window closes within 6 months; a claim under the Directive can in some circumstances be brought well after a decision was made. This isn't legal advice about your specific exposure; it's a plain statement of what the default configuration does and doesn't cover, so the gap isn't silent.
Supporting frameworks outside the EU
The PLD is the lead anchor, but two other frameworks reinforce the same underlying expectation: that someone can explain an AI decision after the fact.
How the audit record works
An independent verdict on every consequential decision, hashed into a tamper-evident chain and timestamped when the trace is received, which you can check against your own trace data.
Full legal detail and citations
What the product itself maps against
EU AI Act (Arts. 5, 9, 12, 13, 14, 15, 26, 50, 72), UK GDPR (Arts. 5, 22, 25), FCA Consumer Duty (PRIN 12, PROD 2.1), SRA Code of Conduct and Bar Council AI Guidance, Equality Act 2010 (ss. 13, 19, 20), and the ICO AI Auditing Framework.
Not legal advice, deliberately
Jiminy does not perform conformity assessments and does not provide legal advice. The regulatory mapping this page and the product describe is observational: it identifies which obligations a decision touches, so your compliance team can reach its own determination. Output vocabulary is deliberately constrained to evidenced / partially_evidenced / not_evidenced, never compliant / non-compliant.
Jiminy audits the log, not the agent
Every verdict evaluates the decision trace as submitted. Attestation (see reliability) proves that trace wasn't altered after it was emitted; it does not, and structurally cannot, prove the trace is a complete account of what the agent did. A step withheld from the submitted log is invisible to the judge, the same way a fact withheld from a witness statement is invisible to a court. This is a limitation of evaluating a submitted record rather than the agent itself, not a gap Jiminy is trying to close quietly.
Directive reference
Directive (EU) 2024/2853 on liability for defective products, repealing Directive 85/374/EEC. Member states must bring implementing measures into force by the transposition deadline; a court can order disclosure of relevant evidence (Article 9), and defectiveness is presumed where the defendant fails to comply (Article 10(2)(a)). Causation and defectiveness can also be presumed in the circumstances set out in Article 10(3) and (4). The new rules apply to products placed on the market after 9 December 2026.