The European Union (EU) General Product Safety Regulation 2023/988 (GPSR) is the main law. It is in force in all EU countries for non-food products put on the market as from 1 December 2024. It covers products intended for consumers or likely to be used by consumers under reasonably foreseeable conditions.
For non-food consumer products put on the market before 13 December 2024, the Austrian law on product safety, Produktsicherheitsgesetz 2004 (PSG 2024), remains applicable. Hence, for consumer products, two sets of rules may apply in parallel.
For non-consumer products, the EU-Market Surveillance Regulation (2019/1020) applies, unless there are specific provisions with the same objective in the EU harmonised legislation which regulate market surveillance and enforcement in a more specific manner.
Annex I of this EU-Regulation (EU) 2019/1020 lists around 70 of these sector-specific Union harmonisation acts for particular product groups, such as machinery, electrical equipment, electromagnetic compatibility (EMC) of equipment, toys, medical devices, explosives for civil use, measuring instruments, marine equipment and automotive-type approval, and many more. Where a sectoral act has specific market surveillance provisions, those specific rules prevail (lex specialis), otherwise the aforementioned EU-Regulation 2019/1020 applies.
The key regulatory authority is the Federal Ministry of Labour, Social Affairs, Health and Consumer Protection (Bundesministerium für Soziales, Gesundheit, Pflege und Konsumentenschutz).
Market surveillance and inspections are carried out in co-operation with the provincial authorities for non-food and the AGES (Austrian Agency for Health and Food Safety) for food products.
“Corrective action” is defined in the EU-Market Surveillance Regulation (2019/1020) and refers to any measure an economic operator takes to address and resolve a product safety or compliance issue, whether following a request from a market surveillance authority or on its own initiative – eg, warnings, withdrawal, recall, online delisting.
The Blue Guide interprets and illustrates these corrective measures, explaining the differences between these corrective measures and how they are used in practice.
The GPSR does not contain a specific definition of “corrective action”, but the term should be interpreted in line with the above-mentioned framework. The GPSR lays down binding rules on when economic operators and market surveillance authorities must adopt corrective measures and what these measures must achieve.
Relevant criteria: corrective measures must be tailored to the level and nature of the risk, must be effective and proportionate in reducing or eliminating that risk, must be taken without undue delay, and must be accompanied by clear and adequate communication so that consumers can protect themselves.
Economic operators and authorities must use effective means of communication, which can include targeted notices, for example via retailers, websites, emails, online platforms, and, where necessary, broader public announcements, depending on the product, the distribution channel and the group of affected consumers.
Notification is based on a risk assessment and is usually triggered by specific events such as injuries, accidents, consumer complaints, internal testing or risk assessment results, or information received from market surveillance authorities or reports by whistle-blowers within the economic operator (eg, the producer) or from outside, in line with the EU Whistleblowing Directive. This law expressly covers product safety matters and is implemented in Austria in the HinweisgeberInnenschutzgesetz (HSchG).
Where a manufacturer considers or has reason to believe that a product is dangerous, it must immediately inform, via the Safety Business Gateway, the market surveillance authorities of all member states where the product has been made available on the market.
Importers and distributors who become aware of such information must immediately inform the manufacturer. A direct notification duty of importers or distributors to the market surveillance authorities is not foreseen: either the manufacturer submits the notification itself, or it instructs the importer or one of the distributors to do so. The GPSR does not grant importers or distributors a right to refuse such an instruction. In an earlier draft version of the EU Regulation, a short deadline of two working days had been proposed.
Where a product has caused an accident which resulted in death or serious harm to a person’s health (including injuries, illness or chronic effects), the manufacturer must ensure that this accident is notified without undue delay via the Safety Business Gateway to the authority of the member state where the accident occurred, giving at least the product type, identification number and, where known, the circumstances; further information must be supplied on request. Importers and distributors who become aware of such an accident must without undue delay inform the manufacturer, who must then either notify the authority itself or instruct an importer or distributor to do so.
Non-EU manufacturers must ensure that an EU based economic operator (such as their EU responsible person or importer) is available to interact with market surveillance authorities and, where appropriate, submit the relevant notifications on their behalf.
The GPSR does not prescribe specific penalty amounts but leaves it to the member states to lay down their own sanctioning regimes. Austria has to date not yet adopted specific financial sanctions for breaches of obligations under the GPSR.
Under the still-applicable Austrian Product Safety Act 2004 (PSG 2004), the maximum administrative fine is EUR25,000. Under the GPSR, penalties must be effective, proportionate and dissuasive. It is therefore open to doubt whether the existing Austrian sanction framework will meet this standard in the long term.
The main causes of action are:
The burden of proof is on the claimant, which must demonstrate:
Action is against:
Standing to bring claims for product liability is held by any natural person suffering personal injury or death and damage to property if ordinarily intended for private use or consumption and if it was mainly used for private purposes, hence privately used property. Pure business-to-business (B2B) property damage to professional assets is exempted.
Liability is extinguished ten years after the day on which the defective product that caused the damage was placed on the market. Within this period, the civil claim itself is subject to a limitation period of three years from the date on which the injured party became aware of the damage and of the person liable.
Under Austrian general civil law, there is a general 30 year long-stop limitation period, meaning an absolute maximum time limit after which a civil claim can no longer be brought, regardless of when the claimant became aware of the damage or the liable party. In contrast, the new EU Product Liability Directive sets out an exceptional 25 year long-stop period specifically for latent personal injuries, which is shorter than the general 30-year period under Austrian law. As the Directive is based on maximum harmonisation, this exceptional 25 year long-stop for latent personal injuries is intended to operate as a specific cap for harmonised product liability claims in Austria.
Basic rule: The relevant Austrian courts have jurisdiction where the defendant (eg, manufacturer, importer) is domiciled/has its legal seat in Austria.
Special product-liability claims: place where the damage occurred or where the defective product was manufactured or put into circulation.
Austrian law does not provide any formal, mandatory pre-action procedure specific to product liability cases. There is no legal obligation on the injured party to send a formal pre-action letter, engage in ADR (alternative dispute resolution), or notify an authority.
Austrian law does not provide for a US-style “litigation hold” or spoliation regime, and neither the Product Liability Act nor the Code of Civil Procedure (ZPO) impose any specific pre-action obligation to preserve products or documents backed by separate sanctions.
Manufacturers are advised to retain product-related documentation for at least ten years (see 2.3 Time Limits for Product Liability Claims).
Courts are free to evaluate the evidence, and if a party destroys or fails to preserve important evidence (such as the product, documents or test reports), the court may take this into account when assessing the overall evidentiary situation and the persuasiveness of that party’s position.
Thus, both claimants and defendants are well advised to preserve the product and relevant documentation, since the loss of such evidence can adversely affect their position in court.
There are no special disclosure rules for product liability cases. Such claims follow the ordinary civil procedure rules, which do not provide US-style discovery or a general duty to disclose all relevant documents.
The new EU Product Liability Directive 2024/2853 will require Austria to introduce targeted disclosure mechanisms so that claimants can obtain relevant evidence from defendants or third parties, subject to judicial control and proportionality, but it will not create a broad, adversarial discovery regime. Access to evidence will remain within the existing judge-driven civil procedure framework.
Expert evidence (Gerichtssachverständige) in product liability cases is governed by the general rules of the Austrian Code of Civil Procedure (ZPO). Courts usually appoint independent court experts to assess technical and medical issues. Party-appointed experts are treated as submissions, not as court evidence, and there is no separate expert evidence regime specific to product liability.
See 2.1 Product Liability Causes of Action and Sources of Law. The claimant bears the burden of proof and must satisfy the court, on the balance of probabilities, that a defect existed and that this defect was more likely than not the cause of the damage.
Under the new EU Product Liability Directive, this basic allocation is maintained, but explicitly requires that the overall burden on the claimant is not excessive, especially in complex technological contexts (software, AI, interconnected systems). The new Directive introduces a rebuttable presumption of defectiveness in favour of the claimant, where:
Presumption of causation applies where:
These presumptions shift the burden to the defendant to rebut them; if the defendant cannot do so, defect and/or causation are deemed proven.
In Austria, product liability cases are brought before the ordinary civil courts, usually the district courts or regional courts, depending on the amount in dispute and subject matter competence; higher instances are the courts of appeal and ultimately the Supreme Court (OGH for Oberster Gerichtshof). All civil product liability cases are decided by professional judges only. The Austrian system does not use juries in civil matters.
First instance judgments (district or regional court) can be appealed to the next higher court, usually within four weeks of service of the written judgment.
A further appeal to the Supreme Court (Revision) is only possible if the statutory admissibility criteria are met (in particular a legal question of fundamental importance), a threshold that is relatively difficult to overcome in practice.
There are no special or shorter deadlines or procedures for product liability cases; they are treated like any other civil matter.
Under the current Austrian Product Liability Act (PHG), defendants can rely on the classical set of defences derived from the 1985 EC-Product Liability Directive, in particular that they did not put the product into circulation, that the defect did not exist when the product was put into circulation, that the defect results from mandatory legal provisions or that, given the state of scientific and technical knowledge at the time, the defect could not have been discovered (development risk defence).
The new EU Product Liability Directive 2024/2853 largely preserves this structure but sets out a more detailed catalogue of defences in Article 11 and at the same time significantly narrows them in practice, especially for digital products.
It links the development risk defence to the period during which the product is within the manufacturer’s control and excludes exoneration where defectiveness is due to related services, software, including software updates, or a lack of safety-relevant updates under the manufacturer’s control. For software-intensive and connected products, this will make it considerably more difficult for manufacturers to rely on development risk and “no defect at the time of placing on the market” arguments.
The main exemptions from liability (defences) can be listed briefly as follows.
Under both the new EU Product Liability Directive and the Austrian PHG, mandatory regulatory requirements and technical standards play different roles in the defect analysis.
In Austrian product liability litigation, the general “loser pays” principle applies: the unsuccessful party must reimburse the successful party’s necessary court fees and tariff-based legal costs, including court-appointed expert, interpreter and witness costs at statutory/tariff levels. In addition, the losing party must still pay its own lawyer’s fees. Contingency fees (pure quota litis) are prohibited under Austrian professional rules, but fee agreements with success-related components (for example a bonus on top of a base or time based fee) are permissible within certain limits.
Moreover, Austrian law does not recognise punitive damages or exemplary damages; only compensatory damages are recoverable.
In Austria, product liability claims can be financed both through commercial third-party litigation funding and through legal expenses insurance.
Austria does not have US-style opt-out class actions, but several collective mechanisms are available and used in product liability contexts.
An Austrian Supreme Court case from 2021 (5Ob 152/21w) concerned an alleged design defect in a ski binding that did not release during a backward fall. The court held that there was no design defect, because in the specific fall scenario – backward fall – the non-release was consistent with the applicable technical standards and industry norms, which indicated that the product was free from defect. The court also rejected an instruction defect. According to the court, an average skier cannot reasonably expect a ski binding to release in every conceivable fall situation. In addition, the manufacturer had provided a general warning stating that the ski–binding–boot system does not necessarily release in all situations where there is a risk of injury or death, which further supported the conclusion that the product was not defective.
Another Austrian Supreme Court case (7Ob 103/19a) concerned a one-centimetre metal fragment found in a canned chicken product, which ended up in the mouth of a 12-year-old claimant but did not cause any physical injury. The claimant, however, developed a clinically relevant obsessive–compulsive disorder (checking compulsion), for which the incident was found to be 10–15% causally responsible. The court affirmed liability, holding that such an incident can at least contribute to triggering a mental disorder of disease value and does not fall outside the bounds of reasonably foreseeable consequences.
A recent Austrian Supreme Court decision from 18 November 2025 (2Ob77/25z) on a defective copper IUD (intrauterine device) whose arm broke and led to an unintended pregnancy has been referred to the CJEU (Court of Justice of the European Union) to clarify whether loss of earnings suffered by a woman as a result of an unintended pregnancy qualifies as “damage caused by personal injury” under Article 9(a) of the Product Liability Directive 85/374. This is crucial for defining the boundary between recoverable personal injury loss and excluded pure economic loss in EU product liability law.
In a subsequent Supreme Court decision of 27 April 2026 (4 Ob 104/25k), the court dealt with another claim arising from a defective copper IUD, involving an unintended pregnancy. The woman seeks compensation for the financial consequences of the unwanted pregnancy, notably the costs of the abortion and of a new contraceptive method. The court held that the decisive questions, in particular whether such follow-on losses qualify as damage caused by personal injury, overlap with the issues already referred to the CJEU in the case cited above (2Ob77/25z). It therefore stayed the proceedings until the CJEU has ruled, underlining the broader significance of the pending reference for the treatment of consequential losses in contraceptive product.
The key driver of current trends is the new EU Product Liability Directive 2024/2853 and its upcoming implementation in Austria.
Future policy in Austria is increasingly focused on putting the EU’s new product liability and safety framework into national law, with a particular emphasis on digital and AI-enabled products.
First, Austria will need to amend its Product Liability Act to transpose Directive 2024/2853, including specific provisions on liability for software and AI systems, explicit coverage of additional types of damage, such as data loss and psychological harm, and enhanced evidentiary support for claimants.
Secondly, it is important to note that software updates may be treated as new instances of placing a product on the market, so each significant update that changes the product’s safety or risk profile may trigger a fresh assessment of defectiveness at the relevant time of that new release.
Thirdly, the legislature and regulators are working on how the Product Liability Directive, the EU AI Act and the GPSR interlock, especially regarding cybersecurity, update and monitoring obligations and risk assessment duties for connected products and IoT devices.
Finally, policy debate is increasingly turning to collective redress mechanisms, third-party litigation funding and the practical deployment of representative actions in mass consumer and product cases, which will be crucial for large-scale disputes involving defective digital products or AI-driven systems.
Waehringer Str. 26
A-1090 Vienna
Austria
+43 1 3199 700
+43 1 3199 700 22
a.eustacchio@eustacchio.com www.eustacchio.com
From Hardware Defects to Autonomous Systems
For many years, Austrian product liability discussions were dominated by classic scenarios: defective household products, industrial machinery, construction materials or medical devices. In these cases, the alleged defect usually lay in the physical properties of the product – a broken component, an inadequate safety guard, an unstable construction.
Today, the market is experiencing a profound shift. A growing share of product liability risk now stems from software, connectivity and automated functions rather than from “pure” hardware.
This development is particularly visible in the automotive and mobility sector. Modern vehicles integrate advanced driver assistance systems, complex sensor suites, high-performance computing platforms and permanent connectivity to back-end servers and other vehicles. The line between a “mechanical” product and a “digital” service is becoming increasingly blurred.
For clients, this means that legal analysis can no longer stop at the question of whether a component is physically intact; it must also examine whether the system behaves safely in software-controlled and data-driven environments.
From an Austrian perspective, these changes interact with a long-established legal framework. Product liability in Austria is primarily based on strict, fault-independent rules implementing EU law, complemented by fault-based general tort principles. While the basic concepts remain stable, their application to autonomous driving, networked products and AI-supported decision-making creates new pressures and questions.
The trend is clear: Austrian courts, regulators and market participants are increasingly required to translate traditional notions of “product”, “defect” and “safety which a person is entitled to expect” into a world where software and data play a central role.
Software as a Product: From Accessory to Core
A central trend that clients should understand is the gradual but consistent recognition of software as a product in its own right. Historically, software was often treated as something ancillary: a tool to run the machine, but not the “product” that courts and regulators focused on. With digitalisation and automation, this approach is no longer sustainable.
In many modern products, and particularly in vehicles and mobility systems, software performs safety-critical tasks. It interprets sensor data, decides when to apply brakes or steering inputs, manages battery systems, controls airbag deployment and co-ordinates complex interaction between components. In those circumstances, it is increasingly difficult to argue that the physical hardware alone determines safety.
With the implementation of the NEW EU Product-Liability Directive, companies operating in Austria should assume that embedded software and standalone software can be evaluated under product liability standards.
This shift has several practical implications.
Product safety by design: For clients, this means that product liability is no longer primarily the domain of mechanical engineering departments. Legal and compliance teams need to be closely aligned with software engineers, systems architects and cybersecurity specialists. This is particularly true where products are designed for safety-critical applications, such as automated driving or remote control of machinery.
Strict Liability Reaching Software Developers
Another important development concerns who is exposed to strict, fault-independent liability. Traditionally, manufacturers of physical products and their importers were the main actors within the strict liability regime.
With the rise of software-centric products, specialised software companies now often hold safety-critical responsibilities even where they do not produce any hardware themselves.
In practice, several liability-relevant constellations are likely.
In these settings, the question is no longer whether software developers have any product-related duties at all, but rather how far strict liability reaches and how responsibilities are allocated between all parties involved. For clients active in Austria, four points are particularly relevant.
Autonomous Driving: Layered Risks and Shared Responsibilities
Nowhere do these trends converge more clearly than in autonomous and highly automated driving. A modern automated driving system is best understood as a layered architecture.
At the bottom layer lies the physical vehicle with its classic safety systems: brakes, steering, suspension, airbags and crash structures. At the next layer, sensors such as cameras, radar and lidar collect data about the environment. Above that, software modules interpret this data, create a model of the vehicle’s surroundings and decide on driving actions. On the top layers, connectivity and back-end services support navigation, updates, fleet learning and sometimes remote supervision.
Each layer involves different actors and potential failure modes. For clients in Austria, this raises complex questions about how strict liability is distributed when an accident occurs: is the alleged defect in the sensor hardware, in the perception algorithm, in the decision logic, in the actuator interface, or in a connectivity service that failed at a critical moment? In many cases, several layers interact, and it may be difficult to pinpoint a single cause.
From a practical perspective, companies will be responding in several ways.
These developments show that autonomous driving does not simply add more technology. It fundamentally changes how risk and responsibility are structured. For clients, the challenge is to ensure that technical reality and legal allocation of risk are aligned, so that no important gap remains uncovered and no party bears disproportionate liability exposure.
Updates, Connectivity and Cybersecurity: Safety as a Moving Target
A core characteristic of modern automated and connected products is that they are never truly “finished”. Vehicles and other devices receive software updates throughout their lifetime, sometimes adding new functions, sometimes fixing bugs, sometimes addressing security vulnerabilities. Each update can, in effect, create a new version of the product.
From a product liability perspective, this dynamic raises two key issues.
Second, cybersecurity is now recognised as an integral part of product safety. A vulnerability that allows an attacker to manipulate steering, braking or sensor data is not only an IT risk. It may directly endanger life and health. Consequently, cybersecurity measures, including secure development practices, penetration testing, key management and incident response, are increasingly scrutinised in liability disputes.
Companies active in Austria therefore need integrated concepts that cover:
These structures are particularly critical for automated and connected vehicles, where large fleets may require co-ordinated updates and communication across several countries.
Market Practice and Client Expectations in Austria
In the Austrian market, these trends are reflected in the type of mandates and questions that companies bring to legal advisers. Manufacturers and suppliers of automotive and technical products no longer ask only whether a particular design choice complies with a standard.
They also want to understand how courts might view a complex chain of software-driven events and what kind of documentation will be helpful in defending a claim.
In practice, specialised product liability counsel are increasingly asked to:
Clients from non-automotive sectors, such as machinery, consumer goods, sports equipment, lifestyle products or food-related technology, are watching developments in the automotive field closely. Many of them are undergoing their own digital transformation, adding connectivity, apps or AI-based features to their analogue products. For these companies, the lessons from automotive are often directly transferable: software and data must be treated as central elements of product safety, not as afterthoughts.
Outlook: Navigating Next-Generation Product Liability and Product Safety
Looking ahead, two developments are likely to shape product liability in Austria and across Europe over the coming years.
First, there will be increasing interaction between product liability rules and sector-specific regulation, particularly in automotive. Type-approval regimes, cybersecurity regulations, software update requirements and AI-specific rules will all influence how courts understand the safety expectations that users may legitimately hold. For clients, this means that compliance cannot be managed in separate silos; regulatory and liability perspectives must be integrated.
Second, the evidentiary environment is changing. Automated and connected vehicles generate large volumes of data, including logs, sensor recordings and event data records. In disputes, these data sets can be both an asset and a risk. Companies that manage data retention and access in a structured way will be better placed to explain what happened in an incident, demonstrate compliance with safety concepts and, where appropriate, show that a defect did not exist. Conversely, a lack of data or inconsistent records can significantly weaken a defence.
For clients operating in or entering the Austrian market, the key message is that product liability is no longer limited to obvious mechanical defects. Software, connectivity, AI and cybersecurity are now central to safety assessments, particularly in autonomous driving and other automated systems. A key precondition for the successful deployment and uptake of automated vehicles is public acceptance. In practice, this will largely turn on whether users’ safety expectations are fulfilled in a way that goes beyond formal compliance with regulatory and voluntary standards.
Against this background, from a legal policy perspective, product liability rules do not only allocate civil responsibility to the stakeholder causally involved in a defect. They also have an important preventive function. Together with the product safety rules, they incentivise robust safety concepts, a transparent allocation of responsibilities and effective incident-response mechanisms. By integrating legal, technical and organisational perspectives early in the design and development process, companies can significantly reduce the risk of future disputes, be better prepared when incidents do occur and more effectively meet the safety and trust expectations that will determine the commercial success of automated mobility solutions.
Waehringer Str. 26
A-1090 Vienna
Austria
+43 1 3199 700
+43 1 3199 700 22
a.eustacchio@eustacchio.com www.eustacchio.com