Product Liability & Safety 2026

Last Updated June 18, 2026

Austria

Law and Practice

Author



EUSTACCHIO is one of Austria’s leading law offices for product liability, product compliance and product safety law, with more than 25 years’ experience and over a decade of specialised focus on the legal aspects of autonomous and connected driving. The firm advises manufacturers, suppliers and software developers of industrial components and automotive and technology systems across the full product life cycle, from concept and design through product safety, compliance and market entry, including the drafting and review of commercial and distribution agreements for national and cross-border product sales. The practice has a particular focus on risks linked to digitalisation, embedded software, connectivity and cybersecurity in networked and automated products, with automotive systems and autonomous vehicles and machines forming an important part of this work.

The European Union (EU) General Product Safety Regulation 2023/988 (GPSR) is the main law. It is in force in all EU countries for non-food products put on the market as from 1 December 2024. It covers products intended for consumers or likely to be used by consumers under reasonably foreseeable conditions.

For non-food consumer products put on the market before 13 December 2024, the Austrian law on product safety, Produktsicherheitsgesetz 2004 (PSG 2024), remains applicable. Hence, for consumer products, two sets of rules may apply in parallel.

For non-consumer products, the EU-Market Surveillance Regulation (2019/1020) applies, unless there are specific provisions with the same objective in the EU harmonised legislation which regulate market surveillance and enforcement in a more specific manner.

Annex I of this EU-Regulation (EU) 2019/1020 lists around 70 of these sector-specific Union harmonisation acts for particular product groups, such as machinery, electrical equipment, electromagnetic compatibility (EMC) of equipment, toys, medical devices, explosives for civil use, measuring instruments, marine equipment and automotive-type approval, and many more. Where a sectoral act has specific market surveillance provisions, those specific rules prevail (lex specialis), otherwise the aforementioned EU-Regulation 2019/1020 applies.

  • EU-Commission Delegated Regulation (EU) 2024/3173 supplements the GPSR by laying down the criteria and rules for assessing the level of risk of consumer products and for certain Safety Gate notifications.
  • The EU-Blue Guide on the implementation of EU product rules 2022, not a product safety act in itself, but a non-binding guidance document (soft law) that explains how EU product safety and product compliance legislation should be interpreted and applied in practice.
  • For food there is a special food law safety regime in the EU: The General Food Law Regulation 178/2002, supplemented by the Austrian Food Safety and Consumer Protection Act 2006 (LMSVG).

The key regulatory authority is the Federal Ministry of Labour, Social Affairs, Health and Consumer Protection (Bundesministerium für Soziales, Gesundheit, Pflege und Konsumentenschutz).

Market surveillance and inspections are carried out in co-operation with the provincial authorities for non-food and the AGES (Austrian Agency for Health and Food Safety) for food products.

“Corrective action” is defined in the EU-Market Surveillance Regulation (2019/1020) and refers to any measure an economic operator takes to address and resolve a product safety or compliance issue, whether following a request from a market surveillance authority or on its own initiative – eg, warnings, withdrawal, recall, online delisting.

The Blue Guide interprets and illustrates these corrective measures, explaining the differences between these corrective measures and how they are used in practice.

The GPSR does not contain a specific definition of “corrective action”, but the term should be interpreted in line with the above-mentioned framework. The GPSR lays down binding rules on when economic operators and market surveillance authorities must adopt corrective measures and what these measures must achieve.

Relevant criteria: corrective measures must be tailored to the level and nature of the risk, must be effective and proportionate in reducing or eliminating that risk, must be taken without undue delay, and must be accompanied by clear and adequate communication so that consumers can protect themselves.

Economic operators and authorities must use effective means of communication, which can include targeted notices, for example via retailers, websites, emails, online platforms, and, where necessary, broader public announcements, depending on the product, the distribution channel and the group of affected consumers.

Notification is based on a risk assessment and is usually triggered by specific events such as injuries, accidents, consumer complaints, internal testing or risk assessment results, or information received from market surveillance authorities or reports by whistle-blowers within the economic operator (eg, the producer) or from outside, in line with the EU Whistleblowing Directive. This law expressly covers product safety matters and is implemented in Austria in the HinweisgeberInnenschutzgesetz (HSchG).

Where a manufacturer considers or has reason to believe that a product is dangerous, it must immediately inform, via the Safety Business Gateway, the market surveillance authorities of all member states where the product has been made available on the market.

Importers and distributors who become aware of such information must immediately inform the manufacturer. A direct notification duty of importers or distributors to the market surveillance authorities is not foreseen: either the manufacturer submits the notification itself, or it instructs the importer or one of the distributors to do so. The GPSR does not grant importers or distributors a right to refuse such an instruction. In an earlier draft version of the EU Regulation, a short deadline of two working days had been proposed.

Where a product has caused an accident which resulted in death or serious harm to a person’s health (including injuries, illness or chronic effects), the manufacturer must ensure that this accident is notified without undue delay via the Safety Business Gateway to the authority of the member state where the accident occurred, giving at least the product type, identification number and, where known, the circumstances; further information must be supplied on request. Importers and distributors who become aware of such an accident must without undue delay inform the manufacturer, who must then either notify the authority itself or instruct an importer or distributor to do so.

Non-EU manufacturers must ensure that an EU based economic operator (such as their EU responsible person or importer) is available to interact with market surveillance authorities and, where appropriate, submit the relevant notifications on their behalf.

The GPSR does not prescribe specific penalty amounts but leaves it to the member states to lay down their own sanctioning regimes. Austria has to date not yet adopted specific financial sanctions for breaches of obligations under the GPSR.

Under the still-applicable Austrian Product Safety Act 2004 (PSG 2004), the maximum administrative fine is EUR25,000. Under the GPSR, penalties must be effective, proportionate and dissuasive. It is therefore open to doubt whether the existing Austrian sanction framework will meet this standard in the long term.

The main causes of action are:

  • statutory non-fault product liability (“strict liability”) under the Austrian Product Liability Act based on the current and the New EU-Product Liability Directive;
  • fault-based tort law;
  • fault-based contract law, both under the Austrian Civil Code (ABGB)

The burden of proof is on the claimant, which must demonstrate:

  • the defect in the product;
  • the damage caused by the product; and
  • the causal link between damage and defect.

Action is against:

  • the producer/manufacturer, own-branders, and with the new EU-Product Liability Directive also against software and AI developers;
  • the importer;
  • the authorised representative in the EU;
  • fulfilment service provider and online marketplaces; and
  • subsidiary: the distributor.

Standing to bring claims for product liability is held by any natural person suffering personal injury or death and damage to property if ordinarily intended for private use or consumption and if it was mainly used for private purposes, hence privately used property. Pure business-to-business (B2B) property damage to professional assets is exempted.

Liability is extinguished ten years after the day on which the defective product that caused the damage was placed on the market. Within this period, the civil claim itself is subject to a limitation period of three years from the date on which the injured party became aware of the damage and of the person liable.

Under Austrian general civil law, there is a general 30 year long-stop limitation period, meaning an absolute maximum time limit after which a civil claim can no longer be brought, regardless of when the claimant became aware of the damage or the liable party. In contrast, the new EU Product Liability Directive sets out an exceptional 25 year long-stop period specifically for latent personal injuries, which is shorter than the general 30-year period under Austrian law. As the Directive is based on maximum harmonisation, this exceptional 25 year long-stop for latent personal injuries is intended to operate as a specific cap for harmonised product liability claims in Austria.

Basic rule: The relevant Austrian courts have jurisdiction where the defendant (eg, manufacturer, importer) is domiciled/has its legal seat in Austria.

Special product-liability claims: place where the damage occurred or where the defective product was manufactured or put into circulation.

Austrian law does not provide any formal, mandatory pre-action procedure specific to product liability cases. There is no legal obligation on the injured party to send a formal pre-action letter, engage in ADR (alternative dispute resolution), or notify an authority.

Austrian law does not provide for a US-style “litigation hold” or spoliation regime, and neither the Product Liability Act nor the Code of Civil Procedure (ZPO) impose any specific pre-action obligation to preserve products or documents backed by separate sanctions.

Manufacturers are advised to retain product-related documentation for at least ten years (see 2.3 Time Limits for Product Liability Claims).

Courts are free to evaluate the evidence, and if a party destroys or fails to preserve important evidence (such as the product, documents or test reports), the court may take this into account when assessing the overall evidentiary situation and the persuasiveness of that party’s position.

Thus, both claimants and defendants are well advised to preserve the product and relevant documentation, since the loss of such evidence can adversely affect their position in court.

There are no special disclosure rules for product liability cases. Such claims follow the ordinary civil procedure rules, which do not provide US-style discovery or a general duty to disclose all relevant documents.

The new EU Product Liability Directive 2024/2853 will require Austria to introduce targeted disclosure mechanisms so that claimants can obtain relevant evidence from defendants or third parties, subject to judicial control and proportionality, but it will not create a broad, adversarial discovery regime. Access to evidence will remain within the existing judge-driven civil procedure framework.

Expert evidence (Gerichtssachverständige) in product liability cases is governed by the general rules of the Austrian Code of Civil Procedure (ZPO). Courts usually appoint independent court experts to assess technical and medical issues. Party-appointed experts are treated as submissions, not as court evidence, and there is no separate expert evidence regime specific to product liability.       

See 2.1 Product Liability Causes of Action and Sources of Law. The claimant bears the burden of proof and must satisfy the court, on the balance of probabilities, that a defect existed and that this defect was more likely than not the cause of the damage.

Under the new EU Product Liability Directive, this basic allocation is maintained, but explicitly requires that the overall burden on the claimant is not excessive, especially in complex technological contexts (software, AI, interconnected systems). The new Directive introduces a rebuttable presumption of defectiveness in favour of the claimant, where:

  • the defendant fails to disclose relevant evidence ordered by the court;
  • the product or its safety is in non-compliance with mandatory safety requirements; or
  • the damage is of a kind “typically consistent” with a defect in the product.

Presumption of causation applies where:

  • the defect and the type of damage are established; and
  • the damage would typically be caused by such a defect.

These presumptions shift the burden to the defendant to rebut them; if the defendant cannot do so, defect and/or causation are deemed proven.

In Austria, product liability cases are brought before the ordinary civil courts, usually the district courts or regional courts, depending on the amount in dispute and subject matter competence; higher instances are the courts of appeal and ultimately the Supreme Court (OGH for Oberster Gerichtshof). All civil product liability cases are decided by professional judges only. The Austrian system does not use juries in civil matters.

First instance judgments (district or regional court) can be appealed to the next higher court, usually within four weeks of service of the written judgment.

A further appeal to the Supreme Court (Revision) is only possible if the statutory admissibility criteria are met (in particular a legal question of fundamental importance), a threshold that is relatively difficult to overcome in practice.

There are no special or shorter deadlines or procedures for product liability cases; they are treated like any other civil matter.

Under the current Austrian Product Liability Act (PHG), defendants can rely on the classical set of defences derived from the 1985 EC-Product Liability Directive, in particular that they did not put the product into circulation, that the defect did not exist when the product was put into circulation, that the defect results from mandatory legal provisions or that, given the state of scientific and technical knowledge at the time, the defect could not have been discovered (development risk defence).

The new EU Product Liability Directive 2024/2853 largely preserves this structure but sets out a more detailed catalogue of defences in Article 11 and at the same time significantly narrows them in practice, especially for digital products.

It links the development risk defence to the period during which the product is within the manufacturer’s control and excludes exoneration where defectiveness is due to related services, software, including software updates, or a lack of safety-relevant updates under the manufacturer’s control. For software-intensive and connected products, this will make it considerably more difficult for manufacturers to rely on development risk and “no defect at the time of placing on the market” arguments.

The main exemptions from liability (defences) can be listed briefly as follows.

  • The economic operator did not place the product on the market or put it into service (or, for a distributor, did not make it available on the market).
  • It is probable that the defect did not exist when the product was placed on the market, put into service or made available, but arose only afterwards.
  • The defect is due to compliance with mandatory legal requirements.
  • According to the objective state of scientific and technical knowledge at the time of placing on the market or putting into service, or while the product was within the manufacturer’s control, the defect could not have been discovered (development risk defence).
  • For a component manufacturer: the defect of the finished product is attributable to its design or to the instructions given by the manufacturer of the finished product.
  • For a person substantially modifying a product: the defect is related to a part of the product that was not affected by the modification.

Under both the new EU Product Liability Directive and the Austrian PHG, mandatory regulatory requirements and technical standards play different roles in the defect analysis.

  • Mandatory regulatory requirements: If the alleged defect directly results from compliance with binding legal rules, this can constitute a specific defence. Regulatory compliance with such mandatory requirements is therefore highly relevant and, where the defence applies, liability excluding.
  • By contrast, technical standards and industry practice: EN/ISO norms and similar standards are usually non-binding. Compliance is only evidence of an appropriate minimum safety level, not an independent defence. Courts may still find a defect if, in the circumstances (state-of-the-art, user group, foreseeable misuse, product presentation), a higher level of safety was objectively to be expected.

In Austrian product liability litigation, the general “loser pays” principle applies: the unsuccessful party must reimburse the successful party’s necessary court fees and tariff-based legal costs, including court-appointed expert, interpreter and witness costs at statutory/tariff levels. In addition, the losing party must still pay its own lawyer’s fees. Contingency fees (pure quota litis) are prohibited under Austrian professional rules, but fee agreements with success-related components (for example a bonus on top of a base or time based fee) are permissible within certain limits.

Moreover, Austrian law does not recognise punitive damages or exemplary damages; only compensatory damages are recoverable.

In Austria, product liability claims can be financed both through commercial third-party litigation funding and through legal expenses insurance.

  • Third-party funding is generally admissible – the Austrian Supreme Court has confirmed its permissibility (notably OGH 6 Ob 224/12b), and funders typically cover court and legal costs, including adverse cost risk, in higher value or mass cases in return for a share of the proceeds.
  • By contrast, legal expenses insurance, usually taken out long before any dispute arises, functions as the most common de facto funding mechanism for consumers, as it covers their own litigation costs and, depending on the policy, the risk of having to pay the opponent’s costs.
  • In both models, the mechanism typically covers both the party’s own litigation costs and, in the event of losing, the obligation to pay the opponent’s costs subject, in the case of insurance, to the specific policy terms and any coverage limits or exclusions.

Austria does not have US-style opt-out class actions, but several collective mechanisms are available and used in product liability contexts.

  • Injured parties generally must bring individual claims, but these can be aggregated procedurally. Austria has implemented the EU Representative Actions Directive: only recognised qualified entities (eg, consumer organisations) can bring representative actions for injunctive and redress measures on behalf of consumers.
  • In practice, multiple product liability claims are often bundled through joinder or by assigning numerous individual claims to one claimant (the “Austrian-style class action” model).
  • Such co-ordinated proceedings are used where many consumers are affected by the same allegedly defective product or marketing conduct, allowing efficient handling of common liability and causation questions.

An Austrian Supreme Court case from 2021 (5Ob 152/21w) concerned an alleged design defect in a ski binding that did not release during a backward fall. The court held that there was no design defect, because in the specific fall scenario – backward fall – the non-release was consistent with the applicable technical standards and industry norms, which indicated that the product was free from defect. The court also rejected an instruction defect. According to the court, an average skier cannot reasonably expect a ski binding to release in every conceivable fall situation. In addition, the manufacturer had provided a general warning stating that the ski–binding–boot system does not necessarily release in all situations where there is a risk of injury or death, which further supported the conclusion that the product was not defective.

Another Austrian Supreme Court case (7Ob 103/19a) concerned a one-centimetre metal fragment found in a canned chicken product, which ended up in the mouth of a 12-year-old claimant but did not cause any physical injury. The claimant, however, developed a clinically relevant obsessive–compulsive disorder (checking compulsion), for which the incident was found to be 10–15% causally responsible. The court affirmed liability, holding that such an incident can at least contribute to triggering a mental disorder of disease value and does not fall outside the bounds of reasonably foreseeable consequences.

A recent Austrian Supreme Court decision from 18 November 2025 (2Ob77/25z) on a defective copper IUD (intrauterine device) whose arm broke and led to an unintended pregnancy has been referred to the CJEU (Court of Justice of the European Union) to clarify whether loss of earnings suffered by a woman as a result of an unintended pregnancy qualifies as “damage caused by personal injury” under Article 9(a) of the Product Liability Directive 85/374. This is crucial for defining the boundary between recoverable personal injury loss and excluded pure economic loss in EU product liability law.

In a subsequent Supreme Court decision of 27 April 2026 (4 Ob 104/25k), the court dealt with another claim arising from a defective copper IUD, involving an unintended pregnancy. The woman seeks compensation for the financial consequences of the unwanted pregnancy, notably the costs of the abortion and of a new contraceptive method. The court held that the decisive questions, in particular whether such follow-on losses qualify as damage caused by personal injury, overlap with the issues already referred to the CJEU in the case cited above (2Ob77/25z). It therefore stayed the proceedings until the CJEU has ruled, underlining the broader significance of the pending reference for the treatment of consequential losses in contraceptive product.

The key driver of current trends is the new EU Product Liability Directive 2024/2853 and its upcoming implementation in Austria.

  • The Directive broadens the concept of “product” to cover software, including AI systems, digital design files and certain connected digital services.
  • It expands recoverable damage by adding explicit compensation for data corruption and abolishing the EUR500 property damage deductible.
  • It broadens the range of strictly liable operators by adding certain fulfilment service providers, specific online intermediaries and those essentially modifying products and reintroducing them to the market
  • New evidentiary tools for claimants, disclosure obligations, rebuttable presumptions in complex technical cases, are expected to influence Austrian litigation practice.
  • In parallel, the General Product Safety Regulation (GPSR) tightens safety duties, especially for online sales, marketplace operators, traceability and recall management, and is driving a modernisation of Austrian product safety practice with a strong focus on digital and connected products.

Future policy in Austria is increasingly focused on putting the EU’s new product liability and safety framework into national law, with a particular emphasis on digital and AI-enabled products.

First, Austria will need to amend its Product Liability Act to transpose Directive 2024/2853, including specific provisions on liability for software and AI systems, explicit coverage of additional types of damage, such as data loss and psychological harm, and enhanced evidentiary support for claimants.

Secondly, it is important to note that software updates may be treated as new instances of placing a product on the market, so each significant update that changes the product’s safety or risk profile may trigger a fresh assessment of defectiveness at the relevant time of that new release.

Thirdly, the legislature and regulators are working on how the Product Liability Directive, the EU AI Act and the GPSR interlock, especially regarding cybersecurity, update and monitoring obligations and risk assessment duties for connected products and IoT devices.

Finally, policy debate is increasingly turning to collective redress mechanisms, third-party litigation funding and the practical deployment of representative actions in mass consumer and product cases, which will be crucial for large-scale disputes involving defective digital products or AI-driven systems.

EUSTACCHIO

Waehringer Str. 26
A-1090 Vienna
Austria

+43 1 3199 700

+43 1 3199 700 22

a.eustacchio@eustacchio.com www.eustacchio.com
Author Business Card

Trends and Developments


Author



EUSTACCHIO is one of Austria’s leading law offices for product liability, product compliance and product safety law, with more than 25 years’ experience and over a decade of specialised focus on the legal aspects of autonomous and connected driving. The firm advises manufacturers, suppliers and software developers of industrial components and automotive and technology systems across the full product life cycle, from concept and design through product safety, compliance and market entry, including the drafting and review of commercial and distribution agreements for national and cross-border product sales. The practice has a particular focus on risks linked to digitalisation, embedded software, connectivity and cybersecurity in networked and automated products, with automotive systems and autonomous vehicles and machines forming an important part of this work.

From Hardware Defects to Autonomous Systems

For many years, Austrian product liability discussions were dominated by classic scenarios: defective household products, industrial machinery, construction materials or medical devices. In these cases, the alleged defect usually lay in the physical properties of the product – a broken component, an inadequate safety guard, an unstable construction.

Today, the market is experiencing a profound shift. A growing share of product liability risk now stems from software, connectivity and automated functions rather than from “pure” hardware.

This development is particularly visible in the automotive and mobility sector. Modern vehicles integrate advanced driver assistance systems, complex sensor suites, high-performance computing platforms and permanent connectivity to back-end servers and other vehicles. The line between a “mechanical” product and a “digital” service is becoming increasingly blurred.

For clients, this means that legal analysis can no longer stop at the question of whether a component is physically intact; it must also examine whether the system behaves safely in software-controlled and data-driven environments.

From an Austrian perspective, these changes interact with a long-established legal framework. Product liability in Austria is primarily based on strict, fault-independent rules implementing EU law, complemented by fault-based general tort principles. While the basic concepts remain stable, their application to autonomous driving, networked products and AI-supported decision-making creates new pressures and questions.

The trend is clear: Austrian courts, regulators and market participants are increasingly required to translate traditional notions of “product”, “defect” and “safety which a person is entitled to expect” into a world where software and data play a central role.

Software as a Product: From Accessory to Core

A central trend that clients should understand is the gradual but consistent recognition of software as a product in its own right. Historically, software was often treated as something ancillary: a tool to run the machine, but not the “product” that courts and regulators focused on. With digitalisation and automation, this approach is no longer sustainable.

In many modern products, and particularly in vehicles and mobility systems, software performs safety-critical tasks. It interprets sensor data, decides when to apply brakes or steering inputs, manages battery systems, controls airbag deployment and co-ordinates complex interaction between components. In those circumstances, it is increasingly difficult to argue that the physical hardware alone determines safety.

With the implementation of the NEW EU Product-Liability Directive, companies operating in Austria should assume that embedded software and standalone software can be evaluated under product liability standards.

This shift has several practical implications.

  • Safety and risk assessments must systematically integrate software architecture, coding practices, validation and verification, and the interaction between different software modules.
  • Documentation, including requirements definitions, hazard analyses, test results and change logs, becomes essential evidence to show that software-related risks have been addressed.
  • Product liability risk can arise not only from an initial coding error, but also from later configuration changes, data quality issues or interaction problems between third-party components.

Product safety by design: For clients, this means that product liability is no longer primarily the domain of mechanical engineering departments. Legal and compliance teams need to be closely aligned with software engineers, systems architects and cybersecurity specialists. This is particularly true where products are designed for safety-critical applications, such as automated driving or remote control of machinery.

Strict Liability Reaching Software Developers

Another important development concerns who is exposed to strict, fault-independent liability. Traditionally, manufacturers of physical products and their importers were the main actors within the strict liability regime.

With the rise of software-centric products, specialised software companies now often hold safety-critical responsibilities even where they do not produce any hardware themselves.

In practice, several liability-relevant constellations are likely.

  • Software developers supply embedded code that forms part of a safety-critical vehicle system, such as a lane-keeping or emergency braking function.
  • Platform providers operate back-end services that are essential for the safe functioning of a product, such as over the air update (OTA) infrastructures or fleet learning platforms.
  • AI developers deliver perception or decision-making modules that determine how an automated system reacts to its environment.

In these settings, the question is no longer whether software developers have any product-related duties at all, but rather how far strict liability reaches and how responsibilities are allocated between all parties involved. For clients active in Austria, four points are particularly relevant.

  • Contractual arrangements need to reflect the fact that software can be the source of strict liability, even if the software company acts “only” as a supplier. Indemnities, limitations of liability and insurance clauses must be drafted with an understanding of the potential scale of claims arising from accidents involving automated systems.
  • Internal compliance structures for software companies must evolve. It is no longer sufficient to meet internal quality standards; processes must be designed to withstand external scrutiny from courts, regulators and claimants. This includes robust change management, traceability of design decisions, clear documentation of risk assessments and structured incident response procedures.
  • Software developers and hardware manufacturers need to agree on how product monitoring and recall duties are shared. When a safety issue is discovered, someone must decide whether to disable functions, deploy patches, issue warnings or initiate recalls. If roles are unclear, both sides risk allegations of inadequate follow up and delayed action.
  • In many projects, software is developed for another company that markets the product under its own name and appears as the manufacturer to the customer, for example in “white-label-constellations” or own-brand constellations. In such constellations, the apparent manufacturer (quasi producer) will typically bear strict product liability externally, while the actual software developer remains in the background. This makes it all the more important to negotiate clear recourse and indemnity arrangements between the apparent manufacturer and the software supplier, so that internal risk allocation reflects the potential exposure towards end users.

Autonomous Driving: Layered Risks and Shared Responsibilities

Nowhere do these trends converge more clearly than in autonomous and highly automated driving. A modern automated driving system is best understood as a layered architecture.

At the bottom layer lies the physical vehicle with its classic safety systems: brakes, steering, suspension, airbags and crash structures. At the next layer, sensors such as cameras, radar and lidar collect data about the environment. Above that, software modules interpret this data, create a model of the vehicle’s surroundings and decide on driving actions. On the top layers, connectivity and back-end services support navigation, updates, fleet learning and sometimes remote supervision.

Each layer involves different actors and potential failure modes. For clients in Austria, this raises complex questions about how strict liability is distributed when an accident occurs: is the alleged defect in the sensor hardware, in the perception algorithm, in the decision logic, in the actuator interface, or in a connectivity service that failed at a critical moment? In many cases, several layers interact, and it may be difficult to pinpoint a single cause.

From a practical perspective, companies will be responding in several ways.

  • Development contracts increasingly specify detailed responsibilities for safety concepts, hazard analyses and safety validation, often aligned with automotive standards such as ISO 26262 or ISO 21448.
  • Supply/distribution agreements between OEMs, Tier 1 suppliers and software developers contain more nuanced provisions on data access, co-operation in incident investigations and responsibilities in recalls or field actions.
  • Cross-border teams, involving both technical and legal experts, prepare scenario-based assessments of potential accidents and claims in different jurisdictions, including Austria.

These developments show that autonomous driving does not simply add more technology. It fundamentally changes how risk and responsibility are structured. For clients, the challenge is to ensure that technical reality and legal allocation of risk are aligned, so that no important gap remains uncovered and no party bears disproportionate liability exposure.

Updates, Connectivity and Cybersecurity: Safety as a Moving Target

A core characteristic of modern automated and connected products is that they are never truly “finished”. Vehicles and other devices receive software updates throughout their lifetime, sometimes adding new functions, sometimes fixing bugs, sometimes addressing security vulnerabilities. Each update can, in effect, create a new version of the product.

From a product liability perspective, this dynamic raises two key issues.

  • The assessment of whether a product is defective must consider the state of the product at the relevant time, including any updates installed or deliberately withheld. If a company knows of a safety issue that can be addressed by an update, failing to act may be treated similarly to failing to recall a dangerous product. For clients, this means that update policies must be carefully designed:
    1. when to push mandatory updates;
    2. how to handle user refusal; and
    3. how to document decisions.

Second, cybersecurity is now recognised as an integral part of product safety. A vulnerability that allows an attacker to manipulate steering, braking or sensor data is not only an IT risk. It may directly endanger life and health. Consequently, cybersecurity measures, including secure development practices, penetration testing, key management and incident response, are increasingly scrutinised in liability disputes.

Companies active in Austria therefore need integrated concepts that cover:

  • safe design and coding practices for embedded and backend software;
  • structured vulnerability management and clear escalation paths;
  • communication strategies towards customers when vulnerabilities are discovered; and
  • co-ordination with regulators and authorities in the event of serious incidents.

These structures are particularly critical for automated and connected vehicles, where large fleets may require co-ordinated updates and communication across several countries.

Market Practice and Client Expectations in Austria

In the Austrian market, these trends are reflected in the type of mandates and questions that companies bring to legal advisers. Manufacturers and suppliers of automotive and technical products no longer ask only whether a particular design choice complies with a standard.

They also want to understand how courts might view a complex chain of software-driven events and what kind of documentation will be helpful in defending a claim.

In practice, specialised product liability counsel are increasingly asked to:

  • review product safety concepts for automated functions, including warning strategies and user interaction;
  • draft and negotiate development, supply and distribution agreements that allocate potential future liability for software defects and update duties;
  • advise on crisis management in the event of accidents involving automated or connected products, including cross-border co-ordination of possible recall actions; and
  • assist in the design of internal product safety committees and escalation processes that bring together legal, technical and compliance perspectives.

Clients from non-automotive sectors, such as machinery, consumer goods, sports equipment, lifestyle products or food-related technology, are watching developments in the automotive field closely. Many of them are undergoing their own digital transformation, adding connectivity, apps or AI-based features to their analogue products. For these companies, the lessons from automotive are often directly transferable: software and data must be treated as central elements of product safety, not as afterthoughts.

Outlook: Navigating Next-Generation Product Liability and Product Safety

Looking ahead, two developments are likely to shape product liability in Austria and across Europe over the coming years.

First, there will be increasing interaction between product liability rules and sector-specific regulation, particularly in automotive. Type-approval regimes, cybersecurity regulations, software update requirements and AI-specific rules will all influence how courts understand the safety expectations that users may legitimately hold. For clients, this means that compliance cannot be managed in separate silos; regulatory and liability perspectives must be integrated.

Second, the evidentiary environment is changing. Automated and connected vehicles generate large volumes of data, including logs, sensor recordings and event data records. In disputes, these data sets can be both an asset and a risk. Companies that manage data retention and access in a structured way will be better placed to explain what happened in an incident, demonstrate compliance with safety concepts and, where appropriate, show that a defect did not exist. Conversely, a lack of data or inconsistent records can significantly weaken a defence.

For clients operating in or entering the Austrian market, the key message is that product liability is no longer limited to obvious mechanical defects. Software, connectivity, AI and cybersecurity are now central to safety assessments, particularly in autonomous driving and other automated systems. A key precondition for the successful deployment and uptake of automated vehicles is public acceptance. In practice, this will largely turn on whether users’ safety expectations are fulfilled in a way that goes beyond formal compliance with regulatory and voluntary standards.

Against this background, from a legal policy perspective, product liability rules do not only allocate civil responsibility to the stakeholder causally involved in a defect. They also have an important preventive function. Together with the product safety rules, they incentivise robust safety concepts, a transparent allocation of responsibilities and effective incident-response mechanisms. By integrating legal, technical and organisational perspectives early in the design and development process, companies can significantly reduce the risk of future disputes, be better prepared when incidents do occur and more effectively meet the safety and trust expectations that will determine the commercial success of automated mobility solutions.

EUSTACCHIO

Waehringer Str. 26
A-1090 Vienna
Austria

+43 1 3199 700

+43 1 3199 700 22

a.eustacchio@eustacchio.com www.eustacchio.com
Author Business Card

Law and Practice

Author



EUSTACCHIO is one of Austria’s leading law offices for product liability, product compliance and product safety law, with more than 25 years’ experience and over a decade of specialised focus on the legal aspects of autonomous and connected driving. The firm advises manufacturers, suppliers and software developers of industrial components and automotive and technology systems across the full product life cycle, from concept and design through product safety, compliance and market entry, including the drafting and review of commercial and distribution agreements for national and cross-border product sales. The practice has a particular focus on risks linked to digitalisation, embedded software, connectivity and cybersecurity in networked and automated products, with automotive systems and autonomous vehicles and machines forming an important part of this work.

Trends and Developments

Author



EUSTACCHIO is one of Austria’s leading law offices for product liability, product compliance and product safety law, with more than 25 years’ experience and over a decade of specialised focus on the legal aspects of autonomous and connected driving. The firm advises manufacturers, suppliers and software developers of industrial components and automotive and technology systems across the full product life cycle, from concept and design through product safety, compliance and market entry, including the drafting and review of commercial and distribution agreements for national and cross-border product sales. The practice has a particular focus on risks linked to digitalisation, embedded software, connectivity and cybersecurity in networked and automated products, with automotive systems and autonomous vehicles and machines forming an important part of this work.

Compare law and practice by selecting locations and topic(s)

{{searchBoxHeader}}

Select Topic(s)

loading ...
{{topic.title}}

Please select at least one chapter and one topic to use the compare functionality.