In the EU, the regulatory requirements applicable to AI‑enabled medical devices derive primarily from the AI Act. Non‑compliance with these requirements may give rise to significant safety risks, which in turn can trigger corresponding liability exposure. As of the latest available information, however, the European Commission has proposed that medical devices be excluded from the scope of the EU AI Act, which could shift regulatory requirements for AI medical devices back towards sector‑specific rules under the MDR. Against this evolving backdrop, forms of contractual and tortious liability may arise in connection with AI systems used in medical devices.

While the strict liability regime under the Product Liability Directive (PLD) remains central for defect‑based claims in the realm of AI medical devices, liability may also stem from contractual and tortious liability. Contractual liability results primarily from contractual breaches, such as the provision of defective or non‑conforming (e.g., AI) software (e.g., incorrect programming), or from a failure to meet maintenance or update obligations. Tortious liability may similarly arise where damage is caused by, or in connection with, an AI system – for example, bodily injury attributable to malfunctioning or insufficiently monitored AI‑enabled devices (e.g., keyword AI-hallucination), or violations of data protection rules caused by autonomous system behavior. Incorrect training of AI can also trigger behavior that is relevant to liability. Both contractual and tortious liability typically require fault, meaning that liability must be attributable to a natural or legal person, rather than to the AI system itself.

Distinguishing between human error and system defect is therefore essential. "Human error" – arising from flawed system design, inadequate validation, insufficient data governance, negligent monitoring, or deficient post‑market processes – may support contractual or tort-based claims. By contrast, "system defects" that result in a product not offering the safety that can reasonably be expected typically fall within strict liability frameworks, such as the PLD. However, in adaptive and data‑driven AI systems, distinguishing between human error and system defects becomes increasingly challenging.

The autonomous evolution of systems can complicate causal analysis (i.e., the keyword blackbox-effect), raising questions of provability, and affecting how burdens of proof are allocated. Under general principles, the claimant bears the burden of proof for the claim requirements. Yet, courts may apply mechanisms such as the secondary burden of proof where decisive information lies within a defendant's control. The PLD also provides for corresponding easing of the burden of proof. Given the opacity of many AI systems, especially adaptive models, corresponding procedural adjustments may become more frequent, and may effectively oblige manufacturers and operators to disclose system‑related information.

Although the PLD and the AI Act have entered into force, their practical application remains in transition. The proposed exclusion of medical devices from the AI Act further highlights the fluidity of the regulatory environment. In anticipation of the PLD's implementation deadline of 9 December 2026, manufacturers, software providers, and operators should implement comprehensive, evidence‑grade documentation covering system design, updates, data sets, model changes, and post‑market interventions. Such documentation will be crucial – not only to demonstrate regulatory compliance – but also to meet heightened evidentiary expectations and manage litigation risk in a rapidly evolving liability landscape.