UK Product Safety Overhaul: AI Liability Implications of the March 2026 OPSS Consults
On March 31, 2026, the UK’s national product safety regulator, the Office for Product Safety and Standards (OPSS), launched two parallel, interconnected consultations proposing a sweeping, generational overhaul of the UK’s product safety, market surveillance, and enforcement framework.
Closing on June 23, 2026, these consultations represent the first major regulatory steps taken under the Product Regulation and Metrology Act 2025 (PRAM Act). They carry significant implications for how liability is assigned for AI-enabled and connected physical products in Great Britain (GB), contrasting sharply with the European Union’s legislative approach.
1. The Twin Consultations
The OPSS proposals are split across two core areas:
- Product Regulation: The UK’s New Product Safety Framework: Reforming the core baseline rules under the UK General Product Safety Regulations 2005 (UK GPSR).
- Product Regulation: Market Surveillance and Enforcement Framework: Consolidating and strengthening enforcement powers currently fragmented across more than 71 pieces of legislation into a single unified toolkit.
2. Key AI and Technology Intersections
The consultations explicitly modernize the UK framework to address risks introduced by digital and emerging technologies:
- Broadened Definition of "Safety": The proposals explicitly update the factors relevant for assessing a product's safety to include cybersecurity and artificial intelligence/machine learning risks. This aligns the UK’s baseline safety assessment factors with the EU’s modernized view of product safety.
- Focus on Embedded AI in Physical Products: Crucially, the consultation focuses on AI components embedded in physical products (e.g., an AI-driven medical device or automated machinery). It does not seek to cover standalone software or standalone AI models in its own right. Standalone software remains excluded from the core scope of the UK GPSR (unlike the EU GPSR, which captures standalone software through guidance).
- Lifecycle Risk Management: The OPSS is actively seeking stakeholder feedback on how to regulate the continuous lifecycle risks of AI-enabled products (where post-market software updates or machine learning shifts alter product behavior) without stifling technical innovation.
- Online Offer Disclosures: The proposals mandate new information requirements for online product offers, which include clearly disclosing to consumers whether a product uses AI or features AI-driven components prior to purchase.
3. Enforcement Overhaul: Civil Monetary Penalties
To dramatically accelerate enforcement, the OPSS proposes shifting away from a heavy historical reliance on slow, costly criminal proceedings.
- Civil Sanctions Toolkit: The proposals introduce a consolidated civil enforcement regime, granting authorities the power to directly issue civil monetary penalties and negotiate enforcement undertakings.
- Public Admissions: The OPSS is exploring powers to force noncompliant companies to publicly admit fault or pay direct compensation to affected consumers.
- Online Marketplace Duties: The proposals establish high-level, outcomes-based duties for online marketplaces to act with due care to prevent, identify, and remove dangerous products, verify seller contact details, and enable regulators to use automated tools to scan and audit their digital interfaces.
4. Divergence: UK Framework vs. EU Product Liability Directive (PLD)
The UK’s approach under the OPSS consultations reveals a fundamental philosophical divergence from the EU's modernized liability regime:
| Feature | UK OPSS Proposals (2026) | EU Product Liability Directive (PLD) |
|---|---|---|
| Scope of "Product" | Baseline GPSR covers physical products with embedded AI. Standalone software is excluded. | Explicitly classifies all software and AI (standalone or embedded) as a "product" subject to strict liability. |
| Type of Liability | Focuses on regulatory compliance, market surveillance, and civil administrative fines. | Establishes a strict civil liability regime allowing consumers to sue for damages without proving fault. |
| Burden of Proof | Standard evidentiary rules apply in civil/criminal courts. | Eases the burden of proof by establishing a legal presumption of defectiveness/causality for technically complex "black box" AI. |
| Evidence Disclosure | Standard judicial discovery rules. | Empowers courts to order defendants to disclose internal technical evidence (while protecting trade secrets). |
| Cybersecurity & Updates | Cybersecurity and updates are factored into product safety assessments. | Manufacturers are strictly liable for damages caused by faulty software updates or weak cybersecurity post-market. |
While the EU has established a highly claimant-friendly, strict civil liability regime that directly targets "black box" AI software, the UK is focusing on a modernized, regulatory-led safety and market surveillance framework for physical products containing AI. In the UK, liability for standalone software failures will largely continue to be governed by traditional contract and tort (negligence) law rather than a strict product liability statute.