Defences for health institutions in case of substantial modification of AI medical devices under the rPLD

The revised Product Liability Directive (rPLD) represents a
significant recalibration of EU product liability for the digital age,
explicitly including software and AI systems within the definition
of a "product" and extending liability to downstream actors who
substantially modify a product . In the healthcare context, this
raises novel questions about the liability of health institutions
that adapt AI-enabled medical devices to local clinical
environments.
However, the doctrinal implications of this transformation remain
underexplored. The rPLD provides a range of defences that may
allow a manufacturer, including one who becomes a
manufacturer through modification, to escape liability. Among
these, the development risk defence is particularly significant.
This defence exempts a manufacturer who proves that the defect
could not have been discovered given the state of scientific and
technical knowledge at the time the product was placed on the
market but its suitability for AI systems whose risk profiles are
temporally open and evolve after deployment has been called
into question. The retention of this defence in the rPLD, despite
the explicit inclusion of software and AI systems within its scope,
has been described as "deplorable" by some commentators,
particularly because it continues to ignore the need to specify
"the objective state of scientific and technical knowledge" in the
context of rapidly evolving digital technologies. This contribution examines the relationship between the
substantial modification rule and the defences available under
the rPLD, with particular attention to the healthcare context.
When a health institution becomes a de facto manufacturer
through modification, what is the relevant "state of scientific and
technical knowledge" for the purposes of the development risk
defence?
The contribution proceeds in four parts. First, it analyses the
doctrinal structure of the substantial modification rule and its
relationship to the defences. Second, it examines the application
of these defences to downstream modifiers in the healthcare
context. Third, it develops a worked clinical scenario to illustrate
how the defences would operate in practice. Fourth, it considers
whether the defences, as currently framed, are adequate for
addressing the specific challenges posed by hospital-modified AI
medical devices, and assesses whether interpretive clarification
or legislative reform may be warranted.