AI Governance Compare

Liability and pending law compared — EU vs China

graded per item, sources below·checked 2026-10-10

One question: if AI causes harm, who pays — and what is still coming? Short answer: neither side has a dedicated AI civil-liability law. The EU deliberately dropped one and modernised product liability instead; China has comprehensive AI legislation on the 2026 State Council plan, but no text yet.

Evidence grades (defined in 00-overview.md): A primary text, checked live; B other official source or a direct reading of the primary text; C our own comparison or inference, or not yet checked.

1. The table

Dimension EU China Grade
Dedicated AI liability instrument none — AI Liability Directive withdrawn 11 February 2025 none A
What fills the gap revised Product Liability Directive (EU) 2024/2853 Civil Code: tort liability + product liability A
Timing in force 2024-12-08; national transposition by 2026-12-09 already applicable B
Software and AI as "products" yes — PLD covers software and AI systems unsettled whether an AI-enabled service is a "product" ⚠ B
Burden of proof disclosure duty + rebuttable presumption for complex products ordinary civil burden; no AI-specific rule A
Administrative liability AI Act, DSA, DMA, GDPR penalties Generative AI Interim Measures, Deep Synthesis Provisions, Algorithmic Recommendation Provisions, PIPL, DSL, CSL — but neither AI measure sets a fine amount of its own: Art 21 of the generative measures enumerates the general laws and adds its own ladder ending in suspension, while Art 22 of the deep-synthesis provisions refers generally and aggravates where serious consequences result A
Ethics gate risk management under the AI Act Measures for Ethical Review of Science and Technology (trial), effective 2023-12-01 A
Pending AI law none for liability; AI Act implementation continues comprehensive AI legislation directed by the State Council 2026 plan (no draft yet) B

2. Five observations

  1. The EU chose "no AI-specific liability". Rather than adopt the AI Liability Directive, it withdrew the proposal and updated product liability — a bet that general law plus a softer evidential burden is enough. — C
  2. China is heading the other way, upwards. Its plan language escalated from study to comprehensive legislation, and now names the AI stack — data, computing power, algorithms, IP, network and supply-chain security — plus key application scenarios. — B
  3. Today, China's liability is administrative-first. Regulators act through filing, security assessment, warnings, suspension of information updates and fines that are modest under the AI-specific rules; private claims rely on the Civil Code. The ceiling is higher outside the AI-specific rules: since 1 January 2026 the amended Cybersecurity Law reaches RMB 10 million for the most serious network-security failures, with up to RMB 1 million on responsible individuals. — A
  4. After December 2026, the EU shifts toward product-law-first. A defective AI-enabled product becomes pursuable with a presumption in the claimant's favour — a meaningful change for software vendors. — B
  5. Two acknowledged gaps line up. The EU's withdrawn directive targeted pure economic loss and non-product AI harm; China has no burden-of-proof rule for AI damage either. The instruments differ; the hole is similar. — C

3. What it means in practice

4. Limits and unverified ⚠

5. Official sources