Digital Products in the EU Market: What Applies From Outside the EU, and When

Why EU law reaches a business with no European office

European Union law on digital products is written to follow the product and the customer, not the seller's address. An Australian company with no EU subsidiary, no EU staff and no EU server can still be inside half a dozen EU regimes. What brings it in is conduct: offering a service to people in the EU, placing a product on the EU market, or letting the output of an AI system be used there.

Four hooks do almost all of the work: offering goods or services to people in the EU or monitoring them there (the General Data Protection Regulation, or GDPR); placing an AI system on the EU market or having its output used there (the AI Act); placing a product on the EU market (the product rules, including the new Product Liability Directive); and offering an intermediary service to recipients in the EU (the Digital Services Act), or a data processing service to EU customers or a connected product on the EU market (the Data Act).

Two structural points sit underneath every section below. EU regulations, such as the GDPR, the AI Act and the Data Act, apply directly in every Member State. EU directives, such as the Product Liability Directive and the consumer contract directives, bind a business only through each Member State's own law, so the rule you actually meet is German, French or Irish law implementing the directive.

Consumer law reaches you by a different route again. Where a business directs its activities to a consumer's country, the contract is governed by the law of that country, and choosing Australian law in your terms cannot take away the consumer protections of that law. Rome I art 6 says so in terms:

The same consumer may sue in the courts of their own country, whatever your domicile, under arts 17(1)(c) and 18(1) of the Brussels Ia Regulation (EU) No 1215/2012.

The EU dates that matter for digital products, in order

Several of these regimes already apply, and the next run of deadlines falls between 2 December 2026 and 2 August 2028. The table puts every obligation this article discusses in date order, with the hook that brings a business outside the EU within it. Read down the last column first: if no hook fits your business, the row does not apply to you.

GDPR: offering, monitoring and the EU representative

The GDPR applies to a business outside the EU in two situations, and the second does not depend on selling anything. Under art 3(2) it applies to processing of personal data of people who are in the EU where the processing relates to offering them goods or services, paid or free, or to monitoring their behaviour in the EU.

Offering turns on whether it is apparent that you envisage offering services to people in one or more Member States. Recital 23 says the mere accessibility of your website from the EU is not enough.

The European Data Protection Board lists factors that may together show an offer: naming an EU country, EU-directed marketing, a .eu or EU country domain, an EU language or currency, delivery to Member States. It also says that goods or services provided to someone in the EU inadvertently or incidentally do not bring the processing within the GDPR.

Monitoring is the hook that catches businesses that think they are safe. The Board's examples include behavioural advertising and online tracking through cookies or other techniques such as fingerprinting. An Australian site that does not market to Europe but runs advertising pixels or analytics profiles on EU visitors can be inside the GDPR on that ground alone. Both points come from its Guidelines 3/2018 on territorial scope.

A business caught by art 3(2) must appoint a representative in the EU:

The exemption in art 27(2)(a) is narrow and cumulative: the processing must be occasional, must not include large scale processing of special category or criminal offence data, and must be unlikely to result in a risk to individuals. Failing to appoint is itself an infringement, fineable under art 83(4)(a) at up to EUR 10 million or 2% of worldwide annual turnover, whichever is higher.

Where the data sits does not decide whether the GDPR applies. On the Board's published view, collecting data directly from a customer in the EU is not a "transfer"; passing it to your own cloud processor outside the EU is, and needs safeguards, because Australia has no EU adequacy decision. The full position is in our guide to when the GDPR reaches an Australian business.

Cookies have a rule of their own. Article 5(3) of the ePrivacy Directive 2002/58/EC allows information to be stored on, or read from, a user's device only with consent, unless it is strictly necessary for a service the user asked for. It applies through each Member State's law, so whether a particular national cookie law is enforced against a site run from Australia is a question of that country's law.

The EU AI Act: who it catches from outside the EU

The AI Act reaches an Australian business either as a provider putting an AI system or model on the EU market, or as a provider or deployer whose AI output is used in the EU. A provider is whoever develops an AI system, or has it developed, and places it on the market under its own name or trade mark, paid or free. A deployer is a business using an AI system under its authority. The output limb is the wide one:

Recital 22 explains that limb as an anti-circumvention rule and puts the test as output intended to be used in the EU. How far it reaches an Australian SaaS whose AI features are used by a European customer's staff has not been decided by any court. The safer working assumption is that EU use of the output is enough.

Open source AI is excluded only outside the high risk, prohibition and transparency rules (art 2(12)). A business that puts its own name on someone else's high risk system, or substantially modifies it, becomes its provider (art 25(1)).

Fines follow the obligation breached: up to EUR 35 million or 7% of worldwide annual turnover, whichever is higher, for a prohibited practice, and up to EUR 15 million or 3% for breaches of the provider, authorised representative, deployer and transparency obligations (art 99(3), (4)). For SMEs the lower of the two figures applies.

What the EU AI Act requires now, and what the Digital Omnibus postponed

The prohibitions and the AI literacy duty already apply, transparency applied from 2 August 2026, and the heavy high risk obligations have been pushed back to December 2027 and August 2028. The postponement came from Regulation (EU) 2026/1744, the Digital Omnibus on AI, in force since 27 July 2026.

• Since 2 February 2025: the prohibited practices in art 5, and AI literacy under art 4. As amended, art 4 requires measures to support the AI literacy of staff using AI, and does not require any guaranteed level of literacy for any individual.
• Since 2 August 2025: obligations of providers of general purpose AI models, including technical documentation, information for downstream integrators, a copyright policy, and for non-EU providers an EU authorised representative (arts 53, 54). Models already on the market then must comply by 2 August 2027.
• Since 2 August 2026: transparency under art 50. Systems that talk to people must tell them they are dealing with AI unless that is obvious; generative systems must mark their output as machine-readable and detectable as AI generated; deployers must disclose deepfakes.
• By 2 December 2026: generative systems placed on the market before 2 August 2026 must comply with the marking duty (art 111(4)). Two new prohibitions also apply from that date, on systems generating non-consensual intimate imagery of an identifiable person and on child sexual abuse material.
• From 2 December 2027 and 2 August 2028: the high risk regime, for Annex III use cases and for AI in products covered by Annex I respectively (art 113(c)).

The marking duty has a limit worth knowing: it does not apply to the extent a system performs an assistive function for standard editing or does not substantially alter the input data the deployer provided, or their meaning. A spell checker or a tool that tidies a user's own text is in a different position from an image generator.

The new prohibitions catch a provider only where that output is the system's intended purpose, or a reasonably foreseeable and reproducible outcome that the system lacks adequate safeguards to prevent (art 5(1a)). For a general purpose image or video generator, that makes guardrails a condition of being on the EU market at all.

The new EU Product Liability Directive treats software as a product

From products placed on the EU market after 8 December 2026, software, including AI systems and software supplied as a service, carries no fault liability for defects that cause injury, property damage or the destruction or corruption of a person's non-professional data. Directive (EU) 2024/2853 replaces the 1985 product liability directive. The date was corrected after publication:

The old directive keeps applying to products placed on the market before 9 December 2026, so there is no gap between the two.

"Product" now expressly includes software (art 4(1)), and recital 13 removes any doubt about the delivery model:

The same recital says that developers of software, including AI system providers under the AI Act, are to be treated as manufacturers, and that information as such, such as the content of media files or e-books, is not a product. Free and open source software supplied outside a commercial activity is excluded (art 2(2)), but supplying it for a price, or for personal data used for anything beyond security and compatibility, is commercial.

Compensable damage is death or personal injury, damage to property other than the product itself and property used only for professional purposes, and destruction or corruption of data not used for professional purposes (art 6(1)). The damage must be suffered by a natural person, but insurers and representative bodies may bring the claim (art 5(2)).

Who is liable when the manufacturer is outside the EU

The Australian manufacturer stays liable, and EU businesses are added to the chain rather than substituted for it. Where the manufacturer is established outside the EU, art 8(1)(c) adds the importer, the manufacturer's authorised representative and, where there is neither, the fulfilment service provider, each without prejudice to the manufacturer's own liability.

Distributors are liable only as a fallback, if they fail to identify an EU operator within a month of being asked (art 8(3)). Online marketplaces face that same fallback where they are not economic operators themselves, on conditions taken from the Digital Services Act (art 8(4)).

Defect is judged by the safety people are entitled to expect. The factors expressly include a product's ability to keep learning after it is placed on the market, and "relevant product safety requirements, including safety-relevant cybersecurity requirements" (art 7(2)(c), (f)). Updates cut both ways. The defence that a defect arose only after the product left you is not available where the defect lies in software or its updates within your control, or in a missing update needed to keep the product safe (art 11(2)).

Claimants also get procedural help. A court may order the defendant to disclose evidence, and defect is presumed where disclosure is refused, where mandatory safety rules were breached, or where there was an obvious malfunction (arts 9, 10(2)). Where technical complexity makes proof excessively difficult, defect or causation is presumed on a showing of likelihood (art 10(4)). All of these presumptions can be rebutted.

Your terms and conditions cannot fix any of this:

Because this is a directive, liability arises under each Member State's transposing law. As at 9 November 2026, EUR-Lex listed national measures from five Member States, Germany among them. The separate AI Liability Directive that was to sit alongside it was withdrawn: the Commission's notice appeared in the Official Journal on 6 October 2025.

Selling to EU consumers: withdrawal rights and the new withdrawal button

An EU consumer who buys online has 14 days to withdraw without giving a reason, and from 19 June 2026 your website or app must give them a button to do it. The 14 days come from art 9(1) of the Consumer Rights Directive 2011/83/EU.

For digital content that is not on a tangible medium, the right is lost once supply begins only if the consumer gave prior express consent, acknowledged losing the right, and you confirmed it on a durable medium (art 16(m)). Skip that three step process and the 14 days stand.

The withdrawal function was inserted by Directive (EU) 2023/2673:

The function must be labelled "withdraw from contract here" or something unambiguously equivalent, stay available throughout the withdrawal period, lead to a confirmation step, and generate an acknowledgement on a durable medium. Member States had to apply it from 19 June 2026.

For software, apps and SaaS supplied to consumers, the Digital Content Directive (EU) 2019/770 adds conformity rules, including security, and a duty to supply the updates needed to keep the product in conformity (art 8(2)).

It applies even where the consumer pays with personal data rather than money, unless the data is used only to supply the service or meet legal requirements (art 3(1)). Neither directive's protections can be waived by a term that disadvantages the consumer (Consumer Rights Directive art 25; Digital Content Directive art 22(1)).

SaaS and hosting: the Digital Services Act

The Digital Services Act applies to more SaaS products than most providers expect, because storing content that users supply is a hosting service. The Act covers intermediary services offered to recipients in the EU, wherever the provider is established, where there is a substantial connection to the EU, such as a significant number of EU users or activities targeted at Member States (arts 2(1), 3(d), (e)). It does not apply to services that are not intermediary services at all (art 2(2)).

The definition of hosting does not require anything to be published:

Recital 29 gives cloud computing, web hosting and file storage and sharing as examples, and says classification depends on technical functionality alone. A hosting service becomes an "online platform", with heavier duties, only if it also disseminates users' content to the public.

A hosting provider must have points of contact for authorities and users (arts 11, 12), clear terms on content restrictions (art 14), a notice and action mechanism for illegal content (art 16) and reasons for any restriction it imposes (art 17).

Annual transparency reports are also required, but micro and small enterprises are relieved of them (art 15(2)), and they are exempt from the online platform section (art 19). A provider with no EU establishment must appoint a legal representative in the EU, who can be held liable (art 13).

Connected products and cloud services: the Data Act

The Data Act applies to cloud and SaaS providers serving EU customers, and from 12 January 2027 they may not charge customers for switching away. It reaches providers of data processing services wherever they are established, and makers of connected products placed on the EU market (art 1(3)(a), (f)). Recital 81 confirms that data processing services include software as a service.

Until then, switching charges must not exceed the provider's direct costs of the switch (art 29(2), (3)). Services custom built for a single customer and not offered at broad commercial scale are carved out of the charging rule (art 31(1)).

For hardware, connected products placed on the market after 12 September 2026 must be designed so that the data they generate is accessible to the user by default, free of charge and in a machine-readable format (arts 3(1), 50). That date has passed, so any connected device placed on the EU market now must already meet it.

Cybersecurity: the Cyber Resilience Act in brief

The Cyber Resilience Act's reporting duty applied from 11 September 2026, including to products already on sale, and the full regime applies from 11 December 2027. Manufacturers of products with digital elements must notify actively exploited vulnerabilities and severe incidents through the EU single reporting platform (arts 14, 16). Products placed on the market before 11 December 2027 are otherwise caught only if substantially modified after that date (art 69(2), (3)).

Pure SaaS is generally outside it. Recital 12 explains that cloud services designed outside the responsibility of a product manufacturer are not covered and are left to the NIS2 Directive, while remote processing that supports a product's functions, such as an app controlling a smart device, is inside. Appointing an EU authorised representative is optional under the Act (art 18). For the detail, including NIS2, see our article on the Cyber Resilience Act.

Product safety, accessibility and connected devices

A consumer product, including in the Commission's view a consumer app, cannot be placed on the EU market without a responsible person established in the EU. The General Product Safety Regulation (EU) 2023/988 has applied since 13 December 2024. Article 16 makes the responsible person a condition of market access:

That person may be your importer, an authorised representative you appoint, or an EU fulfilment service provider, and their contact details must appear on the product, its packaging or accompanying documents. The Regulation's definition of product does not exclude software, and the Commission's guidelines for businesses, published in the Official Journal on 21 November 2025, say it includes apps and software products, giving chatbots as an example.

That is guidance rather than a court ruling, but it is the position market surveillance authorities start from. The Regulation covers products intended for consumers or likely to be used by them, so software built for and sold only to business users, and not likely to reach consumers, is outside it on that ground.

Two more regimes are worth checking against your product line. Internet-connected radio equipment, for example a Wi-Fi connected consumer device, has had to meet cybersecurity essential requirements under the Radio Equipment Directive since 1 August 2025, under Delegated Regulation (EU) 2022/30.

And the European Accessibility Act, Directive (EU) 2019/882, covers e-commerce services and e-books and dedicated software provided to consumers after 28 June 2025, with an exemption for microenterprises providing services. How each Member State's transposing law applies it to a provider outside the EU varies, so treat it as a question to check rather than a settled answer.

Which EU representatives a business outside the EU may need

Several of these regimes require a named person inside the EU, and they are different roles with different triggers. One firm or person can hold several of them, but only if each mandate is written to cover each role.

The last row is the one to think about before signing a mandate under any of the others. A representative appointed for product safety or AI Act purposes is an authorised representative, and under the Product Liability Directive an authorised representative can be sued alongside you. Who carries that exposure between you belongs in the mandate.

What to do, in order of date

Map each product and service against the hooks first, because the obligations follow from the hooks and not from the size of your EU revenue. Then work through the dates.

For a German-parented group, the European parent's existing compliance processes for its own products are the natural starting point for the Australian entity's products; our German desk page sets out how we work with German groups in Australia.

Where this article stops

This is a map of the regimes and their dates, not an assessment of any product. It does not cover sector rules such as medical devices, financial services or audiovisual media, EU competition law, intellectual property, or tax. Whether a given AI feature is high risk, whether a given SaaS product is a hosting service, and which Member State's law governs a given contract each depend on facts.

A further Digital Omnibus proposal amending the GDPR, the cookie rule and the Data Act is before the legislators: the Council agreed its negotiating position in October 2026 and the European Parliament is still at committee stage. Nothing in it is law. A Digital Fairness Act on online consumer protection had been announced but not proposed when this article was checked. More on our technology work is on the IP and technology law page.