Exposure assessment — PLD 2024 and the AI Act
On 9 December 2026, who answers for defective software changes.
The new European product liability directive includes software among products. From that date, a defect is no longer merely a breach of contract. This assessment establishes, for your organisation, where your supplier’s liability stops and yours begins.
The problem
If your organisation has bought, or is buying, a system that incorporates artificial intelligence components, there are three questions you probably cannot answer today.
Who answers if the system produces an output that causes harm — the supplier, the integrator, or you who put it into operation.
Which AI Act obligations apply to your organisation as a deployer, regardless of who built the system.
What exactly the platform you bought contains: which third-party components, under which licences, with which language model and under what terms of use.
None of these questions is answered in the contract you signed. Almost never.
What it covers
Three days of work, on documentation you provide: contracts, architecture, supply chain, procedures in place.
Liability perimeter. Who answers for what, on the basis of the actual contracts and not of commercial statements. Includes analysis of limitation clauses and their effective value against product liability rules.
Applicable AI Act obligations. Classification of the system, obligations as a deployer, transparency obligations, staff AI literacy. With the actual deadlines and their status.
Composition of the supply. Third-party components, licences, model terms of use, points where declared ownership does not match contractual ownership.
Crossing points. Where the conclusions touch obligations already held elsewhere — network security, operational continuity, data protection — with an indication of what to hand to whoever owns them. This assessment does not evaluate those regimes: it flags where they intersect.
Sequence of action. What must be done, in what order, with what urgency. Distinguishing what is already overdue from what has a future date.
What you receive
A document. Not a presentation, not a checklist.
It is written to be read by a board and used by a lawyer. Every statement is classified: what is verified against the documents, what is inferred, what requires a finding beyond this scope.
The document is signed. Whoever signs it answers professionally for what it says.
Terms
- Duration:
- 3 days.
- Fee:
- EUR 4,500 plus VAT.
- Delivery:
- within 15 working days of receiving the documentation.
If an implementation or ongoing advisory engagement opens within 90 days of delivery, the assessment fee is credited in full.
Who signs
Corrado Patierno. Twenty-five years of enterprise systems architecture in regulated and business-critical environments.
Innovation Manager certified by the Italian Ministry of Enterprise. Board member of ENTD, the Italian National Agency for Digital Transformation, from 2020 to 2025. Speaker at the Italian Chamber of Deputies on artificial intelligence and process transformation.
Author of Logistica Fluida (2026) and of the first Italian technical manual on RFID (Duke Editore, 2006).
Designs and maintains two proprietary tools:
Nexus MDS Core — an artificial intelligence platform for regulated environments, sixteen orchestrated services, in production at Federfarma Lombarda, the association of pharmacy owners of the provinces of Milan, Lodi and Monza Brianza: over one thousand pharmacies, around two thousand queries per day, an explicit regulatory version chain, personal data never indexed.
CEPF — a regulatory crossing catalogue, version 7, twenty-one regulatory regimes mapped onto their operational obligations. It is the instrument this assessment is based on.
Request the assessment
I reply personally within two working days. If the first conversation shows that the assessment is not the right instrument for your situation, I will tell you.
Exposure is not assessed when the claim arrives. It is assessed before, while there is still time to act.