Does products liability cover a device version created by a post-market software or AI model update?

A device cleared and sold in one configuration can, months later, be running software or a model that no human at the company would describe as the same product, and the harm may arise entirely from what changed.

The insurance question that follows is not exotic, but it is one very few programmes have been explicitly tested against.

Occurrence-based products cover generally responds to injury taking place during the policy period, regardless of when the product was sold. Claims-made cover responds by reference to when the claim is made and to the retroactive date.

For a device that updates over time, the practical consequence is that a claims-made programme must be maintained continuously, with the retroactive date preserved through every renewal and every carrier change. A lapse or a reset does not just affect new releases, it can strand every version already in the field.

Where software output is wrong and someone relies on it, the allegation can be framed as a defective product or as an error in a service. That framing determines which policy is asked to respond, and the two do not always sit with the same carrier or the same limit.

Devices with a decision-support or diagnostic function are the ones most exposed to the ambiguity, since a clinician acting on an output looks like reliance on advice as much as use of a product. Where an algorithm liability extension is available on the technology or cyber form, its wording is what resolves the overlap, and it should be read alongside the products form rather than in isolation.

A model that is periodically retrained produces behaviour that was never individually specified or reviewed, which is exactly what makes it clinically useful and what complicates the liability picture.

Model governance is the practical control and it is also what underwriters increasingly ask for: validation records, retraining cadence, drift monitoring, and performance reporting. Where a predetermined change control plan has been agreed with the regulator, keep it aligned with what the programme has been told, because a divergence between what you are permitted to change and what your insurer understands you to be doing is where disputes start.

Treat a significant release the way you would treat a new product rather than a maintenance task. That means asking, at the release rather than at renewal, whether anything in the change alters the risk described to the programme.

It is the same mid-term change of operations principle that applies to a laboratory adding tests or a platform opening to new countries.