For forty years EU product liability was about physical goods. A toaster that caught fire was a defective product. A piece of software that wiped your family photos, or a smart-home app that left a door unlocked, was not clearly covered. That gap closes on 9 December 2026.
What changes
The new Product Liability Directive, (EU) 2024/2853, entered into force in December 2024. Member states have until 9 December 2026 to turn it into national law, and the rules apply to products placed on the market or put into service after that date. Products already on the market stay under the old regime, but a substantial modification or update after the date can bring a product under the new rules.
The headline: software is a product. Law-firm summaries list operating systems, mobile apps, embedded software, stand-alone programs, and AI systems, and the directive applies whether the software is installed, embedded, or supplied as a service.
Who can claim, and for what
Only natural persons can claim. The covered damage is:
- death or personal injury, now including medically recognised psychological harm,
- damage to property that is not used exclusively for professional purposes,
- destruction or corruption of data that is not used for professional purposes.
That third item is new and matters for software. A consumer app that corrupts a family's photo library or documents can now be the basis of a claim. Pure financial loss, and damage to a business's own data, are not covered.
What counts as a "defect" for software
A product is defective when it does not provide the safety a person is entitled to expect or the law requires. For digital products the directive adds factors that fit software:
- Cybersecurity. Relevant safety requirements include cybersecurity, so a product that is easy to compromise may be defective. This connects to the Cyber Resilience Act.
- Updates. A manufacturer can be liable for a defect that comes from a software update, or from a missing update that was needed to keep the product safe and was within the manufacturer's control.
- Self-learning. The ability of a product to keep learning after release is taken into account.
- Related services. A digital service that is integrated into a product, such as an app that controls a device, can make the manufacturer responsible if its failure makes the product unsafe.
A key consequence: the defence that "the product was fine when we shipped it" does not help for defects introduced by updates, or by a lack of necessary security updates, that you could control.
Easier for claimants
Two procedural changes will shape real cases:
- Disclosure. A court can order a defendant to disclose relevant evidence when the claimant presents a plausible claim.
- Presumptions. Defectiveness can be presumed if the defendant fails to disclose, if the product breaches mandatory safety rules, or if there is an obvious malfunction. A causal link can be presumed when the technical complexity makes proof excessively difficult for the claimant.
The defendant can rebut these, but needs good records to do so.
Who is in the chain
Liability is not limited to the developer. The directive reaches the manufacturer, the maker of a defective component (including a software component), an importer, the authorised representative, a fulfilment service provider, and in some conditions distributors and online platforms. If you integrate someone else's library into a product you sell, you are the one on the hook toward the injured person, and you may then pursue the supplier.
Free and open-source software developed or supplied outside the course of a commercial activity is excluded. Once it is built into a commercial product, the maker of that product is responsible.
What a small software team can do before December
- Decide your support period and write it down. Say how long you will ship security updates for each product version. Silence is worse than a short, honest period.
- Be able to ship a fix. Automatic or one-click updates, tested rollback, and a way to reach affected users. A defect you cannot patch is a liability.
- Keep evidence. Release notes, test records, vulnerability reports, and decisions about known issues. Disclosure orders and presumptions reward the side with records.
- Run a vulnerability process. A public security contact, a triage routine, and a log of what you fixed and when.
- Check your supply chain contracts. You cannot contract out toward the injured person, but you can agree how risk is shared with suppliers and integrators.
- Talk to your insurer. Ask whether your policy covers claims from software defects under the new regime.
- Line up with the other EU laws. Secure-by-design work for the Cyber Resilience Act and records for the AI Act will also help here.
Why this is not only a big-company problem
The directive does not exempt small businesses. A two-person studio that sells a smart-lock app to EU consumers is a manufacturer of a product. The bigger risk is not a surprise lawsuit tomorrow, but a change in how customers, distributors, and insurers ask questions about updates and evidence. The same pattern appeared with NIS2 supplier questionnaires.
Sources
- Directive (EU) 2024/2853 on EUR-Lex
- Gibson Dunn: EU Product Liability Directive and software, AI, and complex supply chains (March 2026)
- Reed Smith: EU Product Liability Directive, software and digital products
Overview as of November 6, 2026. National transposition varies, and some countries had draft bills at the time of writing. This is not legal advice.