On this page
Software becomes a product, with everything that comes with it.
Under the new Product Liability Directive, software placed on the EU market after 9 December 2026 is a product, however it is delivered: installed, as an app, embedded in a device or as a service in the cloud. AI systems are included. Whoever places such software on the market is liable for damage a defect causes, and the injured person does not have to prove fault.
Each member state writes the directive into its own law by 9 December 2026; the Netherlands, for example, tabled its bill in February 2026. For a software company the date that counts is the same everywhere: what you release in the EU after 9 December falls under the new rules, whether you are based in Amsterdam, Kraków or Toronto.
The 1985 rules next to the new ones
| Topic | Directive of 1985 | New directive, products after 9 December 2026 |
|---|---|---|
| Software | Not expressly a product | Expressly a product, SaaS and AI included |
| Who can claim | Injured persons, property damage only to items for private use | Natural persons only; property used exclusively for work does not count |
| Threshold for property damage | 500 ECU | No threshold, no cap |
| Data | Not covered | Destroyed or corrupted data not used for work |
| Updates | Not addressed | A defect caused by an update, or by a missing safety update, counts |
| Manufacturer outside the EU | Importer liable | Importer, authorised representative or, failing those, the fulfilment service provider |
| Evidence | The claimant proves defect, damage and causal link | Courts can order disclosure, with presumptions in technically complex cases |
| Time limits | Three years to claim, ten-year expiry | Three years, ten years, and 25 years for injuries that surface late |
The manufacturer is whoever develops a product, or has it developed, and markets it under its own name or brand. A retailer that commissions an app and sells it under its own label is the manufacturer, not the studio that wrote the code. Whoever substantially modifies a product outside the original maker's control and offers it again becomes its manufacturer. Information itself, such as website content or an e-book, and mere source code are not products.
Maker of software or an app
Liable
Software is a product, SaaS included. Whoever places it on the market is liable for damage from a defect.
Document quality, testing and updates. Keep security updates going.
Whoever builds software into a product
Liable
The maker of the end product and of the component can both be liable.
Agree in your contract who answers for what.
Importer of software from outside the EU
Check it
Without a manufacturer in the EU, the importer or representative can be held liable.
Know your supplier and its arrangements.
Business using a tool
Be aware
Only using software does not make you a manufacturer. As a company you cannot claim under these rules either: only natural persons can.
Cover your own losses in the contract with your supplier.
Open source outside a commercial activity
Out of scope
Free software not supplied in a commercial activity falls outside.
If you use open source in your own product, you answer for it.
The claimant is always a natural person: a consumer, an employee, a bystander. Damage to property used only for work does not count.
Selling into the EU from outside it
A US or UK software company with no establishment in the EU does not escape the directive: its importer or its authorised representative in the EU becomes liable alongside it, and if neither exists, the fulfilment service provider that stores and ships the product. Expect those partners to ask you for testing records, update commitments and an indemnity. If a claimant cannot identify any of them, a distributor or an online marketplace that fails to name an EU operator within a month can end up liable too. Software you place on the EU market also falls under the Cyber Resilience Act reporting obligations since September 2026.
Why B2B software companies are exposed too
The directive protects natural persons. A company that loses money because your platform failed cannot rely on it and has to look at its contract with you. Yet B2B software reaches people: the warehouse worker injured by a robot with a control bug, the consumer whose personal photos vanish in an app a business offers them. Their claim lands with the manufacturer, even one that never sold to a consumer.
Towards the injured person, liability cannot be limited by contract or capped. Limitation clauses still matter between businesses, to settle who carries the bill afterwards. One carve-out helps small software suppliers: a micro or small enterprise that delivers a software component can agree in its contract that the maker of the end product will not seek recourse against it. Write that down in your software requirements or master agreement.
Where AI fits
An AI system is software, so a product, and its provider is a manufacturer. A system that keeps learning after release is judged with that ability taken into account. If you build a chatbot or assistant into a product you sell, you answer for damage from a defect, on top of the EU AI Act transparency obligations. An AI tool you buy and use internally does not make you a manufacturer; where that line sits for your plans is covered in implement AI in business.
A missing update is a defect too
Normally a manufacturer escapes liability if the defect probably did not exist when the product left its hands. For software that defence fails while the maker keeps control: a defect from an update, from a substantial modification or from a safety update that was needed and never shipped stays with the manufacturer. Courts also weigh the cybersecurity requirements that apply to the product.
What software makers and buyers ask us
Is SaaS really covered?
Yes. Software is a product whether it is stored on a device, accessed over a network or the cloud, or supplied as a service.
Can our company claim if a supplier's software fails?
Not under this directive: only natural persons can, and property used exclusively for work is excluded. Your own losses depend on your contract.
Does it apply to software we already sell?
Products placed on the market before 9 December 2026 stay under the old rules. A substantial modification afterwards can bring a product under the new ones.
Are open-source maintainers liable?
Not when the software is developed or supplied outside a commercial activity. A company that ships open source inside a paid product answers for it.
Before you ship after 9 December
- Map which software and apps you are the manufacturer of, including those you commissioned.
- Record how you test, release and update, and for how long you support security updates; that is your evidence if a court orders disclosure.
- Know the components in your product and who made them, so you know where recourse lies; technical debt in unmaintained code is a liability here.
- Review contracts with builders, suppliers and distributors, and ask your insurer whether your product liability cover includes software.
Whether to build or buy is weighed in build vs buy software; what custom work costs in custom software development cost.