For forty years European product liability law covered things you could drop on your foot. On 9 December 2026 that stops being true.
Directive (EU) 2024/2853 entered into force on 8 December 2024 and must be in national law by 9 December 2026. Article 4(1) defines a product to include electricity, digital manufacturing files, raw materials and software. Recital 13 removes any argument about delivery method: software counts whether it sits on a device, is reached over a network or is sold as a service. Strict liability, the regime that never required proof of negligence, now covers code.
The timing provision matters as much as the definition. Article 2(1) applies the new rules to products placed on the market or put into service after 9 December 2026. Directive 85/374/EEC is repealed from that date under Article 21 but continues to govern products placed on the market before it. Two regimes will run side by side for years.
What changed for a seller of software into the EU. Liability now reaches the manufacturer and component manufacturer, anyone who substantially modifies a product, the importer, the authorised representative, the fulfilment service provider, and distributors and online marketplaces in defined conditions. The old defence that a defect appeared after the product left your hands survives in Article 11(1)(c), but Article 11(2)(c) takes it away where the defect comes from a missing safety-relevant update that remained within the manufacturer's control under Article 4(5). Shipping a product and then declining to patch it is now a liability route. Article 7(3) offers one piece of comfort: releasing a better product later does not make the earlier one defective.
Three changes make claims materially easier to bring. The lower threshold of 500 units for property damage is gone, and caps on personal injury compensation are removed. Article 6(1)(c) makes destruction or corruption of data not used professionally a compensable loss. Article 9 lets a claimant obtain court-ordered disclosure of evidence on presenting facts sufficient to support the plausibility of the claim, and Article 10 sets out rebuttable presumptions of defectiveness, including where the product failed to comply with mandatory EU safety requirements. Article 15 provides that the liability cannot be limited or excluded by contract or by national law, so a terms-of-service cap will not hold. Article 17 sets a ten-year period, extended to twenty-five years where a latent injury prevented earlier proceedings.
One carve-out is worth knowing. Article 2(2) excludes free and open-source software developed or supplied outside a commercial activity, and recital 14 confirms that publishing to an open repository is not placing on the market unless done commercially. Charge for it, or bundle it into something you charge for, and the exclusion goes.
Transposition is behind. At 8 September 2026 three member states had adopted: Hungary on 16 December 2025, Lithuania by Act XV-1080 on 25 June 2026, and Croatia on 7 July 2026. Twelve had drafts, including Germany, the Netherlands, Slovakia, Italy and Poland. Five had made no public progress.
The UK is not bound and has not followed. Part 1 of the Consumer Protection Act 1987 is unchanged and does not address software. The Product Regulation and Metrology Act 2025, which received royal assent on 21 July 2025, recognises software as an intangible component of a product, while its definition of product still refers to tangible items. None of that helps a Manchester software company selling a lending-decision tool to brokers in Dublin and Frankfurt. Sell into the EU and the EU regime is the one that applies to you.
Questions on the 9 December product liability deadline
When does the new EU product liability directive apply?
Directive (EU) 2024/2853 entered into force on 8 December 2024 and must be in national law by 9 December 2026.
Is software a product under the new directive?
Yes. Article 4(1) defines a product to include electricity, digital manufacturing files, raw materials and software, and strict liability, the regime that never required proof of negligence, now covers code.
Does it matter whether software is installed, reached over a network or sold as a service?
No. Recital 13 removes any argument about delivery method: software counts whether it sits on a device, is reached over a network or is sold as a service.
Which products fall under the new regime and which stay under the old one?
Article 2(1) applies the new rules to products placed on the market or put into service after 9 December 2026. Directive 85/374/EEC is repealed from that date under Article 21 but continues to govern products placed on the market before it, so two regimes will run side by side for years.
Who can be held liable?
Liability reaches the manufacturer and component manufacturer, anyone who substantially modifies a product, the importer, the authorised representative, the fulfilment service provider, and distributors and online marketplaces in defined conditions.
Does the defence that the defect appeared after the product left us still work?
It survives in Article 11(1)(c), but Article 11(2)(c) takes it away where the defect comes from a missing safety-relevant update that remained within the manufacturer's control under Article 4(5).
Can we be liable for not shipping a security update?
Yes. Shipping a product and then declining to patch it is now a liability route.
Does releasing a better version make the earlier one defective?
No. Article 7(3) provides that releasing a better product later does not make the earlier one defective.
Is there still a minimum threshold for property damage claims?
No. The lower threshold of 500 units for property damage is gone.
Are personal injury payouts still capped?
No. Caps on personal injury compensation are removed.
Can a claimant recover for destroyed or corrupted data?
Yes. Article 6(1)(c) makes destruction or corruption of data not used professionally a compensable loss.
How does a claimant get evidence out of us?
Article 9 lets a claimant obtain court-ordered disclosure of evidence on presenting facts sufficient to support the plausibility of the claim.
When is a product presumed defective?
Article 10 sets out rebuttable presumptions of defectiveness, including where the product failed to comply with mandatory EU safety requirements.
Can we cap or exclude liability in our terms of service?
No. Article 15 provides that the liability cannot be limited or excluded by contract or by national law, so a terms-of-service cap will not hold.
How long can a claim be brought?
Article 17 sets a ten-year period, extended to twenty-five years where a latent injury prevented earlier proceedings.
Does the directive catch free and open-source software?
Article 2(2) excludes free and open-source software developed or supplied outside a commercial activity, and recital 14 confirms that publishing to an open repository is not placing on the market unless done commercially. Charge for it, or bundle it into something you charge for, and the exclusion goes.
Which member states have adopted it?
At 8 September 2026 three member states had adopted: Hungary on 16 December 2025, Lithuania by Act XV-1080 on 25 June 2026, and Croatia on 7 July 2026. Twelve had drafts, including Germany, the Netherlands, Slovakia, Italy and Poland, and five had made no public progress.
Does the directive apply in the UK?
No. The UK is not bound and has not followed. Part 1 of the Consumer Protection Act 1987 is unchanged and does not address software.
Does the UK Product Regulation and Metrology Act 2025 cover software?
The Act, which received royal assent on 21 July 2025, recognises software as an intangible component of a product, while its definition of product still refers to tangible items.
We sell software from the UK into the EU. Which regime applies to us?
The EU regime. None of the UK position helps a Manchester software company selling a lending-decision tool to brokers in Dublin and Frankfurt. Sell into the EU and the EU regime is the one that applies to you.
Where does ComplianceSME hold these obligations?
More from ComplianceSME
- A machine fired the drivers. The bill is 824,990,000 euro.
- Europe Blamed the AI Act. The Delays Were Data Protection Law.
- The Two Rulebooks, the One Person, and the Answer That Is Already Out of Date
- The 24 hour clock that starts on 11 September
- The leaders who called compliance too complicated, and what the work costs
- ComplianceSME Completes the Free Business Compliance Libraries of All Twenty-Eight Nations
- The Digital Omnibus deferral: what moved, what did not, and what applies now
- Italy's NIS2 basic measures, and what has to be working by 31 October
- Platform work's deadline is 2 December, and the rules reach past the couriers
- The AI Act did not pause, and two prohibitions start on 2 December
- Poland's cybersecurity register closed on 3 October, and the real work starts now
- Every verified deadline between now and the end of December
- Pay gap reporting arrives before the software does
- Six questions Irish companies keep asking, answered with the section that settles each