Why this matters.
The new Product Liability Directive (EU) 2024/2853 replaces the 1985 directive and applies to products placed on the EU market or put into service from 9 December 2026, the date by which member states must bring it into national law. It keeps the core rule of strict, no-fault liability: if a defective product causes death, personal injury (including medically recognised psychological harm), damage to private property or the loss or corruption of non-professional data, the injured person can claim compensation without proving negligence. The big change is scope. Under Article 4, software is now expressly a “product”, whether it is embedded, installed or supplied as a service, which brings apps, firmware, AI systems and digital services that are integral to a product into the regime. Free and open-source software developed or supplied outside a commercial activity is excluded.
Liability also reaches further down the supply chain. Where the manufacturer is outside the EU, the importer, the manufacturer’s authorised representative and, failing those, the fulfilment service provider can be liable (Article 8), and online platforms can be treated like distributors. Courts can order you to disclose evidence (Article 9) and will presume a product is defective in certain cases, such as where you fail to disclose or the case is technically complex (Article 10). A product can be defective because of missing security updates or poor cybersecurity, and you cannot rely on the “later defect” defence if the problem came from software updates you controlled or failed to provide (Article 11(2)). Liability cannot be excluded by contract (Article 15) and claims can run for 10 years, or 25 years for latent personal injury (Article 17). This check helps you see where you stand before the new rules apply.