The previous Product Liability Directive dated from 1985 and was designed for physical goods. The new directive replaces it and adapts liability to digital products and the circular economy. Member states must transpose it by 9 December 2026; it applies to products placed on the market from that date.
Software is a product
Software counts as a product regardless of how it is supplied, whether installed, as an app or as a service. Free open-source software supplied outside a commercial activity is excluded. Digital manufacturing files and related services can also be covered.
What counts as a defect
A product is defective if it does not provide the safety people are entitled to expect. Under the new directive this includes cybersecurity requirements and the failure to provide security updates that are needed to fix a vulnerability and are within the manufacturer’s control.
Damage and evidence
Besides personal injury and property damage, the destruction or corruption of data not used for professional purposes is covered. Claimants gain easier access to evidence: courts can order disclosure, and under certain conditions the defect is presumed.
What manufacturers should do
A product inventory, update commitments, a vulnerability process under the Cyber Resilience Act and documentation demonstrating the state of the art. Our product liability checklist walks through the steps.