For software companies, liability has so far been mainly a matter of contract: warranties, limitations, exclusions. The new EU Product Liability Directive (EU) 2024/2853 adds strict liability that cannot be excluded by contract towards injured parties. It applies to products placed on the market from 9 December 2026, which is only weeks away.
What changes
The 1985 directive barely recognised software. The new directive makes it clear: software is a product, whether installed, downloaded as an app or used as a service. Only free open-source software outside a commercial activity is excluded. Besides personal injury and property damage, the loss or corruption of data not used for professional purposes counts as damage.
Updates become a liability issue
The view of the period after sale is especially significant. A product can be defective if the manufacturer fails to provide security updates that are needed to fix a vulnerability and are within its control. What the Cyber Resilience Act sets as a duty thus becomes relevant for liability too: anyone who knows of vulnerabilities and does not fix them carries the risk.
An easier path for claimants
Claimants previously had to prove defect and causation, which is hard with software. The new directive eases this: courts can order manufacturers to disclose evidence, and where technical complexity makes proof excessively difficult, a defect can be presumed under certain conditions. For manufacturers this means documentation is no longer just quality assurance but defence.
Interplay with the CRA and the Machinery Regulation
Three regulations interlock. Since September 2026 the Cyber Resilience Act has required reporting of exploited vulnerabilities for products with digital elements, with comprehensive security requirements from December 2027. The Machinery Regulation adds requirements on software in safety functions from January 2027. Product liability decides who pays when something goes wrong anyway. Meeting the CRA and Machinery Regulation duties properly puts you in a far better position in a liability case.
Five steps before December
- Inventory products: which software, which versions, which markets and customer groups.
- Define and communicate update commitments: how long and how quickly security updates are delivered.
- Introduce a vulnerability process: report, assessment, fix, notification.
- Monitor components: a bill of materials for the libraries used, checked against known vulnerabilities.
- Secure evidence: keep requirements, tests and releases so they are available years later.
What contracts can still do
Product liability cannot be excluded towards injured parties. Between businesses, contracts remain important, for recourse against component suppliers or for customer cooperation on updates. These questions belong to your legal advisers; we make sure the technical foundations are in place.
For Swiss manufacturers
The directive applies to products placed on the EU market. If the manufacturer is not established in the EU, the importer or authorised representative can be liable, which puts pressure on Swiss manufacturers from their EU distribution partners. Building the foundations now lets you provide evidence to partners instead of evading their questions.
Next steps
Our product liability checklist summarises the steps. For a classification of your products under product liability and the Cyber Resilience Act, the product liability and CRA offer describes the approach. The glossary entries on the Product Liability Directive and the Machinery Regulation explain the terms.