Software Is a Product Now: What Changes on 9 December 2026

What changes, and what does not

From 9 December 2026, a person who suffers death, personal injury, psychological harm, private property damage or private data loss caused by defective software can claim compensation from the manufacturer without proving fault. That is the effect of Directive (EU) 2024/2853, adopted on 23 October 2024 and published in the Official Journal on 18 November 2024. It repeals Council Directive 85/374/EEC, but only with effect from 9 December 2026, and the old Directive keeps applying to products placed on the market or put into service before that date (Article 21).

The assumption to stop making is that software sits outside product liability. Article 4(1) says a product "includes electricity, digital manufacturing files, raw materials and software". Recital 13 adds that software is a product "irrespective of the mode of its supply or usage", whether stored on a device, accessed through a network or supplied as a service, and that a developer or producer of software, including an AI system provider within the meaning of Regulation (EU) 2024/1689, is to be treated as a manufacturer. Recital 13 is interpretive context, not operative text, but it is the Directive's own statement of intent.

The Directive applies to products placed on the market or put into service after 9 December 2026 (Article 2(1)). It is not yet applicable, no claim has been brought under it, and there is no case law.

Who is bound, and from when

The dates are fixed in the instrument. Member States must bring their implementing laws into force by 9 December 2026 (Article 22(1)); the Directive applies to products placed on the market or put into service after that date (Article 2(1)). The European Commission's retail platform page of 19 August 2026 confirms the same date and says the rules apply to products placed on the EU market from then, regardless of where the responsible operator is based. That page is an institutional summary, not the instrument.

Article 8 allocates liability along the supply chain:

• The manufacturer of a defective product, and the manufacturer of a defective component integrated into a product within the manufacturer's control (Article 8(1)).
• For a manufacturer established outside the Union, the importer, the authorised representative and, if neither exists in the Union, the fulfilment service provider (Article 8(1)).
• Anyone who substantially modifies a product outside the manufacturer's control and then makes it available, who is treated as its manufacturer (Article 8(2)).
• Distributors, and certain online platform providers, where no EU-established operator can be identified and the distributor or platform fails to name one within one month of the injured person's request (Article 8(3) and 8(4)).

Liability is joint and several where more than one operator is liable for the same damage (Article 12(1)). It cannot be limited or excluded by contract as against the injured person (Article 15). The Directive does not reduce this to a question of who wrote the code: a component or related service integrated into a product can bring its maker within scope.

What compliance concretely requires

There is no compliance checklist in the Directive. It creates liability, not a licensing or certification duty. What it changes is what a defendant must be able to show.

A product is defective if it does not provide the safety a person is entitled to expect, or that is required under Union or national law (Article 7(1)). Courts must weigh all circumstances, including the effect of any ability to keep learning after the product is placed on the market (Article 7(2)(c)) and relevant safety requirements, including safety-relevant cybersecurity requirements (Article 7(2)(f)).

Two procedural rules matter most to a supplier. Under Article 9, a defendant must disclose relevant evidence at its disposal once the claimant has presented facts sufficient to support the plausibility of the claim. Under Article 10(2)(a), failure to disclose gives rise to a presumption of defect. Article 10(4) also lets a court presume defect or causation where the claimant faces excessive difficulties, in particular because of technical or scientific complexity, and shows that defect or causation is likely. Each presumption can be rebutted (Article 10(5)).

The practical implication is evidential: design and testing records, update history and cybersecurity evidence need to be producible years after release, because the expiry period is ten years from placing on the market, extended to 25 years where personal injury is latent (Article 17), with a three-year limitation period from the claimant's knowledge (Article 16).

The update question

The Directive does not impose a duty to provide updates or upgrades (Recital 51), and a product is not defective merely because a better one, including an update, is later released (Article 7(3)). The Directive does, however, remove a defence. An operator can ordinarily escape liability by proving the defect did not exist when the product was placed on the market or arose afterwards (Article 11(1)(c)). Article 11(2) withholds that defence where the defect is due to software, including updates or upgrades, a lack of software updates necessary to maintain safety, or a related service, provided it is within the manufacturer's control. Control includes the ability to supply updates, itself or through a third party (Article 4(5)).

So a manufacturer that can push updates cannot rely on "it was fine when we shipped it". That is a consequence of the text, not a stated update obligation.

Where it does not reach

Free and open-source software developed or supplied outside the course of a commercial activity is excluded (Article 2(2)). Information alone is not a product (Recital 13). Damage to property used exclusively for professional purposes, and destruction or corruption of data used for professional purposes, is not compensable under the Directive (Article 6(1)). Products placed on the market before 9 December 2026 remain under the old regime. National law on contractual and other non-contractual liability is not displaced (Article 2(4)).

The development-risk defence, that the state of scientific and technical knowledge did not allow the defect to be discovered (Article 11(1)(e)), survives, but Article 18 lets Member States maintain or introduce derogations for specific product categories, subject to notification by 9 December 2026. Whether that defence is available for software will therefore depend on the national law.

What is contested or unproven

No enforcement has occurred, because the regime has not started. Two things are open. First, national implementation is uneven. Faegre Drinker's tracker of 4 September 2026, a law-firm assessment and not an official register, records Hungary (adopted 16 December 2025) and Croatia (24 June 2026) as complete, fifteen jurisdictions as in progress, and ten, including Belgium, France and Spain, with no significant progress. Treat those figures as secondary and check the national position before relying on it. Second, how "within the manufacturer's control" applies to AI systems that continue to learn after release has not been tested by any court.

This brief is not legal advice. It reports what the instrument says as of 28 October 2026.

What a supplier should do

For any software or AI-enabled product that will be placed on the EU market after 9 December 2026, test one assumption: that liability ends when the product ships. If you can still push updates, it does not. Decide now who owns the evidence file for each release, how long it is kept, and what contract recourse you hold against component suppliers, remembering that Article 15 stops you from limiting liability toward the injured person. Then confirm with counsel which Member State law will govern, since transposition and the Article 18 derogations vary.