The New EU Product Liability

The new EU Product Liability Directive fundamentally changes the rules: software is expressly a product. The loss of data not used for professional purposes becomes a ground for liability. And the Directive provides for no general liability cap.

The new rules apply to products placed on the market or put into service after 9 December 2026.

What has changed? #

The previous Product Liability Directive dates from 1985 — a time when independently distributed software was not expressly covered. The new version brings clarity:

Software is a product. Software made available commercially on the EU market is subject to product liability — regardless of whether it is embedded in a physical device or distributed independently.
Data loss as a ground for liability. For the first time, injured parties can claim damages for the destruction or corruption of data not used for professional purposes.
No general liability cap. The new Directive provides for no general ceiling on compensation claims. Liability is therefore theoretically unlimited.
Extended grounds for liability. Not only the manufacturer is liable but potentially also the importer or distributor if the manufacturer is not reachable.
Disclosure obligations. Manufacturers can be required to disclose relevant evidence. If they refuse, the court can decide in favour of the claimant.
Facilitation of burden of proof. Where the defect is established, its causal link with the damage is presumed if the damage is of a kind typically consistent with that defect. The presumption is rebuttable.
Cybersecurity is a safety feature. Art. 7(2)(f) expressly lists "safety-related cybersecurity requirements" among the criteria by which the defectiveness of a product is assessed. A product that fails to meet applicable cybersecurity requirements (such as those from the CRA) is therefore deemed defective in a liability case — even if it otherwise functions. Missing security updates, unpatched vulnerabilities, or a neglected supply chain are no longer merely compliance issues but direct indicators of defectiveness.

Interaction with the CRA #

The Product Liability Directive and the Cyber Resilience Act complement each other: the CRA defines the safety requirements a product must meet. Product liability kicks in when a product causes damage despite these requirements. A breach of CRA obligations — such as missing security updates or an unmaintained SBOM — can serve as evidence of a product defect within the meaning of product liability.

Legal references #

The new Product Liability Directive (Directive EU 2024/2853):

Art. 4 No. 1: Software is a product within the meaning of the Directive
Art. 6(1)(c): Destruction or corruption of data not used for professional purposes as compensable damage
Art. 7(2)(f): Cybersecurity requirements as a criterion of defectiveness
Art. 8: Liability of the manufacturer for defective products and components
Art. 9: Disclosure obligation — manufacturers must disclose relevant evidence upon request
Art. 10: Facilitation of burden of proof — in cases of technical complexity, the court may presume the defect
Art. 11(2): No "became defective later" defence where necessary security updates within the manufacturer's control are missing
Art. 12: Joint and several liability

In interaction with the CRA:

CRA Art. 13(5): Due diligence when integrating open source components
CRA Annex I Part II No. 1: SBOM obligation to document at least the top-level dependencies
CRA Annex I Part II No. 2: Prompt handling and remediation of vulnerabilities
CRA Art. 13(8): As a rule at least 5 years of security support; shorter where the expected period of use is shorter
CRA Art. 65: Representative actions for consumer protection applicable

Whoever demonstrably fulfils these obligations significantly reduces their liability exposure. Whoever neglects them creates an attack surface for compensation claims.

Implementation in Germany #

The new EU Product Liability Directive must be transposed nationally. In Germany this means amending the existing Product Liability Act (ProdHaftG). The transposition deadline ends on 9 December 2026. The specific national arrangements — such as court jurisdiction and procedural rules — will be determined as part of the transposition. Other EU countries have comparable provisions with potentially differing details.

What does this mean for you? #

If your company manufactures, imports, or distributes software, you can be liable for damage caused by product defects — including the loss of privately used data. The best defence is documented diligence: a current SBOM, demonstrable vulnerability management, and a complete remediation history show that you take your obligations seriously. Without this evidence, you have no line of defence in a damage case.