From 9 December, software is a product

On 27 October, the German Act to Modernise Product Liability Law was promulgated in the Federal Law Gazette. It transposes the EU Product Liability Directive 2024/2853 and replaces the Product Liability Act of 1989. Its core enters into force on 9 December 2026, exactly on the directive's deadline.

For anyone who develops, offers or markets software under their own name, a basic assumption changes: liability does not end on delivery.

What is new

Section 2 of the new act explicitly counts software as a product, alongside movable things, electricity and digital manufacturing files. The only exception is free and open-source software developed or supplied outside the course of a commercial activity.

More important than the definition is the point in time. Until now, what mattered was the state of a product when it was placed on the market. Under Section 8(2), what now counts is when the product left the manufacturer's control. And control already exists if the manufacturer is able to supply software updates or upgrades itself or via a third party.

Section 9(2) fits this. A manufacturer can normally escape liability by showing that a defect probably did not yet exist when the product was placed on the market. That does not apply if the defect is due to the lack of software updates or upgrades necessary to maintain safety.

In short: a manufacturer who can supply security updates and does not cannot rely on the product having been fine at delivery.

What is not new

Product liability remains liability towards natural persons. Section 1 covers injury to body and health, damaged property and destroyed or corrupted data, each with an important limit: property used exclusively for professional purposes and data used for professional purposes are excluded. Data loss in a company after a faulty update therefore remains a matter of contract, not of the Product Liability Act.

And the act is not retroactive. Under Section 23, the old act continues to apply to products placed on the market or put into service up to and including 8 December 2026.

Who should act now

This does not only concern those who sell software. Under Section 3, a manufacturer is also anyone who offers a product under their own name or brand. Under Section 4, manufacturers are also liable for components they integrate, including related services, meaning digital services without which a product function could not be performed. And under Section 5, anyone who substantially modifies a product without the manufacturer's consent and then makes it available becomes a manufacturer.

• First the date. For each product and version, record when it was placed on the market. That determines which act applies.
• Then the support period. Until when do you supply security updates, and is that documented and communicated? As long as you are able to supply them, it counts.
• Then the components. Which libraries and services are in the product? Without a software bill of materials, nobody knows where an update is missing.
• And the path to the customer. An update that is merely available but never arrives is weak evidence.

If this reminds you of the Cyber Resilience Act, you are right. From 11 December 2027, it requires a defined support period for products with digital elements, generally at least five years, and a software bill of materials. The Product Liability Act governs the consequences if these are missing, and does so a year earlier.

How isidaten handles this

In the Cyber Resilience Act module, every product has a profile with the date of placing on the market and the support period; if it is shorter than five years, the justification under Art. 13(8) CRA is recorded as well. The module guides the technical documentation under Annex VII along its eight contents, with the software bill of materials coming from licence management.

The test question

For your most important software product: is it stated anywhere, in binding form, until when it receives security updates?

If the answer is "as long as we keep developing it", that becomes a liability question from 9 December.

This article is an assessment, not legal advice.

Sources

Act to Modernise Product Liability Law and to Amend Other Provisions, BGBl. 2026 I No. 321 of 27 October 2026 (German), Article 1 (Product Liability Act, Sections 1 to 5, 8, 9 and 23) and Article 17 (entry into force).

Directive (EU) 2024/2853 on liability for defective products, Art. 22 (transposition by 9 December 2026).

German Bundestag: decision of 8 October 2026 (German), printed papers 21/4297 and 21/8429.