Product Liability Directive
The EU directive that since 2024 explicitly treats software as a product, making its manufacturer liable for damage caused by defective code.
The original 1985 directive covered movable goods – coffee makers, car tyres – and whether software counted at all was disputed. The new one, (EU) 2024/2853, settles it: software is a product, whether it is embedded in a device, downloaded or delivered as a cloud service. Someone who suffers personal injury, property damage or destroyed data does not need to prove negligence, only that the product was defective and caused the harm. Failing to ship security updates can itself be a defect.
Free software developed or supplied outside a commercial activity is excluded, after heavy lobbying from the community. Member states must have the rules in place by December 2026. Together with the Cyber Resilience Act, the directive marks the end of the era in which a warranty disclaimer in the license was considered enough.