Starting December 9, 2026, software providers will face strict liability for product defects under the European Union’s updated regulatory framework.
Directive (EU) 2024/2853, transposed into Italian law on October 28, 2026, explicitly reclassifies software as a product, ending long-standing debates over whether digital tools constitute goods or services, according to reporting by lauraturini.substack.com.
This shift ensures that developers of autonomous software, cloud-based applications, and Software as a Service (SaaS) platforms are held to the same safety standards as physical manufacturers. The regulation covers all software, including artificial intelligence systems, with the narrow exception of open-source software provided outside of commercial activity.
Safety Standards Over Functionality
Liability under the new directive hinges on the concept of safety rather than simple functionality. A product is deemed defective if it fails to provide the safety a user is legitimately entitled to expect. While software that is merely slow or inefficient remains subject to standard contract law, dangerous defects that compromise security trigger the new, more stringent liability regime.
The directive clarifies that information or warnings provided with the software cannot substitute for inherent safety. Cybersecurity vulnerabilities are explicitly included in the assessment of a defect. Courts may also presume a product is defective if it belongs to a series already found to have issues, a principle established by the Court of Justice of the European Union in its 2015 ruling on Boston Scientific Medizintechnik GmbH.
Expanded Scope of Responsibility
The list of potentially liable parties now includes manufacturers, importers, authorized representatives, logistics providers, and those making substantial modifications to a product. If a third party performs significant updates or re-trains an AI model, they assume the legal status of a manufacturer for that modified version.
Manufacturers remain responsible for security updates necessary to maintain safety. While the law does not mandate indefinite support, ending security patches for a product still in use carries legal risk, particularly if the support period was never clearly communicated to users.
Legal Presumptions for Complex Systems
To address the inherent difficulty in proving technical defects, the directive introduces legal presumptions. If a user struggles to prove a defect due to the complexity of a system, such as a neural network, the court may presume the existence of a defect if the user demonstrates its probability.
Damages are now expanded to include psychological harm and the loss of data. Any contract or license term attempting to limit this liability for a natural person is legally void. The new rules apply exclusively to products placed on the market or put into service after December 9, 2026, while existing products remain governed by the previous legislation.
Keep reading