On 8 October 2026, the Law Commission opened a consultation proposing that software and AI systems should be treated as products under the UK’s strict product liability regime. On 9 December 2026, the EU’s new Product Liability Directive is due to apply, bringing software and AI systems within the scope of product liability across the EU.
The two changes follow the same direction, but their legal status differs. The EU Directive is approaching its application date, while the UK’s proposal remains under consultation and is not yet law. Any UK software business selling to EU consumers may be affected by the EU rules, regardless of whether the UK adopts similar changes.
The shift matters because strict liability does not depend on fault. A claimant need not show that anyone was careless, only that the product was defective, that they suffered damage, and that the defect caused it. Applying that to software changes how risk sits across a technology business.
What has changed?
In the UK, nothing yet. The Law Commission published its consultation paper on 8 October 2026. It is open until 14 January 2027, with a final report expected in late 2027, after which the government decides whether to legislate.
In the EU, the change is significant. Directive (EU) 2024/2853 replaces the 1985 Product Liability Directive. Under Article 22, Member States must implement the new rules into national law by 9 December 2026. The Directive applies to products placed on the market or put into service after that date, so it does not apply retrospectively.
Its central move is to treat software as a product however it is supplied, including cloud services and software as a service. Providers of AI systems under the AI Act are treated as manufacturers. Information such as media content, e-books and bare source code is not a product, and free and open-source software developed or supplied outside a commercial activity is excluded — though a manufacturer integrating it into a commercial product may still be liable.
The other changes compound that. Article 7 makes safety-relevant cybersecurity a factor in assessing defectiveness. Article 11(2) removes the “defect arose later” defence where the defect results from software, including updates, from a lack of necessary safety updates, or from a related service within the manufacturer’s control — and a hacker exploiting a vulnerability does not reduce liability. Article 6 extends recoverable damage to destruction or corruption of data not used professionally, and removes the €500 property threshold. Article 9 allows courts to order disclosure from defendants, and Article 10 creates rebuttable presumptions of defectiveness and causation, including where a defendant fails to disclose. Claims run for three years from knowledge, with a ten-year long-stop and 25 years for latent personal injury (Articles 16 and 17).
Who is affected?
For the EU regime, any business placing software, SaaS, AI systems or connected products on the EU market after 9 December 2026 — including UK and Swiss businesses selling into the EU. Article 8 extends liability beyond the manufacturer to importers, authorised representatives and, where neither is established in the EU, fulfilment service providers. Distributors and, in defined circumstances, online platforms are secondarily liable, typically where they fail within one month to identify an EU economic operator or their own supplier.
There are real limits. Claims may be brought only by natural persons, property used exclusively for professional purposes is excluded — so pure B2B SaaS sits largely outside the regime — and pure economic loss is not covered. Mixed private and professional use is covered, which matters for tools used by sole traders and home workers.
For the UK proposals, no one is affected yet. But any business whose products would fall within the expanded definitions — consumer software, AI developers, app publishers, online marketplaces, social platforms — has until 14 January 2027 to respond.
What does this mean for technology companies?
The practical effect is that a category of risk previously managed through contract moves outside it. Strict product liability runs to the injured person, not the counterparty, so terms of service and limitation clauses are not where this exposure is controlled. Safety is an ongoing responsibility, not a one-off certification. Businesses must continue to monitor, maintain and update these products throughout their lifecycle to ensure they remain safe.
The data head also deserves special attention, as destruction or corruption of consumer data is now a recoverable loss in its own right, including recovery and restoration costs. For consumer-facing software, backup and restore capability is a liability control, not only a product feature.
How we can help
The EU deadline is the one with teeth this year. From 9 December 2026, software placed on the EU market is a product, and the people who build, import and distribute it face strict liability for defects — including defects that take the form of a missing security update or an exploitable vulnerability.
The UK consultation is not law and may not become law for some time, but it signals the direction clearly enough that a business rebuilding its practices for the EU deadline should build once, to the broader standard, rather than twice. If you need help, schedule a 20-minute discussion with our technology lawyers.
Image designed by Magnific — www.magnific.com
