Selling software or AI after 9 December 2026? An EU Product Liability Directive sheet (software is a product, safety updates, 10-year evidence file) for small businesses and their accountants
What you get: a finished software and AI product liability sheet in three tabs: a products tab with one row per app, AI feature, firmware or device with software that a business sells or puts its name on, with formulas that say which liability regime applies (old or new Directive), how long to keep the evidence file, and what to fix; an evidence file checklist mapped to the articles a court will look at; and two templates: a reply when someone asks a reseller to name the manufacturer, and a starting clause for small software suppliers. Four made-up example rows show how it fills in.
Short answer: the new EU Product Liability Directive, Directive (EU) 2024/2853, "shall apply to products placed on the market or put into service after 9 December 2026" (Article 2(1)). Under it, "product" includes "software" (Article 4(1)), "irrespective of whether the software is stored on a device, accessed through a communication network or cloud technologies, or supplied through a software-as-a-service model", and AI system providers "should be treated as a manufacturer" (Recital 13). Liability is no-fault, cannot be "limited or excluded by a contractual provision" towards the injured person (Article 15), and a manufacturer that can still push updates is not let off for defects caused by software updates or "a lack of software updates or upgrades necessary to maintain safety" (Article 11(2)). Member States must transpose it "by 9 December 2026" (Article 22(1)); the old Directive 85/374/EEC keeps applying to products placed on the market before that date (Article 21).
Why accountants and their clients should look at this now
Many small clients now ship software: an app sold with a gadget, an AI feature inside a booking or health tool, firmware for a device, a white-label tool sold under their own brand. Products first placed on the EU market or put into service from 10 December 2026 fall under the new rules. Three points matter for advice this quarter:
- Who pays. The developer, anyone who puts "their name, trademark or other distinguishing features" on the product, and anyone who "develops, manufactures or produces a product for their own use" is a manufacturer (Article 4(10)). If the manufacturer is outside the EU, the importer, the authorised representative and, failing both, the fulfilment service provider are liable (Article 8(1)(c)). A distributor becomes liable if it cannot name an EU operator or its own supplier "within one month" of a request (Article 8(3)). Anyone who substantially modifies a product outside the manufacturer's control becomes its manufacturer (Article 8(2)).
- What damage counts. Death or personal injury, including "medically recognised damage to psychological health"; damage to property, except the product itself and "property used exclusively for professional purposes"; and "destruction or corruption of data that are not used for professional purposes" (Article 6(1)). So a business-to-business tool can still be exposed where a person is injured or private data or property is damaged.
- How long. Claims must be brought within three years of awareness (Article 16(1)) and expire 10 years after the product was placed on the market, or after a substantial modification (Article 17(1)); 25 years for latent personal injury (Article 17(2)). That is the time frame for the evidence file and the provision or insurance discussion.
What the Directive does not cover: "information" such as "the content of digital files, such as media files or e-books or the mere source code of software" (Recital 13); "free and open-source software that is developed or supplied outside the course of a commercial activity" (Article 2(2)); and data leaks under GDPR, which stay under GDPR (Article 2(4)(a); Recital 20). It also does not oblige anyone to provide updates (Recital 51); it makes the lack of safety updates count when the manufacturer still controls the product.
Step 1: tab 1, products (one row per product or software release line)
| Column | What to write | Source |
|---|---|---|
| A. Product | Name of the app, AI feature, firmware, device or file you sell or supply | |
| B. Kind | Software (including apps, SaaS and AI systems), Device with software, Digital manufacturing file, Content only (e-book, media file, mere source code) or Open source, non-commercial | Art. 4(1), 4(2), 2(2); Recital 13 |
| C. Could it harm a person? | Yes if it could cause injury, damage private property, or destroy or corrupt data not used for professional purposes, otherwise No | Art. 6(1) |
| D. Your role | Developer, Own brand, Importer, Modifier, Integrator (you build a supplier's software into your product) or Reseller | Art. 4(10), 4(12), 4(14), 8 |
| E. First placed on EU market | Date this product or version was first made available in the EU (or planned date) | Art. 2(1), 4(8), 4(9) |
| F. You can still update it | Yes if you (or a third party on your behalf) can still supply software updates or upgrades | Art. 4(5)(b); Recital 19 |
| G. Security update plan written | Yes if there is a written plan for safety and security updates and how users are told to install them | Art. 11(2)(b) and (c); Recital 51 |
| H. Release and test log kept | Yes if each release has a dated record of what changed and how it was tested | Art. 9, 10(2)(a), 11(1)(c) |
| I. Non-EU maker, no EU importer or representative | Yes or No | Art. 8(1)(c), 8(3) |
| J. Terms exclude or cap liability to injured persons | Yes if your terms or labels try to exclude or limit liability for injury or private damage | Art. 15 |
| K. Insurer confirmed software and data cover | Yes, No or Unknown | Our working rule (Art. 20 names insurance availability as a review topic) |
| L. Regime | =IF(E2="","ADD DATE",IF(E2>DATE(2026,12,9),"New Directive (EU) 2024/2853","Old Directive 85/374/EEC")) | Art. 2(1), 21 |
| M. Keep evidence until | =IF(E2="","",EDATE(E2,120)) | Art. 17(1): 10 years. Restart from the date of any substantial modification (Art. 17(1)(b)). Keeping the file this long is our working rule |
| N. Gaps | =TEXTJOIN("; ",TRUE,IF(AND(F2="Yes",G2<>"Yes"),"no written security update plan",""),IF(H2<>"Yes","no release and test log",""),IF(J2="Yes","exclusion clause will not bind injured persons (Art. 15)",""),IF(K2<>"Yes","ask insurer about software and data cover",""),IF(AND(D2="Reseller",I2="Yes"),"be ready to name an EU operator within 1 month (Art. 8(3))",""),IF(D2="Modifier","check whether the change is substantial (Art. 8(2))","")) | Formula and wording are our working rule, not a legal test |
| O. Result | =IF(OR(B2="Content only",B2="Open source, non-commercial"),"OUT OF SCOPE (Art. 2(2), Recital 13)",IF(C2="No","LOW: re-check if use changes",IF(N2="","OK: keep evidence until "&TEXT(M2,"yyyy-mm-dd"),"FIX: "&N2))) | Our working rule |
Our reading of the date: "after 9 December 2026" means a product first placed on the market or put into service on 10 December 2026 or later. Each Member State's implementing law may use its own wording; check it once published (Article 22(1)).
Step 2: tab 2, evidence file checklist (keep for each release)
A court may order a defendant to disclose "relevant evidence" (Article 9(1)), and defectiveness is presumed if the defendant "fails to disclose" it (Article 10(2)(a)). These are the items we suggest keeping, mapped to the circumstances Article 7(2) lists for judging defectiveness. The list is our working rule.
| # | Keep | Why |
|---|---|---|
| 1 | Instructions, labels, safety warnings and screenshots of the product page as published | Art. 7(2)(a): presentation, labelling, instructions |
| 2 | Intended use and known foreseeable misuse, written down | Art. 7(2)(b) |
| 3 | For AI features that keep learning after release: what can change and how it is monitored | Art. 7(2)(c) |
| 4 | List of other products and services it connects to (apps, devices, APIs) | Art. 7(2)(d); Art. 4(3) related services |
| 5 | Release date per version and the date it left your control | Art. 7(2)(e); Art. 17(1) |
| 6 | Product safety and cybersecurity requirements you applied, with test results | Art. 7(2)(f); Art. 10(2)(b) |
| 7 | Recalls, safety notices and fixes, with dates | Art. 7(2)(g) |
| 8 | Security updates supplied, the date users were told to install them, and install rates if known | Art. 11(2)(c); Recital 51 |
| 9 | Supplier and component list with EU contact for each (manufacturer, importer, representative) | Art. 8(1), 8(3) |
| 10 | Record of any substantial modification and who made it | Art. 4(18), 8(2), 11(1)(g), 17(1)(b) |
Article 9(4) and (5) let courts protect trade secrets during disclosure, so mark confidential files as such rather than leaving them out.
Step 3: tab 3, two templates
(a) Reseller reply when asked to name the manufacturer. A distributor that cannot identify an EU-established manufacturer, importer or representative, or its own supplier, within one month of the request becomes liable (Article 8(3)). Put the request date in a cell and use =EDATE(B1,1) for the reply deadline (our working rule for "one month").
Subject: Your request to identify the economic operator for [product, model, version]
Thank you for your request received on [date]. Under Article 8(3) of Directive (EU) 2024/2853 as implemented in [country], we identify the following for [product, model, version, serial or licence number]: manufacturer [legal name, address]; [importer / authorised representative] in the EU [legal name, address]; and the supplier that supplied it to us [legal name, address]. Please write to them directly. We keep a copy of this reply.
(b) Starting clause for small software component suppliers. A manufacturer that builds software into its product has no right of recourse against a micro or small software-component manufacturer (as defined in Commission Recommendation 2003/361/EC) where it "contractually agreed ... to waive that right" (Article 12(2)). Liability to the injured person itself cannot be waived (Article 15). Starting wording for a lawyer to adapt (our working draft):
"The Customer integrates the Software as a component in its own products. The Customer waives any right of recourse against the Supplier, as provided for in Article 12(2) of Directive (EU) 2024/2853 and the national law implementing it, in respect of damage caused by a defect in the Software. The Supplier confirms that it is a [micro / small] enterprise within the meaning of Commission Recommendation 2003/361/EC on the date of this agreement."
Four made-up example rows
| A. Product | B. Kind | C | D | E | F | G | H | I | J | K | O. Result |
|---|---|---|---|---|---|---|---|---|---|---|---|
| Fitness tracker app v3 | Software | Yes | Developer | 2027-01-15 | Yes | No | Yes | No | Yes | Unknown | FIX: no written security update plan; exclusion clause will not bind injured persons (Art. 15); ask insurer about software and data cover |
| Smart heater, own brand | Device with software | Yes | Own brand | 2026-11-20 | Yes | Yes | Yes | No | No | Yes | OK: keep evidence until 2036-11-20 (regime: old Directive) |
| AI booking assistant resold | Software | Yes | Reseller | 2027-03-01 | No | No | Yes | No | No | FIX: no release and test log; ask insurer about software and data cover; be ready to name an EU operator within 1 month (Art. 8(3)) | |
| Recipe e-book | Content only | No | Developer | 2027-02-01 | OUT OF SCOPE (Art. 2(2), Recital 13) |
These rows are made up for illustration and do not describe any real business, product or supplier. In row 2 the regime note is added by hand from column L.
What to tell a client in one paragraph
"Software and AI you sell or put your name on and first place on the EU market from 10 December 2026 count as products under the new EU product liability rules. If they injure someone, damage private property or wipe private data, you can be liable without fault, your terms cannot exclude that, and if you can still push updates you stay responsible for safety updates. Keep a dated evidence file for each release for at least 10 years, check your insurance covers software and data loss, and if you resell products from outside the EU, make sure you can name an EU importer or representative within a month of being asked." Stay inside your professional rules and refer liability questions to a lawyer. Member States can also keep or add national rules removing the "state of the art" defence for some products (Article 18), and existing national schemes must be notified by 9 December 2026 (Article 18(1)), so check the client's country.
Keep the result next to your AI tool list
The EURO AI Register free edition runs in your browser with no account and no upload. It covers your first 10 AI systems and 10 evidence records, the screening questions, duties by role with dates, and a printable Article 4 AI-literacy record. List each AI feature you sell once, then attach its row from this sheet and the release log as evidence records.
When you need more than 10 systems, the EURO AI Register membership starts at $19 a month and adds unlimited systems, rule updates and email help. Neither tool is legal advice or proof of compliance.
Partner programme opening soon
Partner programme opening soon: join the free waitlist. Planned terms are 50% of each referred sale (75% once you have 5+ paying customers), single level, paid through Gumroad only from revenue received.
Free start: list your AI tools in the EURO AI Register free edition, then add this sheet. Related: AI supplier contract clauses · GPSR product page check sheet · Data Act switching sheet
Sources
- Directive (EU) 2024/2853 on liability for defective products, Articles 2, 4, 6 to 12, 15 to 18, 20 to 22, Recitals 13, 14, 17 to 20 and 51, read on EUR-Lex on 28 October 2026: EUR-Lex
Unadhi Guides are free, independent explainers. We correct errors as soon as we find them: write to mininglife7@gmail.com.