In a few weeks, product liability in the European Union will change substantially. Directive (EU) 2024/2853 replaces the 1985 Product Liability Directive. Member States must transpose it by 9 December 2026, and it applies to products placed on the market or put into service after 8 December 2026. The reform has a clear purpose: to bring strict liability for defective products into the digital age, so that software, AI systems and connected products are treated in the same way as physical goods.

For companies that develop, integrate or distribute digital products, this is not a distant legal reform. It affects how products are designed, updated, documented and supported throughout their lifecycle.

From physical products to software and AI

The notion of “product” now expressly includes software, whether embedded in a device or supplied on its own, as well as digital manufacturing files and AI systems. Related digital services also fall within the regime when a product needs them to perform one of its functions, such as a cloud service that controls a connected device.

Free and open-source software is excluded when it is developed or supplied outside a commercial activity. The decisive factor is the commercial context in which the software is supplied, not the licence under which it is released.

Who can be held liable?

Liability no longer falls only on the manufacturer of the finished product. Several operators may be held responsible:

• the manufacturer of the product;
• the manufacturer of a defective component, including software integrated into the product;
• the importer;
• the authorised representative;
• the fulfilment service provider, where none of the previous operators is established in the EU.

In addition, the following may be held liable in specific cases:

• Distributors, if they fail to identify a responsible operator within one month of a request.
• Online platforms, where they present the product in a way that leads the consumer to believe it is supplied by the platform itself.
• Anyone who substantially modifies a product outside the control of the original manufacturer. That person is treated as its manufacturer.

Liability towards injured persons cannot be excluded or limited by contract. Recourse between operators, however, can and should be regulated in supply and distribution agreements.

Updates and the manufacturer’s control

Under the old regime, a manufacturer could escape liability by showing that the defect did not exist when the product was placed on the market. For digital products this defence is now largely unavailable. A manufacturer remains liable where the defect is due to any of the following, as long as they remain within its control:

• a related service;
• software, including updates and upgrades;
• the lack of updates necessary to maintain safety;
• a substantial modification.

Liability therefore follows the product through its lifecycle. Decisions on how long to provide security updates, and on how updates are tested and deployed, become decisions with legal consequences.

Cybersecurity becomes part of product liability

When assessing whether a product is defective, courts must take into account relevant product safety requirements, including cybersecurity requirements. This creates a direct link with the Cyber Resilience Act: a product with digital elements that does not meet the cybersecurity requirements applicable to it is exposed both to regulatory sanctions and to liability claims.

Evidence and the burden of proof

The Directive makes claims easier to bring. Courts can order defendants to disclose relevant evidence at their disposal. It also introduces rebuttable presumptions of defect and of causation, for example:

• where the defendant fails to disclose evidence;
• where the product does not comply with mandatory safety requirements;
• where damage is caused by an obvious malfunction;
• where technical or scientific complexity makes proof excessively difficult for the claimant.

In practice, technical documentation, test records, update histories and incident logs may become the decisive evidence in a dispute.

Damage, data and time limits

The range of compensable damage is wider:

• death and personal injury, including medically recognised damage to psychological health;
• damage to property, except the defective product itself and property used exclusively for professional purposes;
• the destruction or corruption of data not used for professional purposes.

The previous EUR 500 threshold for property damage has been removed.

Claims must be brought within three years from the date on which the injured person became aware, or should reasonably have become aware, of the damage, the defect and the liable operator. Liability expires ten years after the product was placed on the market, or 25 years for personal injury that emerges slowly. For substantially modified products, the ten-year period starts again from the modification.

The Italian framework

In Italy, the draft transposing decree (Government Act No. 434) received favourable opinions from the competent parliamentary committees, with observations from the Justice Committee. On 28 October 2026 the Council of Ministers approved the legislative decree in final reading, taking those opinions into account.

The decree amends the Consumer Code and follows the Directive closely:

• software, digital manufacturing files and related digital services fall within the notion of product;
• cybersecurity requirements, updates and the ability of a product to learn after being placed on the market are relevant to the assessment of defect;
• the previous EUR 387 deductible for property damage is removed.

Products placed on the market before the new rules take effect remain subject to the previous regime. At the time of writing, the decree is awaiting publication in the Official Journal.

What should companies do before December 2026?

1. Map your products. Identify which products, software, related services and digital functions fall under the new rules, and which will be placed on the market after 8 December 2026.
2. Review the value chain. Identify all the operators involved, from component and software suppliers to importers, distributors and platforms. Clarify contracts, recourse rights and information flows between them.
3. Review software and update processes. Assess how updates, patches, modifications and integrations are developed, approved, documented and monitored, and decide for how long security updates will be provided.
4. Strengthen technical documentation. Make sure that records of design, testing, monitoring, maintenance and cybersecurity can be produced quickly if a court orders disclosure.
5. Connect incident and risk management. Link product safety, cybersecurity and post-market monitoring, and define who investigates incidents and who decides on corrective action.

Product liability as a lifecycle issue

The new Directive changes the question companies must ask. It is no longer enough to ask whether a product was safe when it left the factory. The question is whether the product, its software, its updates and the services it depends on remain safe throughout their life, and whether the company can prove it. Companies that build this into their design, contracts and processes now will be better prepared for 9 December 2026 and for the claims that will follow.

Data Valley Consulting supports companies in assessing their exposure under the new product liability rules, reviewing contracts across the value chain and aligning documentation and update processes with product liability and cybersecurity requirements.

‍