Published on
Software product liability in the EU is no-fault liability: under Directive (EU) 2024/2853, software is a product, and the Directive explains that this includes SaaS. The rules apply to products placed on the market or put into service from 9 December 2026. I am Martin Krüger, a Dutch lawyer at MAAK Advocaten in Amsterdam: if you sell software into the EU from outside it, have your contracts checked now.
Part of our overview of EU product law for companies selling into the Netherlands.
When is your software a product under the new Product Liability Directive?
Almost always when you supply it commercially. Article 4(1) of Directive (EU) 2024/2853 says a product “includes electricity, digital manufacturing files, raw materials and software”. Only free and open-source software developed or supplied outside the course of a commercial activity is excluded (Article 2(2)).
The Directive explains that this covers firmware, apps and AI systems, and that AI system providers under the AI Act count as manufacturers (recital 13); see the EU AI Act and the debate on AI liability. The Directive also explains that the mere source code of software is not a product. A related service is a digital service without which the product cannot perform one or more of its functions, such as a voice assistant (Article 4(3); recital 17).
| Software situation | Covered? | Who is liable | Article |
|---|---|---|---|
| Standalone app or desktop software | yes | the developer, as manufacturer | Art. 4(1), 4(10) |
| SaaS or cloud software | yes, the Directive explains | the developer, as manufacturer | Art. 4(1); recital 13 |
| Firmware in a device | yes, as a component | device manufacturer; firmware manufacturer if integrated within the manufacturer’s control | Art. 4(4), 8(1)(a)–(b) |
| AI function or AI system | yes; learning ability counts for defectiveness | the provider, as manufacturer, the Directive explains | Art. 7(2)(c); recital 13 |
| Related service | yes, where within the manufacturer’s control | product manufacturer and service provider | Art. 4(3), 8(1)(b) |
| Open source outside a commercial activity | no | the manufacturer that builds it into its product, the Directive explains | Art. 2(2); recital 15 |
| Software update causing a substantial modification | yes, as of the modification | the manufacturer if within its control; otherwise whoever modifies it and then makes it available or puts it into service | Art. 4(18), 8(2), 17(1)(b); recital 40 |
What software companies outside the EU most often get wrong is the belief that product liability only concerns physical products, and that a SaaS or download model falls outside it. The Directive counts software as a product, however it is supplied. The second misconception: that a limitation of liability in your licence terms protects you. Against the injured person, it does not. What you can do is arrange the roles with your Dutch integrator, distributor or authorised representative, so that it is clear who can be held to account in the EU and who pays in the end.
Which of your releases fall under the new rules from 9 December 2026?
Software placed on the market or put into service from 9 December 2026 falls under the new rules (Article 2(1), as corrected on 7 May 2026). For products placed on the market or put into service earlier, Directive 85/374/EEC continues to apply (Article 21).
What counts is when the specific release or copy was placed on the market or put into service. Not every software update makes your software new. Only a substantial modification does: a modification that product safety rules treat as substantial or, where they set no threshold, a change to performance, purpose or type that the initial risk assessment did not foresee and that changes the nature of the hazard, creates a new hazard or increases the level of risk (Article 4(18)). The Directive explains that a software update or the continuous learning of an AI system can cause one (recital 40); the 10-year expiry period then runs from when the modified product is made available or put into service (Article 17(1)(b)).
Are you liable for software updates and AI that keeps learning?
Yes, where they are within the manufacturer’s control. Under Article 11(2), the later-defect defence fails for defects due to software or software updates, “a lack of software updates or upgrades necessary to maintain safety”, a related service or a substantial modification.
Software stays within the manufacturer’s control while the manufacturer of the product has “the ability to supply software updates or upgrades, themselves or via a third party” (Article 4(5)). Still, the Directive creates no duty to supply them: “This Directive does not impose any obligation to provide updates or upgrades for a product” (recital 51). Liability follows from a defect. The Directive explains that the later-defect defence remains available where the owner fails to install a software update supplied to keep the product safe.
For AI, a court weighs “the effect on the product of any ability to continue to learn or acquire new features” after it is placed on the market (Article 7(2)(c)), and safety-relevant cybersecurity requirements (Article 7(2)(f)). From 11 December 2027 the Cyber Resilience Act will require manufacturers of products with digital elements to handle vulnerabilities during a support period of, as a rule, at least five years (Article 13(8) CRA).
Who is liable in the EU if your company has no establishment there?
You remain liable yourself. Alongside you, Article 8(1)(c) makes the importer and your authorised representative liable and, where there is neither, the fulfilment service provider.
Where no liable economic operator established in the Union can be identified, a distributor becomes liable unless, within one month of a request, it names such an operator or its own supplier (Article 8(3)). Who counts as importer or distributor for software that is only supplied online is not spelled out in the Directive; until courts decide, the contract chain should settle it. Economic operators liable for the same damage are liable jointly and severally (Article 12(1)), with recourse under national law (Article 14). No contract limits liability towards the injured person (Article 15). See also the new EU Product Liability Directive for non-EU manufacturers.
The agreement that makes the most difference is the one on recourse and indemnity between you and the party that builds your software into its product. Record who bears which share for a defect in your code, in the integration or in the instructions, how quickly you inform each other and who conducts the defence. If you are a micro or small enterprise, the integrator can agree with you that it will not take recourse; the Directive names that option expressly. Ask for that waiver and offer clear arrangements on software updates and reporting in return.
That option is Article 12(2): the integrator has no right of recourse where the software manufacturer was a micro or small enterprise when it placed the component on the market and the integrator contractually agreed to waive that right. According to the explanatory memorandum, the Netherlands does not transpose this separately, because recourse between economic operators can already be arranged by contract.
How will software product liability work in the Netherlands?
In the Netherlands, implementation bill 36 906 is to bring these rules into the Dutch Civil Code. The House of Representatives passed it on 15 October 2026; it is pending before the Senate (status 3 November 2026). Proposed Article 6:184a includes software as a product.
If no senator asks for written preparation, the Senate can pass the bill as a formality (hamerstuk) on 10 November 2026 at the earliest; a royal decree sets its entry into force. Under the bill, proposed Article 6:185(2) excludes the later-defect defence for software within the manufacturer’s control, the development risk defence remains (proposed Article 6:185(1)(e)), and products placed on the market or put into service before 9 December 2026 stay under the old rules (proposed Article 189aa Transitional Act). If your software is marketed in the Netherlands and the injured user lives there, the Rome II Regulation as a rule, with exceptions, points to Dutch law and the Dutch implementation (Article 5(1)(a)).
Has a Dutch integrator or distributor sent you a contract with indemnities and software update terms? I can tell you which risks are yours and what to change: contact Martin Krüger, product law partner in the Netherlands.
What should you do before 9 December 2026?
List the releases you will place on the market from 9 December 2026 (Article 2(1)), the software updates and related services that remain within the manufacturer’s control (Article 4(5)), and the contracts that allocate liability with your EU partners.
As a Dutch lawyer at MAAK Advocaten, I start with a short inventory in three steps. One: which of your products or versions will still be placed on the market from 9 December 2026; the new regime applies to those copies, even if the model is older. Two: over which software updates, cloud functions and related services you keep control after delivery; as long as you can supply software updates, you remain liable for defects arising from them. Three: which contracts with integrators, distributors and customers settle who pays what if things go wrong. Those three lists can be made within a few weeks and show where your risk really lies.
Ask your insurer about EU product liability cover. For related rules, see our overview of EU cybersecurity and digital product laws.
What do you do when an incident follows a software update?
Act in the first days and hold back on the substance of the claim. At the request of a claimant who made the claim plausible, a court can order you to disclose relevant evidence (Article 9); if you do not, defectiveness is presumed (Article 10(2)(a)).
I make sure three things happen in the first days. You record which version was rolled out when, what the software update changed and who installed it, because that determines whether you can rely on a defence. You notify your insurer and your contract partners within the deadlines in the policy and the contracts. And you do not respond on the substance of the claim before it is clear which regime applies and which documents you may have to produce.
Where, despite disclosure of evidence, technical or scientific complexity makes proof excessively difficult and the claimant shows that a defect or causal link is likely, the court presumes the defect or causal link (Article 10(4)); every presumption is rebuttable (Article 10(5)).
When do you need a Dutch lawyer for software product liability?
You need a Dutch lawyer once the question is who bears the cost rather than how the code works. Liability towards the injured person cannot be excluded (Article 15), so it is divided in contracts and through recourse under national law (Article 14).
Your team knows best how to develop securely, test, handle vulnerabilities and roll out software updates; that is and remains technical work. You need a lawyer as soon as the question is who bears the bill: when drafting or renegotiating licence, SaaS, OEM or distribution contracts, when a customer demands an indemnity, and as soon as there is a damage claim or an incident with injury or data loss. Then deadlines run and every sentence you write counts. Record in the contract how long and how fast you supply software updates and who installs them, together with the allocation of liability.
What we do:
- An EU integrator demands an indemnity (Articles 12, 14, 15): we review the contract and negotiate recourse clauses under Dutch law; see also AI contracts under Dutch law.
- You have no EU establishment (Article 8(1)(c), 8(3)): we record the roles with your Dutch partner.
- A claim follows a software update (Articles 9 to 11; three-year limitation period, Article 16): we secure documents and deadlines and conduct the defence or recourse in the Netherlands.
Example: US firmware in a Dutch smart thermostat
A software supplier outside the EU can be liable alongside the Dutch company that sells the device (Article 8(1)(b)), whatever its licence terms say (Article 15).
Suppose a US company supplies the firmware for a smart thermostat that a Dutch company sells under its own brand from January 2027. A software update in 2028, supplied by the US company with the Dutch company’s consent, makes the device overheat, and a fire damages a consumer’s home. The Dutch company is the manufacturer because its brand is on the product (Article 4(10)(b)); the US company is liable for its defective component (Article 8(1)(b)). Because the software update was within the manufacturer’s control, neither can argue that the defect arose later (Articles 4(5) and 11(2)). Both are liable jointly and severally; their contract and national rules on recourse decide who bears what in the end (Articles 12(1) and 14).
A hypothetical example, not one of our cases.
How do we handle a software product liability matter?
In the first days we establish which releases were placed on the market when, which software was within whose control (Article 4(5)) and what the contracts say; then we decide with you whether to settle, defend or seek recourse.
At MAAK Advocaten we act for software companies outside the EU and for their Dutch integrators, distributors and customers, in negotiations and in court at first instance and on appeal, under Dutch law and Directive (EU) 2024/2853.
Frequently asked questions about software product liability
Is SaaS covered by the new Product Liability Directive?
Yes. Software is a product under Article 4(1) of Directive (EU) 2024/2853, and the Directive explains that this applies whether software is stored on a device, accessed through the cloud or supplied as software-as-a-service.
Does the Directive apply to open-source software?
Not to free and open-source software developed or supplied outside the course of a commercial activity (Article 2(2)). The Directive explains that a manufacturer that builds such software into its product can be held liable for it, and that supply for a price or for certain personal data is commercial.
Do software companies have to provide software updates?
The Directive itself imposes no obligation to provide software updates, as recital 51 explains. But where a defect results from missing software updates necessary to maintain safety and within the manufacturer’s control, the later-defect defence fails (Article 11(2)(c)).
Does the Directive cover damage suffered by business customers?
Not for the company itself. Only natural persons can claim under the Directive (Article 5(1)), and damage to property used exclusively for professional purposes and to data used for professional purposes is excluded (Article 6(1)). Your licence or SaaS agreement and national law govern that damage (Article 2(4)(b)).
When do the new rules apply in the Netherlands?
For products placed on the market or put into service from 9 December 2026. The Dutch implementation bill 36 906 is pending before the Senate (status 3 November 2026); a royal decree sets its entry into force.
When should a software company call a Dutch lawyer?
When a Dutch integrator, distributor or customer sends a contract with indemnities or software update terms, when you need to settle who is liable in the EU, or once an incident or claim arises.
Primary sources
- Directive (EU) 2024/2853 of 23 October 2024 on liability for defective products, OJ L, 18.11.2024; Article 2(1) as corrected on 7 May 2026. Directive 85/374/EEC continues to apply to products placed on the market or put into service before 9 December 2026 (Article 21).
- Dutch implementation bill: Kamerstukken 36 906, no. 2, proposed Articles 6:184a, 6:185 Dutch Civil Code and Article 189aa Transitional Act; explanatory memorandum, no. 3. Status: Eerste Kamer, bill 36 906.
- Regulation (EC) No 864/2007 (Rome II), Article 5(1); Regulation (EU) 2024/2847 (Cyber Resilience Act), Articles 13(8) and 71(2); Regulation (EU) 2024/1689 (AI Act), as referred to in recital 13 of Directive (EU) 2024/2853.
Last checked on 3 November 2026 · next relevant date: 9 December 2026
Is a Dutch integrator, distributor or customer asking you to accept liability for your software? Put your situation to me through my page as product law partner in the Netherlands. — Martin Krüger
