Germany's new product liability law takes effect on 9 December 2026. The Bundestag passed it on 8 October and the Bundesrat cleared it on 16 October. For many companies the key change fits in one sentence: software now explicitly counts as a product. If you offer software, apps, portals or devices that run software, you are liable for defects regardless of fault, and in some cases for missing security updates as well.
What it is about
The Act on the Modernisation of Product Liability Law implements the EU Product Liability Directive 2024/2853. It is the first fundamental reform of the German Product Liability Act since 1989. The main points:
- Software is a product however it is supplied: installed locally, as an app, as firmware in a device, or as software-as-a-service from the cloud. Only pure source code, as information, is excluded.
- Updates count. If a manufacturer keeps control over a product after sale, for example through updates or connected digital services, it can be liable for defects that an update introduces. This also applies when an update needed for safety is not supplied.
- Cybersecurity is part of product safety. Whether a product is defective will also be judged against relevant cybersecurity requirements.
- Open source: Free and open-source software is excluded only if it is developed or supplied outside a commercial activity. If you build open-source components into a commercial product, you are liable as manufacturer of the whole product.
- New types of damage: Besides personal injury and property damage, the loss or corruption of data is now covered, provided the data is not used for professional purposes. Claims are open to natural persons. The previous EUR 500 deductible and the liability cap no longer apply.
- Easier proof: Courts can order companies to disclose evidence such as technical documentation. Under certain conditions, defect and causation are presumed, for example if documents are not produced.
- No contractual exclusion: Liability towards injured persons cannot be excluded by contract. Contracts can only settle recourse within the supply chain.
Who is affected and from when
The new rules apply to products placed on the market or put into service from 9 December 2026. Older products remain under the previous law. How courts will treat software that ships continuously in new versions is still open. In practice, you should assume that every new release falls under the new law.
The following are particularly affected:
- Providers of software, apps, portals and SaaS, even if they sell mainly to businesses. A business customer cannot sue under the Product Liability Act for its own commercial losses, but its injured employees, for example, can.
- Manufacturers of machines, devices and IoT products containing software or firmware.
- Companies that substantially modify products and offer them again. They are then treated as the manufacturer.
- Retailers and online shops selling goods from manufacturers outside the EU. Importers, authorised representatives, fulfilment providers and certain platforms may be liable in such cases.
Using standard software internally does not, in principle, make you a manufacturer. Note how long liability lasts: claims generally expire only ten years after the product is placed on the market, or 25 years for health damage that appears late.
What you should prepare now
About six weeks remain until the deadline. These are the points to tackle now:
- Take stock: Which software, apps or devices will you place on the market from 9 December, including as a new version?
- Define your update process: How quickly do you deliver security updates? How long do you support a version, and how do you communicate that?
- Know your dependencies: A software bill of materials (SBOM) and vulnerability monitoring show which open-source components you use and when they need patching.
- Keep records: File tests, approvals, release notes and security assessments in a traceable way. In a dispute you may have to disclose them.
- Review contracts: Clarify recourse arrangements with suppliers, development partners and service providers. Micro and small enterprises that supply software components can agree a recourse waiver with the manufacturer.
- Check insurance: Does your product liability insurance cover software and cloud services?
- Consider the Cyber Resilience Act: The CRA's security requirements help define what counts as a "safe" product.
How Sadeem helps
We develop and operate custom software, portals and web applications, so we know both sides: the code and day-to-day operations. We help you set up a robust update and patch process, make dependencies visible with a software bill of materials, and document tests, approvals and security updates in a traceable way. If you wish, we can take over monitoring, updates and backups on an ongoing basis through managed hosting in Germany.
Want to know where your software stands? Get in touch, the initial consultation is free of charge.
Note: This article gives a general overview and is not legal advice. Please consult a lawyer to assess your individual situation.
Sources
- German Bundestag: Modernisation of product liability law (8 Oct 2026)
- Directive (EU) 2024/2853 on liability for defective products (EUR-Lex)
- Pharma Deutschland: Legislative procedure completed in Bundestag and Bundesrat
- IHK Lippe zu Detmold: New Product Liability Directive
- Gleiss Lutz: Product liability reloaded