The Product Inside the Programme: A Liability Briefing for UK Software Exporters to the EU

For UK software firms, the EU's revised Product Liability Directive is not an abstract Brussels exercise. The directive, adopted in 2024, must be transposed into national law by member states by 9 December 2026. It expressly brings software within the definition of a product. That includes standalone applications, embedded systems, firmware and AI-enabled software. The practical consequence: a defect in code can trigger no-fault liability in EU courts, with damage claims that may arrive years after the licence was signed. The directive does not apply directly in England and Wales, Scotland or Northern Ireland, but it will shape the legal exposure of any UK business placing software on the EU market, whether directly, through a distributor or as part of a connected product.

From licence to product

Old product liability regimes were built around tangible goods. The revised directive closes that gap. Software is treated as a product when placed on the EU market, whether it is embedded in hardware, downloaded, or supplied as part of a connected system. Liability falls primarily on the manufacturer — which can include a software developer that places the product on the market under its own name or makes a substantial modification. Importers and authorised representatives can also be caught. A UK exporter without an EU establishment may need to consider who is the manufacturer for the purposes of the directive when its software is incorporated into an EU-facing product. That is a contractual question as much as a legal one.

The presumption problem

The revised directive retains the basic no-fault structure: a claimant must show a defect, damage and a causal link. But it adds a presumption of defectiveness in certain circumstances. If a product fails to comply with EU safety requirements, or if the claimant faces excessive difficulties — often because of the technical complexity of the product — a court may presume the product was defective. The claimant still has to prove damage and causation, but the evidentiary hill is lower. For software, technical complexity is not an edge case. It is the norm. A claimant may argue that a machine-learning model's opacity, a firmware update history, or the interaction between modules makes defectiveness impossible to prove without the exporter's records. The presumption does not automatically apply, but it changes the settlement dynamics.

Evidence on demand

The directive also introduces a disclosure of evidence mechanism. Courts can order a manufacturer or other party to disclose evidence, subject to confidentiality safeguards. In practice, that means technical files, test logs, change histories, known-issue registers, release notes and incident reports may become disclosable in an EU claim. UK exporters that keep a clean separation between UK and EU technical documentation may find the separation harder to maintain than they expect. The question is not whether the documents exist; it is whether they are organised well enough to withstand a disclosure request without turning a narrow claim into a broad audit.

The long tail

Product liability has a long memory. The directive sets a ten-year liability period from the date the product was placed on the market, with an extension to 25 years where symptoms of injury are slow to emerge. For software, the question of when a product is placed on the market is not always obvious. A new release, a substantial update, or a change in intended use can restart the analysis. A UK exporter that supplies a platform for a decade may find that an older version remains in scope because it is still in use in the field. The long tail is not just a legal reserve; it is an insurance and contract-drafting problem.

A readiness checklist

Contracts

• Map every EU-facing supply chain: direct sales, distributors, OEMs, systems integrators and managed-service providers. Identify who is the manufacturer, importer and authorised representative for each product.
• Add product liability, indemnity and insurance clauses that reflect the revised directive. Allocate responsibility for updates, recalls and disclosure requests. Do not assume a distributor is a liability shield.
• Review limitations of liability. A cap that is unenforceable in an EU member state is not a cap at all. Take local law advice where the contract is governed by a member state's law.

Technical files

• Treat the technical file as a liability record, not just a compliance artefact. Include design decisions, risk assessments, test evidence, known limitations and update records.
• Keep a register of software versions and the dates they were placed on the market. Record substantial modifications and their rationale.
• Document how safety requirements were met. If a product is not subject to a specific EU safety regime, record the standards and internal controls you applied. The absence of a file is not neutral in a disclosure request.

Insurance

• Check whether existing product liability and technology errors-and-omissions cover software-related bodily injury, property damage and data loss. The revised directive extends damage to include destruction or corruption of data, though not data used for professional purposes.
• Confirm territorial scope. A UK policy may exclude EU claims or require an EU-established insured. Ask how the insurer treats long-tail claims and defence costs.
• Consider whether the limit is adequate for a multi-year, multi-claimant scenario. Software defects can affect a population of users at once.

Incident response

• Extend incident response beyond security breaches to product defects. Who decides whether to notify customers, regulators or insurers? Who preserves evidence?
• Set a disclosure protocol. Assume that emails, tickets and engineering notes may be read by a court. Write them accordingly.
• Rehearse a cross-border claim. A claimant in one member state may trigger disclosure obligations that affect documents held in the UK. Legal privilege rules differ.

The deadline is not the end

The 9 December 2026 transposition deadline is a milestone, not a finish line. National implementations will vary in detail, and courts will take time to interpret the new presumptions and disclosure powers. UK exporters should not wait for the first judgment to test their exposure. The sensible approach is to treat the directive as a product-design, contract and insurance programme — one that starts before the next EU contract is signed, not after the first claim arrives.