Product Liability: what companies should review by December

Product Liability: what companies should review by December

9 December 2026 will mark the beginning of a new era for product liability under German law. By then, companies should clarify which of their products and digital services are affected, what role they occupy in the supply chain, and whether their existing technical documentation, contracts and insurance coverage are sufficient under the new legal framework. In particular, multinational corporate groups and providers of software solutions should assess their need for action at an early stage.

Older products remain subject to the current regime

With the modernisation of the German Product Liability Act, Germany is transposing Directive (EU) 2024/2853 on liability for defective products into national law as of the relevant date. The German product liability regime is thus being comprehensively revised for the first time since 1989.

For products that are placed on the market or put into service up to and including 8 December 2026, the existing law will in principle continue to apply. For later products, the new regime will apply from 9 December 2026. Companies will therefore have to work with two liability regimes in parallel for the foreseeable future.

For series products, the specific date on which the individual item is placed on the market is decisive. A model that has been sold for many years may therefore fall under the old or the new regime depending on the individual unit. The relevant dates should be documented in a traceable manner for stock items and products that have already been delivered.

Software and updates become relevant for liability purposes

To date, the German Product Liability Act has essentially been geared towards tangible movable goods. The new regime expands the notion of product to software, AI systems, digital design data and certain connected digital services. Software can be covered regardless of whether it is stored on a device, provided via a cloud environment or offered as software as a service.

For companies, it is crucial to determine whether their software, cloud application or AI solution qualifies as a product within the meaning of the new regime. Open source software used commercially may lose the privileged treatment it has enjoyed so far.

Liability also does not necessarily end with the first delivery. Defects in a later software update or AI model update may become relevant. The same applies to the omission of a security update that would be necessary in order to maintain product safety.

Pure maintenance updates for a product that was placed on the market before 9 December 2026 do not, however, automatically trigger the application of the new liability regime. The position may be different if an update or upgrade fundamentally changes the product and thus in practice creates a new product.

The liability chain becomes longer

The reform extends the liability chain. In addition to manufacturers, importers and suppliers, the manufacturer’s authorised representatives, fulfilment service providers and certain operators of online platforms may also be affected under certain conditions.

For manufacturers established outside the European Union, the new structure is particularly important. If there is no importer or representative in the European Union, the liability risk may shift to the fulfilment service provider, the distributor or, in some circumstances, the platform.

For each product line it should therefore be clarified which group company acts as manufacturer, who imports, who markets the product under its own brand and which company is responsible for software, updates, warnings and recall measures. The description used in the contract alone will not in every case provide a conclusive answer to these roles.

Documentation becomes a liability instrument

The new regime makes it easier for injured parties to obtain evidence. Courts can, under certain conditions, order the disclosure of development documentation, security concepts, test reports and other relevant documents. In addition, statutory presumptions apply in relation to product defects and causation.

Companies should therefore not wait until a potential court case before compiling their technical documentation. Development, testing and security documentation should be stored in a structured way. This also includes risk analyses, declarations of conformity, test reports, version histories and evidence of product safety measures.

At the same time, it should be determined which documents contain trade secrets. This makes it easier to assert protective measures in the event of a disclosure order.

In the event of a substantial modification of a product, for example through refurbishment, conversion, upcycling or a far-reaching software upgrade, the changes made and their impact on the product risk should be documented separately. Anyone who substantially modifies a product and places it on the market again can, under the new regime, be treated as the manufacturer of the modified product.

Adjusting contracts and insurance cover

Supplier, purchasing, distribution, platform and fulfilment contracts should be reviewed in light of the new allocation of liability. The focus is in particular on indemnities, rights of recourse, information obligations, access to technical documentation, product monitoring obligations and the costs of recalls.

Exclusions of liability vis-à-vis injured parties are, as under the previous regime, ineffective. In internal relationships between companies, however, the allocation of liability and recourse can still be governed by contract.

Insurance cover should also be adjusted. The previous maximum liability limit of 85 million euros for personal injury will no longer apply. In addition, new liability risks arise in relation to damage to data that are not used exclusively for professional purposes, harm to mental health and digital services. Existing product liability insurance policies must therefore be reviewed to determine whether these risks as well as exposure as importer, authorised representative or fulfilment service provider are covered.

What companies should review now

Companies should first carry out an inventory of their products and digital services. Software, AI systems, cloud applications, connected services, digital design files and security updates should also be included.

The allocation of responsibilities within the group and the supply chain should then be documented. For French parent companies with a German subsidiary, it is particularly important to clarify whether the German company merely distributes the products or also acts as importer, supplier, authorised representative or operator of a connected service.

Contracts with suppliers, platforms, fulfilment service providers and developers should also be reviewed. Indemnities, information obligations, recall arrangements and responsibility for security updates should reflect the new allocation of liability. At the same time, insurance cover should be reviewed with respect to damage to private data and risks arising from software updates.

Particular attention should be paid to the key date of 9 December 2026. For products that are placed on the market or put into service up to and including 8 December 2026, the previous German Product Liability Act will in principle continue to apply. The product, release and update history should therefore be documented in a robust manner before that date.

By introducing the new German product liability regime, the legislature is responding to a quarter of a century of technological development, digitalisation and global value chains. The significant expansion of the regime primarily creates a need for action for those market participants who will be subject to product liability law for the first time from December 2026.