From 9 December, your software is a product. So are its updates.

From 9 December, your software is a product. So are its updates.

What the new product liability rules mean for leaders of manufacturing, distribution and software companies

In five weeks, liability for damage caused by defective products moves onto a new footing – and most of the change concerns software, not factory floors. From 9 December, a standalone app, the firmware inside a device, an operating system and an AI system all count as products, just like a household appliance or a component.

In Hungary, the new EU rules were already written into the Civil Code at the end of last year. The new regime applies to products placed on the market or put into service after 9 December; products already on the market stay under the old rules, although a product substantially modified after 9 December – for instance by a major software update – may fall under the new regime.

Why is this a leadership issue? Because product liability is strict liability: the injured person does not have to prove the company was at fault, only the defect, the damage and the causal link. Liability towards the injured person cannot be excluded or limited by contract – and the injured person is usually not the company’s contractual partner anyway.

What counts as a product now?

Software is a product whether it is sold on its own – by download or subscription – or built into another product. Digital manufacturing files (such as a 3D-printing design) are covered too, as are related digital services without which a product could not perform its function – typically the app that controls a smart device.

Information itself is not a product, so neither is source code, and the rules do not cover free and open-source software developed outside a commercial activity.

Liability does not end at the point of sale

This is the change that gets the least attention, yet commercially it may matter most. As long as the product remains within the manufacturer’s control – because the manufacturer supplies its updates – the manufacturer’s liability continues. A product can be defective because of a faulty update, and it can be defective because a security update needed to address a known vulnerability was never delivered.

And anyone who substantially modifies a product already on the market – refurbishing it, reprogramming it, changing it outside the original manufacturer’s control – may become a manufacturer themselves. An update policy is therefore no longer just a product decision; it is a liability decision.

Who can the injured person sue?

The circle of liable parties is wider than before. The manufacturer and the maker of a defective component come first; where a defect in embedded software causes the end product to be defective, the end-product manufacturer can be liable alongside the software maker. If the manufacturer is outside the EU, the injured person can turn to the importer, the manufacturer’s authorised representative and, ultimately, the logistics provider handling warehousing, packing and dispatch. Distributors and online platforms come into the frame if, when asked, they fail to identify their own supplier within a short deadline.

A Hungarian distributor or web shop working with non-EU suppliers can thus easily end up as the first defendant.

Claims will be easier to bring

Courts can order a company to disclose relevant evidence, including technical documentation – with trade secrets protected. If the company does not comply, if the product breaches mandatory safety requirements, or if there is an obvious malfunction, the court may presume the product was defective. For complex technologies, where the claimant realistically could not prove the defect, the causal link can be presumed as well.

The previous damage threshold disappears, and the destruction or corruption of non-professional data and medically recognised psychological harm become recoverable. One important distinction for business clients: damage to property used exclusively for professional purposes is still outside the regime. Losses between companies therefore remain a matter of contract – which makes contractual risk allocation even more important.

What should a leader do now?

Six steps worth starting before 9 December:
1. Product inventory – Which of our products contain software, which of our software is a product in its own right, and what will we place on the market after 9 December?
2. Update policy – Who decides on security updates, how long do we support our products, and how is this documented?
3. Supplier contracts – Do contracts with software and component suppliers address recourse, indemnities and handover of documentation?
4. Customer contracts – Since product liability does not cover business customers’ losses, are our own liability caps and warranty terms fit for purpose?
5. Documentation – Is our technical documentation in order and ready to disclose, and do we know which parts are trade secrets?
6. Insurance – Does our product liability cover extend to software defects, data loss and non-EU products?

The bottom line

From 9 December, software is no longer “just a service” but a product, and an update is a liability question. Companies that put their product inventory, update practice and supply chain in order now will enter the new regime with a predictable risk. The rest will find out where they stand in court, when the disclosure order arrives.