Germany promulgates a new Product Liability Act that will treat software as a product, make post-sale updates part of the liability test and add court disclosure and presumptions, from 9 December 2026

What was promulgated, and which date applies

The Bundesgesetzblatt issue of 27 October 2026 carries the Act signed on 22 October 2026. A footnote states that it serves to implement Directive (EU) 2024/2853 on liability for defective products. Article 1 is the new Product Liability Act with 23 sections; the later articles amend other statutes, including provisions on paper files in courts that have nothing to do with products.

Two dates sit in Article 17. Paragraph 1 says the Act takes effect on 9 December 2026, subject to paragraph 2. Paragraph 2 says Articles 2 and 5 to 16 take effect the day after promulgation. On a promulgation date of 27 October that is 28 October 2026 (our arithmetic, not a date printed in the text). Article 2 is the one that matters for the old law: it replaces section 19 of the 1989 Act with a sentence ending that Act on 9 December 2026.

The transition rule is section 23. For products placed on the market or put into service up to and including 8 December 2026, the 1989 Act continues to apply. On the text, the test is the date of the product, so two regimes would run side by side for years. We read nothing in section 23 that turns on the date of the contract or the date of the injury.

Software is a product

Section 2(1) lists the things that are products: movable things including raw materials, electricity, software, and digital design files that control machines or tools. Software is in, 'with the exception of free and open-source software that is developed or supplied outside a business activity' (our rendering of section 2(1) no. 3).

That carve-out is narrow on its wording. Open-source software supplied inside a commercial activity is not excluded by section 2. Section 4(1) repeats the exception for components: the manufacturer of a non-commercial free or open-source component is not liable under the component rule.

Section 1 protects natural persons, not consumers as such, and it names three heads of damage: death or injury to body or health, expressly including medically recognised impairment of mental health; damage to property other than the defective product itself and other than property used exclusively for professional purposes; and destruction or corruption of data that is not used for professional purposes. Mixed-use property is not excluded on that wording.

Control after sale: updates stay in the picture

Section 8(1) judges defect at the time the product was placed on the market or put into service. Section 8(2) moves that date where the manufacturer kept control: the point becomes when the product left the manufacturer's control. Control exists where the manufacturer, or a third party with its agreement, integrates or supplies a component including a software update or upgrade, or modifies the product, or where the manufacturer is able to provide updates itself or through a third party.

Section 9(2) then removes the usual defence that the defect did not exist at the earlier date, in a control case, where the defect traces to a connected service, to software including updates or upgrades, to the absence of updates needed to keep the product safe, or to a substantial modification. In the words of the statute, those four causes defeat the defence.

For a vendor that ships continuous updates, the practical reading is that the later date can govern. Section 7 adds that the court weighs the product's ability to keep learning or acquire new functions after it is placed on the market. We would read that as the hook for adaptive and AI-enabled products, but the statute does not use the term AI, and no court has applied it yet.

Under section 5, anyone who substantially modifies a product without the manufacturer's consent and then makes it available becomes the manufacturer of the modified product. Section 5(2) defines substantial change by reference to product-safety law, and, absent a standard there, by whether the change alters performance, purpose or type beyond the original risk assessment and changes the nature of the hazard, creates a new hazard or increases the risk level.

Who else can be liable, and for how long

Sections 10 to 13 extend liability beyond the manufacturer. Where the manufacturer is outside the EU, the importer and the authorised representative are liable as the manufacturer. A fulfilment service provider is liable where there is no EU importer or representative. A supplier is liable if no EU manufacturer, importer, representative or fulfilment provider can be identified and the supplier does not name one within a month of being asked. Section 13 applies the supplier rule to an online platform that lets consumers conclude distance contracts and meets the relevant condition of the Digital Services Act.

Section 16 sets a limitation period of three years. Section 17(1) extinguishes the claim ten years after the product was placed on the market or put into service, and section 17(3) extends that to 25 years where the latency of a personal injury made it impossible to sue in time. Section 17(2) restarts the ten years for a substantially modified product from the date the modified product was made available.

We found no deductible and no monetary cap in the 23 sections. We did not open the 1989 Act, so what it provided is outside what we verified here.

Evidence: disclosure and presumptions

Section 19 lets a court, on application, order the opposing party or a third party to disclose relevant evidence where the applicant has set out facts and evidence that sufficiently support the plausibility of a damages claim. Disclosure has to be necessary and proportionate and takes trade secrets into account; the court can classify material as confidential.

Section 20 sets out when a defect is presumed. One trigger is failing to disclose relevant evidence despite a court order under section 19(1). Another is the claimant proving the product breaches binding safety requirements meant to protect against the type of injury that occurred. A third is proof that the injury came from an obvious malfunction in reasonably foreseeable use. Causation is presumed where the product is defective and the injury is of a kind typically caused by that defect.

Section 20(3) goes further. Defect, causation or both are assumed if, even after disclosure, the claimant faces excessive difficulty in proving them, in particular because of technical or scientific complexity, and shows that defect or causation is probable. For opaque software, the complexity limb is the one defendants should watch.

What we did not verify

What we opened: the BGBl. 2026 I Nr. 321 publication page and the 14-page Regelungstext PDF, read in full on 4 November 2026, including Article 1 sections 1 to 23, Articles 2 to 16 and Article 17.

What we did not open: the 1989 Product Liability Act, Directive (EU) 2024/2853 itself, the Bundestag and Bundesrat records, the government explanatory memorandum, and any commentary. Secondary reports that the earlier EUR 500 deductible and a EUR 85 million cap fall away were not checked against the 1989 text. Parliamentary vote dates were not verified.

What we refuse to claim: how courts will treat AI systems, whether a given product or service is software for section 2, or what the old Act provided. We have not read any case applying the new text, because none can exist before 9 December 2026.

Related briefings

• EU Product Liability Directive: software and AI
• Sweden: government bill on a new Product Liability Act for software and AI
• Germany: the KI-MIG and the Bundesnetzagentur as AI enforcer
• Europe AI regulation hub
• AI Regulation News hub