Is your software a "Product" or a "Service"? In the EU, the answer just changed
The revised Product Liability Directive explicitly covers software, so defective software can now ground liability claims. What this means for IT projects, with the Dutch implementation as an example.
Table of Contents
Implementing IT projects has changed a lot in the last five to ten years in the EU. A ton of new regulations entered in force that also affect IT projects. An important (upcoming) change is liability for defective software products, or IT projects, that go wrong or have objective flaws/bugs. End of 2024 a significant shift in the legal landscape happened when software was accepted as a “product”. Sounds a bit weird at first, but this has massive implications for delivery of IT projects’.
Shift in Software & IT implementations
What does this mean? Well, lets assume you go to your electronics store and buy a new washing machine, you take it home, connect it, and then because of a defect in the production this thing more or less explodes flooding your apartment. While I hope this will never happen to anyone,.. you can for sure ask financial compensation from the manufacturer. The same is now the case for IT projects. To stick to the Power Platform just as an example (as its easy to understand). Lets say you implement a project in the Power Platform, all goes good the project goes live, but after a month the customer is calling and asking why two cloud flows send his financial information not to his email but is instead leaking the information externally. In this case an engineer made a mistake in the cloud flow which led to financial damage of the customer. So, same as the washing machine the customer in this case might bring the implementation company to court and could potentially demand compensation in financial form as the project/IT product might be considered “defective” as it contained a serious flaw that caused damage. We can see this in the legislation:
Art. 4(1) of the updated Product Liability Directive (PLD) explicitly includes software:
‘product’ means all movables, even if integrated into, or inter-connected with, another movable or an immovable; it includes electricity, digital manufacturing files, raw materials and software;
This small word has a big impact, as all software products, IT projects and so on will be effected when this legislation is implemented in the respective member states. Another important point is to answer the question “what does defective mean”. In the past EU regulations have been a big blurry more often than not. This improved over the last years (at least in my subjective feeling). What “Defectiveness” means is defined in Art. 7 of the PLD. Art. 7(1) for example describes:
A product shall be considered defective where it does not provide the safety that a person is entitled to expect or that is required under Union or national law.
To go back to our example. The customer might not expect that this specific cloud flow will send the financial information to external people instead to his email. Therefore the product might be considered defective. I do not want to mention too many articles here but Art. 8(1) (b) makes clear that the manufacturer, or in our case the IT implementation company, can be held accountable for such mistakes.
Implementation example of the legislation - The Netherlands
As this is a Directive and not an Act, which is directly binding law, EU countries will implement this legislation into national law step by step. As we have seen with NIS2 and GDPR this can go faster or slower depending on the country. The official deadline for PLD is end of 2026, so December 2026 as typically 2 years are give as period for implementations (europarl.europa.eu).
The country where the author lives (The Netherlands) was fast already and went on with changes in the national civil law (raadvanstate.nl) - in Dutch this is called “Burgerlijk Wetboek”. However, mid/end of 2026 the legislation in the Netherlands, and potentially many other EU countries, will be adapted and then this will become binding law.
Focus on Testing & Final Considerations
As its super hard to take such liabilities out in contractual terms testing of software will get into the focus in IT projects even more. How this will play out will be seen, but this updated legislation clearly aims at improving software products.
Another point is what happens when non-compliant software is implemented. Let’s say a vendor implements AI, reads in Emails from Outlook and, without asking for consent from the people who send the email, processes them with AI. Or you transcribe phone calls using CoPilot in your CRM without asking the callers consent… If the organization using this system gets a compliance fine the product could also be considered “defective”? But this is too deep into the legal topics,… I would say the lawyers should figure that out :-).
Lastly, the PLD is in its core more a consumer legislation. That is true. However, the impact on B2B business will be significant as it could provide a foundation for lawsuits if “products” are malfunctioning. So testing, testing and … testing will be on the agenda.
Disclaimer
This post is for informational purposes only & strictly constitutes the opinion of the author - not the companies the author might be employed and/or connected with in any manner - now or in the past. Also this does not constitute legal advice. For specific guidance related to the topics discussed or other legal matters, please consult a qualified professional / lawyer and/or audit firms tech consultancy advisory for qualified and legally binding answers.