EU Product Liability for Software and SaMD: Germany's Pending Bill and the December 2026 Deadline

US makers of software as a medical device (SaMD) plan changes through the FDA. Since December 2022, section 515C of the Federal Food, Drug, and Cosmetic Act has allowed specified changes consistent with an approved or cleared predetermined change control plan without the supplemental application or premarket notification otherwise required.121 U.S.C. § 360e-4 (section 515C of the Federal Food, Drug, and Cosmetic Act, predetermined change control plans for devices, added by Pub. L. No. 117-328, div. FF, title III, § 3308(a), 136 Stat. 5835 (29 December 2022)), subsection (a) (no supplemental application for a change to an approved device consistent with an approved plan) and subsection (b) (no premarket notification for a change to a cleared device consistent with a cleared plan). Product liability is separate. In Winter, a Ninth Circuit panel applying California tort law suggested in 1991, in dictum, that software failing to produce its intended result might be a product. That observation did not settle software liability across US state law.2Winter v. G.P. Putnam's Sons, 938 F.2d 1033, 1036 (9th Cir. 1991) (California tort law; software analogy in dictum, distinguishing a technical product from a book's ideas and expression). Directive (EU) 2024/2853, the new EU Product Liability Directive (PLD), expressly includes software and applies to products placed on the EU market or put into service after 8 December 2026. Retained update capability affects the assessment of later defects and specified defenses; it does not continually renew the separate expiry period.3Directive (EU) 2024/2853 of the European Parliament and of the Council of 23 October 2024 on liability for defective products and repealing Council Directive 85/374/EEC [2024] OJ L 2024/2853 (PLD), as corrected by Corrigendum [2026] OJ L 2026/90364 (7 May 2026) (Art. 2(1) to read “after 8 December 2026” in place of “after 9 December 2026”), Art. 2(1) (scope), Art. 4(5), Art. 7(2)(e), Art. 11(1)(e) and Art. 11(2) PLD (control, assessment and defenses), Art. 17 PLD (separate expiry), Art. 21 PLD (repeal of Directive 85/374/EEC with effect from 9 December 2026 and its continued application to products placed on the market or put into service before that date), Art. 22(1) (transposition by 9 December 2026), Art. 23 (entry into force on the twentieth day following publication). Member States must transpose the Directive by 9 December 2026. Germany's government bill illustrates how the transition can leave software, evidence and applicable law pulling in different directions.

1. Software as a Product, and the Consequences of Control

Art. 4(1) PLD defines a product as all movables and adds, expressly, software. Recital 13 closes the obvious routes around that definition: software is a product irrespective of the mode of its supply or usage, whether it is stored on a device, accessed through a communication network or cloud technologies, or supplied as a service, while information and the mere source code of software are not. The regime it replaces spoke of all movables and electricity, and the Court of Justice has read that definition as leaving services outside it; that services ruling does not settle how the older definition applies to every form of standalone software.4PLD (n 3), Art. 4(1) (product means all movables, even if integrated into or inter-connected with another movable or an immovable, including electricity, digital manufacturing files, raw materials and software) and Recital 13 (software irrespective of the mode of its supply or usage; information and the mere source code of software not a product; AI system providers treated as manufacturers); Council Directive 85/374/EEC of 25 July 1985 on the approximation of the laws, regulations and administrative provisions of the Member States concerning liability for defective products [1985] OJ L210/29, as amended by Directive 1999/34/EC [1999] OJ L141/20; Art. 2 Directive 85/374/EEC (product means all movables and includes electricity), Art. 7(b) (defect probably not existing when the product was put into circulation), Art. 7(e) (state of scientific and technical knowledge when the product was put into circulation); Case C-65/20 VI v KRONE-Verlag Gesellschaft mbH & Co KG ECLI:EU:C:2021:471, para 27 (services do not come within the scope of Directive 85/374/EEC). Germany's bill adopts the new definition without adjustment. § 2 Abs. 1 Nr. 3 ProdHaftG-E, the draft Product Liability Act in Bundestag document 21/4297, lists software as a product, excluding only free and open-source software developed or supplied outside a commercial activity, and the explanatory memorandum repeats the recital's catalog of cloud and software-as-a-service supply.5Gesetzentwurf der Bundesregierung, Entwurf eines Gesetzes zur Modernisierung des Produkthaftungsrechts, BT-Drs. 21/4297 (25 February 2026), Art. 1 of the German bill (Produkthaftungsgesetz, ProdHaftG-E), § 2 Abs. 1 Nr. 3 (software as a product, save free and open-source software developed or supplied outside a commercial activity), and Begründung zu § 2 Abs. 1 Nr. 3 (software irrespective of the mode of its supply or use, including cloud and software-as-a-service supply).

The definition is the smaller change. Art. 4(5) PLD treats a product as within the manufacturer's control where the manufacturer performs, authorizes or consents to the integration or supply of a component, including software updates or upgrades, or to a modification of the product, and, as a separate ground, where it “has the ability to supply software updates or upgrades, themselves or via a third party”. Among the circumstances Art. 7(2)(e) PLD requires a court to take into account in assessing defectiveness is the moment the product was placed on the market or, where the manufacturer retains control after that moment, the moment the product left it. The German memorandum draws the consequence the Directive leaves implicit: where control still subsisted when the damage occurred, the relevant moment is the moment of the damage. A connected device can therefore remain within control when an injury occurs, even though its original release is years earlier.

That continuing control also affects two defenses. Art. 11(1)(c) PLD keeps the familiar exemption for an operator that proves it probable that the defectiveness did not exist when the product was placed on the market, or came into being afterwards, and Art. 11(2) PLD withdraws it where the defectiveness is due to a related service, to software including updates or upgrades, to a lack of software updates or upgrades necessary to maintain safety, or to a substantial modification, provided that it is within the manufacturer's control. Recital 51 states that the Directive imposes no obligation to provide updates, and in the same passage invokes manufacturers' lifecycle responsibilities under Union law, naming the MDR as an example, as the reason a missing security update should not excuse them. The development risk defense survives, but Art. 11(1)(e) PLD measures the state of scientific and technical knowledge at the time the product was placed on the market or during the period in which it was within the manufacturer's control. Germany keeps the defense in § 9 Abs. 1 Nr. 3 ProdHaftG-E for software and devices alike, disapplying it only where a defect in an authorized product containing genetically modified organisms results from genetic engineering, and its memorandum reads the moving reference point as an Obliegenheit, a burden the manufacturer carries in its own interest, to follow the science and remedy defects that become discoverable for as long as control lasts.6PLD (n 3), Art. 4(5) (manufacturer's control, including where the manufacturer has the ability to supply software updates or upgrades, themselves or via a third party), Art. 7(2)(e) (the moment the product left the manufacturer's control), Art. 11(1)(c) (defectiveness probably not existing when the product was placed on the market), Art. 11(1)(e) (state of scientific and technical knowledge at placing on the market or during the period within the manufacturer's control), Art. 11(2) (no exemption under Art. 11(1)(c) PLD where the defectiveness is due to a related service, software including updates or upgrades, a lack of software updates or upgrades necessary to maintain safety, or a substantial modification, provided that it is within the manufacturer's control), Recital 51 (no obligation to provide updates; lifecycle responsibilities under Regulation (EU) 2017/745), Recital 52; Art. 17(1) and (2) PLD and Recital 58 PLD (ordinary updates do not reset expiry; pending proceedings preserved; 25-year exception where personal-injury latency prevents timely proceedings); BT-Drs. 21/4297 (n 5), § 8 Abs. 2 and § 9 Abs. 1 Nr. 3 ProdHaftG-E, Begründung zu § 8 Abs. 2 (where control continued when the damage occurred, the moment of the damage is decisive) and zu § 9 Abs. 1 Nr. 3 (Obliegenheit to follow scientific and technical developments while control continues), Art. 4 of the German bill (development-risk liability maintained under § 37 Abs. 2 Gentechnikgesetz); Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices [2017] OJ L117/1 (MDR).

The expiry rule is distinct. Art. 17(1) PLD normally ends entitlement after ten years, unless proceedings have been initiated. Ordinary updates do not reset that period; a substantially modified product has a new starting point. Art. 17(2) PLD allows a 25-year period where the latency of a personal injury prevented proceedings within ten years, again preserving proceedings initiated in time. Recital 58 PLD expressly distinguishes ordinary updates from substantial modifications.

The Control Question in the German Text

The German text also raises a question about what must be within the manufacturer's control. § 9 Abs. 2 Satz 2 ProdHaftG-E withdraws the later-defect defense where the case falls under § 8 Abs. 2 ProdHaftG-E, that is, where the manufacturer retained control of the product, and the defect is due to one of the four listed causes. The Bundesrat, the chamber of the German states, read that in its opinion of 30 January 2026 as reaching further than Art. 11(2) PLD, which on its reading requires the cause itself to be within the manufacturer's control, and proposed to say so in the text; the Federal Government declined, reasoning that control is already imported through the reference to § 8 Abs. 2 ProdHaftG-E.7BT-Drs. 21/4297 (n 5), § 9 Abs. 2 Satz 2 ProdHaftG-E; Anlage 2, Stellungnahme des Bundesrates (1061st session, 30 January 2026), point 4 (proposal to require that the cause of the defect be subject to the manufacturer's control, in line with Art. 11(2) of the Directive, whose German text reads “sofern sie der Kontrolle des Herstellers unterliegt”); Anlage 3, Gegenäußerung der Bundesregierung, reply to point 4 (control already incorporated through the reference to § 8 Abs. 2 ProdHaftG-E). PLD (n 3), Recital 18 (no consent merely by providing for the technical possibility of integration, by recommending certain brands or by not prohibiting components). The difference is not academic for software. A diagnostic application runs on an operating system its manufacturer did not write, on hospital hardware it does not own, and often calls a model or a library supplied by a vendor. Recital 18 PLD says that a manufacturer does not consent to an integration merely by providing for its technical possibility or by recommending a brand. Whether a German court applying § 9 Abs. 2 ProdHaftG-E asks if the manufacturer controlled the product, or if it controlled the failing layer, is a question the bill leaves to the first case.

The same logic reaches connected devices through the related service, which Art. 4(3) PLD defines as a digital service integrated into or inter-connected with a product in such a way that its absence would prevent the product from performing one or more of its functions; Recital 17 PLD gives as an example a health monitoring service that relies on a product's sensors. Where the manufacturer is established outside the Union, Art. 8(1)(c) PLD adds the importer and the authorized representative as liable operators and, where neither exists, the fulfillment service provider. Art. 11(5) MDR makes that representative liable for defective devices, jointly and severally with the manufacturer, where the manufacturer has not complied with its obligations under Art. 10 MDR. The Directive, and § 10 ProdHaftG-E with it, drops that condition.8PLD (n 3), Art. 4(3) (related service), Art. 8(1)(b) (manufacturer of a defective component), Art. 8(1)(c) (importer, authorized representative and, failing both, fulfillment service provider where the manufacturer is established outside the Union), Recital 17 (a health monitoring service relying on a product's sensors as an example of a related service); MDR (n 6), Art. 11(5) (authorized representative legally liable for defective devices on the same basis as, and jointly and severally with, a manufacturer not established in a Member State that has not complied with Art. 10 MDR); BT-Drs. 21/4297 (n 5), § 4 and § 10 ProdHaftG-E.

Retained update capability affects control and specified defenses. It does not, by itself, restart the PLD's ten-year expiry period; ordinary updates and substantial modifications have different consequences.

2. Which Regime Covers a Device First Supplied in December 2026?

The temporal rule looks like a single line. Art. 2(1) PLD applies the new Directive to products placed on the market or put into service after 8 December 2026, and Art. 21 PLD keeps Directive 85/374/EEC applying to products placed on the market or put into service before 9 December 2026. As published in November 2024, the first provision read “after 9 December 2026”, which left a product first made available on 9 December itself under neither text, and a corrigendum published on 7 May 2026 moved the line to 8 December. The German bill had already drawn it there: § 23 ProdHaftG-E preserves the 1989 Act for products placed on the market or put into service up to and including 8 December 2026.9PLD (n 3), Art. 2(1) as corrected, Art. 4(7) PLD (commercial supply, including free supply), Art. 4(8) PLD (placing on the market means the first making available of a product on the Union market), Art. 4(9) PLD (first commercial use in the Union where the product had not previously been placed on the market), Art. 21, Recital 63; BT-Drs. 21/4297 (n 5), § 23 ProdHaftG-E (the 1989 Act continues to apply to products placed on the market or put into service up to and including 8 December 2026). European Commission, ‘The Blue Guide on the implementation of EU product rules 2022’ [2022] OJ C247/1, Sections 2.2 and 2.3 (individual products rather than types or series; physical handover not necessary), non-binding guidance on EU product rules.

What places a product on one side of the line is its placing on the market, defined in Art. 4(8) PLD as the first making available on the Union market, or its putting into service. Art. 4(9) PLD defines the latter as first use in the Union in a commercial activity, for payment or free of charge, where the product had not previously been placed on the market. The Commission's 2022 Blue Guide treats placing on the market as concerning each individual product, rather than a product type; physical handover is not necessary. Supply in a commercial activity can be free of charge. A shipment or lot record may be evidence, but is not the legal trigger. For downloads and continuously supplied software, the narrower difficulty is identifying the relevant product or copy and its first supply or use. The Guide provides an interpretive starting point, not a binding answer to every software-as-a-service configuration.

For an unchanged legacy device first placed on the market on 8 December, the old product-liability rules remain relevant. In Germany their application to standalone software is less explicit. § 2 ProdHaftG of 1989 defines a product as a movable thing, a bewegliche Sache, and electricity. § 1 Abs. 2 Nr. 2 ProdHaftG exempts the manufacturer where the circumstances indicate that the product did not yet have the defect when it was placed on the market, and § 1 Abs. 2 Nr. 5 ProdHaftG measures the development risk defense at that same moment. Liability for personal injury is capped at 85 million euros for a product, or products with the same defect, under § 10 ProdHaftG, and property damage carries a deductible of 500 euros under § 11 ProdHaftG. The Federal Government told the Bundesrat that neither limit carries much weight in practice, because the courts regularly decide such cases under the fault-based producer liability of § 823 Abs. 1 BGB, to which neither applies.10Gesetz über die Haftung für fehlerhafte Produkte (Produkthaftungsgesetz, ProdHaftG) vom 15. Dezember 1989 (BGBl. I S. 2198), zuletzt geändert am 17. Juli 2017 (BGBl. I S. 2421), § 1 Abs. 2 Nr. 2 (defect not yet present when the product was placed on the market) and Nr. 5 (state of science and technology at that time), § 2 (product: movable things and electricity), § 10 (cap of 85 million euros for personal injury), § 11 (deductible of 500 euros for property damage); § 823 Abs. 1 Bürgerliches Gesetzbuch (BGB); BT-Drs. 21/4297 (n 5), Anlage 3, reply to point 1 (the cap and deductible rarely relevant because the courts regularly apply § 823 Abs. 1 BGB). A claim for a genuinely later defect in the unchanged legacy device may therefore depend on fault-based liability. That differs from an original defect that manifests later, or a separately supplied new software product or component. The identity of the allegedly defective product matters; the transition does not resolve every later-update case.

Updates, Substantial Modifications and New Liability Periods

The German memorandum treats ordinary updates to the legacy product differently from substantial modifications. The memorandum to § 23 ProdHaftG-E says so directly: software updates or upgrades for software placed on the market before 9 December 2026, and other changes to the product, are not relevant unless they produce a substantially modified and therefore new product within § 5 ProdHaftG-E. § 5 ProdHaftG-E addresses modifications without the original manufacturer's consent; its memorandum also explains that substantial modifications within the manufacturer's control leave that manufacturer liable for later defects under § 9(2) no. 4 ProdHaftG-E. Recital 39 PLD treats a substantially modified product subsequently made available as a new product. Recital 40 PLD addresses when a modification through software or continuous learning is actually made, and Art. 17(1)(b) PLD starts a new expiry period on making the substantially modified product available or putting it into service.11BT-Drs. 21/4297 (n 5), § 5 ProdHaftG-E (substantial modification without the manufacturer's consent) and Begründung zu § 23 (software updates or upgrades for software placed on the market before 9 December 2026 not relevant unless they produce a substantially modified and therefore new product within § 5); PLD (n 3), Art. 4(18) (substantial modification), Art. 8(2), Art. 17(1)(b) (expiry period running from the making available of the substantially modified product), Recitals 39 and 40; MDR (n 6), Annex IX, Section 4.10 (changes to an approved device that could affect safety and performance or the conditions prescribed for use require notified-body approval). BT-Drs. 21/4297 (n 5), pp. 28–29 (manufacturer-controlled substantial modifications) and pp. 43–44 (ordinary legacy updates and new products).

A manufacturer's own update can therefore require a fresh assessment of whether the product has been substantially modified and which temporal regime applies. Whether an update is substantial at all turns on Art. 4(18) PLD, which defers first to any threshold in Union or national product-safety law and, failing one, asks whether the change alters the product's original performance, purpose or type without having been foreseen in the manufacturer's initial risk assessment, and whether it changes the nature of the hazard, creates a new hazard or increases the level of risk. For a device holding an EU technical documentation assessment certificate, the MDR asks a different question, whether a change could affect safety and performance or the conditions prescribed for use, and makes such a change subject to the notified body's approval under Section 4.10 of Annex IX MDR. A US team that documented its planned changes in a predetermined change control plan holds a document that looks like foresight. Whether that plan answers the initial-risk-assessment question depends on its contents and the applicable product-safety rules.

AI-enabled devices carry a further clock. For an AI system that is a medical device required to undergo third-party conformity assessment, the high-risk classification follows Art. 6(1) and Annex I AI Act. Under point (c)(ii) of the third paragraph of Art. 113 AI Act, as amended by Regulation (EU) 2026/1744 of 8 July 2026, Chapter III, Sections 1 to 3 AI Act, except Art. 6(5) AI Act, apply to that route from 2 August 2028. Under Art. 111(2) AI Act, as amended, earlier high-risk systems are generally covered if their designs undergo significant changes from the applicable date. This preserves Art. 5 AI Act and the separate transition for the large-scale systems in Art. 111(1) AI Act. In any case, providers and deployers of high-risk systems intended for use by public authorities must comply by 2 August 2030. Whether a particular public hospital qualifies needs separate analysis.12Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (AI Act) [2024] OJ L 2024/1689, as amended by Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI) [2026] OJ L 2026/1744, Art. 12(1) AI Act (automatic recording of events over the lifetime of a high-risk AI system), Art. 111(2) AI Act (earlier high-risk systems generally covered after significant design changes from the applicable date, without prejudice to Art. 5 AI Act and the separate systems in Art. 111(1) AI Act; providers and deployers of systems intended for use by public authorities must comply by 2 August 2030), Art. 113 AI Act, third paragraph, point (c)(ii) (Chapter III, Sections 1 to 3 except Art. 6(5) AI Act, applicable from 2 August 2028 to AI systems classified as high-risk under Art. 6(1) and Annex I AI Act), Annex I, Section A, point 11 (Regulation (EU) 2017/745). A device first supplied in December 2026 may therefore enter the new product-liability regime well before the relevant AI requirements apply. Continued grandfathering depends on design changes and the public-authority exception. The three change concepts that decide its status, the Directive's substantial modification, the AI Act's significant change in design and the MDR's change that could affect safety and performance or the conditions prescribed for use, were drafted by different hands for different purposes.

One more clock runs through a cross-reference. Art. 10(16) MDR requires manufacturers to have measures in place, proportionate to the risk class, the type of device and the size of the enterprise, to provide sufficient financial coverage in respect of their potential liability under Directive 85/374/EEC, and the MDR's consolidated text of 19 July 2026 still says so. The second paragraph of Art. 21 PLD reads references to the repealed Directive as references to the new one.13MDR (n 6), Art. 10(16) (measures to provide sufficient financial coverage in respect of potential liability under Directive 85/374/EEC, in the consolidated text of 19 July 2026); PLD (n 3), Art. 15 (liability not to be limited or excluded by contract or by national law), Art. 17(2) PLD (25-year expiry where personal-injury latency prevented proceedings within ten years, preserving proceedings initiated in time), Art. 21 PLD (legacy-product transition and references to the repealed Directive construed as references to the PLD). For products within the new regime, that cross-reference points to liability without a financial cap, new presumptions and the separate expiry rules. Legacy products retain their transitional treatment. A coverage policy drafted around the older regime may therefore face different exposures across a single device portfolio.

3. Germany's Pending Implementation and Switzerland's Separate Regime

The German timetable left little room. The Federal Government sent its bill to the Bundesrat in December 2025, the Bundesrat gave its opinion on 30 January 2026, and the Bundestag held the first reading on 4 March 2026 and referred the bill to the Committee on Legal Affairs and Consumer Protection, which heard experts on 13 April 2026. At that hearing the one-to-one transposition was criticized by some as going too far and by others as too unambitious. As of 27 August 2026 the committee had made no recommendation and the Bundestag had held no second or third reading. The bill describes itself as not requiring the Bundesrat's consent, but a law the Bundestag adopts still goes to the Bundesrat, which may call the mediation committee within three weeks under Art. 77(2) GG. Under Art. 5 of the German bill the new Act enters into force on 9 December 2026, and under Art. 2 of the German bill the 1989 Act is to expire on that day, a provision that itself takes effect on the day after promulgation.14Gesetzentwurf der Bundesregierung, BR-Drs. 775/25 (19 December 2025), framed in its enacting formula as not requiring the consent of the Bundesrat; Bundesrat, 1061st session (30 January 2026), opinion; Deutscher Bundestag, Plenarprotokoll 21/61 (4 March 2026), first reading and referral to the Ausschuss für Recht und Verbraucherschutz; Ausschuss für Recht und Verbraucherschutz, 31st session, public hearing (13 April 2026); BT-Drs. 21/4297 (n 5), Art. 2 (the 1989 Act to expire on 9 December 2026; in force on the day after promulgation) and Art. 5 (entry into force on 9 December 2026); Art. 77(1) and (2) Grundgesetz für die Bundesrepublik Deutschland (GG). The Commission's register records Hungarian PLD notifications dated 15 April 2026 and Croatia's amendment to its law of obligations notified on 2 July 2026. These entries establish that the measures were notified, not that implementation was complete or correct.15European Commission, national transposition measures communicated for Directive (EU) 2024/2853: Hungary, 2025. évi XCII. törvény a magánjogi tárgyú törvények módosításáról (PLD notification 15 April 2026) and 2013. évi CLXXVII. törvény (notified 15 April 2026), the register also listing four existing Hungarian acts, among them the Civil Code (2013. évi V. törvény); Croatia, Zakon o izmjenama i dopunama Zakona o obveznim odnosima, NN 69/2026 (notified 2 July 2026); PLD (n 3), Art. 22(1).

If the reform and its repeal provision have not been enacted and promulgated in time for 9 December 2026, the 1989 Act remains in force: no effective repeal would yet displace it. A claimant injured by a device placed on the German market after 8 December cannot rely on the Directive against its manufacturer, since a directive cannot of itself impose obligations on an individual. German courts must interpret national law, so far as possible, in the light of the Directive, an obligation that arises once the transposition period has expired and that cannot support an interpretation contra legem.16Case C-91/92 Paola Faccini Dori v Recreb Srl ECLI:EU:C:1994:292, para 20; Case C-106/89 Marleasing SA v La Comercial Internacional de Alimentación SA ECLI:EU:C:1990:395, para 8; Case C-212/04 Konstantinos Adeneler and Others v Ellinikos Organismos Galaktos ECLI:EU:C:2006:443, paras 110 and 115; Joined Cases C-6/90 and C-9/90 Andrea Francovich and Others v Italian Republic ECLI:EU:C:1991:428, paras 39–43; Joined Cases C-178/94, C-179/94, C-188/94, C-189/94 and C-190/94 Erich Dillenkofer and Others v Bundesrepublik Deutschland ECLI:EU:C:1996:375, para 29. Cf. BT-Drs. 21/4297 (n 5), Anlage 3, reply to point 2 (§ 142 Zivilprozessordnung (ZPO) as a comparable existing rule). Whether a court can read software into the bewegliche Sache of § 2 ProdHaftG, build a disclosure order of the kind Art. 9 PLD requires out of § 142 ZPO, which the Federal Government cited to the Bundesrat as a comparable rule, or derive from national law a presumption that the Directive requires and German statute does not contain, are questions about the limits of consistent interpretation.

The claimant's alternative runs against the Federal Republic. A failure to take any measure to transpose a directive within the prescribed period is in itself a serious breach that gives rise to a right to reparation, where the directive confers rights on individuals whose content is identifiable and the breach caused the loss, as the Court of Justice held in Dillenkofer on the foundation laid in Francovich. That claim does not run against the manufacturer. A late transposing Act could raise a separate temporal question. § 23 ProdHaftG-E fixes its temporal line by a calendar date rather than by the Act's own entry into force, so an Act promulgated some months after 9 December 2026 with its transitional rule unamended would reach products placed on the market before it existed. Whether the Bundestag would amend the transitional rule, or how a court would apply it as written to a device released in that interval, are matters a bill drafted for timely adoption does not address.

In a court applying the Rome II Regulation, the ordinary product-liability ladder in Art. 5(1) Rome II starts with the injured person's habitual residence when the damage occurred, then the country of acquisition, then the country of damage, provided in each case that the product was marketed there. It is subject to Art. 4(2) Rome II where the parties shared a habitual residence when the damage occurred, and to Art. 5(2) Rome II where the tort is manifestly more closely connected with another country. Art. 5(1) Rome II also substitutes the defendant's habitual-residence law if that defendant could not reasonably foresee marketing the product, or a product of the same type, in the otherwise designated country.17Regulation (EC) No 864/2007 of the European Parliament and of the Council of 11 July 2007 on the law applicable to non-contractual obligations (Rome II) [2007] OJ L199/40, Art. 4(2) Rome II (common habitual residence when damage occurred), Art. 5(1) Rome II (ordinary product-liability ladder, starting with the injured person's habitual residence when damage occurred, and marketing-foreseeability exception), Art. 5(2) Rome II (manifestly closer connection). A Hungarian and a German claim can therefore reach different national regimes, depending on those connecting factors, each statute's temporal scope and the implementation actually enacted. The patient's residence alone does not decide the result, and notification of a national measure does not establish complete or correct transposition.

Switzerland: Existing Product Liability Law and a Reform Motion

Switzerland is not an EU Member State, and no transposition deadline binds it. The Swiss product liability statute, the PrHG of 1993, was last amended with effect from 1 July 2010. Art. 3(1) PrHG defines a product as any movable thing, including one that forms part of another movable or of an immovable, and electricity, and does not mention software. Under Art. 5(1)(b) PrHG, the manufacturer must prove circumstances indicating that the damage-causing defect did not exist when it put the product into circulation. Art. 5(1)(e) PrHG provides a separate development-risk defense measured at that moment, without the new PLD's express continuing-control provisions. Art. 2(1)(c) PrHG treats as a manufacturer anyone who imports a product for distribution in the course of business, subject to contrary treaty provisions. This can give a Swiss claimant a local defendant for a physical device. Who, if anyone, imports an application downloaded from a US server requires separate analysis.18Bundesgesetz über die Produktehaftpflicht (Produktehaftpflichtgesetz, PrHG) vom 18. Juni 1993 (SR 221.112.944), as in force since 1 July 2010, Art. 2(1)(c) (importer as manufacturer), Art. 3(1) (product: movable things, including those forming part of another movable or of an immovable, and electricity), Art. 5(1)(b) (defect not yet present when the product was placed on the market), Art. 5(1)(e) (state of science and technology at that time), Art. 11(2) (claims for damages under the Obligationenrecht or other provisions of federal or cantonal public law reserved). The PrHG itself contains no counterpart to the PLD's disclosure and defect-presumption rules, and its interaction with the longer limitation periods of Swiss tort law is examined in the analysis of the PLD and US pharma supply chains.

Switzerland has, however, begun to ask the question. Motion 26.3338, submitted in the Nationalrat, the larger chamber of the Swiss Parliament, on 19 March 2026, would instruct the Federal Council to submit to Parliament a revision of the PrHG that would implement the changes introduced in the EU by Directive (EU) 2024/2853 and adapt the statute to technical developments, artificial intelligence among them. On 20 May 2026 the Federal Council proposed that the motion be adopted, and it remained a parliamentary proposal at the article's 27 August 2026 horizon.19Motion 26.3338 Flach, ‘Zeitgemässe Produktehaftung für die Schweiz. Modernisierung des PrHG im Lichte der EU-Reform und der zunehmenden Bedeutung von Software, Daten und künstlicher Intelligenz’ (submitted in the Nationalrat on 19 March 2026; the Federal Council proposed adoption on 20 May 2026). An adopted motion instructs the government to prepare a bill; the motion itself does not amend the PrHG.

What reaches a Swiss claimant sooner is the conflict rule. Art. 135(1) IPRG lets an injured person choose the law of the tortfeasor's establishment (or habitual residence if there is no establishment) or the law of the state of acquisition. The acquisition-state option is unavailable if the tortfeasor proves the product entered commerce there without its consent. Art. 135(1) IPRG thus gives a qualified choice, and Art. 135(2) IPRG limits a Swiss court applying foreign law to what Swiss law would award for such damage.20Bundesgesetz über das Internationale Privatrecht (IPRG) vom 18. Dezember 1987 (SR 291), Art. 135(1) IPRG (choice of the tortfeasor's establishment law, with habitual residence as the fallback absent an establishment, or acquisition-state law; the latter option is unavailable if the tortfeasor proves the product entered commerce there without its consent) and Art. 135(2) IPRG (no award in Switzerland beyond what Swiss law would grant for such damage). A Swiss patient who bought a connected device in Germany may invoke German law, and with it whatever transposition Germany has completed by then. A Swiss patient using an application supplied from the United States may invoke the law of the state in which its manufacturer is established. The forum's conflict rules and the statutory conditions, rather than the manufacturer's preferred market label, determine the available choice.

4. Disclosure and Presumptions Aimed at Software Evidence

Art. 9(1) PLD requires Member States to ensure that a defendant can be ordered to disclose relevant evidence at its disposal once a claimant has presented facts and evidence sufficient to support the plausibility of the claim, and Art. 9(2) PLD permits a reciprocal order where the defendant substantiates its need for relevant evidence at the claimant's disposal. Both routes remain subject to necessity, proportionality and confidentiality safeguards. § 19 ProdHaftG-E transposes the rule closely. Its memorandum requires the damages action to be pending, measures plausibility by reference to the Federal Court of Justice's reading of the disclosure rule for cartel damages, and, following Recital 42 PLD and the Court of Justice in PACCAR, includes documents the defendant must newly create by compiling or classifying information at its disposal. Art. 9(6) PLD and § 19 Abs. 5 ProdHaftG-E let the court require the evidence to be presented in an easily accessible and easily understandable form, and the memorandum, following Recital 42 PLD, names evidence relating to digital products as its example. Trade secrets are protected by applying §§ 16 to 20 GeschGehG, which the court may do on its own motion.21PLD (n 3), Art. 9(1) to (7) (disclosure of evidence, including presentation in an easily accessible and easily understandable manner under Art. 9(6) and national rules on pre-trial disclosure unaffected under Art. 9(7)), Recital 42 (documents created ex novo by compiling or classifying the available evidence); BT-Drs. 21/4297 (n 5), § 19 ProdHaftG-E and Begründung zu § 19 (action already pending; plausibility by reference to BGH, judgment of 4 April 2023, KZR 20/21, paras 50–54; documents to be newly created, citing Case C-163/21 AD and Others v PACCAR Inc and Others ECLI:EU:C:2022:863, para 69; §§ 16 to 20 Gesetz zum Schutz von Geschäftsgeheimnissen (GeschGehG) applied by analogy, also of the court's own motion); Anlage 2, points 6 and 7 (Bundesrat proposals on fishing requests and specificity) and Anlage 3, replies to points 1, 6 and 7 (only existing evidence, no new documentation duties; proposals not taken up). For the call for a pre-trial disclosure claim at the hearing of 13 April 2026, see the hearing cited in (n 14).

For a software defendant the content of such an order is easy to picture: logs, version histories, update rollout records, the verification and validation records that the MDR presupposes and, for an AI-enabled device, training and performance documentation. The Federal Government told the Bundesrat that the disclosure rules concern only evidence already in the manufacturer's possession and create no new documentation duties. Read with its own memorandum's reference to documents compiled for the purpose, that statement distinguishes producing evidence from creating new recordkeeping duties. Existing duties under the MDR or other law remain; relevant information already held may have to be compiled into a new document. The Bundesrat asked for an express bar on fishing requests and for a rule that applications identify the evidence as precisely as can reasonably be expected, and the Federal Government rejected both as unnecessary. Consumer advocates at the April hearing asked for a disclosure claim that could be pursued before any action is filed; the bill contains none, and Art. 9(7) PLD leaves national rules on pre-trial disclosure where they are.

The authorized representative is where this becomes a transatlantic problem. Sued under Art. 8(1)(c) PLD, it can be ordered to disclose relevant evidence at its disposal, and a failure to comply leads to a presumption of defect under Art. 10(2)(a) PLD and § 20 Abs. 1 Nr. 1 ProdHaftG-E. Art. 11(3)(b) MDR already requires it to keep a copy of the technical documentation available at the disposal of the competent authorities.22PLD (n 3), Art. 8(1)(c) and Art. 10(2)(a) (defectiveness presumed where the defendant fails to disclose relevant evidence pursuant to Art. 9(1)); BT-Drs. 21/4297 (n 5), § 10 and § 20 Abs. 1 Nr. 1 ProdHaftG-E; MDR (n 6), Art. 11(3)(b) (copy of the technical documentation kept available at the disposal of competent authorities). Whether that copy is also at its disposal for a claimant, and whether source code, server logs and model files held by a US parent are at the disposal of an EU representative whose mandate may or may not reach them, depend on the facts, the mandate and the applicable procedural law. An MDR mandate does not by itself settle what evidence is legally at the representative's disposal.

Product Safety Requirements and Presumptions of Defectiveness

The presumptions then point at the product-safety file. Art. 10(2)(b) PLD presumes defectiveness where the claimant demonstrates that the product does not comply with mandatory product safety requirements laid down in Union or national law that are intended to protect against the risk of the damage suffered, and Recital 46 PLD includes a product not equipped with the means to log information about its operation as required under Union or national law. For SaMD the obvious candidates sit in Annex I to the MDR, whose Section 17.2 requires software to be developed and manufactured in accordance with the state of the art, taking into account risk management including information security, and whose Section 17.4 requires manufacturers to set out minimum requirements for hardware, IT networks and IT security measures. The AI Act's own logging duty in Art. 12(1) AI Act will not bind a device on the Annex I AI Act route before August 2028, and its application to earlier systems depends on significant design changes and the 2030 public-authority exception. For new connected consumer products within the Cyber Resilience Act (CRA) scope, the general requirements apply from 11 December 2027. Art. 2(2)(a) CRA excludes products to which the MDR applies; Art. 69(2) CRA separately addresses legacy products, with earlier reporting duties under Art. 69(3) and Art. 71(2) CRA.23PLD (n 3), Art. 10(2)(b) and Recital 46 (including a product not equipped with the means to log information about its operation as required under Union or national law); MDR (n 6), Annex I, Section 17.2 (software developed and manufactured in accordance with the state of the art, taking into account the principles of development life cycle, risk management, including information security, verification and validation) and Section 17.4 (minimum requirements concerning hardware, IT networks characteristics and IT security measures); AI Act (n 12), Art. 12(1); Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act) [2024] OJ L 2024/2847, Art. 2(2)(a) (products to which Regulation (EU) 2017/745 applies excluded), Art. 69(2) CRA (legacy products covered following a substantial modification from 11 December 2027), Art. 69(3) CRA (reporting duties also cover earlier products), and Art. 71(2) CRA (general application from 11 December 2027; Art. 14 CRA from 11 September 2026). Which mandatory requirement a claimant can point to, and from what date it bound the device, varies with the product and with its release date.

Art. 10(4) PLD goes further where, despite disclosure, the claimant faces excessive difficulties, in particular due to technical or scientific complexity: the court presumes defectiveness, causation or both for the issue on which the claimant meets the difficulty and likelihood conditions. Recital 48 PLD names the factors in terms that could have been written for this sector, among them the complex nature of the product, such as an innovative medical device, the complex nature of the technology, such as machine learning, and a causal link whose proof would require the claimant to explain the inner workings of an AI system. § 20 Abs. 3 ProdHaftG-E transposes the rule as an Annahme rather than a Vermutung, and its memorandum describes it as a rule on the standard of proof rather than a statutory presumption.24PLD (n 3), Art. 3 (level of harmonisation), Art. 10(3) (presumed causal link), Art. 10(4) (presumption where the claimant faces excessive difficulties, in particular due to technical or scientific complexity, and demonstrates likelihood), Art. 10(5) (right to rebut), Recital 48 (an innovative medical device, machine learning and the inner workings of an AI system among the factors of complexity); BT-Drs. 21/4297 (n 5), § 20 Abs. 3 ProdHaftG-E and Begründung zu § 20 Abs. 3 (a rule on the standard of proof rather than a statutory presumption; the memorandum expressly preserves rebuttal of both assumptions and presumptions), pp. 41–42. The memorandum expressly preserves rebuttal of both presumptions and assumptions. The distinction concerns the standard of proof, not the removal of a defendant's opportunity to rebut; how courts apply that standard to a complex software defect remains consequential. The instrument that would have eased proof in fault-based claims involving AI is gone: the Commission withdrew its proposal for an AI Liability Directive in a notice published on 6 October 2025.25Withdrawal of Commission Proposals [2025] OJ C/2025/5423 (6 October 2025), listing COM(2022) 496 final, Proposal for a Directive of the European Parliament and of the Council on adapting non-contractual civil liability rules to artificial intelligence (AI Liability).

5. For US Software and Device Makers

The first relevant supply of each product is a legal fact that shipment and distribution records may help establish. Software complicates the identification of the product itself: a new copy, a version supplied to existing users and a substantial modification may require different analysis. Records preserved by the regulatory, engineering and commercial functions do not necessarily answer the same question.

Control depends on update capability, not simply an intention to deliver updates. Ending support does not necessarily end the ability that Art. 4(5) PLD describes. Third-party operating systems, cloud services and models add further questions about consent and integration. Art. 12(2) PLD also permits the manufacturer integrating defective software as a component to waive recourse against its software manufacturer, if that supplier met the micro or small enterprise criteria when the software was placed on the market. Partner and linked enterprises count toward those criteria. The waiver affects recourse between businesses, not the injured person's claim.

Disclosure may require existing information to be compiled into a new document. Retention practices, the EU representative's actual access and restrictions arising in parallel US proceedings can therefore matter long after the original procurement. The analysis of the PLD and US pharma supply chains examines that cross-border evidential tension in a different product setting.

A device portfolio can span legacy and new product-liability regimes, delayed national implementation, different conflict rules and distinct regulatory change tests. Insurance and contractual recourse must be assessed against that particular portfolio. Neither regulatory approval nor a single release date resolves the manufacturer's exposure.

The legal significance of an update rests on its technical effect, the relevant product and the parties involved, not simply its version number.