Are software companies liable like manufacturers from December 2026?
In short
Yes. In Germany software companies are liable like manufacturers for software placed on the market from 9 December 2026: without fault for personal injury, property damage and destroyed private data, also for missing security updates. The Bundestag passed the new Product Liability Act (Produkthaftungsgesetz) on 8 October 2026. Extended product liability cover costs small firms about EUR 200 to 500 a year.
Published premiums in Germany for the covers software companies need after the reform.
Example
Typical range
Extended product liability for small businesses
about EUR 200 to 500 a year
IT freelancer, EUR 75,000 to 100,000 turnover, EUR 1 million financial loss, EUR 2 million general liability
EUR 588 net, EUR 699 gross a year
Cyber insurance for software development, EUR 750,000 to 1 million turnover, sum insured EUR 1 million
from about EUR 1,061 a year
Guide values as of October 2026 from published premium examples;
the range for extended product liability dates from 2023.
How insurers adapt their tariffs to the new law will only show with new policy wordings.
The amounts in the worked example are guide values from quoting practice (Richtwert aus der
Angebotspraxis).
Worked example
Smart home heating app sold from January 2027
A faulty update switches off the heating in winter, water pipes burst and private photos on the home server are destroyed.
Water damage in the flat
about EUR 15,000
Restoring private data
about EUR 2,000
Customer's deductible under the new law
EUR 0
Fault of the software company required
no
The software company is liable for around EUR 17,000 without fault. Its product liability insurance pays if software and data losses are included.
What changes for software companies in Germany
The old German Product Liability Act of 1989 only covers movable things and electricity. EU Directive 2024/2853 explicitly adds software, whether downloaded, embedded or supplied as a cloud service, and with it AI systems.
Germany implements this with a new Product Liability Act. The Bundestag passed it on 8 October 2026; under the government bill it takes effect on 9 December 2026. The Bundesrat still deals with it before it is published in the Federal Law Gazette (Bundesgesetzblatt).
Point
Until now
For products from 9 Dec 2026
Software
only as part of a thing
a product in its own right, also as a cloud service
Data loss
no compensation
compensation for data not used for professional purposes
Deductible for property damage
EUR 500
abolished
Cap for personal injury
EUR 85 million
abolished
Updates
hardly regulated
missing security updates can trigger liability
Liability for updates and missing security updates
Through updates, software companies keep control over their product. They therefore cannot argue that a defect only arose after sale if it stems from an update or from a missing security update.
In practice anyone selling software in Germany needs a plan for how long and how fast security gaps will be closed. A forgotten update can become more expensive than the original coding error.
Which losses software companies must pay for
Compensation covers death, injury including medically recognised harm to mental health, damage to things not used exclusively for professional purposes, and the destruction or corruption of data not used professionally. A deleted family photo archive counts, a business's deleted customer database does not.
Pure financial losses of business customers, such as lost sales caused by a software bug, are outside the Product Liability Act. Software companies remain liable for them under the contract, which is what financial loss liability insurance covers.
Who else can be liable besides the software maker
Besides the software maker, importers, authorised representatives, fulfilment service providers, distributors and some online platforms can be liable if no manufacturer is available in the EU. Anyone who substantially modifies someone else's software and offers it counts as manufacturer.
Small software houses get some relief: a manufacturer that builds their software into a product as a component can contractually waive its right of recourse if the software house is a micro or small enterprise.
When the new product liability does not affect you
Free open source software developed or supplied outside a commercial activity stays exempt. Software placed on the market before 9 December 2026 remains under the old law.
If you only write software for business customers, the risk is smaller but not zero: if your software injures a person you are liable, while data and things used only for business purposes fall outside product liability.
Insurance for software companies after the reform
Product liability for software is covered by business liability with product liability, for software often as part of IT liability insurance (IT-Haftpflicht). Check that software as a product, data losses and losses from missing updates are expressly included, and that the sum insured still fits without the old cap.
Norman Nammert arranges IT and product liability cover for software companies as an insurance broker (Versicherungsmakler). The insurer pays the commission, so the advice is free of charge for you.
Step by step
Check which of your programs will be placed on the market, new or in a new version, from 9 December 2026.
Decide how long you will deliver security updates and document it.
Review supplier contracts for recourse and indemnities.
Check business and IT liability for software as a product and data losses.
Reassess the sum insured now that the old cap no longer applies.
Checklist
Software expressly insured as a product
Losses of private data included
Losses from updates and missing security updates covered
Financial loss liability for contract claims of business customers
Security update period set for every product
Common mistakes
Believing that cloud software is not a product
Stopping security updates while customers still use the product
Trying to exclude liability in the small print, which does not work against injured persons
Questions and answers
Frequently asked
Does the new product liability apply to software I have already sold?
No.
It applies to products placed on the market from 9 December 2026.
Older software stays under the previous law.
Is a cloud software provider liable too?
Yes.
Software counts as a product regardless of how it is supplied, including use over the internet.
Can I exclude product liability in my terms?
No.
The directive forbids limiting or excluding liability towards injured persons by contract or
national law.
How long can an injured person bring a claim?
Three years from knowing about the damage, the defect and the manufacturer.
The claim expires ten years after the product was placed on the market,
or 25 years for health damage that appears late.
Am I affected as an open source developer?
Not if you develop or supply the software outside a commercial activity.
If you offer it as part of a business, liability applies.
Does product liability insurance pay my business customers' lost sales?
No, pure financial losses are outside the Product Liability Act.
Software companies need financial loss liability (Vermögensschadenhaftpflicht) for that.
