Product liability from 9 December:
substantial modifications make you the manufacturer

From next year, a case could look like this. A system is delivered in spring 2027. A year later, a service provider installs new control software without consulting the manufacturer, and the software raises the cycle rate. Weeks later, an employee is injured at a protective device that shuts off too late at the higher speed. Who answers for this even without fault will depend on whether the update substantially modified the system. That is what the new Product Liability Act (ProdHaftG) says.

The act was promulgated in the Federal Law Gazette on 27 October. It applies from 9 December 2026, the day the deadline for transposing the EU Product Liability Directive 2024/2853 ends. The Bundestag had approved it on 8 October, and according to MTR Legal, the Bundesrat did not call the mediation committee. The new law covers products placed on the market or put into service from 9 December. For older products, under § 23 the 1989 act remains decisive.

Software is a product, even when it arrives as an update

Under § 2, software and digital manufacturing files now count as products as well. In its recitals, the directive expressly names firmware, operating systems, applications and AI systems, whether they run on the device or come from the cloud. Free and open-source software that arises outside a commercial activity is excluded. Digital services without which a product function does not work count as a component; according to the explanatory memorandum, for example, the temperature control of a connected refrigeration unit.

What is new is the point in time that matters. If the manufacturer keeps control after placing the product on the market, § 8 looks at the moment the product leaves that control. The manufacturer already has control if it can provide updates itself or through third parties. If updates required for safety are missing, § 9 prevents it from arguing that the defect arose only later. Safety-relevant cybersecurity requirements also factor into the assessment under § 7.

According to recital 51, the directive contains no obligation to supply updates. In practice, though, a de facto duty of care for ongoing maintenance arises, writes the law firm Heuking. For operators, this has a flip side. An injured party who negligently fails to install updates that were provided must accept this as contributory fault under recital 55.

Maintenance does not make you a manufacturer, but a substantial modification does

For service providers, § 5 is the key provision. Anyone who substantially modifies a product without the manufacturer's consent and then makes it available or puts it into service is the manufacturer of the modified product. What counts as substantial is determined first by product safety law. For machinery, from 20 January 2027 that is the Machinery Regulation, which also covers digital modifications if they create a new hazard or increase a risk. If there is no such yardstick, a modification is substantial if it changes the performance, purpose or type of the product in a way the manufacturer's risk assessment did not foresee, and as a result a different, new or higher hazard arises.

Repair and maintenance do not trigger this liability as long as they do not change anything substantially. This is stated in the explanatory memorandum to the government bill, not in the act itself. The Bundesrat wanted to write into the law that businesses that install, maintain or repair on commission do not become manufacturers by that alone. The skilled trades had also called for clarification, reports the Deutsches Handwerksblatt. The federal government declined because it already follows from the wording of the provision.

In practice, two details matter. If the modification is made with the manufacturer's consent, the manufacturer remains liable for defects arising later, according to the explanatory memorandum. And the modifier is not liable for defects in parts that its modification does not affect (§ 9(4)). The act leaves open who counts as the manufacturer in a commissioned modification: the contractor who performs the work or the operator who puts the equipment back into service afterward. Article 18 of the Machinery Regulation looks to whoever carries out the modification.

For businesses, it is mainly about injured people

Under § 1, compensation covers death and injury to body and health, including medically recognized psychological harm. It also covers damage to property, except the defective product itself and property used exclusively for professional purposes. Property in mixed use is therefore covered; the old act still required mainly private use. For data it is the reverse. Only data not used professionally is compensated, and even partial professional use rules out compensation, according to recital 22 of the directive.

For a business, this means: if a defective purchased controller damages your own equipment, the Product Liability Act helps neither with the machine nor with lost production data. Contract and tort law remain for that, which § 21 leaves untouched. Every person who is harmed is covered, however, whether employee, patient or passenger, and also, for example, a tenant's car damaged in a fire in the underground garage. The €500 deductible and the €85 million cap from the old act are dropped. According to its response, the federal government considers this of little consequence because courts mostly rule under the tort-based producer liability of the German Civil Code (BGB), to which these limits never applied.

In court, maintenance and update records can be demanded

Plaintiffs get two new tools. Under § 19, the court can order the defendant to disclose relevant evidence if the plaintiff has made a plausible claim. The Committee on Legal Affairs extended this to third parties and names market surveillance authorities as an example (recommended resolution). By its wording, service providers and operators with maintenance reports and update histories can also be affected. They may refuse only with a right to refuse to give evidence, for example for their own trade secrets.

Presumptions in § 20 come on top. If the defendant does not disclose ordered evidence, the defect is presumed. The same applies to violations of mandatory safety requirements that are meant to protect against exactly this risk, and to an obvious malfunction during normal use. If proof is excessively difficult because of technical complexity, probability is enough. According to the response, no new documentation duties arise; only what already exists is disclosed. But only those who have records can clear themselves.

Claims become time-barred three years after the injured party knows, or should know, the defect, the damage and the liable party. They expire at the latest ten years after placing on the market or putting into service, and after 25 years for health damage with a long latency period. After a substantial modification, the ten-year period starts anew (§§ 16 and 17). Heuking advises extending retention periods considerably.

What operators and service providers should settle before the next modification

• Before every retrofit and major software update, record whether the change is substantial, by which yardstick, and who assessed it.
• Where possible, obtain the manufacturer's consent to the change in writing. Then the manufacturer remains liable for defects that arise later.
• Specify in the order who acts as manufacturer in a substantial modification and who indemnifies whom internally. Toward injured parties, liability cannot be excluded under § 18.
• Keep an update history: what the manufacturer provided, when it was installed and why an update was deferred.
• Keep maintenance, inspection and update records for at least ten years from commissioning or the last substantial modification, and check liability insurance for modifications that carry manufacturer risk.

Much will only be clarified in court, above all from what point a software update substantially modifies a system. It is also unclear whether a legacy system that is substantially modified after 9 December falls under the new law. § 23 does not regulate this expressly, but the explanatory memorandum treats a substantially modified product as a new one. Anyone who replaces a controller next year should therefore document as if the new law already applied.