Germany's new Product Liability Act makes software a product – and logs your defence

What has changed

Germany has promulgated a new Product Liability Act that brings the EU's Directive (EU) 2024/2853 into national law ^[1]. The main shift is that standalone software, including AI systems, is now explicitly a product, meaning it carries strict liability. That covers personal injury, damage to property not used exclusively for professional purposes, and destruction or corruption of data not used exclusively for professional purposes.

The law also gives courts the power to order defendants to hand over relevant evidence, and under certain conditions introduces burden-of-proof relief for claimants, meaning the defendant must prove the product wasn't defective or that the defect didn't cause the damage. The act applies to products placed on the market after 9 December 2026.

Why software as a product matters

For years, software lived in a grey area. A toaster that catches fire is a product, but what about an app that makes a wrong decision? The new law settles that. If software is sold or supplied and it causes harm, the maker is liable under strict liability rules, just as if they'd sold a faulty chair.

Think of it like a receipt at a shop. When you buy something physical, the receipt proves what you bought and when. Software doesn't come with a receipt that shows which version was running on the day something went wrong. That's the gap.

The point of the law is to adapt product liability to how technology actually works now. AI systems, operating systems and control software can all cause harm. The new rules mean they're treated as products, and the same liability principles apply.

Evidence and the burden of proof

The law introduces two new levers for claimants. First, courts can order the defendant to hand over relevant evidence ^[1]. That's not an automatic right to rummage through a company's systems, but when a judge considers it proportionate, the defendant must produce the documents, logs or records that show what happened.

Second, in certain cases the burden of proof shifts. If a claimant shows the product was defective and harm occurred, the defendant must prove the product wasn't defective or that the defect didn't cause the harm. For organisations that build or supply software, that means having a record of what the software did becomes a practical necessity, not just good housekeeping.

What this means for you

If you build, sell or supply software that reaches the German market after 9 December 2026, here are the questions to ask now:

• Which versions of your software are in use, and can you show which version ran on a given device or system on a specific day?
• What logs does your software keep, and could you hand them over if a court asked for them?
• If a claimant says your software caused harm, what records do you have to show what the software actually did at that time?
• Does the team that handles incidents and disputes know what evidence exists and where it lives?

The law doesn't say how you keep those records, only that you may need them. Version control was built for developers, not for courts. Logs are written for troubleshooting, not for evidence. The gap is that both can be edited by the people who keep them, and in a dispute that makes them easier to challenge.

How a digital witness fits

Here, the thing to seal is each release and each event that matters for liability: the build fingerprint, release notes, test results and deployment records for software versions, and the log entries that show what the software did and when.

Sealing takes a fingerprint of the record, not the record itself, so the data never leaves your systems. The fingerprint goes to WitniumChain, which returns a witness ID. To check, you or anyone you share the record with calculates the fingerprint again. If it matches, the record is unchanged. Change one character and it won't match.

You seal at two moments: when a version is released, and when an event is logged. A release seal shows which version existed at that time. A log seal shows that the log entry hasn't been edited since it was written, even by someone with administrator access.

What it shows is that the record existed at that time and hasn't changed. What it doesn't show is that the version was free of defects, or that the decision the software made was correct. A witness doesn't make you compliant, and it doesn't settle liability. It gives you a record you can show that nobody, including you, could have quietly rewritten afterwards.

How it would work

1. Your build pipeline seals each release: the fingerprint of the build, the version number and the deployment event.
2. Your software seals log entries as they are written, or in batches every few minutes, through the REST API, the SDK or the MCP server.
3. When a question comes up, you share the record and the witness ID. Anyone can check that the fingerprint matches.

The content stays with you. The first 2,000 witnesses a month are free. Full documentation is at witniumchain.com/docs.

What to watch

The Swedish government has proposed a new Product Liability Act with the same core rules, and it's expected to enter into force on 9 December 2026 ^[2]. Other EU member states are transposing the directive on similar timelines. The date to watch is 9 December 2026: products placed on the market after that date fall under the new rules.

For organisations that build software, the practical timeline is shorter. If you're releasing a new version in late 2026, decide now how you'll show which version ran where and when, and what it logged. Courts move slowly, but disputes start the day something goes wrong.

Sources

1. New Product Liability Act promulgated – stricter product liability, FN Legal, 2026, https://fn.legal/en/new-product-liability-act-promulgated-stricter-product-liability/
2. En ny produktansvarslag (lagrådsremiss), Regeringen, August 2026, https://www.regeringen.se/rattsliga-dokument/lagradsremiss/2026/08/en-ny-produktansvarslag/
3. Directive (EU) 2024/2853 of the European Parliament and of the Council on liability for defective products, EUR-Lex, 2024, https://eur-lex.europa.eu/eli/dir/2024/2853/oj