The Netherlands will treat software as a product from December 2026

What changes on 9 December 2026

The Netherlands, like every EU member state, will transpose Directive (EU) 2024/2853 on liability for defective products into national law by 9 December 2026 ^[1]. The directive does one big thing: it treats freestanding software, AI systems included, as a product ^[2]. Before, Dutch product liability law mostly covered physical things. After 9 December, a piece of software counts the same way.

Think of it like a recall for a toaster. If the toaster catches fire, the maker is liable, and the buyer doesn't have to prove the maker was careless. The same logic now applies to software: if it causes harm covered by the rules, the maker is on the hook, and strict liability applies.

What strict liability means

Strict liability means the claimant doesn't have to show the maker was negligent ^[2]. They have to show three things: the product was defective, they suffered harm, and the defect caused the harm. The maker can still argue defences—say the defect wasn't there when the product left their hands, or that the state of scientific knowledge at the time couldn't have revealed it—but the burden starts on the claimant's side and gets lighter under the new rules.

The directive covers death and personal injury, damage to property not used exclusively for professional purposes, and destruction or corruption of data not used for professional purposes ^[2]. A crashed company server doesn't count. A wiped family laptop does.

Burden reversals and evidence orders

Two new rules tilt the balance. First, if proving causation is excessively difficult or costly—say because the software is too complex or the maker won't hand over the information—courts can presume causation if the claimant shows the product was defective and the defect could plausibly have caused the harm ^[2]. The maker can rebut the presumption, but the starting point has shifted.

Second, under certain conditions courts can order the defendant to hand over relevant evidence ^[2]. That means deployment logs, version histories and incident reports can end up on the table, whether the defendant wanted them there or not.

What this means for you

If you build, import or sell software that reaches the Dutch market after 9 December 2026, ask yourself:

• Which versions of your software are out there, and could you show which one ran on a given date?
• If a court ordered you to hand over deployment records, what would those records say, and who last touched them?
• Can you show that a log or a version manifest is the one created at the time, unchanged since?

The directive doesn't say you must keep these records in any particular way, but the evidential value of a record you could quietly edit is easy to challenge. Access controls and monitoring are the foundation. An independent fingerprint per record goes one step further, because a change shows up even when it's made by someone with the right access.

How a digital witness fits here

The thing to seal is each software release and each deployment event: the build fingerprint, release notes, test results and the deployment timestamp. Sealing takes a fingerprint of the record, not the record itself, so the version data never leaves your systems. If a claim comes two years later and a court wants to know which version ran, anyone you share the record with can check that it's the one created on the day WitniumChain was sealed, unchanged since.

What it doesn't do: it doesn't show that the version was free of defects, or that the software behaved correctly. It just shows which version existed when, in a way that holds up when questioned.

How it would work

1. Your CI/CD pipeline sends a fingerprint of each release (build hash, changelog, tests) to WitniumChain through the REST API, the SDK or the MCP server.
2. Each deployment event (which version, which device or instance, when) gets sealed as it happens.
3. When a court asks which version ran on a specific date, you share the sealed record and the verification link. Anyone can check the fingerprint matches.

The first 2,000 witnesses a month are free.

What to watch

The Dutch government published a draft bill in August 2026, proposing that the new Product Liability Act enter into force on 9 December 2026 ^[2]. That date applies across the EU. If you place software on the market after that, the new rules apply, whether your customer is in Amsterdam, Athens or anywhere else in the Union.

The directive also aligns with the AI Act: high-risk AI systems already have logging duties under Article 12, and the new liability rules mean those logs may one day decide who pays ^[4]. The two regimes pull in the same direction: keep records, protect them and be ready to show them.

If you export software, treat 9 December 2026 as the line. Anything released after that falls under the new regime. Anything released before doesn't, but good version control pays off either way.