Software becomes a product in 23 days. Can you show which version ran?

The shift

For decades, if your toaster caught fire you could sue the maker. If the software in your car braked for a shadow, the legal position was murkier. That changes on 9 December 2026.

From that day, software placed on the EU market counts as a product, with the same strict liability rules as the toaster ^[1]. AI systems are products too, named explicitly in the directive ^[2]. It covers death and personal injury, damage to property not used exclusively for professional purposes, and destruction or corruption of data not used for professional purposes ^[1]. That means a consumer's laptop or a sole trader's files are in, a company's server rack is out.

Think of it like this: a car recall works because manufacturers know which batch went where. With software, the equivalent question is which version was running on whose device, and when. If you can't answer that, the claimant's account is all the court has.

The evidence rules

The revised directive does something new: it gives claimants tools to get at the evidence.

Courts can order the defendant to hand over relevant evidence, even confidential material, under safeguards ^[1]. If the manufacturer fails to produce it, or if the claimant can't reasonably be expected to prove a defect because of the technical complexity, courts may presume the product was defective or that the defect caused the damage ^[1]. In plain terms: if you don't show your working, the judge can assume the worst.

The proposal also shifts some of the burden in cases where the defect manifests itself over time, which covers software that degrades, learns or gets updated ^[2]. That fits AI systems better than the old rules, which were written for things that break in a single event.

What this means for you

If you make, sell or deploy software or AI systems that reach the market after 9 December 2026, ask your team:

• Which version ran? Can you show which release was on a given device at a given time?
• What did it do? For systems that make decisions or generate outputs, do you have a record?
• When did you know? If a defect emerges, when did you become aware, and can you show it?
• What changed? If you pushed an update or a patch, can you prove what it contained and when it went out?

Version control answers the first question for your own systems. The second and third need logs. The fourth is tricky: showing that a release and its deployment record haven't been touched since the day in question.

How a witness fits here

The thing to seal is each release and each deployment.

At release, seal the build fingerprint, the release notes and the test results. At deployment, seal a record of which version went where and when. The release stays in your version control, the deployment log stays in your systems. Only the fingerprints go to WitniumChain.

Anyone you share the records with — a regulator, an insurer, a court — can check that they match the sealed fingerprints, so they know nothing has changed since the day you sealed them. It works even if the person checking doesn't trust you, because the seal is independent.

What it doesn't do: it doesn't show that the version was free of defects, or that your response to an incident was adequate. It shows that the record is what you say it was, at the time you say it was.

Say a connected home device injures someone in March 2027, and the case reaches court in 2028. The claimant's side argues the software was defective. You need to show which version was running in March, what it contained and that your records haven't been edited since. A digital witness gives you that.

How it would work

1. At each release, your build pipeline sends a fingerprint of the release package to WitniumChain and gets a witness ID back.
2. At deployment, the same happens: a fingerprint of the deployment record (device ID, version, timestamp) is sealed.
3. If the records are questioned, you or anyone you share them with calculates the fingerprints again and checks them against the sealed ones.

Get started with the REST API, the SDK or the MCP server. Your code, your logs and your releases stay on your systems. The first 2,000 witnesses a month are free. Read the docs at witniumchain.com/docs or get access now at witniumchain.com/signup.

What to watch

The directive is law, but member states have until 9 December 2026 to transpose it. In Sweden, the government's draft is already out ^[1]. The date to watch is the one in the directive: 9 December 2026. Anything placed on the market after that day is in.

For AI systems, this sits alongside the AI Act's logging requirements (Article 12) and the rules on keeping records of model versions and data sets (Articles 11 and 19) ^[3]. The Product Liability Directive is about who pays when something goes wrong. The AI Act is about preventing it. Both ask the same question at some point: can you show what your system did?