Sweden's new Product Liability Act drops the 3,500 kr deductible

What changes on 1 January 2027

Sweden's new Product Liability Act, which implements EU Directive 2024/2853, comes into force on 1 January 2027 ^[1]. The government's draft bill, published in August 2026, proposes three changes that matter for anyone who builds, sells or insures products.

First, the 3,500 kr deductible for property damage disappears. Under the old act, victims couldn't claim damages for property damage below that threshold. Now they can ^[1].

Second, stand-alone software becomes a product. That includes AI systems. Liability is strict for death and personal injury, damage to property not used exclusively for professional purposes, and destruction or corruption of data not used for professional purposes ^[1]. A glitch that wipes a customer's holiday photos can now count.

Third, courts gain the power to order defendants to disclose relevant evidence, and the burden of proof is eased in certain circumstances ^[1]. If a claimant shows that a defect probably caused the damage but can't prove it because the information sits with the defendant, the court can assume the defect caused it unless the defendant proves otherwise.

Think of it like this: if your coffee machine catches fire and the fire investigator says the heating element probably failed but can't prove it without the manufacturer's design files, the court can now order the manufacturer to hand them over, and if they don't, the court can assume the element was defective.

What counts as a product

The directive makes stand-alone software a product, and the Swedish bill follows it ^[1]. That covers software you download, stream or run in the cloud, as long as it reaches the market after 9 December 2026.

AI systems are explicitly included. A recommendation engine, a diagnostic aid, a pricing algorithm and a fraud detection model all count, whether they run on a server, in an app or embedded in hardware.

The liability is strict. The victim doesn't have to show that anyone was careless, only that the product was defective, that they suffered damage and that the defect caused it ^[1].

What damage is covered

The act covers three kinds of damage: death and personal injury, damage to property not used exclusively for professional purposes, and destruction or corruption of data not used for professional purposes ^[1].

That last one is new. Say a photo editing app corrupts a user's entire photo library. If the photos were personal, the user can claim. If they were part of a commercial studio's archive, they can't.

The line between private and professional use can be blurry. A laptop used for both work emails and family photos sits somewhere in the middle, and the courts will probably have to clarify where the line falls.

The evidence rules

Two evidence rules make it easier for victims to bring claims.

First, courts can order defendants to disclose relevant evidence, under conditions that protect trade secrets and confidential information ^[1]. That matters when the victim can show a defect probably exists but can't prove it without access to internal records.

Second, the burden of proof shifts in some situations. If a victim shows that a defect probably caused the damage, but can't prove the causal link because the necessary information is in the defendant's control, and the defendant either refuses to hand it over or the court decides it would be disproportionate to require it, the court can presume the defect caused the damage unless the defendant proves otherwise ^[1].

That presumption is a significant change. It means that refusing to cooperate with evidence requests, or simply being unable to produce the right records, can tip the scales.

What this means for you

If you build or sell software that reaches the market after 9 December 2026, ask yourself three questions.

First, could you show which version of your software was running on a given day? Version control is built for development, not for evidence, and git logs are kept by people who could rewrite them.

Second, do you have records of decisions the software made, changes it applied, or data it processed? If a customer claims your software corrupted their files, what would you show a court?

Third, are those records in a form that holds up when questioned? Access logs, deployment records and decision logs matter more when a court can order you to hand them over, and when refusing to do so can count against you.

Insurers will probably start asking similar questions. A product liability policy is easier to underwrite when the insured can show what their software did and when.

Sealing software versions and events

This is where a digital witness fits. The thing to seal is each software release and each deployment: the build fingerprint, the release notes, the test results and the timestamp. You seal the fingerprint, not the code, so the code itself never leaves your systems.

Say a robot mower injures someone in July 2027 and the question six months later is which software version it was running. If you sealed each release and each deployment as it happened, you can show the court a record that hasn't changed since the day it was made, checked against a public chain that you don't control. The court can verify it, the insurer can verify it, and the claimant's solicitor can verify it.

Sealing happens through the REST API, the SDK or the MCP server. You integrate it into your build pipeline, and each release gets a witness ID. To check later, anyone you share the record with calculates the fingerprint again and compares it with the sealed one. A match means nothing has changed. A mismatch means something has.

A digital witness doesn't show that the version was free of defects, and it doesn't make you compliant with anything. What it does is give you a checkable record of which version existed when, unchanged, kept by you and verified by a system that takes no sides. That's WitniumChain. The content stays with you, the fingerprint goes on the chain, and the first 2,000 witnesses a month are free. Read the docs.

How it would work

1. At each release, seal the build fingerprint, release notes and test results.
2. At each deployment, seal the event: device or instance reference, version deployed and timestamp.
3. When the record is questioned, share it and let the other side check the fingerprint.

What to watch

The act applies to products placed on the market after 9 December 2026 ^[1]. If you have a release scheduled for early 2027, the clock is already running.

The EU's Cyber Resilience Act, which sets security requirements for products with digital elements, is expected to start applying in late 2027. Together, the two acts will shape what records you need to keep and for how long.

Sweden's bill is a draft. The final text may differ, but the core rules come from the EU directive and are unlikely to change in substance.