UK Law Commission proposes bringing software and AI within product liability

The proposal in brief

On 8 October 2026, the Law Commission of England and Wales published a consultation paper proposing major reforms to product liability law.^[1] At the heart of the proposals is a change that would bring software and AI systems within the scope of strict liability as products, alongside physical goods.

Under the current Consumer Protection Act 1987, which implements an older EU directive, software is not clearly a product. The Law Commission proposes to change that. Under the reforms, a claimant injured by defective software would not have to prove that the developer was negligent. They would only have to show that the software was defective, that it caused harm and that the harm falls within scope.

The consultation also proposes new powers for courts to order defendants to hand over evidence, including source code, data sets and test results, where that evidence is relevant and the claimant cannot reasonably obtain it another way.^[2] That mirrors provisions in the EU's Product Liability Directive.

The consultation runs until 7 January 2027, and the Law Commission expects to publish final recommendations later in 2027.^[3]

What would count as a product

The proposals define software broadly. It would include applications, operating systems, firmware and AI models, whether sold separately or embedded in a device.^[4] A phone app, a chatbot, an autonomous vehicle's control system and a medical diagnosis tool would all be products.

The liability would be strict. That means the claimant does not have to prove fault, only that the software was defective when it left the developer's control, that it caused harm and that the harm is of a kind the law covers. The harm must be death, personal injury or damage to property intended for private use. Pure economic loss is not covered, and neither is damage to property used exclusively for business.^[5]

That mirrors the position in the EU under Directive (EU) 2024/2853, which applies to products placed on the market after 9 December 2026.^[6] In Sweden, a new Product Liability Act is proposed to enter into force on the same date.^[7]

Evidence and disclosure

One of the harder questions in software liability is evidence. The claimant may know what happened—a car crashed, a chatbot gave harmful advice—but not what the software did or why.

The Law Commission proposes that courts should be able to order a defendant to disclose relevant evidence, including technical documentation, source code, training data and test results, when the claimant has shown a reasonable case and cannot get the evidence elsewhere.^[2] The court would weigh the claimant's need against the burden on the defendant and the risk to trade secrets.

That puts the question of what you can show squarely on the table. If a court orders disclosure and you cannot produce a clear record of which version ran, what it did and when, the case becomes harder to defend.

Keeping a checkable version history

Here, the thing to seal is each release as it leaves your hands: the build fingerprint, the release notes and the test results. Sealing takes a fingerprint of those records, not the records themselves, so they never leave your systems. The fingerprint is sealed on a chain where any later change would show, even one made by the organisation itself. If a claim arises months or years later, anyone you share the records with can check that they are the ones created at release.

WitniumChain^[8] provides a REST API, an SDK and an MCP server to seal records as part of a build pipeline. The first 2,000 witnesses a month are free.

What the witness shows is that a release record existed at a given time and has not changed since. What it does not show is that the version was free of defects, or that it was the version actually deployed. Deployment is a separate event to seal.

How it would work

1. At each release, your build system sends a fingerprint of the release manifest—version number, build hash, release notes, test summary—to the API and gets a witness ID back.
2. The manifest stays in your repository; only the fingerprint is sealed.
3. When disclosure is ordered, you provide the manifest and the witness ID. Anyone can check that the fingerprint still matches, which proves the manifest has not changed since release.

Comparing the UK and EU approaches

The Law Commission's proposals are not identical to the EU directive, but the direction is the same. Both bring software into scope, both impose strict liability for certain kinds of harm and both give courts new powers to order disclosure of technical evidence.

One difference is timing. The EU directive applies from 9 December 2026 for new products.^[6] The UK proposals are still at consultation stage, so any reforms would come later. Another difference is detail: the EU directive sets out specific conditions for when a court may presume a defect or a causal link if the defendant does not hand over evidence.^[9] The Law Commission's proposals are less prescriptive, leaving more to judicial discretion.

What both share is the recognition that software is different from a physical product in one important respect: the evidence of what went wrong is usually in the hands of the defendant, and often only the defendant.

What this means for you

If you develop, supply or deploy software in the UK, here are three questions to ask now:

• Could you show which version of your software was running on a given date, and what it contained?
• If a court ordered you to hand over technical documentation for a release from two years ago, could you produce it in a form that is demonstrably unchanged?
• Who in your organisation would be responsible for responding to such an order, and do they know where the records are kept?

The answers matter whether or not the Law Commission's proposals are adopted. The EU directive already applies to software placed on the market after 9 December 2026, and anyone selling into the EU or supplying components to products sold there should assume that questions about version history, data sets and testing will be asked.

What to watch

The consultation closes on 7 January 2027.^[3] Responses will be published, and the Law Commission expects to issue final recommendations later in 2027. Whether and when those recommendations become law depends on the government and Parliament.

In the meantime, the EU's Product Liability Directive applies from 9 December 2026.^[6] In Sweden, the proposed Product Liability Act has the same date.^[7] Anyone developing or supplying software should read both.

For a view of how courts are already treating AI-related disputes, the British Columbia tribunal's decision in Moffatt v. Air Canada, where a chatbot's answer became the evidence and the airline had none of its own, is worth an hour.^[10]