How the UK Can Close the Product Safety Gap: Lessons from the EU

A lost bank card and a faulty robot

When you lose a bank card, the clock starts when you notice it's gone, not when it suits you to report it. The EU's new product liability rules work the same way for software: the deadline for evidence begins at the incident, and someone will ask questions later.

On 9 December 2026, software becomes a product in the EU. Standalone software, AI systems included, will fall under strict liability for death, personal injury, damage to property not used exclusively for professional purposes, and destruction or corruption of data not used for professional purposes. ^[1] The UK has not followed. Under the Consumer Protection Act 1987, software remains out of scope. ^[2]

The gap is widening. As AI systems make more decisions, disputes turn on a simple question: what did the software do, and which version was running?

What the EU directive changes

Directive (EU) 2024/2853 on liability for defective products, adopted in October 2024, updates the 1985 product liability regime. ^[1] It adds software to the definition of a product, whether sold separately or embedded in a physical item. AI systems are explicitly covered.

Liability is strict. If a product is defective and causes harm, the producer is liable without the claimant having to prove fault. The directive also makes it easier to get evidence. Under Article 8, courts can order a defendant to disclose relevant evidence, and under Article 9, the burden of proof shifts to the defendant when the claimant can show that the product was likely defective or that the defect likely caused the harm. ^[1]

For the UK, this matters because products often cross borders. A robot built in Britain, running British software and sold in Germany is covered by the directive once it reaches the German market. The question then is whether the British developer can show what the software did.

What this means for evidence

Say a lawnmower's navigation software fails and the machine drives into a pond, damaging a neighbour's fence and a parked car. The neighbour claims. The manufacturer says the software worked as designed, and suggests the customer modified it. The court asks: which version was installed, what did the logs show, and can you prove the logs haven't been edited?

That is the evidence question. It comes months or years after the event, and by then the device may be gone, the logs overwritten and the installation record a spreadsheet someone with administrator rights could have changed last week.

Article 8 allows courts to order disclosure of evidence that is relevant and proportionate, and that the claimant could not reasonably obtain otherwise. ^[1] If the defendant has no credible record, or the record it offers looks easy to alter, the court may assume the evidence would not have helped it.

The UK's position

In January 2025, the UK government launched a consultation on reforming product liability law. ^[2] It asked whether software should be brought within the scope of strict liability, and whether the rules on evidence and the burden of proof should be updated along EU lines.

The consultation closed in April 2025, and the government has not yet published its response. Until it does, the Consumer Protection Act 1987 applies unchanged, and software remains outside it. That puts UK developers in an odd position: their products may be subject to strict liability in the EU but not at home, and the evidential tools the directive offers claimants are not available in UK courts.

Where a digital witness fits

This is where sealing each software release and deployment event makes the difference between a short conversation and a long one.

The thing to seal is each release: the build fingerprint, the release notes and the test results. When a version is deployed, seal the deployment event as well. Sealing takes a fingerprint of the record, not the record itself, so nothing sensitive leaves your systems. It is done through the REST API, the SDK or the MCP server that connects to <a href="/signup">WitniumChain</a>.

When someone questions which version ran on a given day, anyone you share the sealed record with can check that it is exactly what was recorded at the time, unchanged since. Courts, notified bodies, insurers and customers can all do the check themselves. See the <a href="/docs">documentation</a> for how.

What it shows is that a release and its deployment record existed at that time and have not been altered. What it doesn't show is that the version was free of defects, or that the deployment was done properly. It is not a substitute for testing, version control or backups. It is a receipt that holds up when someone asks whether you can prove what you say you deployed.

The first 2,000 witnesses a month are free.

How it would work

1. At each release, send a fingerprint of the build artefact, release notes and test summary to WitniumChain and get a witness ID back.
2. At deployment, seal the event: device serial number, version deployed and timestamp.
3. When questioned, share the record and the witness ID so anyone can check that nothing has changed.

What to watch

The UK government is expected to respond to its consultation on product liability reform later in 2025. If it follows the EU's lead, standalone software and AI will be brought within the strict liability regime, with updated rules on evidence and the burden of proof.

For now, the EU's deadline is firm: 9 December 2026. Member States must transpose the directive into national law by that date, and it will apply to products placed on the market from then on. ^[1]

What this means for you

If you develop or sell software, here are three questions to ask this week:

• Could you show which version of your software was running on a customer's device on a given day six months ago?
• If a court ordered you to hand over deployment logs, would those logs hold up to scrutiny, or could someone with the right access have quietly edited them?
• Do you know where your software is sold, and which liability regimes apply in those markets?

The EU has closed the gap. The UK may follow. Either way, the ability to prove what your software did, and when, is no longer optional.