EU puts software under strict liability from December; Gurley wants US to follow
What's the deal? From 9 December 2026, the European Union's new Product Liability Directive treats software, software as a service, and AI systems as products — making their makers strictly liable for defects. Claimants no longer need to prove fault, only that a product was defective, that they suffered damage, and that the defect caused it.
Why now? Directive (EU) 2024/2853 replaces the bloc's 1985 rules, which were drafted before modern software existed. Member states must implement it into national law by 9 December 2026, and it applies only to products placed on the market after that date — not retroactively.
What changes in practice? The directive treats software as a product however it is supplied, including cloud services, and treats AI system providers as manufacturers. It makes cybersecurity a factor in assessing defects, removes the previous €500 property-damage threshold, and lets courts order defendants to disclose evidence. A hacker exploiting a vulnerability does not reduce a manufacturer's liability.
Who is affected? Any business placing software, SaaS, AI systems, or connected products on the EU market after the deadline — including UK and Swiss firms selling to EU customers. Bare source code, e-books, and noncommercial free and open-source software are excluded, though a manufacturer integrating open-source code into a commercial product may still be liable.
What about the US? Investor Bill Gurley has called for the US to adopt a similar regime, citing a recent software-caused flight stoppage and hacks at AI labs. There is no comparable broad US rule; a 2025 Senate AI-liability bill remains at committee stage, so Gurley's call is advocacy rather than imminent legislation.
What's next? The UK is moving in the same direction but more slowly. On 8 October 2026, the Law Commission opened a consultation proposing that software and AI be brought under the UK's strict product liability regime; it closes on 14 January 2027, with a final report expected in late 2027 before the government decides whether to legislate.
The signal: The transatlantic debate is shifting from whether software makers bear the cost of software-caused harm to how much. The EU is setting the terms, and the pressure to follow — in the UK and, if Gurley has his way, the US — is building.
Read more: legal500.com
Image credit: Generated with Gemini
