Software product liability from December 2026

The Austrian Product Liability Act (Produkthaftungsgesetz, PHG) recognises only movable tangible things as products (§ 4 PHG). Anyone developing software has so far not been strictly liable for it unless it forms part of a tangible thing. Directive (EU) 2024/2853 changes that: it replaces Directive 85/374/EEC, on which the PHG is based, and applies to products placed on the market or put into service after 9 December 2026 (Art 2 Abs 1). Older products remain subject to the existing law (Art 21).

Software is a product

In future, software expressly counts as a product (Art 4 Nr 1) – whether it is stored on a device, downloaded or provided as a cloud service; AI systems are covered as well. Pure information such as media files or bare source code is not covered. Digital services without which a product cannot perform one of its functions count as a component of that product (Art 4 Nr 3 and 4). Free and open-source software developed or supplied outside the course of a commercial activity is exempt (Art 2 Abs 2). Anyone who builds it into their own product is liable for it as for any other component (Art 8 Abs 1).

Defects, updates and cybersecurity

A product is defective if it does not provide the safety a person is entitled to expect or that is required by law (Art 7 Abs 1). Factors to be considered include the product's ability to continue learning after being placed on the market, its foreseeable interaction with other products and safety-relevant cybersecurity requirements (Art 7 Abs 2 lit c, d and f). The fact that a better product or an update is released later does not by itself make the older one defective (Art 7 Abs 3).

The key innovation is the manufacturer's control (Art 4 Nr 5): anyone who can supply software updates or upgrades, or have them supplied by a third party, retains control over the product even after the sale. The defence that the defect did not yet exist when the product was placed on the market does remain (Art 11 Abs 1 lit c). But it does not apply where the defect is due to software including updates, to a related service, to a substantial modification or to the absence of updates necessary to maintain safety, and this is within the manufacturer's control (Art 11 Abs 2).

Who is liable

The manufacturer of the product and the manufacturer of a defective component are liable, jointly and severally (Art 8 Abs 1, Art 12 Abs 1). Anyone who presents a product under their own name or trade mark also counts as the manufacturer (Art 4 Nr 10). If the manufacturer is established outside the Union, the importer and the authorised representative are liable, failing them the fulfilment service provider (Art 8 Abs 1 lit c). Anyone who substantially modifies a product outside the manufacturer's control and then makes it available is treated as its manufacturer (Art 8 Abs 2). Distributors and online platforms are liable if they fail to identify an economic operator in the Union to the injured person within one month (Art 8 Abs 3 and 4).

What changes for injured persons

Compensation is available for death and personal injury including medically recognised damage to psychological health, damage to privately used property and, newly, the destruction or corruption of privately used data (Art 6 Abs 1). Only natural persons are entitled to claim (Art 5); property used for professional purposes remains excluded as before. The 500 euro deductible for property damage (§ 2 PHG) no longer has any basis in the directive. Liability towards the injured person can be limited neither by contract nor by caps (Art 15).

Procedurally, things become harder for manufacturers. Anyone who makes a claim plausible can require the defendant to disclose relevant evidence; trade secrets must be protected in the process (Art 9). Defectiveness is presumed if the defendant fails to disclose, if the product does not meet mandatory safety requirements or if it has obviously malfunctioned during ordinary use (Art 10 Abs 2); where proof is excessively difficult, the likelihood of a defect suffices (Art 10 Abs 4). All presumptions are rebuttable (Art 10 Abs 5). The limitation period is three years from knowledge of the damage, the defect and the liable party (Art 16). The claim is extinguished ten years after the product was placed on the market, or after 25 years where personal injury becomes apparent only later (Art 17); a substantial modification restarts the period.

Status of implementation in Austria

The directive must be implemented by 9 December 2026 (Art 22). As of October 2026, no Austrian draft amending the PHG had been submitted to Parliament or put out for consultation. A directive does not create obligations between private parties; until it is implemented, the PHG continues to govern. Once the deadline has passed, the courts must interpret national law in conformity with the directive as far as its wording allows – how far that goes with § 4 PHG is an open question. Statutory warranty (Gewährleistung, as distinct from a guarantee) and contractual damages under the ABGB remain available alongside (Art 2 Abs 4 lit b). The requirements of the Cyber Resilience Act (Regulation (EU) 2024/2847) for products with digital elements are a separate set of obligations; they do, however, become the yardstick for whether a product is defective.

What to do now

• Clarify your role: manufacturer, component manufacturer, own brand, importer, authorised representative, fulfilment service provider or substantial modification – each role has its own liability consequences.
• Define update and support commitments: anyone who can supply updates retains control and liability. The period for security-relevant updates belongs in the product description and the contract; the end of control must be documented.
• Review contracts with suppliers and customers: recourse, duties to cooperate and to inform. A waiver of recourse against small software suppliers is permitted (Art 12 Abs 2), but should be a deliberate decision.
• Build up documentation and evidence: risk assessment, development and test records, update history. What cannot be disclosed leads to a presumption of defectiveness; trade secrets must be marked as such.
• Check insurance: whether product liability cover extends to software, data damage and cyber incidents.

This information is general in nature and does not replace advice on an individual case.