Product liability readiness for European healthtech
The updated EU Product Liability Directive explicitly treats software - including SaaS applications and AI systems - as products. It applies to products placed on the market or put into service after 9 December 2026. Asteron helps European healthtech companies identify where product defects could cause harm, clarify responsibility across software, components and related services, and preserve the lifecycle evidence needed to explain product decisions, updates and post-market actions.
- Software, AI and device exposure mapped
- Defect and harm scenarios assessed
- Releases, updates and components traceable
- Product evidence and disclosure readiness strengthened
What is the updated Product Liability Directive?
Directive (EU) 2024/2853 establishes no-fault liability for damage caused by defective products. An injured person does not need to prove negligence, but must generally establish the product defect, damage and causal relationship, subject to the Directive’s evidence and presumption rules.
The updated regime reflects software, connected products, AI, security updates, digital services and complex supply chains. Software can qualify as a product whether installed locally, accessed through a network, supplied through cloud technology or offered through a SaaS model.
The Directive does not decide whether a product may enter the market. It governs civil liability after a defective product causes qualifying damage. MDR, IVDR, the AI Act, CRA and other product rules continue to apply separately.
When do the new rules apply?
Companies selling across the Netherlands, Germany and other European markets should maintain one reliable evidence baseline while monitoring each country’s implementing law and procedural rules.
- By 9 December 2026
National transposition
EU Member States must transpose Directive (EU) 2024/2853 into national law.
- After 9 December 2026
Updated rules apply
The updated regime applies to products placed on the market or put into service after this date.
- Earlier products
Previous regime continues
Products placed on the market before the cut-off generally remain subject to the previous product-liability rules.
- Ongoing
Updates and modifications
Software updates, upgrades and substantial modifications can affect responsibility when they remain under the manufacturer’s control.
What counts as a product?
Free distribution does not necessarily mean non-commercial supply. Payment, commercial integration and the use of personal data beyond limited security, compatibility or interoperability purposes can affect the analysis.
When is a product defective?
A product is defective when it does not provide the safety that a person is entitled to expect or that is required under applicable law. The assessment considers the complete product, expected safety, applicable requirements and the circumstances of the damage.
Product and user context
- - Product presentation, instructions and warnings
- - Intended purpose
- - Reasonably foreseeable use and misuse
- - Needs of the users for whom the product is intended
- - Effects of other products expected to be used with it
- - Safety expectations at the time it entered the market
Lifecycle and regulatory context
- - Product-safety and cybersecurity requirements
- - Ability to learn or acquire new features
- - Updates, upgrades and manufacturer-controlled changes
- - Recalls or other interventions by competent authorities
- - Whether a safer subsequent version alone proves anything - it does not
- - Evidence available about design, testing and post-market decisions
A bug, vulnerability or adverse outcome is not automatically proof that a product was defective. The Directive requires a full, contextual assessment rather than a single-fault conclusion.
Who may be liable?
The commercial contract does not determine every statutory liability question. Product branding, actual control over design or updates, operator location and supply-chain structure must also be considered.
What damage can the Directive cover?
The updated regime includes:
- - Death or personal injury, including medically recognised psychological harm
- - Damage to or destruction of property other than the defective product itself, subject to the Directive’s conditions
- - Destruction or corruption of data not used exclusively for professional purposes
Pure commercial loss, contractual disputes, privacy violations and regulatory penalties may fall under other legal regimes rather than this Directive.
For healthtech products, the same event can trigger several separate processes: patient-safety assessment, MDR or IVDR vigilance, cybersecurity reporting, GDPR breach analysis, customer notification and a product-liability claim.
Why product evidence matters more
National courts can order disclosure of relevant evidence when a claimant presents a sufficiently plausible case. Confidential information and trade secrets should receive proportionate protection, but they do not remove the need to preserve intelligible evidence.
The Directive also permits presumptions concerning defectiveness or causation in defined circumstances, including:
- - Failure to disclose ordered evidence
- - Non-compliance with mandatory product-safety requirements
- - Obvious malfunction during reasonably foreseeable use
- - Excessive technical or scientific complexity that makes proof unusually difficult
The claimant still starts with defect, damage and causation, while courts can apply the Directive’s specific disclosure and presumption mechanisms. The burden of proof does not transfer automatically in every case.
Product decisions
- - Intended purpose and user groups
- - Product and system architecture
- - Known limitations and warnings
- - Risk acceptability decisions
- - Verification and validation results
- - Clinical, analytical or performance evidence where relevant
- - Security and privacy design decisions
Lifecycle operation
- - Version and release history
- - Update and upgrade decisions
- - Component and supplier traceability
- - Vulnerability and incident records
- - Complaints and adverse-event assessment
- - Corrective actions and effectiveness checks
- - Post-market monitoring and support decisions
- - Customer communications and end-of-life notices
Documentation should show what the company knew, when it knew it, what decision was made and whether the response was reasonable. A large policy library without product-level traceability does not provide this evidence.
Priority healthtech exposure areas
Clinical and user harm
Define how software output, downtime, incorrect data, delayed alerts or foreseeable misuse could affect patients, clinicians and other users. Trace each pathway back to a specific product decision, control or communication that would be examined if damage occurred.
Software and AI change
Control releases, model updates, training-data changes, configuration changes and new functionality that may alter product behaviour or safety. Maintain records that show what changed, why it changed, how it was validated and how customers were informed.
Cybersecurity
Connect vulnerability handling, security updates, access control, resilience and incident response to product risk. Cybersecurity failures can contribute to a finding that expected product safety was not provided, particularly where mandatory security requirements apply.
Components and related services
Maintain traceability over libraries, cloud services, integrations, devices, data sources and outsourced development that can influence product operation. A defect introduced through a component or related service can still create manufacturer exposure for the final product.
Relationship to other frameworks
Compliance with a standard or CE-marking requirement can provide valuable evidence, but it does not create automatic immunity from a product-liability claim.
How Asteron delivers the project
Product and operator scope
Identify products, software, components, related services, legal entities and markets.
Defect and harm scenarios
Map how product behaviour, updates, misuse, downtime or security failures could cause qualifying damage.
Evidence baseline
Review current design, risk, testing, release, supplier and post-market records.
Lifecycle controls
Strengthen change, update, component, complaint, incident and corrective-action workflows.
Disclosure readiness
Define evidence ownership, retention, accessibility and legal-escalation procedures.
Remediation roadmap
Prioritise remaining actions and integrate them into the relevant management and product systems.
Deliverables
Exposure and responsibility
- - Product and legal-entity scope
- - Manufacturer, component and related-service map
- - Market and implementation overview
- - Defect and harm scenario model
- - Responsibility and escalation matrix
- - Prioritised liability-readiness roadmap
Evidence and lifecycle readiness
- - Product-evidence inventory
- - Release and update traceability model
- - Component and supplier evidence requirements
- - Complaint and incident workflow
- - Corrective-action and post-market alignment
- - Evidence-retention and disclosure-readiness process
- - Management, legal and insurer briefing pack
Product Liability readiness pricing
Reuse established governance, risk, supplier, incident and evidence processes and extend them to product-liability readiness.
Build the readiness baseline without relying on an existing Asteron-managed compliance system.
The starting price covers one legal entity, one defined product or closely related product family and one principal EU market. Multiple products, complex AI systems, medical-device portfolios or multi-country legal analysis require a scoped proposal.
Prices exclude VAT where applicable.
There is no Product Liability certification, independent audit or official approval. Asteron strengthens operational readiness and evidence but cannot guarantee the outcome of a claim, court proceeding or national legal interpretation.
What remains separate
- - Formal legal opinions
- - Interpretation of national civil procedure
- - Litigation, claim defence or settlement
- - Negotiation with claimants or insurers
- - Product-liability insurance
- - Technical remediation and software development
- - Clinical, analytical or performance studies
- - Penetration testing
- - MDR, IVDR, CRA or AI Act conformity assessment
- - Notified-body or external legal fees
- - Work for additional products or legal entities
Responsibilities
Asteron
- - Map products, operators and evidence responsibilities
- - Identify operational readiness gaps
- - Strengthen lifecycle and evidence controls
- - Connect relevant compliance frameworks
- - Prepare a prioritised implementation roadmap
Your organisation
- - Confirm products, markets and commercial relationships
- - Approve product risks and safety decisions
- - Implement technical and product changes
- - Preserve accurate lifecycle evidence
- - Manage complaints, updates and post-market actions
- - Obtain qualified legal and insurance advice
- - Make decisions concerning claims and legal disclosure
Frequently asked questions
Does the updated Directive apply to software?
Yes. Directive (EU) 2024/2853 explicitly treats software as a product, whether installed locally, delivered through a network or offered as a service. The regime covers commercial supply and does not depend on the delivery model. Free and open-source software developed outside a commercial activity is generally excluded.
Is SaaS treated as a product?
SaaS applications can qualify as products under the updated Directive regardless of the hosting or subscription model. What matters is that software is placed on the market or put into service commercially. A product-level analysis is required for each SaaS offering, component and related digital service.
Are AI systems included?
Yes. AI systems fall within the Directive, and their providers or developers may be treated as manufacturers of a software product. AI Act obligations apply separately for qualifying AI systems. The two regimes address different risks and do not replace each other.
Does the Directive apply to medical-device software?
Yes. Medical-device and IVD software remain in the scope of product-liability exposure alongside MDR or IVDR duties. CE marking and conformity assessment provide valuable evidence but do not remove civil liability if a defective product causes qualifying damage.
When do the new rules begin to apply?
Member States must transpose the Directive by 9 December 2026. The updated regime applies to products placed on the market or put into service after that date. Earlier products generally remain subject to the previous regime.
What happens to products placed on the market before December 2026?
Products already on the market before the cut-off generally remain governed by the earlier product-liability rules. Substantial modifications, upgrades or continued manufacturer control over updates can still affect responsibility. Companies should map when each product or version entered the market.
Does CE marking prevent a product-liability claim?
No. CE marking, notified-body certificates and conformity with harmonised standards can support the defence, but they do not create automatic immunity from a product-liability claim. The Directive governs civil liability, which sits alongside market-access requirements.
Is ISO 14971 sufficient for liability readiness?
ISO 14971 provides structured medical-device risk management and is a strong foundation. It does not, on its own, cover economic-operator responsibility mapping, disclosure readiness, software update traceability across products or evidence-retention duties specific to product-liability exposure.
Can a cybersecurity vulnerability make a product defective?
A vulnerability alone is not automatic proof of a defect. However, cybersecurity failures, missing security updates or non-compliance with applicable security requirements can contribute to a finding that the product did not provide the safety a person was entitled to expect.
What evidence may need to be disclosed?
National courts can order disclosure of relevant evidence when a claimant presents a sufficiently plausible case. This typically includes design, risk, testing, release, complaint and post-market records. Confidential information and trade secrets receive proportionate protection but must remain intelligible and available.
Who is liable when several companies develop the product?
Responsibility depends on economic-operator roles: manufacturer of the final product, software developer, component manufacturer, importer, authorised representative, distributor and providers of related services. Commercial contracts do not determine every statutory question; product branding, control over design and updates and supply-chain structure also matter.
How are software updates and upgrades treated?
Updates, upgrades and substantial modifications supplied under the manufacturer’s control can affect liability, including for products originally placed on the market before the cut-off. Traceable release records, decision logs and customer communications are essential.
How long can product-liability exposure continue?
The Directive sets specific limitation and long-stop periods after the product was placed on the market or put into service, with extended periods for latent personal injury. Companies should preserve evidence for the full period during which claims can realistically arise, not only for a typical retention cycle.
Is there a Product Liability certificate?
No. There is no Product Liability certification, independent audit or official approval. Asteron strengthens operational readiness and evidence but cannot guarantee the outcome of a claim, court proceeding or national legal interpretation.
How much does readiness cost?
Readiness starts from EUR 6,900 when reusing an existing Asteron Compliance Core and from EUR 9,900 as a first Asteron engagement. The starting price covers one legal entity, one defined product or closely related product family and one principal EU market. Multiple products, complex AI systems, medical-device portfolios or multi-country legal analysis require a scoped proposal. Prices exclude VAT where applicable.
Make product decisions defensible before the new rules apply
Clarify responsibility, strengthen lifecycle evidence and connect risk, updates, suppliers and post-market action before products enter the European market after December 2026.
Official references: Directive (EU) 2024/2853, EUR-Lex summary, European Commission - Liability for defective products.
Last reviewed: July 2026