In brief
- The new EU directive on liability for defective products applies to products placed on the market after 9 December 2026. It replaces a 1985 text.
- Software becomes a product, and the destruction or corruption of personal data becomes compensable damage.
- When the manufacturer is established outside the Union, liability moves up to the importer, the authorised representative, then the fulfilment service provider. And if no operator established in the Union can be identified, a distributor who fails to name one within a month becomes liable, as do some marketplaces.
- A shop that puts its own brand on a product made by others is treated as its manufacturer.
- As of 13 October 2026, France has not yet amended its Civil Code; in May the government announced a dedicated text.
From 9 December 2026, an online seller can become liable for damage caused by a defective product it did not make. The new EU directive moves liability from the importer to the fulfilment service provider when the manufacturer is outside the Union, and down to the distributor that cannot name, within one month, a liable party established in the Union. It also classes software as a product.
How we checked On 13 October 2026 we read Directive (EU) 2024/2853 on EUR-Lex, the French Ministry of Justice’s answer of 12 May 2026 to written question No. 11448 in the National Assembly, and Article 1245-2 of the French Civil Code in its current version on Légifrance. The sources are listed at the end of the article.
What changes on 9 December 2026?
Directive 2024/2853 repeals and replaces the 1985 directive, which France transposed in Articles 1245 to 1245-17 of its Civil Code. It applies to products placed on the market or put into service after 9 December 2026, the date by which Member States must have transposed it. It is a maximum harmonisation directive: States can neither tighten nor relax the regime. What the directive says is therefore, in substance, what national laws will say.
The principle does not change: strict liability, without fault, for damage caused by a product that does not provide the safety a person is entitled to expect. What changes is what counts as a product, what counts as damage, and above all who has to pay.
Does software really become a product?
Yes. The directive defines a product as any movable, and specifies that the term includes electricity, digital manufacturing files, raw materials and software. It also covers “related services”, the digital services integrated into a product without which it could not perform its functions, such as the app that controls a connected device. Free and open-source software developed outside a commercial activity is excluded.
On the damage side, the list grows: death and personal injury, including medically recognised harm to psychological health, damage to property not used exclusively for professional purposes, and now the destruction or corruption of data not used for professional purposes. Purely economic losses and privacy infringements remain outside the regime.
Can an online seller be liable for a product it did not make?
This is the change that directly concerns shops. The directive sets out a chain of liable parties.
| Situation | Who is liable | What it means for a shop |
|---|---|---|
| Manufacturer established in the Union | The manufacturer | If your brand is on the product, that is you |
| Manufacturer established outside the Union | The importer, the manufacturer’s authorised representative and, failing both, the fulfilment service provider | If you import yourself, that is you; if your logistics provider is the only operator in the Union, that is them |
| No identifiable operator established in the Union | Each distributor that does not name a liable party, or its own supplier, within one month of the injured person’s request | You, if you cannot answer in time |
| Sale on a marketplace | The platform, on the same terms as a distributor, where the conditions of Article 6(3) of the Digital Services Act are met, that is, in essence, when it leads consumers to believe it supplies the product itself | Your platform will turn to you to find out who is liable |
Two rules complete this table. Anyone who puts their name or trademark on a product and presents themselves as its manufacturer is treated as such: that is the case of white labelling, very common in e-commerce. And anyone who substantially modifies a product outside the manufacturer’s control, then makes it available, also becomes a manufacturer.
What makes things easier for the injured person?
The directive eases the burden of proof. The claimant must still prove the defect, the damage and the causal link between them, but the defect is presumed in three cases: if the defendant fails to disclose evidence a court has ordered it to produce, if the product does not comply with mandatory safety requirements, or if the damage was caused by an obvious malfunction during normal use. The court may also presume the defect or the causal link where technical complexity makes proof excessively difficult.
The limitation period is three years from when the injured person becomes aware of the damage, the defect and the identity of the liable party. Liability ends ten years after the product was placed on the market, twenty-five years for personal injury with a slow onset. A substantial modification starts the period again.
Where does France stand?
As of 13 October 2026, Article 1245-2 of the French Civil Code, which defines a product, is in force in its 2016 wording. In its answer published on 12 May 2026, the Ministry of Justice said that transposition work had been under way since December 2024, that sector consultations were planned for the first quarter of 2026, and that a dedicated text was being considered. The timetable remains tight. But maximum harmonisation reduces the uncertainty: the content is set by the directive.
What should you do before 9 December?
- For each product, identify the liable party established in the Union: manufacturer, importer or authorised representative. Record their name and address in your supplier file. That is what will let you answer within the month.
- Find your white-label products: if your brand is on them, you are the manufacturer within the meaning of the directive.
- Review your suppliers outside the Union: with no importer or authorised representative in the Union, liability passes to your logistics provider, then to you.
- Review your contracts with suppliers and service providers: the directive prohibits limiting or excluding liability towards the injured person by contract, hence the value of setting out clearly between you who bears what.
- Ask your insurer about cover for your product liability from 9 December, software and data included.
- For connected products, document your updates: a substantial update makes you, or your supplier, liable for what is effectively a new product.
This work overlaps with what the General Product Safety Regulation already requires for online listings, which we cover in our article on product safety information in listings.
What this says about the bigger picture
Recent EU texts all follow the same logic: there must always be someone in the Union who answers for a product sold to a European consumer. Product safety, packaging, customs, liability: each time, the gap left by a distant manufacturer is filled by the importer, the authorised representative, the logistics provider, the platform and, last of all, the seller.
For a shop, the answer is the same everywhere: know, for each product, who answers for it in the Union, and be able to say so quickly. That catalogue and supplier work is what we do through our e-commerce and marketplaces expertise.
What this article is not Legal advice. The French transposing law had not been published as of 13 October 2026; it will largely reproduce the directive, which is a maximum harmonisation text. For your contracts and insurance, take advice.
Sources
All of these pages were opened on 13 October 2026.
- Directive (EU) 2024/2853 on liability for defective products, Articles 2, 4, 5, 6, 8, 10, 16, 17 and 22, EUR-Lex. View
- French National Assembly, written question No. 11448 by Sacha Houlié and answer from the Ministry of Justice published in the Official Journal of 12 May 2026 (in French). View
- French Civil Code, Article 1245-2, version in force, Légifrance (in French). View
FAQ
What changes for defective product liability in 2026?
Directive (EU) 2024/2853 applies to products placed on the market after 9 December 2026. It includes software among products, adds the corruption of personal data and harm to psychological health to compensable damage, eases the burden of proof for the injured person and extends liability to the importer, the authorised representative, the fulfilment service provider, then the distributor and some platforms when no liable party can be identified in the Union.
Can an online seller be liable for a defective product it did not make?
Yes, in two cases. If it puts its brand on the product, it is treated as the manufacturer. And if no operator established in the Union, whether manufacturer, importer or authorised representative, can be identified, the distributor becomes liable if it does not name a liable party, or its own supplier, within one month of the injured person’s request.
Has France transposed the directive?
Not as of 13 October 2026: Article 1245-2 of the Civil Code is still in its 2016 wording. In May 2026 the Ministry of Justice said work was under way and that a dedicated text was being considered. As the directive is a maximum harmonisation text, French law will reproduce most of it.
Is software covered?
Yes. The directive expressly includes software among products, as well as digital services integrated into a product without which it could not perform its functions. Only free and open-source software developed outside a commercial activity is excluded.
Can Dotsland help?
Yes. We map with you, product by product, the liable party established in the Union, the white-label cases and the risky suppliers. Start with the list above, then get in touch.