Analysis ยท AI for Business
Your software vendors are about to answer for defects. What that changes for small businesses.
The EU has rewritten product liability for the digital age, and almost everything written about it speaks to the companies that make software. Most small businesses sit on the other side of the counter: they buy it. Here is what the new rules mean when the AI is inside the tools you already pay for, and what to ask your vendors before December 2026.
Key takeaways
- Directive (EU) 2024/2853 treats software as a product for strict liability purposes, including SaaS and AI systems, according to EUR-Lex.
- It entered into force on 8 December 2024; Member States must transpose it by 9 December 2026, and it applies to products placed on the market after that date, according to the European Parliament and Gibson Dunn.
- For most SMEs the exposure belongs to the vendor, not to you: the practical change is in what you can demand from the companies selling the tools you already pay for.
- Buyers gain bargaining power: disclosure duties and rebuttable presumptions shift the burden of proof, and the old liability cap is gone, according to the European Commission and Pinsent Masons.
- The same discipline protects your own business: systems you own, with records of what changed, when and who approved it, are cheaper to run and safer to rely on.
What changed, in plain terms
The new regime is set out in Directive (EU) 2024/2853, which treats software as a product for the purposes of strict liability, whether it is installed locally, accessed over a network or delivered as software as a service. AI systems fall inside that definition. The European Parliament's briefing records that the Directive entered into force on 8 December 2024, and Member States must transpose it into national law by 9 December 2026. It applies to products placed on the market or put into service after that date; older products stay under the 1985 rules.
Strict liability means an injured party does not have to prove negligence, only that the product was defective and that it caused damage. That standard used to belong to physical goods. It now follows the software layer that increasingly controls them, which is how the European Commission frames the purpose of the reform.
If you buy software, the exposure is mostly your vendor's
The Directive aims at the chain that puts a product on the EU market: the manufacturer, the importer, the authorised representative and, in some cases, the distributor, as Gibson Dunn's analysis of the Directive's economic operators sets out. A shop running a point-of-sale system, an accounting subscription and a delivery app is none of those things. It is the user, and for the user the Directive arrives not as a compliance burden but as a change in what the companies selling those tools have to stand behind.
There are exceptions worth knowing. If your business imports connected devices from outside the EU and resells them, you can occupy the importer's place in the liability chain. If software you commission ends up embedded in something you sell, the question of who counts as the producer belongs in the contract. For the typical service or retail SME, though, the honest reading is this: the Directive lands on your desk as a purchasing question, not a legal one.
What to ask your vendors before December 2026
The useful consequence of the new regime is bargaining power. Vendors selling into the EU know the old regime's liability cap is gone and that courts can order them to disclose evidence, the pair of changes Pinsent Masons and Freshfields both single out as the ones reshaping vendor behaviour. A vendor prepared for that world keeps better records, tests updates before shipping them and can say who answers for the product in Europe. A vendor that cannot was always a risk; the Directive just makes the risk legible.
Four questions belong in writing with every critical supplier. Who is your responsible entity in the EU? What is your update policy, and are updates tested and reversible? What records of changes and incidents do you keep, and can we see the ones that touch our data? What do we take with us if we leave? None of them needs a lawyer to ask, and the answers say more about a vendor than any feature list.
The quiet lesson: records win
Underneath the legal machinery, the Directive rewards one behaviour above all others: being able to prove what changed, when it changed and who approved it. Disclosure duties and rebuttable presumptions mean the party that can produce its records stands stronger than the party that cannot, whichever side of a claim it is on, a point the European Commission makes in describing how the reform eases the victim's burden of proof.
That behaviour is not a legal artefact. It is a property of well-built systems. A business whose invoicing, stock and customer flows run through one system it owns can answer the same questions about its own operation: what changed, when, and what happened next. The businesses that keep those records do not just sleep better in a dispute. They run tighter operations on every ordinary day in between.
If you do sell software or connected products
Then the full weight of the new regime applies to you. Map every offering against the Directive's definition of a product, including anything delivered through the cloud. Identify which entity in your chain would face a claim. Tighten release discipline, supplier contracts and the attribution of updates and fixes, because after 9 December 2026 each new product you place on the EU market sits under the new rules, as Gibson Dunn and Freshfields set out in their analyses of the final text.
The preparation that counts is not a memo. It is being able to demonstrate, months after the fact, what changed, when, who approved it and what was tested before release.
The date that matters
Mark 9 December 2026. Products placed on the market or put into service after it fall under the new regime; older ones remain under the 1985 framework, according to the European Parliament and Gibson Dunn. For buyers the cut is practical: the tools you adopt and the contracts you renew from 2027 onwards live entirely in the new world, so the questions in this article belong in every renewal conversation you have between now and then.
Different perspectives
Buyers get a better market without lifting a finger. Strict liability plus disclosure duties push vendors towards the practices customers always wanted: tested releases, traceable updates and clear accountability for how AI behaves. Serious suppliers will treat the Directive as a selling point, and small businesses gain a negotiating position they never had against software companies many times their size.
Costs do not vanish; they move. Insurance, defensive engineering and slower release cycles get priced into subscriptions, and small vendors or tools built on open components may retreat from the EU market rather than carry the exposure, a concern raised in commentary on the final text. The plausible downside for a small business is fewer choices at higher prices, in a market that consolidates around the vendors big enough to absorb the risk.
Comparison
What the Directive means depending on your role
| Your role | What actually changes |
|---|---|
| You buy SaaS or AI tools | No new duties. New standing: vendors must answer for defects, so put the hard questions in writing before renewing |
| You import or resell devices or software | You can occupy the importer's or distributor's place in the liability chain; check contracts and EU representation |
| You commission custom systems | Agree in the contract who counts as the producer and who owns updates, records and fixes |
| You sell software or connected products in the EU | Full new regime for products placed on the market after 9 December 2026; records and release discipline are the defence |
Our view
Snip.work's operator view: the Directive is what happens when software stops being a sidecar and becomes the product itself, and its deepest lesson has nothing to do with courtrooms. The party that can show what changed, when, and who approved it wins, in a dispute, in an audit and in the ordinary running of a business.
That is what we build. A Batina, a 32-year-old family retailer, now runs one system across POS, online store and stock, with invoicing automated and the data feeding sharper marketing. When the system is one connected whole, you can see where the risk lives, who owns each step and what changed before a problem ever reaches a customer. Cut the busywork. Build the system. Keep the growth.
What to do
- List the software and AI tools your business depends on, and mark the ones where a defect would hit invoicing, stock or customer data.
- Ask every critical vendor, in writing: who answers for this product in the EU, and how are updates tested, recorded and rolled back.
- Fold the answers into renewals from now on; contracts running past December 2026 should name the vendor's EU responsible entity and its update duties.
- If you sell software or connected products, audit against Directive (EU) 2024/2853 and tighten release and incident records before 9 December 2026.