Germany adopts new product liability rules to combat cyber risks

Daniel Widmann of Pinsent Masons was commenting after the German Bundestag adopted the Act on the Modernisation of Product Liability Law, which implements the EU product liability directive into national law and significantly expands liability exposure for manufacturers and other economic operators in Germany.

The EU product liability directive entered into force on 9 December 2024. Subject to final consideration by the Bundesrat, the new regime in Germany is expected to enter into force on 9 December 2026 – the deadline by which all member states are obliged to transpose the directive into their national laws.

The new German regime and will apply to all products placed on the market from 9 December onward. Widmann, a cyber security expert at Pinsent Masons, said one of the most significant developments for technology businesses is the explicit recognition of cybersecurity as a relevant factor when assessing whether a product, including software, AI and software as a service is deemed defective.

“Technology companies are currently investing significant resources in preparing for the Cyber Resilience Act, NIS2 and other cybersecurity requirements,” he said. “However, the discussion should not focus solely on regulatory compliance. Under the new liability framework, cybersecurity shortcomings may also become relevant when courts assess whether a product is defective and whether manufacturers or other economic operators may be exposed to liability claims.”

The reform also comes at a time when European businesses are already preparing for compliance with the EU Cyber Resilience Act (CRA), the Network and Information Security Directive 2 (NIS2), and other cybersecurity requirements.

The new framework creates an important link between cybersecurity compliance and civil liability risk. Increasingly, organisations may be required to demonstrate that appropriate cybersecurity measures, vulnerability management processes and security updates have been implemented throughout the product lifecycle.

Widmann said this issue would be particularly relevant for German manufacturers of connected products, software developers, AI providers, digital service providers and other organisations placing related products on both the German and EU markets. “For many organisations, cybersecurity has traditionally been viewed as a regulatory compliance issue, but the implementation of the new product liability directive demonstrates that cybersecurity is increasingly becoming a product liability issue as well,” he added.

Businesses will now be required to review their secure-by-design principles, vulnerability handling processes, security monitoring, software maintenance and security updates to ensure their operations and processes are compliant, as well as adopt proactive litigation and risk management strategies to deal with defective products.

The interaction between the CRA and the new product liability regime is particularly relevant as it demonstrates that compliance and product liability can no longer be viewed in isolation, said Widmann. “Organisations should therefore review their product governance, cybersecurity documentation and development processes to ensure that they can demonstrate a robust approach to cybersecurity throughout the product lifecycle,” he added.