A Turkish company selling software, a SaaS product, an AI feature, a game or a connected device to people in the EU is moving into a much wider no-fault liability regime. Directive (EU) 2024/2853 on liability for defective products replaces the 1985 Product Liability Directive and, for the first time, names software as a product. A Turkish developer usually has no EU seat, but its EU importer, authorised representative or fulfilment partner does, and they can be expected to push the risk back by contract. This article covers scope and timing, who can be sued, defect and evidence for software and AI, the Turkish contrast, and what to fix first.
What changes, and from when
The Directive was published on 18 November 2024 and entered into force on 8 December 2024 (Article 23). Member States must bring their implementing laws into force by 9 December 2026 (Article 22(1)). The new rules apply to products placed on the market or put into service after 9 December 2026 (Article 2(1)). Directive 85/374/EEC is repealed from that date but continues to govern products placed on the market or put into service before it (Article 21). The Directive is maximum harmonisation: Member States may not adopt stricter or looser rules unless it allows them to (Article 3).
| Point | Directive 85/374/EEC | Directive (EU) 2024/2853 |
|---|---|---|
| Product | Movables and electricity | Also software and digital manufacturing files; related digital services count as components (Article 4) |
| Damage | Personal injury; private-use property above a 500 ECU threshold | Adds psychological health and non-professional data; no threshold (Article 6) |
| Non-EU manufacturer | Importer treated as producer; supplier liable if the producer cannot be identified | Importer, authorised representative, fulfilment service provider; distributors and some platforms as fallback (Article 8) |
| Evidence | Injured person proves damage, defect and causation | Court-ordered disclosure and rebuttable presumptions (Articles 9 and 10) |
As of November 2026, Germany has completed its transposition: the Bundestag adopted the Act modernising product liability law on 8 October 2026, the Bundesrat decided on 16 October 2026 not to refer it to the Mediation Committee, and the Act was promulgated in the Federal Law Gazette on 27 October 2026 (BGBl. 2026 I No. 321). Its main provisions enter into force on 9 December 2026. The position in other Member States should be checked country by country. The proposed AI Liability Directive (COM(2022) 496) is no longer on the table: its withdrawal was published in the Official Journal on 6 October 2025. Key dates are on our upcoming legal deadlines page.
Software, SaaS, AI and open source
Article 4(1) expressly includes software in the definition of product, and Recital 13 adds that this applies however it is supplied: on a device, through the cloud or as software-as-a-service. The same recital says that AI system providers within the meaning of the AI Act should be treated as manufacturers. Information is not a product, so the content of media files or e-books and the mere source code of software are outside the rules.
- Related services. A digital service without which the product could not perform one of its functions, such as a temperature control service for a smart fridge or a voice-assistant service, is a component (Article 4(3) and (4)); Recital 17 ties this to services within the manufacturer’s control. Internet access services are not related services (Recital 17).
- Open source. Free and open-source software developed or supplied outside a commercial activity is excluded (Article 2(2)). Supply for a price, or for personal data used other than exclusively for security, compatibility or interoperability, is commercial (Recital 14). A manufacturer that builds non-commercial open-source code into its product can be held liable for defects in that code, while the open-source developer is not (Recital 15).
- Small software suppliers. An integrating manufacturer has no recourse against the maker of a defective software component that was a micro or small enterprise when it placed the component on the market (under Recommendation 2003/361/EC, fewer than 50 staff and annual turnover or balance sheet total up to EUR 10 million, partner and linked enterprises included) if it contractually waived recourse (Article 12(2)). In our view, small Turkish SDK or module suppliers have good reason to ask for that waiver.
Who answers when the manufacturer is in Türkiye
The manufacturer of a defective product and the manufacturer of a defective component integrated within its control are liable (Article 8(1)(a) and (b)). Where the manufacturer is established outside the Union, and without prejudice to its own liability, the injured person can also sue the importer, the authorised representative and, if there is neither in the Union, the fulfilment service provider: anyone offering at least two of warehousing, packaging, addressing and dispatching without owning the product (Articles 8(1)(c) and 4(13)).
If no liable operator established in the Union can be identified, a distributor is liable when it fails to name one, or its own supplier, within one month of the injured person’s request (Article 8(3)). The same applies to an online marketplace that is not itself an economic operator, where the conditions of Article 6(3) of the Digital Services Act are met (Article 8(4)). Liable operators answer jointly and severally (Article 12(1)), with recourse under national law (Article 14).
In our view, a developer that sells apps or games directly through an app store may well have no EU importer or authorised representative, in which case the claim may run against the Turkish manufacturer itself. Our article on allocating AI liability between company, vendor and model provider covers the contractual chain.
Defect, updates and the end of support
A product is defective if it does not provide the safety a person is entitled to expect or that Union or national law requires (Article 7(1)). Article 7(2) lists, among other circumstances, the effect of any ability to keep learning after release, the moment the product left the manufacturer’s control, and safety-relevant cybersecurity requirements; Recital 32 confirms that a vulnerability can make a product defective. A later, better version or update does not by itself make the earlier one defective (Article 7(3)).
The defence that the defect probably arose after release (Article 11(1)(c)) is unavailable where the defect is due to a related service, software including updates, a lack of updates necessary to maintain safety, or a substantial modification, while within the manufacturer’s control (Article 11(2)). Control includes the ability to supply updates, directly or through a third party (Article 4(5)(b)). The Directive imposes no duty to update (Recital 51), but a manufacturer that could patch and did not may lose the defence that the defect arose after release. In our view, because the test is ability rather than promise, an end-of-support notice alone may not end control; this has not yet been tested in the courts. A user who negligently fails to install a supplied update may see compensation reduced (Article 13(2); Recital 55), while a third party’s exploit of a vulnerability does not reduce the manufacturer’s liability towards the injured person (Article 13(1); Recital 55).
The development risk defence survives (Article 11(1)(e)), subject to national derogations: Member States may keep existing measures and may introduce new ones only for specific product categories (Article 18). A substantial modification, including through a software update or the continuous learning of an AI system (Recital 40), restarts the 10-year expiry period (Article 17(1)(b)). For incident handling, see our article on AI incident response and liability; security obligations are covered in our piece on the EU Cyber Resilience Act.
What can be claimed, and how evidence works
The right to compensation belongs to natural persons, though an insurer or other person subrogated to their rights can also claim (Article 5). Compensable damage is death or personal injury, including medically recognised damage to psychological health; damage to property, except the defective product and property used exclusively for professional purposes; and destruction or corruption of data not used for professional purposes (Article 6(1)). Data used professionally, even partly, is excluded (Recital 22), so, in our view, pure B2B SaaS has narrower exposure than a consumer app or game, although personal injury claims remain possible. Liability cannot be limited or excluded towards the injured person by contract or national law (Article 15), and Recital 56 adds that national law may not set financial ceilings either.
The claimant proves defect, damage and causation (Article 10(1)), but, where the claimant has presented facts and evidence sufficient to support the plausibility of the claim, a court can order the defendant to disclose relevant evidence at its disposal (Article 9(1)), with protection for trade secrets (Article 9(4) and (5)). Defect is presumed on a failure to disclose, a breach of mandatory safety requirements, or an obvious malfunction in normal use (Article 10(2)); causation, once defect is established and the damage is of a kind typically consistent with it (Article 10(3)); and either or both where technical complexity makes proof excessively difficult and the claimant shows likelihood (Article 10(4)). All presumptions are rebuttable (Article 10(5)), in practice mainly with the manufacturer’s own documentation and logs. Claims must be brought within three years of the day the injured person became aware, or should reasonably have become aware, of the damage, the defect and the liable operator (Article 16(1)). Unless proceedings have started, the right expires 10 years after placing on the market or putting into service, or 25 years where latent personal injury prevented an earlier claim (Article 17).
The Turkish contrast: Law No. 7223
Domestically, product liability sits in the Law on Product Safety and Technical Regulations No. 7223 (Official Gazette 12 March 2020, No. 31066). Under Article 6, the manufacturer or importer compensates damage a product causes to a person or property; the injured party must prove the damage and the causal link between the product’s non-conformity and that damage; several liable manufacturers or importers are jointly and severally liable; contract terms excluding or reducing that liability are void; and claims are time-barred three years after the injured party learns of the damage and the liable person, and in any case ten years after the damage occurred. Non-conformity means failure to comply with the relevant technical regulation or general product safety legislation (Article 3), which differs from the expectations-based defect test of the Directive. Article 2(2) also deems products exported, or intended for export, to EU Member States to be placed on the market for the purposes of the Law. Article 3 defines a product as any substance, preparation or goods and does not mention software; in our view, whether standalone software or SaaS is covered remains unsettled.
What EU partners will ask for, and where to start
EU importers, representatives and integrators can be expected to try to move their exposure back to Türkiye: indemnities (sometimes uncapped), recourse rights, minimum insurance, update commitments and access to logs. Our article on AI insurance and product liability cover explains how to check whether a policy responds.
- Map what you place on the EU market after 9 December 2026, and through whom.
- Set a security update period and end-of-support policy you can deliver, and align contracts and user notices.
- Keep design files, risk assessments, test results, update logs and model change records ready for Article 9 disclosure.
- Assess major updates and model retraining as possible substantial modifications, and document each assessment.
- Negotiate indemnity caps, conduct of claims and recourse; as a small software supplier, ask for the Article 12(2) waiver.
- Confirm that insurance covers EU product liability claims, software-only products included.
Frequently asked questions
We are a Turkish company with no EU office. Can an EU consumer sue us directly?
Under the Directive, yes. The manufacturer remains liable wherever it is established (Article 8(1)). The Directive adds EU-based defendants (importer, authorised representative, fulfilment service provider) so that the injured person has someone in the Union to sue, and those businesses are likely to seek recourse against you. Which court has jurisdiction, and whether a judgment can be enforced in Türkiye, are separate questions.
Can our terms of service cap liability for these claims?
Not towards the injured person. Article 15 prevents liability under the Directive from being limited or excluded by contract or by national law, and Recital 56 adds that national law may not set financial ceilings either. Caps, indemnities and recourse clauses still allocate the cost between businesses in the supply chain, so they remain worth negotiating.
Are we liable for failing to ship a security patch?
Potentially. A lack of updates necessary to maintain safety, while the product is within your control, removes the defence that the defect arose after release (Article 11(2)(c)). There is no duty to update, but an unpatched vulnerability can support a finding of defect; a user who ignores a supplied update may receive less.
Sources. Directive (EU) 2024/2853 (OJ L, 18.11.2024), Articles 1 to 18 and 21 to 23, Recitals 13 to 15, 17, 22, 32, 40, 51, 55 and 56; Council Directive 85/374/EEC, Articles 2, 3, 4 and 9; Commission Recommendation 2003/361/EC, Annex, Article 2; Withdrawal of Commission proposals (OJ C/2025/5423, 6.10.2025); European Commission, Liability for defective products; Deutscher Bundestag (8 October 2026); Bundesrat, Drucksache 584/26 (Beschluss), 16 October 2026; BGBl. 2026 I No. 321 (27 October 2026); Law No. 7223 (Official Gazette 12 March 2020, No. 31066), Articles 2, 3 and 6.
This article is general information and not legal advice; a specific situation should be assessed with counsel.
Author
More from Vircon Insights
The EU Cyber Resilience Act Reporting Clock Started on 11 September 2026: 24-Hour Duties for Turkish Software and Device Makers
October 13, 2026Carving Out a Product Line: Partial Demerger, Spin-Off and the Simplified Merger Under Turkish Law (TCC 155–156, 159–179)
October 31, 2026PSD3 and the PSR: What the EU Payments Reform Means for Turkish Payment and E-Money Institutions
October 19, 2026Foreign Payment and E-Money Providers Serving Turkish Customers: When a Turkish Licence Is Required
November 8, 2026Commercial Books of a Turkish Company: Opening and Closing Certifications, e-Ledger, the Electronic Share Ledger and Ten-Year Retention (TCC 64–82)
November 8, 2026Raising Venture Capital for a Licensed Turkish Fintech: Shareholder Suitability, Approval Thresholds, Investor Rights and ESOP
November 7, 2026Related Practice Areas
US Company Formations & Flip-Ups
Delaware C-Corp, flip-up structures, SAFE/convertible notes, 83(b).
View service →IT Law
SaaS, software licensing, cloud services and IT contracts.
View service →Gaming & Esports Law
Studio funding rounds, chain of title, publishing and platform agreements, esports.
View service →