Template: Software Is Becoming a "Product." Your 10-Point Vendor Liability Checklist.

For about 40 years, product liability has been mostly about physical things: toasters, car parts, medical devices. That's changing. The EU's revised Product Liability Directive brings software and AI into scope, and member states must transpose it by December 9, 2026. Then on October 8, the UK Law Commission opened a consultation proposing that software, AI systems, and some online platform features count as "products" under UK law too.

If your company builds, sells, or embeds software, this changes how your vendor contracts should read. Here's a ready-to-use checklist to work through before the rules land.

What's happening (the short version)

• EU: Directive (EU) 2024/2853 must be in national law by December 9, 2026. According to Covington's Inside Privacy tracker, it covers AI and other software and keeps strict, no-fault liability for manufacturers. It also adds liability for defects that appear after sale while a product is still under the manufacturer's control, such as failing to provide security or software updates. Recoverable harm includes data loss or corruption, and courts can presume defectiveness in some circumstances and order evidence disclosure.
• UK: The Law Commission's proposals are not law yet. Per Legal IT Insider, they would expand "product" to cover software, AI systems, and design features of online platforms, extend liability to online marketplaces, and keep key business defences adapted for the digital age. The consultation closes January 14, 2027, and final recommendations are expected in late 2027.

The 10-point vendor contract checklist

Use this for any agreement where software or AI ends up in something your company sells, or where a vendor's software runs a product your customers rely on. For each item, mark it Covered, Gap, or Not applicable.

Part A: Know your role

1. Map your position. For each product line, are you the manufacturer, an importer, a distributor, or just a buyer? The answer changes who claimants come to first.
2. Inventory the software components. List the third-party software, AI models, and open-source components inside your products. You can't allocate liability for parts you haven't identified.

Part B: Fix the contract language

3. Defect vs. warranty. Check that "defect" isn't defined only as nonconformity with specs. Safety-based defect claims don't care what the SOW said.
4. Update obligations. Require security and software updates for a defined support period, with notice before end-of-support. The EU rules link liability to updates, so your contracts should too.
5. Indemnities. Add or confirm an indemnity for third-party product liability claims caused by the vendor's component, including data loss claims.
6. Caps and carve-outs. Decide whether product liability indemnities sit outside the general liability cap. If they don't, know the number you're accepting.
7. Recourse waivers. Watch for clauses waiving your right of recourse against component suppliers. The EU regime treats some of those waivers specially, particularly for small software component makers, so get local advice before you sign one.

Part C: Be ready for a claim

8. Evidence cooperation. Require vendors to keep logs, version history, and technical records for the liability period and to cooperate with disclosure orders.
9. Insurance. Confirm vendor product liability and tech E&O coverage, and ask your own broker whether your policy treats software as a product.
10. Consultation decision. Decide by mid-December whether your company will respond to the UK consultation before January 14, alone or through a trade association.

Scoring guide

• 0 to 2 gaps: Green. Fold the fixes into your next renewal cycle.
• 3 to 5 gaps: Yellow. Prioritize contracts for products sold into the EU, and send amendment requests this quarter.
• 6 or more gaps: Red. Brief your GC and product leadership now, and set up a cross-functional review with engineering and procurement.

Make it repeatable

Doing this once in a spreadsheet is fine. Doing it across hundreds of agreements needs tooling. Contract intelligence tools can find every agreement missing an update obligation or with product liability inside the cap. Clause management tools help you roll out the new standard language. For tracking the regulatory changes themselves, browse the corporate and regulatory compliance category.

Software used to be "licensed, not sold." Product liability law is starting to ignore that distinction. Your contracts shouldn't.

This article is general information, not legal advice. Check transposition status and requirements in each country where you operate.