Software as a product from 9 December 2026: what changes for underwriting across PI, product liability and cyber

From 9 December 2026 software is a product under Directive (EU) 2024/2853. What falls into PI, product liability and cyber, where the three covers overlap or leave gaps, and what changes in underwriting questions.

by cybercoverinsurance

From 9 December 2026, software placed on the EU market is a product, and whoever makes it is liable for damage caused by a defect even without fault. The question underwriters care about is a different one: does the way this risk is underwritten change? Yes, but less than the headlines suggest and in different places than expected. The directive does not create a new risk. It moves part of software risk from contract and fault into strict liability towards natural persons. And it does so on the border between three policies that have so far split the work without talking to each other: PI (or tech E&O), product liability and cyber.

This article separates what falls into each, where they overlap, where they leave a hole and what changes in underwriting questions.

What the law actually says

In the text, "Article" means a binding rule of the directive; "recital" means one of the introductory paragraphs that explain how those rules should be read.

Directive (EU) 2024/2853 applies to products placed on the market or put into service after 9 December 2026 and expressly includes software in the definition of product (Articles 2 and 4, EUR-Lex). It does not matter how the software reaches the user: installed on the device, used over the internet or the cloud, or sold on subscription as a service (software-as-a-service). Recital 13 makes this clear. Free and open-source software developed or supplied outside a commercial activity is excluded (Article 2).

Five points matter for underwriters.

Who can claim. Only natural persons, that is, private individuals (Article 5). A business that suffers damage cannot use this directive: contract and ordinary rules apply to it.
Which damage. The directive allows only three types of damage (Article 6): death or injury, including psychological harm confirmed by a doctor; damage to personal property, excluding the defective product itself and property used only for work; deletion or corruption of data not used for work, for example personal files wiped from a computer. Someone who only loses money, for example because a business is shut down, cannot claim under these rules (recital 24). And deleted or corrupted data is different from personal data that is stolen or leaked: that case stays under the GDPR (recital 20).
What makes a product defective. The factors include safety-relevant cybersecurity requirements and the product's ability to keep learning (Article 7).
After the sale. The defence that the defect did not exist when the product was placed on the market does not apply where the defect comes from software, its updates or the lack of updates needed for safety, when these are within the manufacturer's control (Article 11(2)).
Proof and third parties. Courts can order disclosure of evidence (Article 9) and defectiveness and causation can be presumed (Article 10). If someone else also contributes to the damage, the manufacturer's liability towards the injured person is not reduced (Article 13). The example is an attacker exploiting a flaw in the software: the manufacturer cannot shift liability onto the attacker (recital 55). Compensation can be reduced if the injured person was at fault, for example by not installing a security update.

Liability runs along a chain: manufacturer, manufacturer of the defective component, importer, authorised representative, fulfilment service provider, and in some cases distributors and online platforms; anyone who substantially modifies a product outside the manufacturer's control becomes a manufacturer (Article 8). Several operators are jointly and severally liable (Article 12) and liability towards the injured person cannot be limited by contract (Article 15). The injured person has three years to act from when they learn of the damage, the defect and who is liable (Article 16). In any case the right is lost ten years after the product is placed on the market, or twenty-five years for injuries that appear only after a long time (recital 57).

In Italy, the Council of Ministers gave final approval on 28 October 2026 to the implementing legislative decree, which amends the Consumer Code and removes the 387 euro deductible on property damage (eDotto).

What stays out

Before talking about policies, it helps to say what the directive does not touch, because this is what tempers many alarmist readings.

A business shutdown caused by a supplier's defective update is not compensable damage under the directive: it is economic loss of a professional party. The same goes for corrupted business data. These cases stay where they were: contract and ordinary liability, and therefore the supplier's PI or tech E&O and the insured's own cyber. Products placed on the market before 9 December 2026 also stay out and remain under the old rules.

The directive bites where software touches people and consumer goods: connected medical devices, cars and mobility, home automation and building systems, household appliances, wearables, apps that run safety functions or handle non-professional personal data.

Three policies, three logics

Product liability was built for injury and property damage caused by a product. It is the first policy the directive calls on. The problem is that many software makers do not buy it, because they see themselves as service providers, and many wordings describe the insured product in terms of physical goods. Covington and Airmic recommend widening the product definition to software, updates and components, and revisiting damage definitions (Covington, Airmic). The third head of damage, non-professional data, is the most awkward for this policy: the liability wording has to be checked to see whether it treats data as tangible property or excludes it, and Reed Smith expects insurers to revise their definitions of property damage and data impairment.

PI or tech E&O was built for economic loss caused by an error in a professional service. It covers well the B2B client that suffers downtime, which is exactly what the directive leaves out. But it often excludes or limits injury and property damage, which are the core of the directive. Covington suggests extending the damage definition to injury, property damage and recognised psychological harm, and aligning the definition of professional services with the directive's concept of product.

Cyber was built for the insured's own cyber incident: response costs, interruption, restoring its own data, liability for data breaches and network security. It normally excludes injury and property damage. Covington and Airmic name cyber and tech E&O as the best fit for defective software, but warn that directive risks may not sit cleanly within cyber wordings and that dedicated sub-limits and exclusions may appear.

In short: the directive produces product liability damage (people and property), often caused by typical cyber events (vulnerabilities, updates), for companies that mostly buy PI. None of the three policies was written for this crossing.

The overlaps, one by one

1. Injury caused by an exploited vulnerability. This is the clearest case. A connected device is compromised and someone is hurt. Under the directive the manufacturer is liable and the attacker's involvement does not reduce liability (Article 13). Product liability is the natural policy for the injury, but it may carry exclusions for malicious cyber acts. Cyber knows the event but excludes the injury. PI may exclude both. The possible result is not an overlap but a gap, and it is the most concrete form of reverse silent cyber: a cyber risk no policy intends to cover.

2. A missed update. The directive treats the lack of a security update as a source of defect (Article 11). For PI it is an omission in the service; for product liability it is a defective product. The two policies have different triggers: product liability often works on an occurrence or manifestation basis, while cyber and tech E&O are usually claims-made with a retroactive date (Reed Smith). With an expiry of up to twenty-five years, the same defect can trigger two policies in different years, or none if the retroactive date or the extended reporting period does not reach far enough.

3. Corrupted consumer data. A defective update wipes the non-professional personal data of many users. Under the directive this is compensable damage. Product liability may not see it as property damage. Cyber covers third-party liability if there is a security incident, but a coding error without an attack may not trigger it. Tech E&O responds to the error but may exclude damage to third parties who are not clients. The risk is twofold: a gap if no wording recognises data as damage, an overlap if two policies recognise it and fight over the claim through other-insurance clauses.

4. The recourse chain. The device maker pays the consumer under its own product liability policy, then seeks recourse against the software supplier. For the supplier, that recourse arrives as a contractual claim from a professional client: economic loss, so PI territory. The same defect thus produces two claims on two policies of two different insureds, possibly with the same insurer. The directive adds a detail: a manufacturer that integrates software from a micro or small enterprise has no recourse if it waived it by contract (Article 12(2)). For whoever writes the small supplier's PI, indemnity and waiver clauses in client contracts become a risk factor; for whoever writes the client's product liability, the waiver removes a source of recovery.

5. Defence costs. Presumptions and disclosure increase the cost and length of litigation. Covington and Reed Smith recommend reviewing defence cost limits. If three policies can be called on, it matters who runs the defence and how costs are shared: without clear rules, the risk is a dispute between insurers while the insured waits.

6. Aggregation. A defective update pushed to thousands of devices is, for product liability, a possible serial loss; for tech E&O a series of related claims; for cyber a systemic event. Each policy has its own definition of a single loss. The same thousands of claimants can be worth one limit in one policy and many limits in another. For an insurer writing several lines on the same client, this is unmeasured accumulation.

What changes in underwriting

The "product or service" question loses value. Until now that distinction decided which policy to offer. For the directive this distinction no longer matters: software sold on subscription as a service is also a product (recital 13). The underwriter should ask instead what the software does, which devices it runs on and whether it can cause harm to people, property or consumer data.

The exposure base changes. Turnover measures this risk poorly. Installed base, number of connected devices, safety-relevant functions and length of support matter more. Software with little revenue running on millions of devices weighs more than a best-selling business application used only by companies.

The lifecycle enters the questionnaire. If a missed update is a defect, the update policy is underwriting data: how many years security patches are guaranteed, how quickly known vulnerabilities are fixed, how delivery to users is documented. The Cyber Resilience Act will push the same way, and its mandatory requirements, if breached, can lead to a presumption of defect (Article 10).

The tail gets longer. With ten and twenty-five year expiry periods, retroactive dates and extended reporting periods become central clauses for anyone selling tech E&O and cyber to device and software makers.

The programme must be read as a whole. Marsh notes that software as a product could lead to merging parts of tech PI, product liability and cyber (Marsh). Whether or not the market moves to combined policies, the underwriter needs to see all three of the insured's wordings and know which one responds to which scenario.

What to bring to renewals

Can the insured's software or services cause injury, damage to consumer property or loss of non-professional data? On which products and with what installed base?
Does the product liability risk description include software, updates and related digital services, including those supplied from the cloud?
Does the tech E&O exclude injury and property damage? If so, which policy covers injury caused by a software defect?
Does product liability carry exclusions for malicious cyber acts or for data? Does cyber exclude injury and property damage? Is the scenario of an exploited vulnerability that hurts someone covered anywhere?
For how many years does the insured guarantee security updates, and how quickly does it fix known vulnerabilities?
Which client contracts contain recourse waivers or indemnities, and with what limits?

On the portfolio side, the question is cross-line accumulation. How many insureds, across product liability, tech E&O and cyber, depend on the same software component or the same update supplier? A defect in that component does not produce one claim: it produces one for every line and every link in the chain.

This article is for information only and is not legal or insurance advice.