Software as a hazardous product: draft amendments to the Civil Code

The Government has begun implementing EU Directive 2024/2853 on liability for defective products, which is due to be completed by 9 December 2026; the draft bill prepared by the Ministry of Justice also provides for this date as the date of entry into force.

The draft repeals the existing provisions of the Civil Code concerning liability for damage caused by a dangerous product and introduces new provisions to bring Polish law into line with the requirements of the Directive.

This is still at an early stage of the legislative process, so the details may still change; however, compliance with the directive will be the deciding factor.

What is changing?

The new regulations are primarily intended to bring the regulatory framework into line with market realities, which are constantly evolving, including new types of products and the forms and methods of their distribution. However, they also amend the rules on liability themselves.

The product will therefore also include software and a digital production file (e.g. for 3D printing). However, free and open-source software created or supplied outside the scope of a business activity is excluded.

When assessing product safety, factors such as cybersecurity and the product’s ability to learn after it has been placed on the market will be taken into account.

After-sales service

The manufacturer shall also be liable for the consequences of updates, and of any failure to provide updates necessary for security, for as long as it retains control over the product.

Anyone who substantially modifies a product will be treated as the manufacturer.

A broader scope of liability for damage

In addition to the manufacturer and importer, the following may also be held liable:

• authorised representative,
• a logistics operator handling sales (known as ‘fulfilment’),
• and, in the alternative, the distributor and the online platform.

Compensation will be payable not only for personal injury or damage to property, but also for damage resulting from the destruction or corruption of data used for private purposes.

The €500 threshold for property damage will be abolished. Liability for a dangerous product cannot be contractually excluded or limited.

Business implications

The changes will affect manufacturers of software-enabled devices, software suppliers, importers and e-commerce businesses. It is worth taking a look now:

• contracts within the supply chain in terms of recourse,
• update policy,
• and the scope of third-party liability cover.

The new rules will apply to damage caused by products placed on the market after the Act comes into force, whilst the existing provisions will continue to apply to those placed on the market previously.

The applicable legal regime will therefore be determined by the date on which a specific product is placed on the market, rather than the time at which the damage occurred.