Product liability for software from 9 December 2026: what Slovakia's new act means for apps

Product liability for software takes effect under Slovak law on 9 December 2026. Slovak Act No. 242/2026 Coll. states explicitly that software counts as a product, and that a manufacturer also includes a company that has a product designed or made for it, or puts its own name on it. If you offer people your own app and it causes them damage, you can be liable regardless of fault. You cannot contract out of this liability towards the injured person, not even in your terms of use. The new rules apply to products placed on the market or put into service from 9 December 2026.

The act transposes the EU Product Liability Directive, which every member state brings into its own law. This article follows the Slovak act, so it applies to you directly if you offer an app, a customer portal or a device with software to customers in Slovakia. Below you will find when you count as a manufacturer, which damage is covered, why security updates matter and what to prepare before December. It is a similar kind of change to the withdrawal button for online shops: the law applies to everyone and the technology has to adapt. If you are only planning an app, see how we build custom web applications with an update plan from day one. This article explains the text of the law and is not legal advice.

Product liability for software: what Act No. 242/2026 Coll. brings

The new act replaces the Slovak law of 1999 and explicitly covers software, digital services and online platforms.

The Slovak National Council passed Act No. 242/2026 Coll. on liability for damage caused by a defective product on 17 September 2026. It was published in the Slovak Collection of Laws on 6 October 2026 and takes effect on 9 December 2026. It repeals the previous Act No. 294/1999 Coll. and transposes Directive (EU) 2024/2853 on liability for defective products. The directive is European, so every member state adapts its own laws to it.

The core stays the same: the manufacturer is liable for damage that a defective product causes to a natural person. The act adds terms that connect this principle to the digital world.

Term in the act	What the act says	What it means for a company with an app
Product (Section 2(a))	A movable item; software is also considered a product	An app is a product just like a device
Related service (Section 2(c))	A digital service without which the product could not perform at least one of its functions	For example an online service without which the app or device would lose some of its functions
Manufacturer (Section 2(f))	Also whoever has a product designed or made, or marks it with their name or brand	A company that had an app developed and offers it under its own brand
Manufacturer's control (Section 2(g))	The manufacturer supplies software updates itself or through a third party, or is able to supply them	As long as you update the app, it remains under your control
Substantial modification (Section 2(h))	For example a change after placing on the market that the manufacturer did not foresee and that creates a new hazard or increases the risk	Whoever makes the product available after such a change outside the manufacturer's control is liable for damage (Section 6(6))

Software is a product: when you are the manufacturer too

The manufacturer is not only the developer, but also the company that commissions an app and offers it under its own name.

For an ordinary business this is the most important point. Section 2(f) treats as a manufacturer anyone who has a product designed or made, or presents themselves as the manufacturer by putting their name, trade mark or other distinguishing feature on it. So if you have a studio build a booking app, a loyalty app or a customer portal and offer it to customers under your brand, you can be the manufacturer in the eyes of the injured person.

Recital 13 of the directive adds that software is a product regardless of how it is supplied: stored on a device, accessed through the cloud or supplied as a service (SaaS). It explicitly mentions applications and AI systems. Information as such, on the other hand, is not a product, meaning the content of digital files such as media files or e-books, nor the mere source code. Plain text and images on a website are therefore closer to information, while an app is software.

Two more groups the act names:

• Open-source software. The act does not apply to free and open-source software developed or supplied outside a commercial activity (Section 1(2)). But if you build such a library into your own commercial product, under recital 15 of the directive you are liable for the damage, not the author of the library.
• Online platforms. A provider of an online platform through which consumers conclude distance contracts with traders can, under certain conditions, be liable like a distributor (Section 6(5)). A distributor is liable when no responsible person established in the EU can be identified and the distributor does not name one within one month of the injured person's request (Section 6(4)).

Product liability for software: which damage is covered and which is not

The act protects natural persons and their private property and data, not property and data used exclusively for business.

A natural person who suffered damage from a defective product has a claim (Section 3). Section 4 lists exactly which damage that means. For software the third item matters most: destruction or corruption of data.

Type of damage (Section 4(1))	Covered by the act	Exception
Death or personal injury	Yes, including medically recognised damage to psychological health	No exception
Damage to or destruction of property	Yes	The defective product itself and property used exclusively for business or professional purposes
Destruction or corruption of data	Yes	Data used for business or professional purposes

In practice this gives a simple sorting rule. An internal tool used only by your employees on company data is usually far from this regime, unless it can endanger health. A consumer app that manages people's private data, controls a device at home or relates to health is exactly what the act is aimed at. Section 3(2) also leaves other claims for damages in place, for example under the Slovak Civil Code.

Software updates: when you cannot escape liability

As long as you can update the app, it is under your control, and a missing security update can make you liable.

For a physical product, defectiveness is assessed mainly at the moment the manufacturer placed it on the market. Software, however, keeps changing after launch. For a product that stays under the manufacturer's control, the act therefore looks at the moment it left that control (Section 5(2)(e)). Under Section 2(g), a product is under control also when the manufacturer is able to supply updates itself or through a third party.

The strongest provision is Section 7(4). A manufacturer can normally defend itself by showing that the defect probably did not exist when the product was placed on the market. That defence does not work if the defect was caused by software including its updates, a related service, a substantial modification or the failure to supply a software update needed to maintain safety, where these are under the manufacturer's control. In other words, a neglected security fix is not just technical debt, it is a legal risk.

When assessing defectiveness, Section 5(2) takes into account, among other things:

• product safety requirements, including cybersecurity requirements,
• the product's ability to continue learning or acquire new features after being placed on the market, which concerns AI features in particular,
• the reasonably foreseeable effect of other products used together or connected with yours,
• instructions for installation, use and maintenance.

The act also contains two reassuring rules. A product is not defective merely because a better version was released later (Section 5(3)). And the manufacturer is not liable if the state of scientific and technical knowledge at the relevant time did not allow the defect to be discovered (Section 7(1)(e)). A contract will not help you, though: Section 8 says liability towards the injured person cannot be excluded or limited, and a unilateral statement or agreement that does so is invalid. A line in your terms of use saying "we are not liable for damage" will not protect you under this act. How much regular fixes matter is also covered in our article on WordPress website security, which applies well beyond WordPress.

Evidence and deadlines: why documentation pays off

A court can order disclosure of evidence and, for complex software, presume a defect, so documentation of development and updates is your defence.

The claimant has to prove the defect, the damage and the causal link (Section 15(1)). The act helps the claimant considerably, though:

• Disclosure of evidence (Section 14). If the claimant presents sufficient evidence, the court can, on request, order the defendant to disclose evidence at its disposal. For trade secrets the court weighs proportionality and can take measures to preserve confidentiality.
• Presumption of defectiveness (Section 15(2)). A product is presumed defective if the defendant does not disclose the evidence, if it does not meet mandatory safety requirements, or if the damage was caused by an obvious malfunction during normal use.
• Technical complexity (Section 15(4)). If technical or scientific complexity makes it excessively difficult for the claimant to prove the defect, it is enough to show that it is likely. With software and AI that is a realistic scenario.

The presumptions can be rebutted (Section 15(5)), and the best way to do it is with what you have documented: tests, risk assessments, records of released updates and of when you fixed a reported bug. If several persons are liable, for example the app manufacturer and a component manufacturer, they are liable jointly and severally (Section 9).

Deadline	Length	Runs from
Limitation of the claim (Section 12)	3 years	The day the injured person learned or could have learned of the damage, the defect and the liable person
Expiry of the right (Section 13(1))	10 years	Placing the product on the market or putting it into service, or making it available after a substantial modification
Expiry for latent personal injury (Section 13(2))	25 years	The same moment as for the 10-year period

What to do before 9 December 2026: a plan for companies with an app

Find out whether you are a manufacturer, and set up updates and documentation so that they hold up in court.

Under the transitional provision (Section 17), the new act applies to products placed on the market or put into service from 9 December 2026. Older products are governed by the rules in force until 8 December 2026. How an app launched before that day and updated afterwards will be treated is not addressed explicitly in the text of the act. That is a question for your lawyer, not your developer. On the technical side, it pays to prepare the following:

1. Product list. List the apps, portals and devices you offer to natural persons under your name. Mark internal tools separately.
2. Component list. List the libraries, external APIs and third-party services the app cannot work without. If a component is defective, its manufacturer can be liable too (Section 6(2)), but that does not protect you towards the injured person.
3. Security update plan. Decide who does the updates, how fast and for how long. Safe deployment with staging and rollback is described in our article on updates with staging and rollback.
4. Documentation. Keep risk assessments, test results, release records and records of how reported bugs were handled. In a dispute about defectiveness, what you can prove decides.
5. User instructions. When assessing defectiveness, the act considers labelling and instructions for use and maintenance. Keep them clear and current.
6. AI features under supervision. If the app uses a model that learns or changes its behaviour, monitor what it does after deployment. The act explicitly accounts for this ability.
7. Contract with your development partner. Liability towards the injured person cannot be limited. How you share it with your supplier and who will maintain the app is a matter for your contract, which you should have a lawyer review.

What it looks like in practice

In our experience the biggest risk is not the code itself but an app nobody looks after once it is live. Typically it is an app built by an external supplier, offered by the company under its own brand, with dependency updates done only when something breaks. Apps put together quickly with AI tools often end up the same way, as we describe in our first-aid checklist for vibe-coded websites. Under the new act, exactly this situation, a product under your control without security fixes, is one where liability is hard to escape.

How we handle it at Denva: we deploy the app and test it on real data, hand over the access and the code to you, and after launch we can set up ongoing care and further development as needed. When you want to add something, we build on what exists instead of starting from scratch.

When you can handle it yourself and when to bring us in

You can handle it yourself if:

• you only run a presentation website and internal tools for your own staff,
• you have your own developer who updates regularly and keeps a record of it,
• you can write the product and component lists in one afternoon.

It is worth bringing us in if:

• you offer customers your own app or portal and the original supplier no longer maintains it,
• you do not know which libraries and third-party services the app uses or when they were last updated,
• you plan to launch a new app after 9 December 2026 and want an update plan and documentation from the start.

Conclusion

From 9 December 2026, product liability under the Slovak act turns software into a full product. A company that offers people its own app can be the manufacturer even if it did not write the code, and it cannot contract out of this liability towards the injured person. What will matter most is whether you keep the app secure and whether you can prove it. If you are not sure where your app stands, get in touch through a no-obligation consultation. We will go through the technical side with you; leave the legal side to your lawyer.

FAQ

Frequently asked questions.

When does the new Slovak product liability act take effect?

Slovak Act No. 242/2026 Coll. takes effect on 9 December 2026. It applies to products placed on the market or put into service from that day; older products fall under the rules in force until 8 December 2026.

Is software or a mobile app considered a product?

Yes. Section 2(a) of the act states explicitly that software is also a product. Directive (EU) 2024/2853 adds that it does not matter whether it runs on a device, in the cloud or as SaaS.

Am I the manufacturer if a studio built the app for me?

You can be. Under Section 2(f), a manufacturer also includes whoever has a product designed or made, or marks it with their name or brand. Have a lawyer assess your situation and your contract with the supplier.

Can I exclude liability in my terms and conditions?

No. Under Section 8, liability towards the injured person cannot be excluded or limited, and a unilateral statement or agreement that does so is invalid.

Does the act also cover internal company apps?

Mostly only marginally. The act protects natural persons and does not cover damage to property or data used for business or professional purposes. Death or personal injury of a natural person, however, is covered without such an exception.