Activities / How software is offered

Distributes a software product

distributes_software_product

Your app is itself a software product a maker ships to customers, rather than a service you operate and run yourself.

scope deployment
in the registry since 1.0
217 laws in 110 jurisdictions name it

What triggers it

The lint's definition. It makes software available to others in any form: a desktop app, library, package, CLI, firmware, or a server others self-host. A service used only through a browser or API is not this.

This covers packaged desktop software, a licensed on-premises system, and a software development kit other companies embed in their own products.

What does not

A service you host and operate entirely yourself, with no separate product to install, does not count in the same way.

Often confused with Ships a mobile app.

The law it brings into scope

The kinds of law that name this activity in the LexLint law library, with the number of laws and jurisdictions in each, as of 19 Oct 2026. The examples are chosen by rule, laws in force first and the widest jurisdiction first; each section's page lists every law.

Area of law	Laws	Jurisdictions
Cybersecurity law Build software securely, handle reported flaws, and report incidents on a deadline. EUCC Certification Scheme, Vulnerability Management by the Holder of a Certificate European Union Product Security Requirements for Connectable Products United Kingdom Bürgerliches Gesetzbuch (BGB), Section 327f Updates, Including Security Updates, for Digital Products Germany	136	84
Product and AI liability law Answer in damages when defective software or an AI system causes harm. Product Liability Directive 85/374/EEC, producer liability for defective products European Union Consumer Protection Act 1987, Part I, strict liability for defective products United Kingdom Codice del consumo, Articles 114 to 127, Product Liability (Directive 85/374/EEC) Italy	56	38
AI law Tell people when they are dealing with an AI system or its output, and control the uses the law calls high-risk. Making or Supplying a Generator of Purported Intimate Images United Kingdom Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them Italy AI Act, Article 25 (responsibilities along the AI value chain) European Union from 2 Dec 2027, in 13 months	13	5
Privacy law Have a legal basis for personal data, honor people's rights over it, and report a breach. Data Act, User Access to Connected-Product Data and Sharing with Third Parties (Articles 3 to 5) European Union Ley para la Protección de Datos Personales, cross border transfer of personal data El Salvador Loi n°001/2011 relative à la protection des données à caractère personnel, modifiée par la loi n°025/2023 Gabon	9	7
Reuse law Reproduce other publishers' content only as far as an exception or a license allows. Directive 2009/24/EC on the legal protection of computer programs (Software Directive), Articles 1, 4, 5 and 6 European Union Copyright, Designs and Patents Act 1988, literary works including computer programs, acts restricted by copyright, and adaptation United Kingdom Copyright Act, first sale and computer program copies, 17 U.S.C. §§ 109 and 117 United States	6	4
Communications law Get consent before marketing, calling, recording or storing data on a device, and honor an opt-out. Einwilligungsverwaltungsverordnung (EinwV, Consent Management Services Ordinance), Recognized Consent-Management Services Germany Canada's Anti-Spam Legislation Canada Consumer Protection Against Computer Spyware Act Pennsylvania	3	3
Content moderation law Act on notice of unlawful content, explain moderation decisions, and report on them. LCEN Article 12 (rewritten by the SREN Law), Warnings and Blocking Orders against Online Services Built to Imitate Another Service France	1	1
Scraping law Stay within computer-access law, a site's terms, and the copyright in what is copied. Penal Code, creation, provision and use of unauthorized command electronic records (computer viruses) Japan	1	1

Counterparties that usually come with it

a package registry
an update or download server

A component that cannot run as documented without one of these names it in its ACTIVITIES.md under talks_to, with required: true. That party's jurisdiction then joins the run of every product that uses the component, and the finding says why it is there. A default the deployer can change is asked about, never added. Talking to a party never makes a product that party.

In a declaration

This activity is a property of how software is offered, so only an application or a service declares it, and only as performs. A component with a package URL is on a package registry, so a validator adds this activity to it without its being written; a repository that is deployed and never distributed says so under not.

For an application

activities: - id: distributes_software_product mentioned: performs enabled: by_default note: <one sentence: what it does, and the kind of law it attracts>

History

In the registry since version 1.0, 16 Oct 2026.

In the glossary: Distributes a software product.

The activity registry is LexLint's open list; this page's text is licensed under Creative Commons Attribution 4.0.