Distributes a software product, in Germany

Produkthaftungsgesetz (ProdHaftG) · Read the law's page

• Do not assume this Act answers whether standalone software is a product: section 2 lists movable things and electricity and does not name software (§ 2).
• If you make a product or a component or basic material of one, or put your name or trademark on a product as if you made it, you answer as its manufacturer; so does a person who imports a product into the European Economic Area in the course of business (§§ 1(1) and 4(1) and (2)).
• If the manufacturer cannot be identified, name the manufacturer or the person who supplied you within one month of the injured person's request, or you are treated as the manufacturer (§ 4(3)).
• A product is defective if it does not offer the safety that may legitimately be expected, judged on its presentation, the use that can reasonably be expected and the time it was put into circulation (§ 3(1)).
• You carry the burden of proving an exclusion if it is disputed: that you did not put the product into circulation, that the defect probably did not exist then, that the defect results from compliance with mandatory legal rules, or that it could not be recognized according to the state of science and technology (§ 1(2) and (4)).
• Do not rely on a contract term to limit or exclude your liability in advance; such agreements are void (§ 14).
• Liability covers death, injury to body or health and damage to a thing other than the defective product that is ordinarily intended for private use; personal injury caused by identical defective products is capped at EUR 85 million, and the injured person bears the first EUR 500 of damage to a thing (§§ 1(1), 10(1) and 11).
• A claim is time-barred three years after the injured person learned, or should have learned, of the damage, the defect and the person liable, and expires ten years after you put the product into circulation (§§ 12(1) and 13(1)).

BGB § 327f, Aktualisierungen · Read the law's page

• If you are a trader supplying a digital product, meaning digital content or a digital service such as software or an app, to a consumer under a contract, Section 327f binds you.
• Provide the consumer, during the relevant period, with the updates needed to keep the digital product in conformity with the contract, including security updates, and inform the consumer about them (Section 327f(1)).

EinwV §§ 1-20 · Read the law's page

• Integrating a recognized consent-management service to ask for consent under section 25(1) of the TDDDG is voluntary (section 18(1)); you remain responsible for the GDPR information duties and the requirements for valid consent even where you integrate one (section 1(2)).
• If you integrate a recognized consent-management service, take the end users' settings into account, and where you have no consent from an end user through the integration, point to the end user's settings with the recognized service when you ask for consent (section 19(1)).
• If you integrate a recognized service and ask for end users' settings through it, you should, by technical and organizational measures reflecting the state of the art, take care that the end user's use of the service is taken into account when your digital service is called up and that it is checked whether settings are managed at the service (section 18(2)); you should also let the service store the consents you request, point end users at a visible and suitable place to the integration, cooperate with the service on the requirements of section 7, and give it the information required under Articles 7 and 12 to 14 of the GDPR in a machine-readable format (section 18(3)).
• If you manufacture or provide software for retrieving and presenting information from the internet, you should, within the technical possibilities, take care that it takes the integration of recognized services into account and does not suppress, delay, decrypt or otherwise alter a signal or end-user settings deposited through the recognized service or the provider of digital services (section 17).
• If you integrate a recognized service, you should not, without an objective reason, work toward end users using or excluding particular recognized services (section 20).
• To be recognized by the Federal Commissioner for Data Protection and Freedom of Information, a consent-management service must apply with a security concept (sections 8, 10 and 12) and meet the Part 2 requirements, among them: store the settings an end user made and transmit them to the provider on each further use, manage only consents for which the end user was informed in advance of the matters section 3(2) lists, and document the information on which a consent rests in a way that is easily accessible to the end user (section 3).

Barrierefreiheitsstärkungsgesetz (BFSG) vom 16. Juli 2021 (BGBl. I S. 2970), §§ 1 bis 3, 14, 16, 17, 37 und 38 · Read the law's page

• If you offer or provide to consumers a service listed in section 1(3) (telecommunications services other than machine-to-machine transmission services; the websites, mobile services and applications, electronic tickets, transport information and interactive self-service terminals of air, bus, rail and waterborne passenger transport, where for urban, suburban and regional transport only the interactive self-service terminals are covered; consumer banking services; e-books and dedicated software; e-commerce services), offer or provide it only if it meets the accessibility requirements of the Verordnung zum Barrierefreiheitsstärkungsgesetz, so that persons with disabilities can find, reach and use it in the generally customary way, without particular difficulty and in principle without outside help (BFSG, s. 3(1) and s. 14(1) item 1; Directive (EU) 2019/882, Art. 13(1)).
• For an e-commerce service (a digital service offered through a website or an application on a mobile device and provided electronically at a consumer's individual request with a view to concluding a consumer contract), that means the website or app must meet those requirements (s. 2 item 26 and s. 14(1)).
• State in your general terms and conditions, or in another clearly perceivable way, how the service meets the requirements: a general description of the service in an accessible format, the explanations needed to understand how it is carried out, a description of how it meets the applicable requirements, and the competent market surveillance authority; make that information available to the public in accessible form and keep it for as long as you offer or provide the service (s. 14(1) item 2 and (2); Annex 3, item 1).
• Ensure that the requirements are always met while you offer or provide the service, taking account of changes in how it is provided, changes in the requirements and changes in the harmonized standards or technical specifications you rely on (s. 14(3)).
• If the service does not meet the requirements, take the corrective measures needed to bring it into conformity and inform the market surveillance authority and the authorities of the Member States where you provide the service, without delay and with details of the non-conformity and the measures taken (s. 14(4)).
• Give the market surveillance authority, on its reasoned request, all the information needed to demonstrate conformity, and cooperate with it on every measure to restore conformity (s. 14(5)).
• You may rely on section 16 (a significant change that would fundamentally alter the basic nature of the service) or on section 17 (a disproportionate burden, judged on the criteria of Annex 4) only after you have assessed it and documented the assessment, which you keep for five years from the last time you provided the service and give the authority on request (ss. 16(1) and (2), 17(1) and (2)).
• If you rely on section 17, repeat the assessment for each category or type of service at least every five years, and whenever the service changes or the competent authority asks; you may not rely on it if you receive public or private funds, other than your own, to improve accessibility (s. 17(3) and (4)).
• If you rely on section 16 or 17 for a particular service, inform the market surveillance authority, and the authorities of the Member States where you provide the service, without delay (ss. 16(3) and 17(5)).
• The duty in section 3(1) does not apply to a microenterprise that offers or provides services: an enterprise that employs fewer than ten persons and has either an annual turnover of at most EUR 2 million or an annual balance sheet total of at most EUR 2 million (s. 3(3) and s. 2 item 17).
• The Act does not apply to pre-recorded time-based media and office file formats published before 28 June 2025, online maps and map services (if the essential navigation information is offered in accessible digital form), content of third parties that you neither finance, develop nor control, or content of websites and mobile applications that counts as an archive because it is not updated or revised after 28 June 2025 (s. 1(4)).
• Until 27 June 2030 you may go on providing your services with products you lawfully used for that or similar services before 28 June 2025, and a service contract concluded before 28 June 2025 may continue unchanged until it expires, but no longer than 27 June 2030 (s. 38(1)).
• A self-service terminal you lawfully used before 28 June 2025 may stay in use for comparable services until the end of its economic useful life, but no longer than fifteen years after it was put into use (s. 38(2)); the Directive would have allowed 20 years (Art. 32(2)).

Barrierefreiheitsstärkungsgesetz (BFSG), §§ 1 Abs. 2, 6 bis 8, 12, 16 bis 19 und 37 · Read the law's page

• If you manufacture a product listed in section 1(2) and place it on the market in the Union after 28 June 2025, make it accessible, so that persons with disabilities can find, reach and use it in the generally customary way, without particular difficulty and in principle without outside help, to the requirements of the Verordnung zum Barrierefreiheitsstärkungsgesetz (BFSG, s. 3(1); Directive (EU) 2019/882, Art. 7(1)).
• Place the product on the market only if it was designed and manufactured to those requirements, the technical documentation under Annex 2 was prepared, the conformity assessment (an internal production control) was carried out and showed conformity, an EU declaration of conformity was issued under section 18, and the CE marking was affixed under section 19 (s. 6(1)).
• Keep the technical documentation and the EU declaration of conformity for five years after placing the product on the market, and make sure by suitable procedures that series production stays in conformity, taking changes in product design and in the standards or technical specifications relied on into account (s. 6(2) and (3)).
• If you know or have reason to believe that a product you placed on the market does not meet the requirements, take the corrective measures needed without delay, withdraw or recall it if conformity cannot be restored, and inform the market surveillance authority and the authorities of the Member States where you placed it, with details of the non-conformity and the measures taken (s. 6(4)).
• Keep a register of the products whose non-conformity you reported to the authorities and of the complaints about them, in writing or electronically (s. 6(5)).
• Put a type, batch or serial number or another identifier on the product (or on the packaging or an accompanying document where the size or nature of the product makes that impossible), state your name, trade name or brand and a postal address with a central contact point in a language consumers easily understand, and ensure that instructions for use and safety information in German, clear, understandable and distinct as the ordinance requires, accompany it (s. 7(1) to (4)).
• Give the market surveillance authority, on its reasoned request, all information and documents needed to show conformity, in German or a language the authority easily understands, and cooperate with it on any measure to restore conformity (s. 7(5)).
• If you appoint an authorized representative, give it in writing at least the duties to keep the declaration and documentation for five years, to supply information and documents to the authority and to cooperate with it; you may not transfer the duty to design and manufacture to the requirements or to prepare the technical documentation (s. 8(3) and (4)).
• If you are an importer or distributor that sells a product under your own name or brand, or modifies a product already on the market so that its conformity may be affected, meet the manufacturer's duties in sections 6 and 7 (s. 12).
• Rely on section 16 (fundamental alteration) or section 17 (disproportionate burden, judged on the criteria of Annex 4) only after you have assessed it and documented the assessment, which you keep for five years from the last making available of a product and show to the authority on request; inform the market surveillance authority and those of the Member States where the product is placed without delay; you may not rely on section 17(1) if you receive public or private funds, other than your own, to improve accessibility; and the EU declaration of conformity states which requirements the exception affects (ss. 16(1) to (3), 17(1) to (5) and 18(2)).
• A microenterprise dealing with products need not keep the documentation or notify the authority when it relies on section 16 or 17, but must give the authority on request the facts relevant to its assessment (ss. 16(4) and 17(2)).

Barrierefreiheitsstärkungsgesetz (BFSG), §§ 20 bis 23, 28 bis 30, 32 bis 35 · Read the law's page

• If a market surveillance authority checks a product or service of yours, cooperate fully with it; economic operators must cooperate with the authority in checking a product (BFSG, s. 22(1)), and must give it, on its reasoned request, the information it needs for its tasks, though you may refuse to answer a question whose answer would expose you or a relative to criminal prosecution or to proceedings for an administrative offence, and you must be told of that right (s. 35).
• If the authority finds that a product does not meet the requirements, take suitable measures to restore conformity within the reasonable period it sets, and extend them to all the affected products you made available on the Union market; if you do not, the authority restricts or prohibits making the product available on the German market, or has it withdrawn or recalled (s. 22(2) to (4)).
• If the authority finds a formal non-conformity (a missing or incorrect CE marking or EU declaration of conformity, unavailable or incomplete technical documentation, missing or incorrect manufacturer or importer details, or another unmet formal obligation under sections 6, 7, 9 or 10), correct it within the reasonable period it sets, failing which it restricts or prohibits making the product available until conformity is established (s. 23).
• If the authority finds that a service does not meet the requirements, take suitable corrective measures within the period it sets; if you do not, it calls on you again under threat of prohibiting the service, and if you still do not, it can order you to stop offering or providing the service within a period it sets, and withdraws the order once you show conformity (s. 29).
• If the authority finds a formal non-conformity of a service (the information under Annex 3 not prepared, or not completely, or not made available to the public in accessible form, or not completely), correct it within the reasonable period it sets, failing which it calls on you again under threat of prohibition and then takes the necessary measures (s. 30).

Barrierefreiheitsstärkungsgesetz (BFSG), §§ 9 bis 11, 13 und 37 · Read the law's page

• If you are an importer, place on the market only products that meet the accessibility requirements of the Verordnung zum Barrierefreiheitsstärkungsgesetz, and only after the manufacturer has carried out the conformity assessment under Annex 2, prepared the technical documentation, marked the product with the CE marking and met its marking duties, and the product carries instructions for use and safety information (BFSG, s. 9(1) and (2); Directive (EU) 2019/882, Art. 9).
• If you are an importer and know or have reason to believe that a product does not meet the requirements, do not place it on the market until conformity is restored, inform the manufacturer and the market surveillance authorities, and keep storage and transport conditions that do not impair conformity (s. 9(3) and (4)); the corrective-measure, withdrawal, recall and register duties of section 6(4) and (5) apply to you in the same way (s. 9(5)).
• State your name, trade name or brand and postal address on the product (or its packaging or an accompanying document), ensure that German instructions for use and safety information that meet the ordinance accompany it, keep a copy of the EU declaration of conformity for five years for the authorities and be able to produce the technical documentation on request, and give the authority the information and documents it asks for on a reasoned request (s. 10 and s. 7(5)).
• If you are a distributor, make a product available on the market only when it bears the CE marking, the instructions and safety information accompany it, and the manufacturer and the importer have met their marking duties (s. 11(1); Directive (EU) 2019/882, Art. 10).
• If you are a distributor and know or have reason to believe that a product does not meet the requirements, do not make it available until conformity is restored, and inform the manufacturer or importer and the market surveillance authorities without delay; keep storage and transport conditions that do not impair conformity; and ensure that corrective measures are taken and the product is withdrawn if conformity cannot be restored, informing the market surveillance authority and those of the Member States where you made it available, with details (s. 11(2) to (4)).
• If you are a distributor, give the authority the information and documents it asks for on a reasoned request and cooperate with it on measures to restore conformity (s. 11(5) with s. 7(5)).
• If you are an importer or distributor that sells a product under your own name or brand, or modifies a product already on the market so that its conformity may be affected, meet the manufacturer's duties in sections 6 and 7 instead (s. 12; Directive (EU) 2019/882, Art. 11).
• Tell the market surveillance authority, on its request, from whom you obtained a product and to whom you supplied it, and be able to produce that information for at least five years from obtaining or supplying the product (s. 13(1) and (2)).
• The defences of section 16 (fundamental alteration) and section 17 (disproportionate burden) and the relief for microenterprises dealing with products apply to you as to a manufacturer (ss. 16 and 17).

Medienstaatsvertrag (MStV), §§ 99a bis 99e · Read the law's page

• If you offer consumers a service that gives access to audiovisual media services (a telemedium used to find, select, get information on and watch television programmes and television-like telemedia, including an electronic programme guide), ensure accessible access, design the selection of offers accessibly and support accessible use, meeting the requirements of Annex I, Section III and Section IV, point (b) of Directive (EU) 2019/882 (MStV, s. 99a(1) and s. 2(2) item 31; Directive (EU) 2019/882, Art. 2(2)(b)).
• Rely on a disproportionate burden (judged on Annex VI of the Directive) or on a fundamental alteration of the service only after assessing it; document the assessment, keep its results for five years after you last provide the service and send the competent Landesmedienanstalt a copy on request; and if you rely on a disproportionate burden, repeat the assessment when the service changes, when the Landesmedienanstalt asks, and at least every five years (s. 99a(1) to (4)).
• You may not rely on a disproportionate burden if you receive public or private funds, other than your own, to improve accessibility (s. 99a(1)).
• If the service does not conform, take the corrective measures needed and inform the competent Landesmedienanstalt and the authorities of the Member States where you provide it without delay, with details; if you rely on a disproportionate burden or a fundamental alteration, send information on it to the authorities of the Member State where the service is provided; and give the Landesmedienanstalt, on request, the information needed to show conformity (s. 99b(2) to (4)).
• State, in accessible form for the public, in your general terms and conditions or in another clearly perceivable way, how the service meets the requirements, with a general description of the service, the explanations needed to use it and the competent Landesmedienanstalt, and keep that information for as long as you offer the service (s. 99c).
• Conformity with harmonized standards whose references are published in the Official Journal of the European Union, or with technical specifications under Article 15(3) of the Directive, is presumed to meet the requirements (s. 99b(1)).
• These duties do not apply to a microenterprise within the meaning of Article 3(23) of Directive (EU) 2019/882 (s. 99a(5)).
• Until 27 June 2030 you may go on providing the service with products you lawfully used for it before 28 June 2025, and a contract concluded before 28 June 2025 may continue unchanged until it expires, but no longer than five years from that date (s. 121a(2)).

Verordnung zum Barrierefreiheitsstärkungsgesetz (BFSGV), §§ 1 bis 22 · Read the law's page

• If you place on the market a product listed in section 1(2) of the BFSG, or provide a service listed in section 1(3) to consumers, meet the requirements of the Verordnung zum Barrierefreiheitsstärkungsgesetz (BFSGV, s. 1; Directive (EU) 2019/882, Annex I); a microenterprise that provides services is exempt from the duty (BFSG, s. 3(3)).
• Observe the state of the art in meeting the requirements; you may depart from it if the requirements are met to the same degree in another way, and the Bundesfachstelle für Barrierefreiheit publishes the standards it regards as most important on its website (s. 3). Conformity with a harmonized standard whose reference is published in the Official Journal of the European Union is presumed to meet the requirements it covers (BFSG, s. 4).
• Products: give the information on the product itself (labels, instructions for use, warnings) through more than one sensory channel, in an understandable and perceivable way, in a font of suitable size and shape with sufficient contrast and spacing (s. 4(1)); make public, when the product is placed on the market, the information on its accessibility features, their activation and interoperability with assistive technologies, and on its use, in the ten ways section 4(2) lists, and give the information on the product itself where possible (s. 4(2) and (3)).
• Products: put the packaging information on the packaging where its size or nature allows, and make installation, maintenance, storage and disposal instructions that are not on the product publicly available and accessible when the product is placed on the market, except for self-service terminals (s. 5).
• Products: give the product, including its user interface, components, functions and features that let persons with disabilities access, perceive, operate, understand and control it (s. 6(1)), and meet the thirteen requirements of section 6(2): more than one sensory channel, alternatives to speech and voice input, flexible size, brightness, contrast and visual clarity, alternatives to colour and to audible signals, volume and speed control with enhanced audio functions, sequential control and alternatives to fine motor control with tactilely recognizable parts, no operation needing great reach or force, no triggering of photosensitive seizures, privacy when accessibility features are used, alternatives to biometric identification and control, consistency with enough flexible time, and software and hardware interfaces for assistive technologies.
• Self-service terminals: provide speech output, allow individual headphones, warn through more than one sensory channel when response time is limited and allow it to be extended, provide buttons with sufficient contrast and tactile recognizability, use audio signals compatible with hearing aids, telecoils, cochlear implants and technical hearing aids, and do not require anyone to activate accessibility features before the terminal can be switched on (s. 7).
• E-book readers: provide speech output (s. 8). Consumer terminal equipment with interactive computing capability for telecommunications services: support real-time text where text is used with voice, high audio quality, total conversation services where video is used, an effective wireless connection to hearing technology, and operation without interference with assistive devices (s. 9). Equipment used to access audiovisual media services: provide the accessibility components that the media service provider offers for access, selection, control, personalization and transmission to assistive devices (s. 10).
• Support services such as help desks, call centres, technical support, relay services and training, where available, give accessible information on accessibility and compatibility with assistive technologies through accessible means of communication (ss. 11 and 12 item 4).
• Services: the products you use to provide a service meet sections 4 and 6 to 11 (and section 5 where applicable); information on how the service works, on its connection to those products and on their accessibility features and interoperability is given through more than one sensory channel, findable, understandable, perceivable, in text formats suitable for generating alternative assistive formats, with alternatives to non-text content and in a suitable font; and websites with their online applications and mobile services including apps are perceivable, operable, understandable and robust (s. 12).
• Services: provide functions, procedures, strategies and changes in how the service is carried out that are oriented to the needs of persons with disabilities and ensure interoperability with assistive technologies (s. 13).
• Telecommunications services: where a service enables voice communication, provide real-time text in addition to voice, and a total conversation service where it provides video; synchronize emergency communications across voice and text (and total conversation where video is provided) and pass them on without delay to the local emergency answering point (s. 14).
• Passenger transport services by air, bus, rail and waterborne transport, other than urban, suburban and regional services: provide information on the accessibility of vehicles, surrounding infrastructure and buildings and on assistance, information on smart ticketing systems such as electronic reservation and booking, real-time travel information such as timetables, disruptions, connections and onward travel, and additional service information such as staff on duty at the station, defective lifts and services temporarily unavailable (s. 15); for urban, suburban and regional transport, the interactive self-service terminals used meet sections 4, 6, 7 and 11 (s. 16).
• Consumer banking services: make identification methods, authentication methods, electronic signatures, security functions and payment services perceivable, operable, understandable and robust, and keep information on how the service works at a language level no higher than B2 of the Common European Framework of Reference for Languages (s. 17).
• E-books: provide synchronized text and audio where the e-book has both, do not prevent assistive technologies from working, ensure access to content and navigation including dynamic layouts, provide a structure, flexibility and choice in presentation and alternative ways of rendering the content, ensure interoperability with assistive technologies, provide metadata that makes accessibility features findable, and ensure that accessibility features are not blocked by technical protection measures under sections 95a to 96 of the Copyright Act (s. 18).
• E-commerce services: provide information on the accessibility of the products and services offered, to the extent the responsible economic operator supplies it, and make identification, authentication, security and payment functions, and identification methods, authentication methods, electronic signatures and payment services, perceivable, operable, understandable and robust (s. 19).
• For functions that sections 4 to 19 do not cover, meet the functional performance criteria of section 21: where a product or service offers visual operation, at least one way of use without vision, one with limited vision and one without colour discrimination; for audible operation, one without hearing and one with enhanced audio; where voice input is needed, one without it; for manual operation, one that needs no fine motor control, hand strength or simultaneous use of several controls; controls within reach of all users; no photosensitive seizure triggers; at least one way of use that eases use with cognitive limitations; and privacy when accessibility features are used (ss. 20(1) and 21); where sections 4 to 19 set a specific technical requirement, you may meet the functional performance criteria instead only if you meet the other requirements of those sections and the result is equally or more accessible (s. 20(2)).

Entwurf eines Gesetzes zur Modernisierung des Produkthaftungsrechts · Read the law's page

• If you develop or make software, or have it designed or made, you answer as its manufacturer; free and open-source software developed or supplied outside a business activity is outside the definition of a product (§§ 2(1) No. 3 and 3).
• Keep supplying the software updates and upgrades needed to keep the product safe while the product is within your control: if you are able to provide them yourself or through a third party you keep control, and a defect caused by software, by an update or upgrade, or by a missing necessary update is not excused because it arose after you put the product into circulation (§§ 8(2) and 9(2)).
• Meet the product-safety requirements that apply to your product, safety-relevant cybersecurity requirements included: they count in judging whether it is defective (§ 7 No. 5), and failing a binding product-safety requirement that protects against the injury presumes it defective (§ 20(1) No. 2).
• Account for what your product learns or acquires after it is put into circulation: the effect of that ability is weighed in judging whether it is defective (§ 7 No. 3).
• Keep records you could produce if a court orders disclosure on a claimant's plausible claim; failing to disclose despite the order presumes the product defective (§§ 19(1) and 20(1) No. 1).
• If you hold relevant evidence for a product liability claim against someone else, the court can, on the claimant's application, order you as a third party to disclose it, limited to what is necessary and proportionate, except to the extent you may refuse to testify under sections 383 to 385 of the Code of Civil Procedure (§ 19(1) and (3)).
• If you are a manufacturer outside the EU, your importer into the EU market and your representative appointed in writing and established in the EU are liable as the manufacturer is, and where there is neither, the fulfilment service provider is liable too (§§ 10 and 11).
• If you make a product available in the supply chain without being its manufacturer or importer, or run an online platform that lets consumers conclude distance contracts with traders where the conditions of Article 6(3) of the Digital Services Act are met, you are liable as the manufacturer is when no manufacturer, importer, representative or fulfilment service provider established in the EU can be identified, unless within one month of receiving the injured person's request you name one of them or your own supplier of the product (§§ 12 and 13).
• If you substantially modify a product without the manufacturer's consent and then make it available on the market or put it into operation, you are the manufacturer of the modified product (§ 5(1)).
• Do not rely on a contract term to limit or exclude your liability to an injured person; departing from the Act to their disadvantage is not allowed (§ 18).
• You are excused if you did not put the product into circulation, if the defect results from the product meeting legal requirements, or if the defect could not be recognized according to the objective state of science and technology at the relevant time (§ 9(1)).
• Claims lapse three years after the creditor learned, or should have learned, of the defect, the damage and the identity of the debtor, and expire ten years after the product was put into circulation or into operation, or 25 years for a latent personal injury (§§ 16 and 17).