Distributes a software product, in the United Kingdom

Consumer Protection Act 1987, c. 43, Part I (ss. 1-9) · Read the law's page

• The Act defines a product as any goods or electricity, including one comprised in another product as a component part; it is uncertain whether that reaches software or an AI system supplied on its own, and the Law Commission of England and Wales has proposed that it should (section 1(2)).
• If you manufacture a product, put your name or trademark on it as if you made it, or import it into the United Kingdom to supply it in the course of business, you are liable for damage a defect in it causes, and the injured person does not have to prove fault (section 2(1) and (2)).
• If you only supply a product and the injured person asks you to identify the producer, own-brander or importer, within a reasonable period after the damage and when they cannot reasonably identify all of them, answer within a reasonable period by identifying them or the person who supplied it to you, or you are liable for the damage yourself (section 2(3)).
• A product is defective if its safety is not such as persons generally are entitled to expect; all the circumstances count, including how you marketed it, your instructions and warnings, what might reasonably be done with it and when you supplied it (section 3).
• Do not rely on a contract term, a notice or any other provision to limit or exclude this liability to an injured person or to a dependant or relative of one (section 7).
• You have a defense if the defect is attributable to compliance with a legal requirement, did not exist in the product at the relevant time, or could not have been discovered given the state of scientific and technical knowledge at the relevant time (section 4(1)(a), (d) and (e)).
• Claims cover death, personal injury and loss of or damage to property ordinarily intended for private use, but not damage to the product itself, and property damage of £275 or less is not compensated (section 5).
• In England and Wales a claim must be brought within three years of the later of when it accrued and the claimant's date of knowledge, and the right of action is extinguished ten years after the relevant time (Limitation Act 1980, section 11A).

Copyright, Designs and Patents Act 1988, ss. 3, 16 and 21 · Read the law's page

• Get the copyright owner's licence before you copy a work, issue copies of it to the public, rent or lend it to the public, perform, show or play it in public, communicate it to the public, or make an adaptation of it (s. 16(1)).
• Do not do, or authorise another to do, any of those acts without the licence of the copyright owner: a person who does so infringes the copyright (s. 16(2)).
• Treat copying or otherwise dealing with a substantial part of a work, directly or indirectly, as dealing with the work, whether or not any intervening act itself infringes copyright (s. 16(3)).
• Treat a computer program, and preparatory design material for one, as a literary work in which copyright subsists once it is recorded, in writing or otherwise (s. 3(1) and (2)).
• Treat an arrangement or altered version of a computer program, or a translation of it, including a version converted into or out of a computer language or code or into a different one, as an adaptation, and making one as an act restricted by the copyright (s. 21(1), (3)(ab) and (4)).
• Check the acts permitted in relation to copyright works in Chapter III and the copyright licensing provisions in Chapter VII, to which the restrictions are subject (s. 16(4)).

Consumer Rights Act 2015, c. 15, s. 46 · Read the law's page

• This binds a trader that supplies digital content to a consumer under a contract; a trader acts for purposes relating to its trade, business, craft or profession, and a consumer is an individual acting wholly or mainly outside them (sections 2(2), 2(3) and 46(1)).
• If your digital content damages the consumer's device or other digital content, and the damage would not have occurred had you exercised reasonable care and skill, repair the damage within a reasonable time and without significant inconvenience to the consumer, bearing the necessary costs, or compensate the consumer with an appropriate payment (section 46(1) to (3)).
• Pay any compensation without undue delay and within 14 days of agreeing that the consumer is entitled to it, and charge the consumer no fee for the payment (section 46(5) and (6)).

Automated and Electric Vehicles Act 2018, c. 18, Part 1 (ss. 1-8) · Read the law's page

• This applies only to a vehicle the Secretary of State has listed as an automated vehicle under section 1, and it binds the insurer of that vehicle (or its owner in the public-body cases), not a software developer directly (sections 1(4) and 2).
• If you supply the software or the vehicle that drives itself, the insurer or owner that has settled the injured person's claim can recover from you wherever you are also liable to that person for the accident (section 5(1)).
• If you are an insured person, do not make software alterations the policy prohibits and install the safety-critical software updates you know or ought reasonably to know are safety-critical; otherwise the policy may exclude or limit the insurer's liability to you, and the insurer may recover from you what it paid to others to the extent the policy provides; if you are not the holder of the policy, the alterations limb reaches you only if you knew at the time of the accident that the alterations were prohibited (section 4(1), (2) and (4)).
• Liability to an injured person cannot be limited or excluded by an insurance policy term or in any other way, except as section 4 allows (section 2(6)).
• For damage to property in one accident, liability is capped at the compulsory-insurance property limit in section 145(4)(b) of the Road Traffic Act 1988 (section 2(4)).

Product Security and Telecommunications Infrastructure Act 2022, c. 46, Part 1; Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023, SI 2023/1007 · Read the law's page

• This binds a manufacturer, importer or distributor of a physical internet- or network-connectable consumer product placed on the UK market, and does not by itself reach a company that only publishes an app or other software with no connectable product of its own.
• Ban universal default passwords and easily guessable passwords across the product's hardware and pre-installed or required software; a password must be unique per unit or set by the user, and must not be built from incremental counters or from publicly derivable identifiers.
• Publish at least one point of contact for reporting a security issue affecting the product, in English, free of charge, without requiring the reporter's personal information, and state when the reporter will get an acknowledgment and status updates.
• Publish the minimum period for which the product will receive security updates, in plain language, before or at the point of sale, and never shorten that stated period once published.
• The duties to publish a reporting contact and a minimum update period do not reach software used on a smartphone or a cellular-capable tablet computer, and the whole regime excepts a desktop computer, a laptop computer, a non-cellular tablet computer, an electric-vehicle charge point, most medical devices, and an assured smart meter.
• Before making a connectable product available in the United Kingdom, have it accompanied by a statement of compliance, or a summary of one, in which the manufacturer states its opinion that it has complied with the applicable security requirements; a product that holds a current Japan JC-STAR STAR-1 label or a current Singapore Cybersecurity Labelling Scheme label is treated as meeting both the security requirements and this statement duty.

Crime and Policing Act 2026, c. 20, s. 99, inserting ss. 66I-66L into the Sexual Offences Act 2003 · Read the law's page

• Do not make or adapt a thing, or supply or offer to supply a thing, for use as a generator of purported intimate images, meaning a thing for creating, or facilitating the creation of, purported intimate images of a person.
• A thing includes a program, information in electronic form and a service, and you are treated as making, adapting, supplying or offering the thing for that use if a reasonable person, having regard to all the circumstances, would consider that you do.
• It is a defense to prove that you took all reasonable steps to prevent the thing being used for creating, or facilitating the creation of, purported intimate images of a person without the person's consent.
• A service provider that only provides access to a communication network, or transmits or temporarily stores information provided by a user in the ways section 66K describes, does not commit the offense, and a provider that stores a user's information keeps that protection only if it did not know the information was or contained a generator of purported intimate images and promptly removes it or disables access once it knows.

Crime and Policing Act 2026, c. 20, s. 72, inserting ss. 46A-46C into the Sexual Offences Act 2003 · Read the law's page

• Do not make or adapt a thing, including a program, information in electronic form or a service, for use for creating, or facilitating the creation of, child sexual abuse images.
• Do not possess, supply or offer to supply a thing that is made or adapted for that use; it is a defense to prove that you did not know, and had no cause to suspect, that the thing was a CSA image-generator.
• A service provider that only provides access to a communication network, or transmits or temporarily stores information provided by a user in the ways the section describes, does not commit the offense, and a provider that stores a user's information keeps that protection only if it did not know the information was or contained a CSA image-generator and promptly removes it or disables access once it knows.

Crime and Policing Act 2026, c. 20, s. 73, inserting Arts. 42A-42C into the Sexual Offences (Northern Ireland) Order 2008 · Read the law's page

• Do not make or adapt a thing, including a program, information in electronic form or a service, for use for creating, or facilitating the creation of, child sexual abuse images.
• Do not possess, supply or offer to supply a thing that is made or adapted for that use; it is a defense to prove that you did not know, and had no cause to suspect, that the thing was a CSA image-generator.
• A service provider that only provides access to a communication network, or transmits or temporarily stores information provided by a user in the ways the section describes, does not commit the offense, and a provider that stores a user's information keeps that protection only if it did not know the information was or contained a CSA image-generator and promptly removes it or disables access once it knows.

Crime and Policing Act 2026, c. 20, s. 74, inserting ss. 52D-52E into the Civic Government (Scotland) Act 1982 · Read the law's page

• Do not make or adapt a thing, including a program, information in electronic form or a service, for use for creating, or facilitating the creation of, child sexual abuse images.
• Do not possess, supply or offer to supply a thing that is made or adapted for that use; it is a defense to prove that you did not know, and had no cause to suspect, that the thing was a CSA image-generator.
• A service provider that only provides access to a communication network, or transmits or temporarily stores information provided by a user in the ways the section describes, does not commit the offense, and a provider that stores a user's information keeps that protection only if it did not know the information was or contained a CSA image-generator and promptly removes it or disables access once it knows.