Home / Articles / Software is now a product / Versions / v1.2.0
Software is now a product: what changed in v1.2.0
From v1.1.0 (2026-10-25, 9b4a89d1f) to v1.2.0 (2026-10-27, db67c5ce1), paragraph by paragraph.
0 paragraphs added, 0 removed, 3 changed in place, 50 unchanged. About 0 words added and 199 removed. Insertions are marked like this, deletions like this; unchanged runs are folded to one line; figures appear as their file names.
2 unchanged paragraphs
!shot lz-card.webp | images/ | Lauren Zabierek's LinkedIn post on LinkedIn,of 25 October 2026: acard card, R-05,R-05 on the Product Liability Directive. The 1985 directive never named software; Directive 2024/2853 makes standalone software, SaaS, AI systems and digital manufacturing files products, subject to strict, no-fault liability; courts can presume defectiveness and causation where a defect is too complex to prove; the liability cannot be waived by a EULA; it applies to products placed on the EU market from 9 December 2026. | small | aside
12 unchanged paragraphs, under In short {#in-short}, Why I read it {#why}, What the articles say {#articles}
!shot lz-tests.webp | images/ | Does the new Product Liability Directive bite? Six questions,questions in order:order, is it a product (software is, including SaaS; services as such and mere source code are not); was it placed onthen the market after 9 December 2026; was it supplied in a commercial activity (non-commercial open source is excluded); is the injured person a natural person; is the damage covered (injury, private property, private data destroyed or corrupted); is the product defective (judged with safety-relevant cybersecurity requirements). Then the defences,defences and what is not a defence. | concept
8 unchanged paragraphs, under php2shell, under the new rules {#php}
!shot lz-php.webp | images/ | php2shell under the new directive: who is likely liable and who is not, across the PHP project, no,vendors openand source outside a commercial activity; a vendor shipping an appliance or app on unpatched PHP, likely, for a consumer's injury, property or personal data destroyed; a SaaS whose unpatched PHP lets attackers wipe or encrypt consumers' personal files, likely; the same SaaS if attackers only steal the data, not under this directive; a business that loses its own data, no claim under this directive; a product shipped on end-of-life PHP 7.4, hard to defend. A reading of the text, not legal advice.SaaS. | concept
28 unchanged paragraphs, under Will it stop companies updating? {#incentives}, The questions it leaves {#questions}, What this does not claim {#limits}…