# Software is now a product: what changed in v1.2.0, sgit.ai > The changes to the article "Software is now a product" in v1.2.0, paragraph by paragraph. *Source: · sgit.ai v0.7.87 · this file is generated from the same content as the page, so the two cannot drift. Every page on this site has a `.md` twin; internal links below point at them.* --- [Home](../../../index.md) / [Articles](../../index.md) / [Software is now a product](../../software-is-now-a-product.md) / [Versions](../software-is-now-a-product.md) / v1.2.0 # Software is now a product: what changed in v1.2.0 From v1.1.0 (2026-10-25, `9b4a89d1f`) to v1.2.0 (2026-10-27, `db67c5ce1`), paragraph by paragraph. 0 paragraphs added, 0 removed, 3 changed in place, 50 unchanged. About 0 words added and 199 removed. Insertions are marked like this, deletions like this; unchanged runs are folded to one line; figures appear as their file names. [← v1.1.0](v1.1.0.md) · [all versions](../software-is-now-a-product.md) 2 unchanged paragraphs !shot lz-card.webp | images/ | Lauren Zabierek's LinkedIn post on LinkedIn,of 25 October 2026: acardcard, R-05,R-05 on the Product Liability Directive. The 1985 directive never named software; Directive 2024/2853 makes standalone software, SaaS, AI systems and digital manufacturing files products, subject to strict, no-fault liability; courts can presume defectiveness and causation where a defect is too complex to prove; the liability cannot be waived by a EULA; it applies to products placed on the EU market from 9 December 2026. | small | aside 12 unchanged paragraphs, under In short {#in-short}, Why I read it {#why}, What the articles say {#articles} !shot lz-tests.webp | images/ | Does the new Product Liability Directive bite? Six questions,questions in order:order,is it a product (software is, including SaaS; services as such and mere source code are not); was it placed onthen the market after 9 December 2026; was it supplied in a commercial activity (non-commercial open source is excluded); is the injured person a natural person; is the damage covered (injury, private property, private data destroyed or corrupted); is the product defective (judged with safety-relevant cybersecurity requirements). Then the defences,defences and what is not a defence. | concept 8 unchanged paragraphs, under php2shell, under the new rules {#php} !shot lz-php.webp | images/ | php2shell under the new directive: who is likely liable and who is not, across the PHP project, no,vendorsopenandsource outside a commercial activity; a vendor shipping an appliance or app on unpatched PHP, likely, for a consumer's injury, property or personal data destroyed; a SaaS whose unpatched PHP lets attackers wipe or encrypt consumers' personal files, likely; the same SaaS if attackers only steal the data, not under this directive; a business that loses its own data, no claim under this directive; a product shipped on end-of-life PHP 7.4, hard to defend. A reading of the text, not legal advice.SaaS. | concept 28 unchanged paragraphs, under Will it stop companies updating? {#incentives}, The questions it leaves {#questions}, What this does not claim {#limits}… [← v1.1.0](v1.1.0.md) · [all versions](../software-is-now-a-product.md) --- *[Site index for agents](../../../llms.txt) · [HTML version](https://newsroom.sgit.ai/articles/versions/software-is-now-a-product/v1.2.0.html)*