On 9 December 2026 (Directive (EU) 2024/2853, Art. 22(1)) the deadline expires by which member states must transpose the new Product Liability Directive; with effect from the same day, Directive 85/374/EEC is repealed (Art. 21). In Germany, product liability law is to be comprehensively reformed for the first time since 1989 (BMJV). For technical wholesale, this is less a legal question than a data question: can your shop, years later and within one month (Art. 8(3) of the Directive), say who the manufacturer is, who represents it in the EU and where the goods came from, for every line it sold? This article shows which fields, links and information channels shop, ERP and customer portal need for that. It is not legal advice – the legal assessment of your range belongs with your legal department or law firm.
Key takeaways
- Two regimes run side by side: the new Directive applies to products placed on the market after 9 December 2026 (Art. 2(1)); older products stay under the previous law. What counts is a date from the supply chain, not the sales date in the shop.
- If no manufacturer, importer, authorised representative or fulfilment service provider established in the EU can be identified, the supplier is liable unless it names a responsible economic operator or its own supplier within one month (Art. 8(3)) of a request.
- The long-stop period is ten years (Art. 17(1)), or 25 years (Art. 17(2)) for personal injury with late-appearing symptoms. For consumer products, the General Product Safety Regulation requires supplier information for only six years (Art. 15(5) GPSR).
- Anyone who substantially modifies a product outside the manufacturer’s control and makes it available again is considered its manufacturer (Art. 8(2)). Assembled, modified or retrofitted items therefore need a dedicated flag with a date.
- Software, digital manufacturing files and raw materials explicitly count as products (Art. 4 point 1). Firmware versions, parameter files and downloads belong in the same documentation as the hardware.
- The item master only shows today’s supplier. What holds up is the origin per order line: goods receipt, upstream supplier and EU operator, passed from the ERP to shop and customer portal and stored there unchanged.
What changes on 9 December 2026
Current product liability rests on the Directive of 1985, which Germany transposed in 1989 (BMJV) through its Product Liability Act. Directive (EU) 2024/2853 replaces this foundation. Member states must transpose it by 9 December 2026 (Art. 22(1)), and with effect from the same day Directive 85/374/EEC is repealed (Art. 21). The transitional rule is what matters for data retention: the old Directive continues to apply to products placed on the market or put into service before that date (Art. 21), the new one to everything afterwards (Art. 2(1)). For years, two sets of rules will run side by side, and a date from the supply chain decides which one applies.
In Germany, the Federal Ministry of Justice and Consumer Protection has published a government draft dated 17 December 2025 (BMJV); because of the number of changes, the Product Liability Act is to be rewritten. At the time of writing, the official statute portal still showed the previous Product Liability Act. The following sections therefore rely on the text of the Directive, which sets the key points for all member states, and on the current Act for comparison. The table shows the points that matter for data retention in trade.
| Point | Product Liability Act (current) | Directive (EU) 2024/2853 |
|---|---|---|
| Definition of product | movable items and electricity (Section 2 ProdHaftG) | additionally and explicitly digital manufacturing files, raw materials and software (Art. 4 point 1) |
| Supplier without an identifiable manufacturer | liable unless it names the manufacturer or its own supplier within one month (Section 4(3) ProdHaftG) | liable unless it names an economic operator or its own supplier within one month; authorised representative and fulfilment service provider are explicitly part of the chain (Art. 8) |
| Cap for personal injury | 85 million euros (Section 10(1) ProdHaftG) | liability must not be limited by national law, for example through financial ceilings (Art. 15, recital 56) |
| Limitation | three years from knowledge (Section 12(1) ProdHaftG) | three years from knowledge (Art. 16(1)) |
| Expiry | ten years after placing on the market (Section 13(1) ProdHaftG) | ten years, 25 years for latent personal injury; restarts after a substantial modification (Art. 17) |
| Substantial modification | no explicit rule in the statutory text | anyone who substantially modifies outside the manufacturer’s control and makes available is considered the manufacturer (Art. 8(2)) |
Not legal advice, but data work
Who is liable: from manufacturer to supplier
The Directive defines which economic operators are liable (Art. 8(1)). First comes the manufacturer of the defective product, alongside the manufacturer of a defective component. If the manufacturer is established outside the Union, the importer and the manufacturer’s authorised representative are liable as well. If there is neither an importer established in the Union nor an authorised representative, the fulfilment service provider is liable (Art. 8(1)(c)(iii)). A fulfilment service provider is anyone offering at least two (Art. 4 point 13) of the services warehousing, packaging, addressing and dispatching for a product it does not own. Several liable parties are jointly and severally liable (Art. 12(1)); whoever pays can seek recourse against the others under national law (Art. 14).
At the end of the chain stands the supplier: anyone in the supply chain who makes a product available on the market and is neither its manufacturer nor its importer (Art. 4 point 14). That is the typical distributor in technical wholesale. If no responsible economic operator established in the Union can be identified, every supplier of the defective product is liable if the injured person asks it to name such an operator or its own supplier and it fails to do so within one month (Art. 8(3)) of receiving the request. The one-month period itself is not new; current German law already contains it (Section 4(3) ProdHaftG). What is new is that the authorised representative and the fulfilment service provider are explicitly part of the chain and that naming aims at an economic operator established in the Union.
For B2B trade it is worth looking at which damage is compensated (Art. 6(1)). Any natural person who suffers damage caused by a defective product has a claim (Art. 5(1)). Covered are death and personal injury including medically recognised damage to psychological health, damage to or destruction of property, and destruction or corruption of data not used for professional purposes. Excluded, among other things, is property used exclusively for professional purposes. If a supplied pressure regulator damages a plant at the customer’s site, that property damage therefore falls outside the Directive. If a fitter is injured in the process, however, there is personal injury – and then it matters who supplied the regulator. The table maps the roles a distributor can end up in to the data it needs for each.
| Role in technical wholesale | When it applies | Data the shop needs |
|---|---|---|
| Supplier | distributor makes available, no responsible economic operator in the EU can be identified (Art. 8(3)) | upstream supplier and EU operator for every line sold, retrievable within one month |
| Manufacturer through own brand | distributor’s name, trademark or distinguishing feature on the product (Art. 4 point 10(b)) | own-brand flag, actual manufacturer, manufacturing contract |
| Manufacturer after substantial modification | modification outside the manufacturer’s control, then making available (Art. 8(2)) | modification flag, type of change, date, test evidence |
| Importer | goods of a manufacturer without EU establishment are imported directly (Art. 8(1)) | manufacturer outside the EU, import document, own role per item |
| Fulfilment service provider | at least two services out of warehousing, packaging, addressing and dispatch for third-party goods (Art. 4 point 13) | separation of own and third-party stock, principal per shipment |
The one-month deadline is a data question
One month sounds generous until you put the second time axis next to it. The claim becomes time-barred three years (Art. 16(1)) after the day on which the injured person became aware, or should reasonably have become aware, of the damage, the defect and the liable economic operator. It expires after ten years (Art. 17(1)), or after 25 years (Art. 17(2)) for personal injury whose symptoms appear late. A hydraulic hose placed on the market in early 2027 can therefore still be the subject of a request in 2036. By then suppliers change, item numbers get merged and the ERP may well have been replaced once.
This is where the typical gap lies: an item master usually knows the current main supplier, not the supplier the specific piece came from. Anyone who has to answer a request years later needs the origin as it was at the time of delivery. That information is created at goods receipt and has to be passed down to the order line and stored there unchanged – with a date, because the period depends on when the product was placed on the market.
For consumer products there is already a related duty. The General Product Safety Regulation requires economic operators to be able to identify every economic operator that supplied them with the product or with an embedded part, component or software (Art. 15(3) GPSR), for six years (Art. 15(5) GPSR) from receipt or delivery. The Regulation covers products intended for consumers or likely, under reasonably foreseeable conditions, to be used by consumers (Art. 3 point 1 GPSR). Anyone who already covers this duty has the basic framework. Anyone who only sells to businesses may never have needed it.
Six years of information, ten years of liability
Building block 1: supplier master with EU operator
The first building block is unspectacular but the basis for everything else: a supplier and manufacturer master that records for every item not only the purchasing supplier but also the manufacturer and the economic operator responsible in the EU. For many harmonised products, the Market Surveillance Regulation already requires an economic operator established in the Union to be responsible for the product (Art. 4(1) of Regulation (EU) 2019/1020); the General Product Safety Regulation extends this to consumer products (Art. 16(1) GPSR). Anyone offering consumer products online must also state the manufacturer’s name, postal address and email address (Art. 19 GPSR). These details can be reused for product liability if they are stored as structured data rather than free text.
Manufacturer with address
Name, registered trademark, postal address and email address of the manufacturer as a record of its own, not as free text in the product description.
EU economic operator
Importer, authorised representative or fulfilment service provider established in the Union, with role and contact, whenever the manufacturer sits outside the EU.
Role of the upstream supplier
Is the purchasing supplier a manufacturer, importer or distributor? The role decides whether naming it closes the chain or only extends it by one link.
Valid from and to
Every link between item, manufacturer and supplier with a time range. A change of supplier creates a new record instead of overwriting the old one.
Evidence
Supplier declaration, declaration of conformity or contract as a document with filing date, linked to the master record and not just sitting in the purchasing inbox.
Retention
Deletion rules based on the longest liability period that may apply, not on the shortest internal retention requirement.
This data is rarely created in the shop. It comes from purchasing, a supplier portal or a product information system and has to be maintained where the other item attributes are maintained. How to give such mandatory fields validation rules is covered in the article on data quality in the PIM; the technical connection to Shopware is described on our page on PIM integration. If you are already working on the digital product passport, you can carry manufacturer and economic operator data there as well.
Building block 2: origin per order line
The master alone is not enough, because many items in technical wholesale are sourced from several suppliers: standard parts, hoses, seals, bearings. Only goods receipt knows which source a specific piece came from. The chain becomes reliable once this information is passed from goods receipt via storage location and picking to the delivery note line. It is the same mechanism as with batch and serial numbers, only in the opposite direction: there the aim is to find affected customers, here it is to name the upstream supplier.
In practice the ERP holds this link, and the shop receives it through the return channel of order data. Each line needs at least upstream supplier, manufacturer, EU operator, goods receipt date and, where available, batch or serial number. How data exchange between shop and ERP is structured is covered in the article on ERP integration in B2B e-commerce; we implement the transfer itself through our ERP integrations. If your suppliers deliver through a digital supplier portal, manufacturer details can be captured with the delivery notice.
No batches: one supplier per item number
Two special cases deserve fields of their own. In drop shipping, the upstream supplier delivers directly to the customer; the line never has a goods receipt, and the origin has to be taken from the purchase order to the supplier. When importing directly from a manufacturer without establishment in the Union, the distributor becomes the importer and is liable in that role (Art. 8(1)). Which origin and supplier declarations are maintained for customs anyway is covered in the article on customs codes and origin. For liability, however, what counts is not the country of origin but who placed the goods on the Union market.
Building block 3: flags for modification and configuration
Technical wholesale does not only sell, it assembles: hoses are cut to length and crimped with fittings, cables are made up, drives are put together from motor and gearbox, devices are retrofitted. The Directive is clear on this: anyone who substantially modifies a product outside the manufacturer’s control and then makes it available on the market or puts it into service is considered its manufacturer (Art. 8(2)).
What is substantial is determined first by Union or national product safety rules (Art. 4 point 18(a)). Where these set no measure, modifications count as substantial if they change the product’s original performance, purpose or type without this having been foreseen in the manufacturer’s initial risk assessment, and if they change the nature of the hazard, create a new hazard or increase the level of risk (Art. 4 point 18(b)). Not every assembly job is therefore a substantial modification. The classification is a technical and legal decision; data retention has to ensure that it was made, justified and can be retrieved later.
Two consequences matter for data retention. First, the long-stop period for a substantially modified product starts again, from the date on which it was made available or put into service after the modification (Art. 17(1)(b)). Second, whoever modified a product can be exempted if the defect relates to a part not affected by the modification (Art. 11(1)(g)). Both require documentation of exactly what was changed and when. These details belong on every affected line:
- Flag on the item: standard goods, assembled, modified or retrofitted
- Description of the change per order: which parts, which work steps, which components from other manufacturers
- Classification as substantial or not substantial, with date, reasoning and responsible person
- Date of making available after the modification as a separate field, because the long-stop period restarts from it
- Test evidence such as a pressure test or measurement report, linked to the order line
- Origin of all built-in components as in building block 2, not only that of the base item
A related case is the own brand. The manufacturer also includes anyone who has a product designed or manufactured, or who presents itself as the manufacturer by putting its name, trademark or other distinguishing feature on it (Art. 4 point 10(b)); current German law takes a similar view (Section 4(1) ProdHaftG). Items under your own label therefore need a flag and the actual manufacturer in the master. If you sell through a product configurator, the configuration should be stored as part of the order line, so that it remains clear later which variant was built from which components.
Building block 4: keep software versions traceable
Software, digital manufacturing files and raw materials explicitly count as products (Art. 4 point 1). In technical wholesale this concerns controllers, frequency inverters, sensors and measuring devices with firmware, but also parameter files and programs supplied with the device. In addition, an economic operator is not exempted from liability where the defectiveness is due to software, including updates or upgrades, or to a lack of updates needed to maintain safety, provided these are within the manufacturer’s control (Art. 11(2)).
For data retention this means: the firmware version shipped belongs to the serial number or at least to the order line. Anyone offering updates for download through the shop or customer portal should log which version was available for which device and when, and which customer downloaded it. Digital manufacturing files – files that allow a tangible item to be produced through automated control of machines or tools (Art. 4 point 2), such as print files for additively manufactured spare parts – need the same versioning. If you run a digital spare parts catalogue with downloadable files, check it with this in mind.
Duties around updates and vulnerabilities are governed by a separate law; which details the shop needs for them is covered in the article on the Cyber Resilience Act. Connected devices add pre-purchase information duties, covered in the article on data disclosure for connected products. Product liability lays a time axis over these duties: the version history has to remain retrievable for as long as liability lasts.
Building block 5: the information channel in the customer portal
A request may arrive by letter, by email, through field sales or through the customer portal. The deadline runs from receipt of the request (Art. 8(3)(b)), not from the moment it reaches the responsible department. A fixed intake channel with date of receipt, responsibility and follow-up is therefore the simplest building block in this article, and one that can be set up without changing any system.
Your customers are part of the chain themselves: an installer passes your valve on to a building owner, a maintenance company fits your spare part into a machine. If they receive a request, they need manufacturer and EU economic operator from you, and quickly. A B2B customer portal can show these details per delivery note line: manufacturer with address, EU operator, batch, delivery date and the related documents. If delivery notes and invoices are already in the customer account, as described in the article on where order documents live, that is one additional column rather than a new system. Which further functions can be built on the same data is shown in the article on self-service customer portals.
Then there is disclosure in court proceedings. Once an injured person has presented facts and evidence that sufficiently support the plausibility of the claim, the defendant can be required to disclose relevant evidence at its disposal (Art. 9(1)). If it fails to do so, the product is presumed defective (Art. 10(2)(a)). For a distributor that counts as manufacturer after a modification, this means: modification records, test evidence and software versions are not just good housekeeping but potential evidence.
Before the deadline: a plan in six steps
There is not much time left before the deadline, but the work can be staged. The order follows the risk: first the items whose manufacturer sits outside the Union or which you modify yourself, then the rest of the range.
- Take stock: which items have a manufacturer without establishment in the Union, which are assembled, modified or sold under your own brand, which contain software?
- Extend the supplier master: manufacturer, EU economic operator, role of the upstream supplier and validity period as mandatory fields, starting with the items from step 1.
- Put origin on the line: goods receipt, upstream supplier and EU operator are stored per order line and passed from the ERP to shop and customer portal.
- Flag modifications: flag, description of the change, classification, date of making available and test evidence for every assembled or modified line.
- Set retention: agree deletion periods for supply chain, modification and software data with your legal advisers and store them in the system.
- Run a test request: an internal test request about a delivery from a few years ago shows whether the answer actually comes together within one month.
Which of these steps has the most effect on your range depends on how much you assemble and import. We have compiled the typical data flows between Shopware, ERP and portal in technical wholesale on our page on B2B e-commerce for technical wholesale. If you are introducing EUDR due diligence numbers at the same time, you can create the fields for upstream suppliers and evidence in one go.
Sources
Related Articles
EUDR from December 2026: Reference Numbers in B2B Shops
The deforestation regulation applies from 30 December 2026. How reference numbers flow from goods receipt through ERP and shop to delivery note and invoice.
Where Order Documents Live and How Long They Stay
Order confirmation, delivery note, invoice and price list in the customer account: which retention period applies, when it starts and where the files may sit.
Showing Declarations of Performance Before Checkout
Regulation (EU) 2024/3110: how the declaration of performance and conformity, CE details and safety information become visible in the shop before the contract binds.