The Wire
Private Mode is on. No preferences, library, notes, or reading history are stored, and no jurisdiction is written to the address bar.
Center for International and Comparative Law · Emory University School of Law

The private international law of cross-border deals

Cornerstone Series · Clauses You Can’t Control Disputes Technology and IP

What Rome II Does to Your Governing-Law Clause

The clause the buyer negotiated cannot reach the claim that matters. The clause it acquired is one a stranger can bring an action about, and the action reaches versions the target retired before the deal.

Abstract

A governing-law clause binds the parties who signed it, and Regulation (EC) No 864/2007 (Rome II) assigns an injured third party’s claim by its own cascade without reference to it. That much is settled, and on the facts a textbook would use the cascade returns the law the general rule would have returned anyway. On the facts of a software target it does not, for three reasons that are all ordinary. The argument of this piece is about the other clause. The target’s own end-user agreement is not a shield the buyer inherits: after VKI v. Amazon a term reciting the trader’s home law and stopping there is capable of being unfair, point (2) of Annex I to Directive (EU) 2020/1828 makes an unfair term the subject of a representative action, Article 2(1) of that Directive reaches infringements that ceased before the action was brought, and Article 8(3) lets a qualified entity seek an injunction without any consumer coming forward or any proof of loss. The objection to that is that an injunction is cheap, and the answer is that the order is not the amendment: Article 8(2) allows a finding that the practice is an infringement and an order to publish it, Article 13(3) makes the trader notify the affected consumers at its own expense, and Article 15 makes the final decision evidence in every follow-on national redress action against the same trader for the same practice. Redress itself is a narrower and more national question, and the piece says where the line falls. The piece traces the cascade and says what it is worth; marks the seam between Rome II and Rome I Article 6, which are routinely run together; corrects the common reading of the 1973 Hague Products Liability Convention, which does not apply between a supplier and the person he supplied; and prices the two instruments that decide the size of the exposure, the expiry regime in Directive (EU) 2024/2853 and the collective-redress route in Directive (EU) 2020/1828. It also says what governs the units already shipped, which on any deal closing before December 2026 is almost all of them: Directive 85/374/EEC, which runs its own ten years and which never says whether software is a product at all.

On the record

  • Applies from January 11, 2009Regulation (EC) No 864/2007 (Rome II), arts. 31 and 32, as construed in Homawoo
  • Binds 26 of 27 EU Member StatesRome II, art. 1(4) and recital 40
  • Article 5, the product-liability cascadeRome II, art. 5
  • 1973 Hague Products Liability Convention binds seven EU Member StatesHCCH status table, Convention No. 22; saved by Rome II, art. 28(1)
  • A consumer’s protection floor is uneven, and cannot be chosen away where it appliesRome I, art. 6(2)
  • Software is a product for units placed on the market after December 9, 2026; earlier ones stay under Directive 85/374/EECDirective (EU) 2024/2853, arts. 2(1), 4(1) and 21(1)
  • Ten years to start a claim, twenty-five for slow-emerging injury, for units inside the new Directive; ten years from putting into circulation for everything before itDirective (EU) 2024/2853, art. 17; Directive 85/374/EEC, art. 11
  • A choice-of-law term that recites only the trader’s law can be unfair, so far as it misleadsVKI v. Amazon, Case C-191/15, paras. 66 to 71
  • A qualified entity can bring that as a representative action, with no consumer coming forward, over a practice that has already stoppedDirective (EU) 2020/1828, arts. 2(1) and 8(3), and Annex I, point (2)

A United States buyer acquires a European software company, and the purchase agreement chooses New York law. Two years after closing, a consumer in Germany is injured by the product and sues. The buyer reaches for the New York choice-of-law clause, on behalf of the target it now owns. It does not apply, and that is the least of it. Under Regulation (EC) No 864/2007 (Rome II)The EU regulation fixing the law applicable to non-contractual obligations, such as tort and product-liability claims., the law governing a non-contractual claim, including product liability, is fixed by the Regulation’s own rules, and the only contract that could displace them is one this claimant is a party to.1 Three further instruments then decide what the claim is worth, how long it can be brought, and who may bring it. The acquisition agreement reaches none of them.

Which body of conflicts law runs at all depends on where she sues. If she sues in a Member State, everything below is live. If the claim is brought against the United States parent in a United States court, none of Rome II applies and that court runs its own choice-of-law analysis. The New York clause is still irrelevant there, for a reason that has nothing to do with any of this: she is a stranger to the acquisition agreement in New York exactly as she is in Frankfurt, and a contract cannot choose the law of a claim by someone who did not sign it. Everything that follows assumes she sues in a Member State, which on these facts is the likely place, because that is where she is and where Brussels Ia gives her a court. Inside the Union the forum splits with the claim. Her contract claim against the target sits in Section 4 of Brussels Ia: Article 17 of Brussels Ia confines that section to matters relating to a consumer contract and to the other party to it, Article 18(1) gives her the courts for the place where she is domiciled, and Article 19 permits departure only by an agreement made after the dispute arose, or one that widens her choice, or one between parties domiciled in the same Member State when they contracted. Her tort claim runs on Article 7(2) instead, where a jurisdiction agreement falls to be tested under Article 25 and Article 19 does not reach it. So the end-user forum clause is worth very little against the contract claim and rather more against the tort claim, which is the opposite of what a reader would guess.Regulation (EU) No 1215/2012, arts. 7(2), 17, 18(1), 19 and 25.

Why the clause does not travel

A choice-of-law clauseA contract term in which the parties select the governing law for disputes between them. is an agreement between the people who signed it. The consumer in Germany signed nothing. Rome II binds every Member State except Denmark and applies to events giving rise to damage occurring after January 11, 2009; in Croatia it has applied since accession on July 1, 2013.2

Article 14 does allow a choice of law for a non-contractual obligation, but only by the parties to that obligation. The consumer is not a party to the acquisition agreement, so there is no Article 14 choice to test and Articles 4 and 5 apply of their own force. That is the first of two reasons the agreement never gets near this claim. The second is that the buyer is not on the list of people who can be sued at all, and that list is not in Rome II; it is in the product-liability Directive, and it is set out further down. Article 14 matters one deal over, where buyer and seller might purport to choose the law of the tort as between themselves. There it is confined three times: the choice “shall not prejudice the rights of third parties”; a choice made before the event is available only where all the parties are pursuing a commercial activity and the agreement was freely negotiated; and two non-derogability rules apply. Under Article 14(2), where all the elements relevant to the situation are located in one country, choosing another country’s law cannot displace that country’s rules that cannot be derogated from by agreement. Article 14(3) does the same work one level up: where all those elements are located in Member States, choosing the law of a non-Member State cannot displace provisions of Union law that cannot be derogated from.3

Where the Article 5 cascade stops converging

Article 5(1) applies without prejudice to Article 4(2), so a common habitual residence of claimant and defendant takes priority. Failing that, the cascade runs to the injured person’s habitual residence, then the place the product was acquired, then the place the damage occurred, and each limb applies only if the product was marketed in that country. Within Article 5(1) itself a foreseeability override then applies: if the person claimed to be liable could not reasonably foresee the marketing of that product, or a product of the same type, in the country the cascade selects, the applicable law is instead that of the country where that person is habitually resident.4

On the facts above, every limb returns German law, and so does the general rule in Article 4(1). That convergence is what makes the cascade look skippable. It stops being skippable in three situations, and each of them is ordinary for a software target.

Where the product was not marketed in the country a limb selects, that limb fails and the analysis drops to the next one, so a target that sells into some Member States and not others has one answer per user, not one answer per product.

Where the seller could not reasonably foresee marketing in the country the cascade lands on, the override sends the claim to the law of the habitual residence of the person claimed to be liable, which will normally still be the target as producer rather than the buyer’s group, unless the buyer has actually moved the producing entity. And Article 4(2) displaces the whole cascade where claimant and defendant are habitually resident in the same country at the time the damage occurs. That looks like a planning lever and is not one, for a reason that sits in the second half of the provision people stop reading. Article 23(1) fixes a company’s habitual residence at its place of central administration rather than its place of incorporation. But the same paragraph goes on: where the event giving rise to the damage occurs, or the damage arises, “in the course of operation of a branch, agency or any other establishment,” the place of that establishment is treated as the habitual residence. So a common residence with a German consumer does not require moving central administration to Germany. A German development or support establishment in the chain that produced the damage will do it, and a buyer can trip into Article 4(2) by standing one up after closing without anybody deciding anything. Read Article 4(2) as a rule post-closing integration can walk into, not as one a buyer would ever choose.Rome II, art. 23(1), both subparagraphs.

At the end of the cascade sits the Article 5(2) escape, which applies the law of another country where the tort is manifestly more closely connected with it, and which expressly contemplates that such a connection may rest on a pre-existing relationship between the parties, such as a contract, closely connected with the tort. That is the clause a buyer should read twice, and it points away from the acquisition agreement entirely, at a document neither party to the deal negotiated and neither one drafted for this purpose.

Identifying the applicable law does not end the analysis. Two provisions let the forum’s own law back in whatever the cascade selected: Article 16 preserves the overriding mandatory provisions of the forum, and Article 26 permits refusal of a provision of the applicable law that is manifestly incompatible with the forum’s public policy. A third lets in a law that may be neither. Article 17 of Rome II requires the court, in assessing the conduct of the person claimed to be liable, to take account “as a matter of fact and in so far as is appropriate” of the rules of safety and conduct in force at the place and time of the event giving rise to the liability, which in a product case is usually where the thing was made or put into circulation and not where the user was hurt. Read that carefully, because it points the other way from the rest of this piece: that provision is as often the producer’s as the claimant’s, and it is how a target that built to one country’s standard gets to say so in a court applying another country’s law.Rome II, arts. 16, 17 and 26.

One caution before any of this runs. Where claimant and defendant are already in contract, which is the ordinary software case, the boundary between contract and tort is not drawn by which document a claimant produces. The Court of Justice draws it by asking whether the contract has to be interpreted to decide the claim: in Brogsitter a claim pleaded in tort was treated as contractual because the conduct complained of could be regarded as a breach of the contract’s terms, judged by reference to its purpose, while in Wikingerhof a claim stayed in tort because interpreting the contract was not indispensable to deciding it.5 A defect claim for physical injury normally stays in tort, and Rome II Article 5 applies to it. A claim that the product did not do what the terms warranted usually does not, and lands under Rome I instead. The two Regulations are to be read consistently with each other and with Brussels Ia, so the same line governs the applicable law and the forum.

A buyer can trip into Article 4(2) by standing up a German establishment after closing, without anybody deciding anything.

The clause you bought, and what it is good for

Rome I Article 6(2) does not floor a Rome II tort. Article 6 of Rome I governs consumer contracts, so if the claim is a product-liability tort under Rome II Article 5, Article 6(2) has nothing to say about it. What the consumer-contract regime does instead is reach this dispute from three directions, none of which is the tort itself. It supplies the pre-existing relationship Article 5(2) contemplates, which is how the end-user agreement gets into the tort analysis at all and is the escape the conclusion of this piece turns on. It governs any parallel contractual claim the same user brings. And through Directive 93/13/EEC it supplies the standard against which the clause itself can be attacked. Three routes in, and not one of them makes a Rome I provision govern a Rome II claim.

The acquisition agreement cannot reach the consumer, because she is a stranger to it. The target’s own end-user terms are a different matter: a license or subscription agreement between the target and the injured user is exactly the kind of pre-existing relationship Article 5(2) contemplates. It is also governed by its own regime, and that regime is not permissive. Under Article 6(1) of Regulation (EC) No 593/2008 (Rome I), a contract between a consumer and a professional who directs activities to the consumer’s country is governed by the law of the consumer’s habitual residence. The parties may choose another law, but Article 6(2) provides that the choice “may not, however, have the result of depriving the consumer of the protection afforded to him by provisions that cannot be derogated from by agreement” under the law that would otherwise apply.6 A EULA choosing the target’s home law therefore sets a floor and not a ceiling: the chosen law keeps governing, and on any point where the consumer’s own law has a rule that cannot be derogated from and is more protective, that rule is added on top of it.

Three limits keep that from being a general rule, and each of them is a diligence question. Article 6(1) reaches only a contract concluded for a purpose outside the customer’s trade or profession, with a professional who pursues or directs activities to the country of her habitual residence, so a business user of the same software sits outside Article 6 altogether and falls back to Articles 3 and 4, where the clause does what it says. Article 6(4)(a) takes out a contract of services to be supplied exclusively in a country other than the consumer’s habitual residence. And the comparison runs point by point rather than regime by regime, so she does not import her own law wholesale; she gains only the rules of it that cannot be derogated from and that are more protective on the point actually in issue. The floor is real and it is uneven.6

And the clause can be unfair merely for saying so. In VKI v. Amazon the Court of Justice held that a term in a trader’s general conditions, not individually negotiated, providing that a contract concluded in the course of electronic commerce is governed by the law of the trader’s own Member State “is unfair in so far as it leads the consumer into error by giving him the impression that only the law of that Member State applies to the contract, without informing him that under Article 6(2) of Regulation No 593/2008 he also enjoys the protection of the mandatory provisions of the law that would be applicable in the absence of that term.” The Court was careful, and the care is the part a summary drops. The test it applied is the ordinary one in Article 3(1) of Directive 93/13/EEC, so the term has to cause a significant imbalance in the parties’ rights and obligations contrary to good faith; the Court said such a term is unfair “only in so far as it displays certain specific characteristics inherent in its wording or context” that do that. Choice-of-law terms are not unfair as such, the holding is confined to the extent (“in so far as”) the term misleads, and whether a particular clause misleads is for the national court on all the circumstances.7 So the finding is available where a clause recites the chosen law and stops there, which says the first half of the position and not the second. It is not available against a clause that carries the second half. A sentence saying that mandatory consumer protections of the user’s own country continue to apply is outside what the Court held unfair, and drafting it in is the cheapest thing on any list in this piece. What it does not do is retire the versions already shipped.

The same judgment carries a second holding that belongs in a conflicts column. The law applicable to an action for an injunction against the use of unfair terms is determined under Article 6(1) of Rome II, as unfair competition affecting the collective interests of consumers, while the law applicable to the assessment of any particular term is always determined under Rome I. One dispute, two Regulations, and the answers can differ.7

What survives Rome II

Rome II does not occupy the whole field. Article 28(1) saves pre-existing conventions laying down conflict-of-law rules for non-contractual obligations to which one or more Member States were party when Rome II was adopted. Article 28(2) then claws back, as between Member States, those conventions concluded exclusively between Member States. Because the 1973 Hague Products Liability Convention also binds states outside the Union, namely Norway, Serbia, North Macedonia, and Montenegro, Article 28(2) does not reach it, and it continues to govern in the seven Member States bound by it: France, Spain, Luxembourg, the Netherlands, Finland, Croatia, and Slovenia.8

But it does not govern the case in the opening paragraph, and the reason is not in its connecting factors. The second paragraph of Article 1 provides that where the property in, or the right to use, the product was transferred to the person suffering damage by the person claimed to be liable, the Convention does not apply to their liability inter se. In the ordinary software case, where the user downloads or subscribes directly from the target, the Convention is excluded as between exactly those two, whichever contracting state she sues in. A French court would apply Article 5 of Rome II to that claim, not the Convention.

Where the Convention does bite is the case an acquisition actually creates: a chain with more than two links. The claim against the component supplier, the upstream manufacturer, or the group company that did not itself supply the user is not caught by the inter se exclusion, and in a contracting state the Convention governs it. The forum decides whether the Convention is in play at all; the pairing of this claimant with this defendant decides whether the claim escapes the inter se exclusion. Both have to be checked. It binds the courts of contracting states, applies irrespective of the nature of the proceedings, and applies even where it points to the law of a non-contracting state. Its connecting factors are also different from Rome II’s: Article 4 requires the place of injury to coincide with the claimant’s habitual residence, the defendant’s principal place of business, or the place of acquisition; Article 5 prefers the claimant’s habitual residence on a similar coincidence; Article 6 falls back to the defendant’s principal place of business unless the claimant bases the claim on the law of the place of injury, which is the one point in the cascade where the claimant chooses; and Article 7 carries a foreseeability defense of its own. Two claims out of one accident, litigated in the same court, can therefore run on different instruments.9

One further caution before anyone prices the Convention. Its definition of a product, “natural and industrial products, whether raw or manufactured and whether movable or immovable,” sits awkwardly with software, and unlike Union law it has not been revisited: the definition in Article 2(a) is the one concluded on October 2, 1973, and the Convention has no equivalent of the definition in Directive (EU) 2024/2853.9

The clock the buyer has to price

Choice of law decides which rules apply. Limitation decides whether the claim exists at all, and here Union law has just moved. Directive (EU) 2024/2853 applies to products placed on the market or put into service after December 9, 2026, which is also its transposition deadline, and it settles the question the 1973 Convention leaves open: “product” expressly “includes electricity, digital manufacturing files, raw materials and software.” Free and open-source software developed or supplied outside a commercial activity is carved out.10

Which means that on a deal closing now, almost none of the installed base is in that Directive at all. Everything placed on the market before December 9, 2026 stays under Directive 85/374/EEC, and the old Directive does not answer the question the new one settles in a clause. Article 2 defines a product as “all movables even if incorporated into another movable or into an immovable” and then adds one inclusion, that “‘product’ includes electricity.” It names electricity and not software, and whether software is a movable for that purpose is argued, not decided, and is argued in national transposing law. That is the live question on a target’s existing releases, and until December 2026 it is worth more to a buyer than anything in the new Article 17, because it decides whether the pre-2027 base carries strict liability under a Union regime at all. The old Directive’s own outer period has the same shape as the new one: ten years from the date the producer put the actual product that caused the damage into circulation, unless the injured person has instituted proceedings in the meantime. So the schedule this piece asks for later is the right request either way; only the instrument it feeds changes.Council Directive 85/374/EEC, arts. 2 (as amended by Directive 1999/34/EC), 10 and 11.

Three of its provisions decide the shape of the buyer’s exposure. None of them can be bargained with the injured person. All of them can be allocated between buyer and seller, which is a different thing and comes later.

  • Liability cannot be limited against the injured person. Article 15 requires Member States to ensure that an economic operator’s liability “is not, in relation to the injured person, limited or excluded by a contractual provision or by national law.” The limitation of liability in the target’s terms is not a defense to her claim, whatever it is worth between the parties who agreed it.
  • The outer limit is ten years, or twenty-five. Article 16 of the Directive sets a three-year limitation period, running from the day the injured person knew or should have known of the damage, the defectiveness, and the identity of the economic operator liable under Article 8. Article 17 of the Directive sets the outer periods, and frames them as the extinction of the injured person’s entitlement rather than as a bar on proceedings: ten years from the placing on the market or putting into service under art. 17(1)(a), and twenty-five under art. 17(2) where she could not bring proceedings within the ten because of the latency of a personal injury. Both are subject to a carve-out worth reading, because it changes what a buyer is pricing: the entitlement expires “unless that injured person has, in the meantime, initiated proceedings against an economic operator.” The period is a deadline for starting a claim, not a date on which a live one dies. Note what each period bounds. The Directive’s Article 17 extinguishes the injured person’s entitlement against the economic operator; a contractual survival period bounds only the buyer’s recourse against the seller, so the two do not net against each other, they sit one behind the other. The ten years also runs unit by unit from the day each product was placed on the market, so the tail on an installed base is shorter than ten years from closing, while every release the buyer ships afterwards starts a fresh ten in the buyer’s own name. And the Directive’s three years from knowledge is the period that usually operates; its Article 17 is the backstop that decides whether the claim can exist at all.
  • A substantial modification moves the start date, and the bar is higher than it sounds. For a substantially modified product the ten years runs instead from the date that product was made available following the modification. What counts is defined, and it is not a version number: the modification must be treated as substantial by product-safety rules, or else must both change the product’s performance, purpose or type outside the manufacturer’s own initial risk assessment and change the nature of the hazard, create a new one, or raise the level of risk. A release inside the roadmap does not clear that. A re-architecture that introduces a hazard the original assessment never contemplated may. And the deeming provision that turns a modifier into a manufacturer is conditioned on the modification being made outside the manufacturer’s control, so a buyer shipping releases through the target it now owns is answering in its own name rather than reviving anything of the seller’s.

The tail is a schedule, not a period

Where the ten years actually runs, for four units of the same product. The earliest unit here ships six years before closing, so every unit sits inside Directive (EU) 2024/2853 only if closing falls after December 9, 2032. No deal closing this decade looks like that: on a real installed base the bars fall on both sides of the line, and the ones on the near side are governed by Directive 85/374/EEC instead. The chart is drawn on one instrument to show the shape of the period; the caption says what the shape hides.

Article 17 runs ten years from each unit, not ten years from the deal Shipped 6 years before closing Shipped 3 years before closing Shipped at closing Shipped 2 years after, by the buyer Contract survival, from closing closing -6 -3 0 +3 +6 +9 +12 +14 years from closing
n = one illustrative product with four release dates; the release dates are chosen to show the shape, and a reader should substitute the target’s own placing-on-the-market schedule. Article 17(1)(a) of Directive (EU) 2024/2853 runs its ten years from the date the individual product was placed on the market or put into service, and art. 17(1)(b) restarts it from the date a substantially modified product was made available, so the exposure on an installed base is ten years less the age of that base, and every unit the buyer ships after closing starts a fresh ten in the buyer’s own name. The dashed lane is drawn short deliberately: a survival period bounds the buyer’s recourse against the seller, not the injured person’s entitlement, so the two lanes do not net against each other. Not drawn: the twenty-five years art. 17(2) allows where a personal injury emerges too slowly for the ten, which would run off the right edge for every bar here; nor the carve-out in art. 17(1) itself, under which the entitlement survives the period where the injured person has initiated proceedings in the meantime, so a bar is the last date on which a claim can be started and not the date on which a pending one dies. And one thing the shape hides: for a deal closing in the next few years the installed base straddles December 9, 2026, and the units on the wrong side of that date are not on this chart at all. They stay under Directive 85/374/EEC, which runs its own ten years from the putting into circulation of the individual product and carries neither the disclosure duty in art. 9 nor the presumptions in art. 10. The diligence request has to ask which side of that date each release falls on, because the answer changes the instrument and not only the number.

The evidential position moves in the same direction. Article 9 requires disclosure of relevant evidence at the claimant’s request once the claim is shown to be plausible, and Article 10 presumes defectiveness where the defendant fails to disclose, where the product breaches mandatory safety requirements, or where an obvious malfunction occurred in reasonably foreseeable use, and presumes causation where the damage is of a kind typically consistent with the defect. It also lets the court presume either, or both, where technical complexity makes proof excessively difficult and the claimant shows the proposition is likely. The presumptions are rebuttable, which is not the same as neutral: each of them shifts the burden to the defendant at precisely the point where the claim would otherwise fail for want of proof.10

Whether the claim reaches the buyer at all

Everything above assumes a defendant. Article 8 says who that is, and the answer is narrower than a deal team expects: the manufacturer of the defective product, the manufacturer of a defective component integrated within the manufacturer’s control, and, where the manufacturer sits outside the Union, the importer, the authorized representative, and failing both the fulfilment service provider, with the distributor picked up under Article 8(3) of the product-liability Directive only where the injured person asks it to name an economic operator upstream and it fails to do so within one month of the request. Note that the first limb carries no requirement that the manufacturer be established in the Union; the Union-establishment condition attaches to limb (c), which adds the importer and the others alongside the manufacturer rather than in place of it. An acquiring parent that neither makes the product nor places it on the Union market is on none of these limbs, and so is not itself a defendant. What it bought is a subsidiary that is one, and every euro of that liability still runs through the equity it paid for. Whether it stays off the list is the next question.

Which makes post-closing integration a liability decision, and it is not usually taken as one. Move development out of the Union and the offshore group company becomes the manufacturer under Article 8(1)(a), which carries no Union-establishment requirement at all, while the Union entity that places the product on the market becomes the importer under Article 8(1)(c)(i). Article 8(1)(c) adds the importer “without prejudice to the liability of that manufacturer,” so this is not a relocation of exposure onto the subsidiary. It is an addition, and the larger half of it lands on the group company that now does the developing. Ship a release that clears the Article 4, point (18) threshold from a company outside the original manufacturer’s control, and Article 8(2) makes that company a manufacturer of the modified product in its own name.

One limb does not work this way, and the difference is worth keeping straight. An authorized representative is defined as a person “who has received a written mandate from a manufacturer,” so nobody becomes one by shipping. It is a box an integration plan ticks deliberately or not at all, which makes it the only limb nobody enters by accident. The rest happen whether or not anyone notices, and that is the point: what the buyer does after closing decides whether it is a defendant, and post-closing integration is the only part of this analysis the buyer controls.Directive (EU) 2024/2853, art. 8(1) to (3); art. 4, points (10), (11), (12) and (18).

And who gets to bring it

Here is where the clause the buyer acquired stops being a document and becomes a claim, and it is worth being exact about which kind. After VKI, a term reciting the trader’s own law and saying nothing about Article 6(2) is capable of being unfair. Point (2) of Annex I to Directive (EU) 2020/1828 makes Directive 93/13/EEC one of the instruments a representative action can be brought under, and Article 2(1) reaches infringements “where those infringements ceased before the representative action was brought.” What that buys is an injunction, and it buys it on easy terms: under Article 8(3) of the representative-actions Directive no individual consumer has to come forward to be represented, and the qualified entity need not prove loss to any of them or intent or negligence on the trader’s part. A term the target retired is therefore an exposure that survives the buyer’s arrival.

How far back that reaches is worth stating exactly, because it is stated loosely almost everywhere. Article 22 fixes which regime runs, not how old the practice may be. The transposing provisions govern representative actions brought on or after June 25, 2023, and actions brought before that date run on Directive 2009/22/EC instead. The only thing Article 22 dates at the other end is the suspension and interruption of limitation periods under Article 16, which it confines to redress claims based on infringements occurring on or after June 25, 2023. Nothing in it puts a floor under how old an infringement can be for the injunctive limb. That is a national limitation question, and it is one to put to local counsel rather than to answer out of the Directive.

The obvious objection is that an injunction is cheap. A partner will say the remedy is an order to change a clause, that changing a clause is a paralegal afternoon, and that nobody prices a paralegal afternoon. That is right about the clause and wrong about the order, and three provisions of the same Directive say why. A definitive injunctive measure may include a measure establishing that the practice constitutes an infringement, and an obligation to publish the decision or a corrective statement, in each case “if provided for in national law.” Article 13(3) then requires the court to make the trader inform the consumers concerned of the final decision, at the trader’s expense and individually where appropriate, unless they are informed some other way. And Article 15 makes a final decision of any Member State’s court on the existence of an infringement usable by all parties as evidence in any other action for redress against the same trader for the same practice, in accordance with national law on evaluation of evidence. The amendment is the afternoon. The exposure is a finding, delivered to the affected users at the buyer’s own cost, that every follow-on national claim can put into evidence. Each of those three is conditioned on national law, which is what makes this a diligence request rather than a number.

Redress is a different question, and this is where a client alert will overreach. Article 2(2) provides that the Directive “does not affect rules under Union or national law establishing contractual and non-contractual remedies”, and Article 9(1) gives remedies only “as appropriate and as available under Union or national law”. The Directive is a procedural conduit; it creates no cause of action. What Directive 93/13 supplies for an unfair term is that the term does not bind, which for a choice-of-law recital returns the consumer to the Article 6(2) floor she had anyway. And Article 9(3) requires consumers not habitually resident in the forum Member State to opt in expressly before a redress measure binds them. So the honest statement of the exposure is an injunction across the installed base of terms, the finding that can travel with it, and a money claim only where national law supplies the cause of action, rather than one collective judgment on behalf of everybody who ever clicked accept.11

The last instrument decides whether the claim arrives one user at a time. Under Directive (EU) 2020/1828, Member States must ensure that qualified entities “designated in advance in another Member State for the purpose of bringing cross-border representative actions can bring such representative actions before their courts or administrative authorities.” The Directive applies to domestic and cross-border infringements alike, and expressly “where those infringements ceased before the representative action was brought,” so a practice the target stopped at closing is still actionable afterwards. Annex I lists, at point (2), Directive 93/13/EEC on unfair terms, which is the limb that reaches the end-user agreement discussed above, and, at point (1), Directive 85/374/EEC on liability for defective products, which continues to apply to products placed on the market before December 9, 2026 and whose references are construed as references to the new Directive for products placed after it.11

Put them together and the answer to the question the buyer asked is not the interesting part. The New York clause never governed this claim and nobody competent thought it did. A German consumer’s tort claim is governed by German law under Rome II whatever New York law says, subject to one escape, Article 5(2), which can carry the tort to the law of another country where the end-user relationship makes the connection with that country manifestly closer. Read the provision precisely: it selects a country’s law, not whichever law the end-user agreement chose. A New York clause in a EULA is not by itself a connection with New York, and the escape more often lands on the law of the place the relationship actually sits. The floor of her contractual protection is set by Rome I Article 6(2) whatever the end-user agreement says, and the clause that told her otherwise may itself be unfair. The outer limit on the claim is ten years, and which instrument supplies it turns on one date: units placed on the market after December 9, 2026 run on Article 17 of Directive (EU) 2024/2853, which also allows twenty-five for a slow-emerging injury and restarts the ten on a substantial modification, and everything shipped before then runs on Article 11 of Directive 85/374/EEC, which does neither. And a qualified entity in another Member State can bring the whole thing collectively, about conduct that stopped before the buyer arrived.

The interesting part is the direction the exposure runs. Everything the buyer negotiated points one way, at the seller, on a period the parties set. Everything that decides the size of the claim points the other way, at the target’s own users, on periods the parties cannot set, brought under a clause the target wrote for a different purpose entirely. A deal team that reads the end-user agreement as boilerplate has read the only document in the data room that a stranger can sue on.

Insurance does not close this

The reasonable objection to everything above is that a buyer does not carry this risk on the contract at all. It takes a product-safety and compliance representation, backs the representation with warranty and indemnity insurance, and moves on. Three features of the new regime cut against that answer, and none of them can be underwritten away.

First, a warranty and indemnity policy responds to the breach of a representation, tested as at closing. Neither outer period describes a state of affairs at closing. Take the new Directive, which is where the tail is headed and where every unit shipped from December 9, 2026 lands: its Article 17 does not describe a state of affairs at closing; it describes an entitlement that arises when someone is injured, which may be years afterwards and on a unit shipped years before. A representation that the products complied with applicable law when the deal signed can be perfectly true and leave the claim untouched. Second, Article 15 makes the target’s own limitation of liability ineffective against the injured person, so whatever the underwriter priced against on the target’s side of the ledger is not there. And third, because that Article runs ten years from the placing on the market of each unit, the tail is not a single period a policy can be written to: it is a schedule of overlapping periods, one per release, and the buyer’s own post-closing releases start new ones in the buyer’s own name.

The practical consequence is a gap that can be computed rather than argued about. Ask for the placing-on-the-market schedule by release, run the ten years from each, and set the resulting curve against the policy period and against the survival period. Where the curve runs past both, someone is carrying it, and the memo should say who. And keep the two policies apart, because Rome II Article 18 reaches only one of them. It permits a direct action against “the insurer of the person liable to provide compensation” where either the law applicable to the non-contractual obligation or the law applicable to the insurance contract so provides. A warranty and indemnity insurer is not that person’s insurer; it insures the buyer’s claim against the seller, and the injured consumer is nowhere in that contract. The policy Article 18 is about is the target’s own product liability tower, which is a different diligence request, a different limit, and usually a different broker.Directive (EU) 2024/2853, arts. 15, 16 and 17; Rome II, art. 18.

How to draft around what you cannot choose

None of these six moves is the indemnity, which is where most of this conversation starts and ends.

  1. Ask for every version of the end-user terms in force since June 25, 2023, not just the current one. Article 2(1) of Directive (EU) 2020/1828 reaches infringements that ceased before the action was brought, and after VKI the infringement can be a choice-of-law recital that told the user only half the position. June 25, 2023 is the date the new regime took over from Directive 2009/22/EC for actions brought after it, not a floor on how old the practice can be, so ask for the library going back as far as the target kept one and let local counsel say what its own limitation law does with the early versions. Nobody asks for a retired clause library in diligence, and it is one email.
  2. Compute the tail rather than assuming it. The remaining exposure on the installed base is ten years less the age of that base, which is a number, and it is usually shorter and more negotiable than the headline suggests. Ask which releases fall before December 9, 2026 while you are at it: those stay under Directive 85/374/EEC, on a different evidential footing, and the schedule that answers the first question answers this one too.
  3. Read the end-user agreement as a conflicts instrument and not as boilerplate. Check whether its choice-of-law clause tells the user about Article 6(2) or only about the trader’s law, because that is the difference VKI turns on, and check the forum clause on both of the lives it leads. Nobody drafts a EULA expecting it to be read as evidence of a pre-existing relationship under Rome II, which is the use this piece is about.
  4. Decide who carries the pre-closing tail, and prefer cover to a promise. A ten-year indemnity from a fund that dissolves in year two is a paper asset. A contingent-liability or known-issue policy survives the seller; an indemnity does not. If the seller will not fund one, the buyer is carrying it, and one sentence in the memo should say so.
  5. Treat the integration plan as a liability decision. Where development sits, which entity ships, and whether a release clears the substantial-modification threshold each decide who is on the Article 8 list. It is the part of this analysis the buyer controls, and it is usually settled by people who have never read Article 8 of the Directive.
  6. Map the Member States where the product is sold and where the components come from. Seven of them run a different instrument, and it changes the answer only for the claims the target did not itself supply, which is exactly the set an acquisition creates.

Cite this piece

Eric Martin, What Rome II Does to Your Governing-Law Clause, Conflicts & Capital (Aug. 20, 2026), https://conflictsandcapital.netlify.app/cornerstone/rome-ii-governing-law.

Part of the series Clauses You Can’t Control ↗

Notes

  1. Regulation (EC) No 864/2007 of the European Parliament and of the Council of 11 July 2007 on the law applicable to non-contractual obligations (Rome II), 2007 O.J. (L 199) 40. EUR-Lex ↗ ↩
  2. Rome II, arts. 31 and 32, read with Case C-412/10, Homawoo v. GMF Assurances SA, ECLI:EU:C:2011:747 (Nov. 17, 2011), holding that the Regulation applies only to events giving rise to damage occurring after January 11, 2009. Croatia acceded to the Union on July 1, 2013. ↩
  3. Rome II, art. 14(1) (the choice “shall not prejudice the rights of third parties”), art. 14(1)(b) (pre-event choice only where all the parties pursue a commercial activity, by an agreement freely negotiated), art. 14(2) and art. 14(3) (non-derogable rules of the country, and of the Union, where all relevant elements are located there). ↩
  4. Rome II, art. 5(1)(a)–(c) (the cascade, each limb conditional on the product having been marketed in that country), the closing subparagraph of art. 5(1) (foreseeability override, applying the law of the habitual residence of the person claimed to be liable), art. 4(2) (common habitual residence takes priority) and art. 5(2) (manifestly closer connection, which “might be based in particular on a pre-existing relationship between the parties, such as a contract”). ↩
  5. On the contract and tort boundary, Case C-548/12, Brogsitter v. Fabrication de Montres Normandes, ECLI:EU:C:2014:148 (Mar. 13, 2014), and Case C-59/19, Wikingerhof v. Booking.com, ECLI:EU:C:2020:950 (Nov. 24, 2020). Both are decided on the jurisdictional heads of Regulation (EU) No 1215/2012 and its predecessor rather than on Rome I or Rome II; recital 7 of each of Regulation (EC) No 593/2008 and Regulation (EC) No 864/2007 requires the substantive scope of those Regulations to be consistent with that Regulation, which is why the same line is used here. EUR-Lex ↗ ↩
  6. Regulation (EC) No 593/2008 (Rome I), art. 6(1) (a consumer contract is governed by the law of the consumer’s habitual residence where the professional pursues or directs activities to that country and the contract falls within the scope of those activities) and art. 6(2): a choice of law “may not, however, have the result of depriving the consumer of the protection afforded to him by provisions that cannot be derogated from by agreement by virtue of the law which, in the absence of choice, would have been applicable on the basis of paragraph 1”. Note the carve-outs in art. 6(4), of which art. 6(4)(a), services supplied to the consumer exclusively in a country other than that of his habitual residence, is the one a software supplier should check. Compare arts. 3(3) and 3(4), the general non-derogability provisions. EUR-Lex ↗ ↩
  7. Case C-191/15, Verein für Konsumenteninformation v. Amazon EU Sàrl, ECLI:EU:C:2016:612 (July 28, 2016), operative points 1 and 2. On the term: unfair under art. 3(1) of Directive 93/13/EEC “in so far as it leads the consumer into error by giving him the impression that only the law of that Member State applies to the contract, without informing him that under Article 6(2) of Regulation No 593/2008 he also enjoys the protection of the mandatory provisions of the law that would be applicable in the absence of that term, this being for the national court to ascertain in the light of all the relevant circumstances”; see paras. 66 to 71, and para. 67 (such a term is unfair “only in so far as it displays certain specific characteristics inherent in its wording or context which cause a significant imbalance in the rights and obligations of the parties”). On the split: the law applicable to an action for an injunction is determined under art. 6(1) of Rome II, that applicable to the assessment of a particular term always under Rome I, both without prejudice to art. 1(3) of each Regulation; see paras. 42, 43 and 49. EUR-Lex ↗ ↩
  8. Convention of 2 October 1973 on the Law Applicable to Products Liability, saved by Rome II, art. 28(1). In force for France, Spain, Luxembourg, the Netherlands, Finland, Croatia, and Slovenia, and for Norway, Serbia, North Macedonia, and Montenegro outside the Union. Belgium, Italy, and Portugal signed but never ratified. HCCH status table ↗ ↩
  9. Convention of 2 October 1973, art. 1, second paragraph: “Where the property in, or the right to use, the product was transferred to the person suffering damage by the person claimed to be liable, the Convention shall not apply to their liability inter se.” Art. 1, third paragraph (application irrespective of the nature of the proceedings); art. 2(a) (“the word ‘product’ shall include natural and industrial products, whether raw or manufactured and whether movable or immovable”); arts. 4, 5 and 6 (the connecting factors, each requiring a coincidence between two of the place of injury, the claimant’s habitual residence, the defendant’s principal place of business and the place of acquisition, failing which the defendant’s principal place of business applies unless the claimant bases the claim on the law of the place of injury); art. 7 (foreseeability defense); art. 11 (application independent of reciprocity). HCCH ↗ ↩
  10. Directive (EU) 2024/2853 on liability for defective products, art. 2(1) (applies to products placed on the market or put into service after December 9, 2026), art. 2(2) (free and open-source software developed or supplied outside the course of a commercial activity is excluded), art. 4(1) (“‘product’ means all movables, even if integrated into, or inter-connected with, another movable or an immovable; it includes electricity, digital manufacturing files, raw materials and software”), art. 4, point (18) (definition of “substantial modification”: substantial under Union or national product-safety rules, or, where those lay down no threshold, a modification that both changes the product’s original performance, purpose or type without that change having been foreseen in the manufacturer’s initial risk assessment and changes the nature of the hazard, creates a new hazard or increases the level of risk), art. 8(2) (a person who substantially modifies a product “outside the manufacturer’s control” and thereafter makes it available is considered its manufacturer), art. 9 (disclosure of evidence), art. 10 (burden of proof and the rebuttable presumptions), art. 15 (liability “is not, in relation to the injured person, limited or excluded by a contractual provision or by national law”), art. 16 (a three-year limitation period running from knowledge of the damage, the defectiveness and the identity of the operator liable under art. 8; art. 16 contains neither outer period), art. 17 (the expiry periods: ten years running from the placing on the market or, for a substantially modified product, from the date it was made available following the modification, and twenty-five years where the injured person could not bring proceedings within ten because of the latency of a personal injury), art. 21 (Directive 85/374/EEC repealed with effect from December 9, 2026, continuing to apply to products placed on the market or put into service before that date, and references to it construed as references to this Directive) and art. 22(1) (transposition by December 9, 2026). EUR-Lex ↗ ↩
  11. Directive (EU) 2020/1828 on representative actions, art. 2(1) (scope, covering domestic and cross-border infringements “including where those infringements ceased before the representative action was brought or where those infringements ceased before the representative action was concluded”), art. 4(3) (criteria for designation as a qualified entity for cross-border actions), art. 6(1) (“Member States shall ensure that qualified entities designated in advance in another Member State for the purpose of bringing cross-border representative actions can bring such representative actions before their courts or administrative authorities”) and Annex I, points (1) and (2), listing Directive 85/374/EEC and Directive 93/13/EEC respectively. On what a qualified entity can actually obtain: art. 7(4) (a qualified entity must be entitled to seek “at least… (a) injunctive measures; (b) redress measures”); art. 8(3) (“In order for a qualified entity to seek an injunctive measure, individual consumers shall not be required to express their wish to be represented by that qualified entity”); art. 2(2) (the Directive “does not affect rules under Union or national law establishing contractual and non-contractual remedies”); art. 9(1) (a redress measure requires remedies “as appropriate and as available under Union or national law”); and art. 9(3) (consumers not habitually resident in the Member State of the forum “have to explicitly express their wish to be represented” in order to be bound). On what an injunction is worth: art. 8(2) (a definitive measure “may include, if provided for in national law: (a) a measure establishing that the practice constitutes an infringement…; and (b) an obligation to publish the decision on the measure in full or in part… or an obligation to publish a corrective statement”); art. 8(3) (no consumer need express a wish to be represented, and the qualified entity need not prove “actual loss or damage on the part of the individual consumers affected” or “intent or negligence on the part of the trader”); art. 13(3) (the court or administrative authority “shall require the trader to inform the consumers concerned by the representative action, at the trader’s expense, of any final decisions providing for the measures referred to in Article 7”, individually where appropriate, the obligation not applying where those consumers are informed in another manner, and Member States being free to require the qualified entity to ask for it); and art. 15, “Effects of final decisions” (a final decision of a court or administrative authority of any Member State on the existence of an infringement harming the collective interests of consumers “can be used by all parties as evidence in the context of any other action before their national courts or administrative authorities to seek redress measures against the same trader for the same practice, in accordance with national law on evaluation of evidence”). On reach in time: art. 22(1) (the transposing provisions apply to representative actions brought on or after June 25, 2023, and the provisions transposing Directive 2009/22/EC to actions brought before that date) and art. 22(2) (the rules on suspension or interruption of limitation periods transposing art. 16 apply only to redress claims based on infringements occurring on or after June 25, 2023); neither paragraph limits how old an infringement may be for the injunctive limb. The distinction between the injunctive and the redress limb is the difference between an exposure that runs against the installed base of terms automatically and one that has to be built out of a national cause of action, and it is the point most summaries of this Directive elide. Art. 21 of Directive (EU) 2024/2853 resolves the cross-reference: references to the repealed Directive 85/374/EEC are to be construed as references to the new one. Annex I point (1) therefore carries Directive (EU) 2024/2853 for products placed on the market after December 9, 2026, and Directive 85/374/EEC for products placed before it. EUR-Lex ↗ ↩

Get The Brief

Each new issue on the private international law of cross-border deals.

Your address is used only to send the column, and you can unsubscribe at any time. Privacy statement ↗