EU Product Liability Directive (Directive (EU) 2024/2853): strict liability for defective products, including software and related services
Software, digital manufacturing files and integrated digital services count as products, and a product is defective when it does not provide the safety a person is entitled to expect, judged in part by its ability to keep learning and by safety-relevant cybersecurity requirements. A manufacturer that fails to disclose relevant evidence is presumed to have supplied a defective product, and it cannot escape liability for defects caused by software, by a substantial modification, or by a missing safety update that was within its control.
Scope. Reaches a US manufacturer whose product or software is placed on the EU market: Article 8(1)(a) makes the manufacturer liable, and Article 8(1)(c) adds its EU importer, authorised representative or, failing both, fulfilment service provider.
Draft mapping. Drafted by the Register's agents from the rule's text and not yet confirmed by a person. It is the Register's reading, not legal advice: whether and how the rule applies to you is a question for counsel.
Controls this rule maps to
Required by the text The rule's text requires a measure that is this control, or plainly includes it. Implied A binding rule whose purpose needs this control, but whose text does not name it. The Register's reading. Recommended A voluntary standard or guidance recommends it; nothing binds you to it. Proposed Appears in a proposed rule or proposed provision that is not yet in force.
| Control | Strength | Where in the rule, and why | Confidence | Missing or failed in |
|---|---|---|---|---|
| Independent audit log C-V1 | Implied | Article 9(1): the defendant 'is required to disclose relevant evidence that is at the defendant's disposal'; Article 10(2)(a): defectiveness is presumed where 'the defendant fails to disclose relevant evidence pursuant to Article 9(1)'. The Directive imposes no record-keeping duty; a record of what the system did is only the evidence a manufacturer would need, so confidence is low. | low | 1 case |
| Organizational recovery process C-R4 | Implied | Article 11(2): no exemption under Article 11(1)(c) where the defectiveness is due to '(b) software, including software updates or upgrades; (c) a lack of software updates or upgrades necessary to maintain safety; (d) a substantial modification of the product', provided that it is within the manufacturer's control. | medium | 1 case |