The EU's Directive 2024/2853 on liability for defective products treats software as a product, however it is supplied, and allows a cybersecurity vulnerability to make a product defective. It applies to products placed on the market after 9 December 2026. This is educational, not legal advice.
Software is a product
Article 4(1) defines a product to include electricity, digital manufacturing files, raw materials and software. Recital 13 says this applies however the software is supplied, including as a cloud or other service. Pure information, such as media files or e-books, is not a product.
For engineering leaders, the old comfort that "software is a service, not a product" is gone for in scope cases in the EU.
How defects are judged
Article 7(1) says a product is defective if it does not provide the safety a person is entitled to expect, or that is required by Union or national law. Factors under Article 7(2) include presentation, reasonably foreseeable use and misuse, and the effect of connected products or learning features. Article 7(2)(f) explicitly points to relevant product safety requirements, including safety relevant cybersecurity requirements.
Recital 32 states that a cybersecurity vulnerability can be a defect. Recital 31 adds that warnings alone do not make a dangerous product safe.
Article 7(3) says a better product appearing later does not make an existing one defective, which protects ordinary product improvement.
Updates after release
Article 11(2)(c) and Recital 51 address the post-sale argument. A manufacturer cannot escape by pointing to the date the product was put on the market when the defect is a lack of security updates needed to maintain safety. This does not apply where the owner fails to install an update that was provided.
So the question shifts from "did we ship it clean" to "did we keep it safe while we controlled updates". Support windows, patch timelines and the ability to push fixes now have legal weight in this setting.
Presumptions that matter
Article 10(2) lists cases where defectiveness is presumed, including non-compliance with mandatory safety requirements, an obvious malfunction during normal use, and a defendant's failure to disclose evidence. The last one is a records issue. If you cannot produce your vulnerability handling history, a court may presume against you.
What to do now
- Work out which of your products fall within the EU market and the 9 December 2026 date.
- Write down your support period and security update commitments, and check you can keep them.
- Keep a defensible record of vulnerability triage and fixes.
- Track components. You cannot show diligence on dependencies you cannot list.
Safeguard's SBOM and dependency scanning and reachability analysis can help keep that record. Whether liability attaches in a given case is for counsel.
Quick check
Does the Directive apply to products already on the market?
Per Article 2(1) it applies to products placed on the market or put into service after 9 December 2026. Earlier products remain under the previous directive.
Is a missing security update a defect?
It can be, where the update was needed to maintain safety and the manufacturer was in control. The rule does not apply where the owner failed to install an update that was provided.
Sources
Last reviewed: 19 October 2026.
