EU’s Liability Shift: Revolutionizing Cybersecurity Practices for All Products

• Introduction of New Directive: The EU adopted a revised Product Liability Directive in late 2024 that covers software and cybersecurity flaws.
• Broader Scope: Software, including apps and firmware, now counts as a product, so makers can be liable when a defect causes harm.
• Hard-hitting Provisions: A product can be judged defective if it lacks the security updates needed to keep it safe.
• Global Ripple Effect: Any company selling into the EU has to account for the new rules.
• Implementational Hurdles: The rules apply to products placed on the market from December 9, 2026, giving businesses time to prepare.

Rethinking Accountability: A Historic Overhaul

The European Union’s revised Product Liability Directive (Directive (EU) 2024/2853), published in November 2024, changes who pays when connected products cause harm. Product liability used to be mostly about physical defects. The new directive makes clear that software, including standalone apps, operating systems and firmware, counts as a product. That means a manufacturer can be held liable for damage caused by defective software, including cybersecurity weaknesses.

It is a big change in how liability works for technology. EU countries have until December 9, 2026 to apply it, and it covers products placed on the market from that date.

A Comprehensive Overhaul: Ensuring Global Safety Standards

The scope is broad. It reaches software on its own and physical goods that depend on software, such as Internet of Things (IoT) devices. A product can be considered defective if it does not provide the safety people are entitled to expect, and that now includes cybersecurity. Failing to supply security updates that are needed to keep a product safe can also count as a defect while the manufacturer still controls the product.

The effect will reach well beyond Europe. Any company that sells into the EU market, wherever it is based, will need to think about software security as a liability issue, not only a quality one.

Key Elements of the Directive

The directive works alongside the EU Cyber Resilience Act, which sets security requirements for products with digital elements. Together they push manufacturers to build in security from design through the end of a product’s support period. The Cyber Resilience Act requires vulnerability handling and incident reporting, while the liability directive lets people claim compensation when insecure products cause harm.

The liability rules also make claims easier for injured people. Courts can order companies to disclose evidence, and in complex technical cases the burden of proof can be eased. Damage covered includes death, personal injury, property damage and the destruction or corruption of data that is not used for professional purposes.

Industry Adapts: Navigating Challenges and Opportunities

Compliance will cost money. Companies need secure development practices, a plan for security updates and good records showing what they did. Smaller firms may struggle most. There is an upside: companies that can show strong security will have a selling point.

Firms that start early will have an easier time. Updating development and support processes now is cheaper than defending claims later.

The Takeaway

The revised Product Liability Directive raises the bar for anyone selling software or connected products in Europe. Security flaws are no longer just a reputational risk. They can lead to legal liability.

For manufacturers worldwide, the message is to treat cybersecurity as a product safety issue, with clear update commitments and secure design. The EU has set the pace, and other regions may follow.

Frank Jones, CISSP

Frank Jones has loved computers from the age of 13. Frank got his hacking career started when he downloaded a war dialing program that he used to detect dial up modems in his hometown of Chicago. Frank Jones now works as a JAVA coder and cyber security researcher.