EU's New Product Liability Directive & Its Cybersecurity Impact

**Executive summary:** The EU's revised Product Liability Directive, effective Dec. 8, 2024 with national implementation by Dec. 9, 2026, broadens liability to include software, SaaS, embedded software, and AI, creates a presumption of defectiveness in hard-to-prove cases, extends liability across software updates and supply chains (including non-EU sellers via importers/representatives), recognizes irrecoverable data loss as actionable harm, limits liability waivers, requires sensitive disclosures in legal proceedings, and emphasizes the need for state-of-the-art cybersecurity measures, secure update mechanisms, vulnerability management, and legal and technical compliance steps to mitigate increased exposure.