Software liability gets real: 5 ways to get ahead of the EU's new directive

The report examines the EU’s updated Product Liability Directive that expands “product” to include software and digital files and imposes strict, no-fault liability on software publishers and certain platforms for defects and security vulnerabilities, including responsibilities for updates, planned obsolescence, and evidence disclosure. It highlights impacts on organizations globally (including U.S. suppliers to the EU), the heightened accountability for open-source and third-party components, and alignment with Secure by Design initiatives. The report recommends five actions to prepare: implement a mature secure software development lifecycle; enhance pre- and post-release defect detection; strengthen open-source/third-party governance and SBOM transparency; plan for supported lifecycles and updates; and improve documentation and evidence preservation across development and operations.