Keep the evidence to answer a product liability claim

Region

European Union (EU). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds.

How to do it

Directive (EU) 2024/2853 replaces the 1985 Product Liability Directive from 9 December 2026. Software now counts as a product. Free and open-source software made outside a commercial activity is excluded. Damage covers death, injury, property, and the destruction or corruption of data not used for professional purposes. AI systems count as software, and so do apps and firmware, however they are supplied. A manufacturer stays liable for defects caused by software updates, or by missing safety updates, while it controls the product. That includes missing security updates. A court can order you to disclose evidence, under Article 9. If you do not, the court presumes the product defective, under Article 10. The 1985 rules had a minimum claim for property damage, and the new Directive has none. It has no cap on liability either. Claims expire ten years after the product, or a substantially changed version, reached the market. For personal injury whose symptoms appear late, the period is 25 years under Article 17(2). Each EU country writes the Directive into its own law, so check the national act. Keep each release's bill of materials as the provenance rule describes, and plan updates with the support period rule. Store the records as Keep evidence where nobody can change it says.

Examples

JavaScript example

const LIABILITY_YEARS = 10;

export const lockIsLongEnough = (releasedAt, lockUntil) => {
  const required = new Date(releasedAt);
  required.setUTCFullYear(required.getUTCFullYear() + LIABILITY_YEARS);
  return new Date(lockUntil) >= required;
};

Python example

from datetime import date

LIABILITY_YEARS = 10

def lock_is_long_enough(released_at: date, lock_until: date) -> bool:
    try:
        required = released_at.replace(year=released_at.year + LIABILITY_YEARS)
    except ValueError:
        required = released_at.replace(year=released_at.year + LIABILITY_YEARS, day=28)
    return lock_until >= required

How to check

Every release of a product sold in the EU has a stored record. It holds the version, date, bill of materials, test results and security fixes. The storage lock on each record ends at least ten years after the release date.

Sources

• Product Liability Directive (EU) 2024/2853

Related rules

• APS-75 Publish what is in each release in Application security
• CMP-50 Handle vulnerabilities for the whole support period in Compliance and governance
• CMP-35 Keep evidence where nobody can change it in Compliance and governance