---
title: "Keep the evidence to answer a product · Agent Wranglers"
url: https://agentwranglers.se/playbook/compliance/product-and-data-laws/product-liability
id: CMP-55
level: Recommended
applies: digital-product
region: EU
updated: 2026-10-27
build: a2a6bdfed830
tokens: 1268
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Keep the evidence to answer a product liability claim

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Product and data laws](https://agentwranglers.se/playbook/compliance/product-and-data-laws.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: CMP-55
- Level: Recommended
- Chapter: [Product and data laws](https://agentwranglers.se/playbook/compliance/product-and-data-laws.md)
- Rule: For software placed on the EU market after 9 December 2026, keep a record of every release for ten years. Ship the updates needed to keep it safe while you control it.
- Check: Every release of a product sold in the EU has a stored record. It holds the version, date, bill of materials, test results and security fixes. The storage lock on each record ends at least ten years after the release date.
- Applies when: The project sells or hands out software or devices that others run, not only a hosted service.
- Region: European Union (EU). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds.
- How: Directive (EU) 2024/2853 replaces the 1985 Product Liability Directive from 9 December 2026. Software now counts as a product. Free and open-source software made outside a commercial activity is excluded. Damage covers death, injury, property, and the destruction or corruption of data not used for professional purposes. AI systems count as software, and so do apps and firmware, however they are supplied. A manufacturer stays liable for defects caused by software updates, or by missing safety updates, while it controls the product. That includes missing security updates. A court can order you to disclose evidence, under Article 9. If you do not, the court presumes the product defective, under Article 10. The 1985 rules had a minimum claim for property damage, and the new Directive has none. It has no cap on liability either. Claims expire ten years after the product, or a substantially changed version, reached the market. For personal injury whose symptoms appear late, the period is 25 years under Article 17(2). Each EU country writes the Directive into its own law, so check the national act. Keep each release's bill of materials as the [provenance rule](https://agentwranglers.se/playbook/application-security/supply-chain/sbom-and-provenance.md) describes, and plan updates with the [support period rule](https://agentwranglers.se/playbook/compliance/security-laws/cra-support-period.md). Store the records as [Keep evidence where nobody can change it](https://agentwranglers.se/playbook/compliance/controls-and-evidence/evidence-store.md) says.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
const LIABILITY_YEARS = 10;

export const lockIsLongEnough = (releasedAt, lockUntil) => {
  const required = new Date(releasedAt);
  required.setUTCFullYear(required.getUTCFullYear() + LIABILITY_YEARS);
  return new Date(lockUntil) >= required;
};
```

### Python example

```python
from datetime import date

LIABILITY_YEARS = 10

def lock_is_long_enough(released_at: date, lock_until: date) -> bool:
    try:
        required = released_at.replace(year=released_at.year + LIABILITY_YEARS)
    except ValueError:
        required = released_at.replace(year=released_at.year + LIABILITY_YEARS, day=28)
    return lock_until >= required
```

## Sources

- [Product Liability Directive (EU) 2024/2853](https://eur-lex.europa.eu/eli/dir/2024/2853/oj)

## Related rules

- APS-75 [Publish what is in each release](https://agentwranglers.se/playbook/application-security/supply-chain/sbom-and-provenance.md) in Application security
- CMP-50 [Handle vulnerabilities for the whole support period](https://agentwranglers.se/playbook/compliance/security-laws/cra-support-period.md) in Compliance and governance
- CMP-35 [Keep evidence where nobody can change it](https://agentwranglers.se/playbook/compliance/controls-and-evidence/evidence-store.md) in Compliance and governance

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/compliance/product-and-data-laws/product-liability">Agent Wranglers compliance and governance playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Give users the data from connected products](https://agentwranglers.se/playbook/compliance/product-and-data-laws/data-act-connected-products.md)
- Next: [Plan to accept the EU digital identity wallet](https://agentwranglers.se/playbook/compliance/product-and-data-laws/eudi-wallet.md)
- [Product and data laws](https://agentwranglers.se/playbook/compliance/product-and-data-laws.md)