For AI agents: llms.txt is a short guide that sends you to the rules your problem needs, and rules.json holds every rule of this playbook as JSON.

Applies when

The project it has users in the EU.

How to do it

Directive (EU) 2024/2853 replaces the 1985 Product Liability Directive from 9 December 2026. Software now counts as a product. Free and open-source software made outside a commercial activity is excluded. Damage covers death, injury, property, and the destruction or corruption of data not used for professional purposes. A manufacturer stays liable for defects caused by software updates, or by missing safety updates, while it controls the product. A court can order you to disclose evidence, under Article 9. Claims expire ten years after the product, or a substantially changed version, reached the market. Each EU country writes the Directive into its own law, so check the national act. Keep each release's bill of materials as the provenance rule describes, and plan updates with the support period rule. Store the records as Keep evidence where nobody can change it says.

Examples

Using these examples: they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

JavaScript example

const LIABILITY_YEARS = 10;

export const lockIsLongEnough = (releasedAt, lockUntil) => {
  const required = new Date(releasedAt);
  required.setUTCFullYear(required.getUTCFullYear() + LIABILITY_YEARS);
  return new Date(lockUntil) >= required;
};

Python example

from datetime import date

LIABILITY_YEARS = 10

def lock_is_long_enough(released_at: date, lock_until: date) -> bool:
    try:
        required = released_at.replace(year=released_at.year + LIABILITY_YEARS)
    except ValueError:
        required = released_at.replace(year=released_at.year + LIABILITY_YEARS, day=28)
    return lock_until >= required

How to check

Every release of a product sold in the EU has a stored record. It holds the version, date, bill of materials, test results and security fixes. The storage lock on each record ends at least ten years after the release date.

Sources

• Product Liability Directive (EU) 2024/2853

Related rules

• Publish what is in each release in Security testing
• Handle vulnerabilities for the whole support period in Compliance
• Keep evidence where nobody can change it in Compliance