---
title: "Keep the evidence to answer a product · Agent Wranglers"
url: https://agentwranglers.se/playbook/compliance/product-and-sector-laws/product-liability
updated: 2026-10-21
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Keep the evidence to answer a product liability claim

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Product and sector laws](https://agentwranglers.se/playbook/compliance/product-and-sector-laws.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers). Updated 2026-10-21.

- Level: Recommended
- Chapter: [Product and sector laws](https://agentwranglers.se/playbook/compliance/product-and-sector-laws)
- Rule: For software placed on the EU market after 9 December 2026, keep a record of every release for ten years. Ship the updates needed to keep it safe while you control it.
- Applies when: The project has users in the EU.
- How: Directive (EU) 2024/2853 replaces the 1985 Product Liability Directive from 9 December 2026. Software now counts as a product. Free and open-source software made outside a commercial activity is excluded. Damage covers death, injury, property, and the destruction or corruption of data not used for professional purposes. A manufacturer stays liable for defects caused by software updates, or by missing safety updates, while it controls the product. A court can order you to disclose evidence, under Article 9. Claims expire ten years after the product, or a substantially changed version, reached the market. Each EU country writes the Directive into its own law, so check the national act. Keep each release's bill of materials as the [provenance rule](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/sbom-and-provenance) describes, and plan updates with the [support period rule](https://agentwranglers.se/playbook/compliance/product-and-sector-laws/cra-support-period). Store the records as [Keep evidence where nobody can change it](https://agentwranglers.se/playbook/compliance/controls-and-evidence/evidence-store) says.
- Check: Every release of a product sold in the EU has a stored record. It holds the version, date, bill of materials, test results and security fixes. The storage lock on each record ends at least ten years after the release date.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
const LIABILITY_YEARS = 10;

export const lockIsLongEnough = (releasedAt, lockUntil) => {
  const required = new Date(releasedAt);
  required.setUTCFullYear(required.getUTCFullYear() + LIABILITY_YEARS);
  return new Date(lockUntil) >= required;
};
```

### Python example

```python
from datetime import date

LIABILITY_YEARS = 10

def lock_is_long_enough(released_at: date, lock_until: date) -> bool:
    try:
        required = released_at.replace(year=released_at.year + LIABILITY_YEARS)
    except ValueError:
        required = released_at.replace(year=released_at.year + LIABILITY_YEARS, day=28)
    return lock_until >= required
```

## Sources

- [Product Liability Directive (EU) 2024/2853](https://eur-lex.europa.eu/eli/dir/2024/2853/oj)

## Related rules

- [Publish what is in each release](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/sbom-and-provenance) in Security testing
- [Handle vulnerabilities for the whole support period](https://agentwranglers.se/playbook/compliance/product-and-sector-laws/cra-support-period) in Compliance
- [Keep evidence where nobody can change it](https://agentwranglers.se/playbook/compliance/controls-and-evidence/evidence-store) in Compliance

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/compliance/product-and-sector-laws/product-liability">Agent Wranglers compliance playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Give users the data from connected products](https://agentwranglers.se/playbook/compliance/product-and-sector-laws/data-act-connected-products)
- [Product and sector laws](https://agentwranglers.se/playbook/compliance/product-and-sector-laws)