Software Liability Comes to the EU: Navigating New Compliance Challenges

The European Union has taken a significant step by introducing a directive to update the EU’s civil liability law that extends the definition of "defective products" to include software. These pivotal liability rules hold manufacturers accountable for harm caused by software vulnerabilities, urging them to prioritize cybersecurity and compliance. Here’s how manufactures should think about navigating these new compliance challenges. 

The Redefinition of “Defective Products” 

The redefinition of "defective products" under the EU software liability directive marks an important shift in how software is treated in terms of legal responsibility. Previously, the term "defective products" primarily referred to tangible goods that could cause harm due to their physical characteristics. However, with the advent of these rules, software too is now categorized under this definition. This change underscores the recognition of software's integral role in modern products and its potential to cause harm if not properly secured. 

This redefinition aims to protect consumers by ensuring that manufacturers implement and maintain high levels of security in their software products. It also places a greater burden on manufacturers to prove that all necessary precautions were taken to prevent software-related incidents, shifting the landscape of liability and consumer protection in the digital age. 

Compliance Challenges for Manufacturers Set by New Rules 

Manufacturers face several compliance challenges under the updated product liability rules. 

• Cybersecurity Throughout Product Lifecycle: Manufacturers must ensure they address vulnerabilities in software throughout the product lifecycle, necessitating a strong focus on software security, including regular updates, patches, and security measures. 

• Documentation and Evidence: There is a need for thorough documentation and evidence of compliance efforts to prepare for potential legal claims. 

• Extended Liability: The directive extends liability to importers and EU representatives of foreign software, emphasizing the need for compliance across the supply chain. 

• Open-source Software Carve-Out: Although there is a specific carve-out for non-profit open-source software, manufacturers must still be diligent in how it is integrated and maintained within their products. 

• Digital Components and Platforms: The directive recognizes digital manufacturing files and software as products, extending liability to online platforms that act like economic operators if they sell defective products. 

Navigating These Liability Complexities 

Manufacturers can navigate the complexities of liability due to software vulnerabilities and the updated product liability rules by implementing several strategies: 

• Proactive Measures: Manufacturers should adopt proactive security testing measures throughout the software development lifecycle. Read this eBook to learn more about securing the SDLC. 

• Supply Chain Management: You’ll want to be able to produce a Software Bill of Materials (SBoM) to tell what’s being used in software, like nutrition facts on food labels. 

• Evidence Management: Manufacturers must be prepared to provide relevant evidence in court, which can aid in resolving liability claims more effectively. That means you need clear reporting in real-time. 

These are complexities we’ve helped organizations navigate for 20 years. Schedule a demo to see how Veracode can help you navigate all of the complexities with our world-class platform.