The EU will make vendors liable for bugs

The European Union has revised its product liability laws to include software and associated risks, such as security flaws and planned obsolescence. The new Directive on Liability for Defective Products, which replaces an older directive, allows consumers to hold companies accountable for selling defective software products. Key changes include extending liability to vendors for software with security flaws that cause consumer damage, both physical and material. The directive also mandates that vendors must provide a software update mechanism and prohibits withholding information about negative impacts of updates. Companies can be held liable for planned obsolescence practices, such as intentionally degrading product performance to encourage upgrades. While consumers must prove product defectiveness, the directive introduces mechanisms to compel vendors to provide necessary evidence. Notably, free and open-source software is exempt from these requirements. The directive was approved by the EU Parliament and Council and will take effect in 24 months, in the fall of 2026.

- The EU's new directive includes software in product liability laws.

- Vendors are liable for security flaws in software that cause consumer damage.

- Companies must provide update mechanisms and cannot withhold negative update information.

- Planned obsolescence practices can lead to vendor liability.

- Free and open-source software is exempt from the new liability requirements.