Product Liability Directive: penetration testing and the evidence it leaves
From 9 December 2026, software is a product under EU liability law, and a product can be defective because of a security weakness it should not have had or an update it should have received. Liability is strict: the claimant does not have to prove you were careless, a court can order you to disclose your evidence, and in some cases it can presume the product was defective unless you show otherwise. The question a manufacturer will be asked is not "were you careful" but "show us". Tested, fixed and re-tested, with dates and names, is what there is to show.
When it applies.
- 01Entered into forcemilestone
- 02Applies to new products fromThe date that matters
JurisdictionEuropean Union, through national law. Applies to products placed on the market or put into service after 9 December 2026.
In scope, and out.
- Manufacturers of products, now explicitly including software, whether standalone, embedded or supplied as a service, together with digital manufacturing files and AI systems.
- Manufacturers of a defective component, including a software component, alongside the manufacturer of the product it went into.
- Importers, authorised representatives and in some cases fulfilment service providers and distributors, where the manufacturer is outside the EU or cannot be identified.
- Not in scope is free and open-source software developed or supplied outside a commercial activity.
What it asks of you
The Directive does not ask a manufacturer to do anything in particular. It changes what happens when something goes wrong. Software is a product. A product is defective when it does not provide the safety a person is entitled to expect, and the factors a court weighs now include safety-relevant cybersecurity requirements and whether the product received the updates it needed. The manufacturer stays liable for defects in software and updates, and for the lack of updates, while the software is within its control. Liability does not depend on fault.
What changes in practice is the burden. A claimant who makes a plausible case can ask a court to order disclosure of the evidence you hold, and where proof is excessively difficult because of technical complexity, or where you do not disclose, or where the product breached a mandatory safety requirement, defectiveness or causation can be presumed. The manufacturer who can show a dated record of what was tested, found, fixed and re-tested is in a different position from the one who can only say the team was diligent.
What the evidence looks like
The same report that satisfies an engineer has to satisfy a court, so it is written for both. Each finding carries its proof, the component it affects, the fix that was agreed, the re-test that showed the fix held, and the names of the people who did the work, with dates throughout. Where we recommended leaving something alone, the record says so and says why, because a reasoned decision reads very differently from an omission. Reproduction steps let an expert on either side confirm what was found and what was fixed.
The obligations testing can answer.
- Article 4
Software is a product for the purposes of the Directive.
Everything below applies to the code you ship, including the updates to it.
Application and API testing; Incenter - Article 7
A product is defective when it does not provide the safety a person is entitled to expect, assessed against factors that include relevant product safety requirements, among them safety-relevant cybersecurity requirements, and the effect of updates or the lack of them.
Testing a product against the attacks it will actually face, with proof of what succeeds, is how you know what safety it provides before a court asks.
Penetration testing; Incenter - Article 11
A manufacturer is not exempt from liability where the defect is due to software, including updates, or to the lack of updates needed to maintain safety, while the software is within its control.
Continuous testing for as long as the product is in your control, and every fix re-tested so that an update is shown to have worked rather than assumed to.
Incenter; closure sprint - Article 9
A court may order the defendant to disclose relevant evidence at its disposal, presented in an accessible and understandable way.
Your evidence will be read by people who are not engineers. Ours is written to be, with plain findings, the proof, the fix, the re-test, and who did it and when.
Every engagement - Article 10
Defectiveness or causation can be presumed, including where the defendant fails to disclose evidence, where the product does not comply with mandatory safety requirements, or where proof is excessively difficult because of technical complexity.
A dated testing record is the manufacturer's answer to a presumption. Without one, the presumption stands.
Every engagement
The record you can hand over.
- A dated report per test with each finding, its proof, the fix, the re-test and the named testers, which is the chronology a defence file needs.
- The reasoned list of what was not fixed and why, which is the difference between a judgement and an omission.
- Reproduction steps, so that a third party, including an expert witness, can confirm what was found and what was fixed.
PLD, answered plainly.
Is software a product under the new Directive?
Yes (Article 4), including software embedded in a product or supplied as a service. Free and open-source software supplied outside a commercial activity is excluded.
Can a missing security update make a product defective?
Yes. Article 11 removes the manufacturer's exemption where the defect comes from software, from updates, or from the lack of updates needed to maintain safety while the software is within its control, and Article 7 lists safety-relevant cybersecurity requirements among the factors a court weighs.
Does the Directive apply to products already on the market?
It applies to products placed on the market or put into service after 9 December 2026. The 1985 Directive continues to govern earlier products.
What should a testing record show?
What was tested and when, what was found with proof, what was fixed and by whom and when, that the fix was re-tested, and what was deliberately not fixed and why.
Does OSec advise on the Directive?
No. We test, fix with you and re-test, and the record we leave is for your counsel to use.