--- title: "EU Product Liability for Software: Evidence Checklist" canonical: https://wavect.io/blog/eu-product-liability-software-evidence-2026/ language: en description: "Prepare software engineering evidence for the revised EU Product Liability Directive: traceability, build provenance, tests, incidents, updates, and retention." image: "https://wavect.io/img/blog/headers/header_eu-product-liability-software-evidence-2026.png" --- [**Back**](/blog/overview/) [![Kevin Riedl](/img/team/kevin.webp)](/team/kevin-riedl/) [Kevin Riedl](/team/kevin-riedl/) https://linkedin.com/in/wsdt 8 min read · 24 Aug 2026 Last reviewed August 24, 2026 [**Next**](/blog/ai-bill-of-materials-cyclonedx-spdx-2026/) # EU Product Liability for Software: The Engineering Evidence Checklist TL;DR The revised EU Product Liability Directive explicitly includes software and applies to products placed on the market or put into service after 9 December 2026. Teams should create a versioned evidence chain from intended use and foreseeable misuse through architecture, dependencies, tests, release approvals, incidents, corrective updates, adoption, communication, and end of support. Evidence supports safer engineering but does not replace legal advice or make an unsafe product safe. **The revised EU Product Liability Directive expressly treats software, including AI systems and software supplied as a service, as products. It applies to products placed on the market or put into service after 9 December 2026. Engineering teams should preserve evidence that connects intended use, foreseeable misuse, security, tests, releases, incidents, updates, and user communication.** Liability is a legal determination, so use counsel for case-specific advice. Engineering's job is to make the product history explainable and retrievable. This guide addresses that evidence system, not litigation strategy. ## What changes for software teams? | Area | Directive signal | Evidence to retain | | --- | --- | --- | | **Product scope** | Software is explicitly included | Version, supplier, deployment, and market records | | **Defect assessment** | Safety includes cybersecurity and expected updates | Threat models, test results, advisories, and update decisions | | **Disclosure** | Courts may order relevant evidence disclosure | Searchable, proportionate records with defined retention | ## What belongs in a software evidence chain? Build traceability from a safety-relevant requirement to its implementation, verification, release, telemetry, and corrective action. Evidence should show what the team knew, what it decided, who approved it, and what users were told at that time. - Dated intended-use, user-group, operating-environment, and foreseeable-misuse assumptions. - Architecture decisions, threat models, hazard analysis, access-control rules, and dependency inventory. - Reproducible test results, review records, known limitations, residual risks, and release approvals. - Incident reports, support tickets, update decisions, rollout metrics, notices, and end-of-support records. ## How much evidence is enough? More logs are not automatically better. Preserve decision-grade evidence with provenance, access controls, retention, and a clear link to the shipped version. A data lake full of unverifiable screenshots and mutable dashboards is weak evidence and a privacy burden. - Use immutable build identifiers and connect them to source, artifacts, dependencies, configuration, and tests. - Record why a failed test was waived and who accepted the residual risk. - Test whether an independent reviewer can reconstruct one release without tribal knowledge. ## Which operational practices reduce product risk? Treat post-release maintenance as part of product safety. Monitor relevant failures and vulnerabilities, triage them against affected versions, ship corrective updates, verify adoption, and communicate material residual risk. - Define security and safety ownership for the supported life of the product. - Keep rollback, feature-disable, customer-notification, and evidence-preservation runbooks. - Apply the same controls to AI model, prompt, policy, and dataset changes that can alter behavior. ## A 30-day evidence-readiness plan 1. Map safety-relevant products, deployments, actors, users, and post-9-December-2026 releases. 2. Choose one release and reconstruct its requirement-to-production evidence chain. 3. Close missing build provenance, test retention, approval, incident, and update records. 4. Define retention, legal hold, privacy, access, and disclosure-export procedures with counsel. 5. Automate evidence capture in CI/CD and service operations instead of relying on manual archives. 6. Run a mock evidence request and remediate every answer that depends on one employee's memory. ## EU software product-liability FAQ ### Does the revised directive cover SaaS? The directive's definition of product includes software, and its recitals explain that this includes software supplied through cloud services such as SaaS. ### When do the new rules apply? Member States must apply the national measures to products placed on the market or put into service after 9 December 2026. ### Is free and open-source software excluded? Software developed or supplied outside a commercial activity is excluded, but commercial integration, services, or business use can change the analysis. Seek legal advice for the specific distribution model. ### Will documentation prevent liability? No. Evidence does not make an unsafe product safe. It supports disciplined engineering, faster correction, and an accurate account of what was built and maintained. ## Final thoughts The practical response is not a legal memo stored beside the repository. It is a versioned evidence chain produced by normal delivery and maintenance work, tested before anyone needs it under pressure. ## Primary sources 1. [Directive (EU) 2024/2853](https://eur-lex.europa.eu/eli/dir/2024/2853/oj). Official text of the revised Product Liability Directive 2. [European Commission defective-products page](https://commission.europa.eu/business-economy-euro/doing-business-eu/contract-rules/consumer-contracts/liability-defective-products_en). Official policy overview for consumers and businesses ## You may also like.. [**Software maintenance cost benchmark** Connect evidence readiness to the recurring work needed to keep software safe.](/blog/software-maintenance-cost-benchmark-dach-saas/) [**Wavect vs development agencies** Compare teams for long-lived, evidence-driven software delivery.](/compare/wavect-vs-dev-agencies/) AI governance and regulation ## Continue through this cluster Security, policy, compliance and operating controls for responsible AI adoption. [Start with the cornerstone**EU AI Act Cost for a 5-Person Startup**](/blog/eu-ai-act-compliance-cost-startup/) - [Cyber Resilience Act Reporting: 24-Hour Playbook](/blog/cyber-resilience-act-reporting-playbook-2026/) - [AI Bill of Materials: CycloneDX vs SPDX](/blog/ai-bill-of-materials-cyclonedx-spdx-2026/) - [LLM Pseudonymization Gateways: Does the Prompt Leave GDPR Scope?](/blog/llm-pseudonymization-gateway-gdpr-2026/) - [Semantica Review 2026: Can It Explain Every AI Agent Decision?](/blog/semantica-ai-agent-decision-provenance/) - [AI Agent Contract Signing: eIDAS QES Integration Guide](/blog/ai-agent-eidas-signature-integration/) Inbox, without the noise ## Follow the work that matters to you Get a short email when we publish something new. Follow the whole blog or only the problems you care about. [**Back**](/blog/overview/) [![Kevin Riedl](/img/team/kevin.webp)](/team/kevin-riedl/) [Kevin Riedl](/team/kevin-riedl/) https://linkedin.com/in/wsdt 8 min read · 24 Aug 2026 Last reviewed August 24, 2026 [**Next**](/blog/ai-bill-of-materials-cyclonedx-spdx-2026/) New posts by email × × Get new posts by email A short email when we publish. Free, no tracking. ## Structured Data ```json { "@context": "https://schema.org", "@graph": [ { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ], "employee": [ { "@id": "https://wavect.io/team/kevin-riedl/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Kevin Riedl", "url": "https://wavect.io/team/kevin-riedl/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } }, { "@id": "https://wavect.io/team/christof-jori/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Christof Jori", "url": "https://wavect.io/team/christof-jori/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } } ], "founder": [ { "@id": "https://wavect.io/team/kevin-riedl/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Kevin Riedl", "url": "https://wavect.io/team/kevin-riedl/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } }, { "@id": "https://wavect.io/team/christof-jori/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Christof Jori", "url": "https://wavect.io/team/christof-jori/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } } ], "legalRepresentative": [ { "@id": "https://wavect.io/team/kevin-riedl/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Kevin Riedl", "url": "https://wavect.io/team/kevin-riedl/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } }, { "@id": "https://wavect.io/team/christof-jori/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Christof Jori", "url": "https://wavect.io/team/christof-jori/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } } ], "name": "Wavect GmbH", "subjectOf": { "@id": "https://wavect.io/verified-claims.json#dataset", "@type": "Dataset", "creator": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] }, "description": "A machine-readable registry of quantitative and qualitative claims published by Wavect, with review dates, localized page appearances and public third-party citations where available.", "inLanguage": "en", "isAccessibleForFree": true, "license": "https://creativecommons.org/licenses/by/4.0/", "name": "Wavect verified publication claims", "url": "https://wavect.io/verified-claims.json" }, "url": "https://wavect.io/" }, { "@id": "https://wavect.io/team/kevin-riedl/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Kevin Riedl", "sameAs": [ "https://www.wikidata.org/wiki/Q139796365", "https://www.linkedin.com/in/wsdt", "https://github.com/wsdt" ], "url": "https://wavect.io/team/kevin-riedl/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } }, { "@id": "https://wavect.io/team/christof-jori/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Christof Jori", "sameAs": [ "https://www.wikidata.org/wiki/Q139796367", "https://www.linkedin.com/in/jocr77/", "https://github.com/jo-chris" ], "url": "https://wavect.io/team/christof-jori/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } }, { "@id": "https://wavect.io/#website", "@type": "WebSite", "inLanguage": [ "en", "de", "es", "zh" ], "name": "Wavect", "potentialAction": { "@type": "SearchAction", "query-input": "required name=search_term_string", "target": { "@type": "EntryPoint", "urlTemplate": "https://wavect.io/search/?q={search_term_string}" } }, "publisher": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] }, "url": "https://wavect.io/" }, { "@id": "https://wavect.io/blog/eu-product-liability-software-evidence-2026/#webpage", "@type": "WebPage", "dateModified": "2026-08-24", "inLanguage": "en", "isPartOf": { "@id": "https://wavect.io/#website", "@type": "WebSite" }, "lastReviewed": "2026-08-24", "url": "https://wavect.io/blog/eu-product-liability-software-evidence-2026/" } ] } ``` ```json { "@context": "https://schema.org", "@type": "BlogPosting", "abstract": "The revised EU Product Liability Directive explicitly includes software and applies to products placed on the market or put into service after 9 December 2026. Teams should create a versioned evidence chain from intended use and foreseeable misuse through architecture, dependencies, tests, release approvals, incidents, corrective updates, adoption, communication, and end of support. Evidence supports safer engineering but does not replace legal advice or make an unsafe product safe.", "articleBody": " Blog overview/Business and regulation/AI governance and regulation EU Product Liability for Software: The Engineering Evidence Checklist TL;DR The revised EU Product Liability Directive explicitly includes software and applies to products placed on the market or put into service after 9 December 2026. Teams should create a versioned evidence chain from intended use and foreseeable misuse through architecture, dependencies, tests, release approvals, incidents, corrective updates, adoption, communication, and end of support. Evidence supports safer engineering but does not replace legal advice or make an unsafe product safe. The revised EU Product Liability Directive expressly treats software, including AI systems and software supplied as a service, as products. It applies to products placed on the market or put into service after 9 December 2026. Engineering teams should preserve evidence that connects intended use, foreseeable misuse, security, tests, releases, incidents, updates, and user communication. Liability is a legal determination, so use counsel for case-specific advice. Engineering's job is to make the product history explainable and retrievable. This guide addresses that evidence system, not litigation strategy. What changes for software teams? AreaDirective signalEvidence to retain Product scopeSoftware is explicitly includedVersion, supplier, deployment, and market recordsDefect assessmentSafety includes cybersecurity and expected updatesThreat models, test results, advisories, and update decisionsDisclosureCourts may order relevant evidence disclosureSearchable, proportionate records with defined retention What belongs in a software evidence chain? Build traceability from a safety-relevant requirement to its implementation, verification, release, telemetry, and corrective action. Evidence should show what the team knew, what it decided, who approved it, and what users were told at that time. Dated intended-use, user-group, operating-environment, and foreseeable-misuse assumptions.Architecture decisions, threat models, hazard analysis, access-control rules, and dependency inventory.Reproducible test results, review records, known limitations, residual risks, and release approvals.Incident reports, support tickets, update decisions, rollout metrics, notices, and end-of-support records. How much evidence is enough? More logs are not automatically better. Preserve decision-grade evidence with provenance, access controls, retention, and a clear link to the shipped version. A data lake full of unverifiable screenshots and mutable dashboards is weak evidence and a privacy burden. Use immutable build identifiers and connect them to source, artifacts, dependencies, configuration, and tests.Record why a failed test was waived and who accepted the residual risk.Test whether an independent reviewer can reconstruct one release without tribal knowledge. Which operational practices reduce product risk? Treat post-release maintenance as part of product safety. Monitor relevant failures and vulnerabilities, triage them against affected versions, ship corrective updates, verify adoption, and communicate material residual risk. Define security and safety ownership for the supported life of the product.Keep rollback, feature-disable, customer-notification, and evidence-preservation runbooks.Apply the same controls to AI model, prompt, policy, and dataset changes that can alter behavior. A 30-day evidence-readiness plan Map safety-relevant products, deployments, actors, users, and post-9-December-2026 releases.Choose one release and reconstruct its requirement-to-production evidence chain.Close missing build provenance, test retention, approval, incident, and update records.Define retention, legal hold, privacy, access, and disclosure-export procedures with counsel.Automate evidence capture in CI/CD and service operations instead of relying on manual archives.Run a mock evidence request and remediate every answer that depends on one employee's memory. Useful service paths: Software QA See it in production: Bond Analytics Platform Decide it first: How to choose a software development agency EU software product-liability FAQ Does the revised directive cover SaaS? The directive's definition of product includes software, and its recitals explain that this includes software supplied through cloud services such as SaaS. When do the new rules apply? Member States must apply the national measures to products placed on the market or put into service after 9 December 2026. Is free and open-source software excluded? Software developed or supplied outside a commercial activity is excluded, but commercial integration, services, or business use can change the analysis. Seek legal advice for the specific distribution model. Will documentation prevent liability? No. Evidence does not make an unsafe product safe. It supports disciplined engineering, faster correction, and an accurate account of what was built and maintained.", "articleSection": "Regulation", "author": { "@id": "https://wavect.io/team/kevin-riedl/#person", "@type": "Person", "name": "Kevin Riedl", "sameAs": [ "https://www.wikidata.org/wiki/Q139796365", "https://www.linkedin.com/in/wsdt", "https://github.com/wsdt" ], "url": "https://wavect.io/team/kevin-riedl/" }, "citation": [ { "@type": "WebPage", "name": "Directive (EU) 2024/2853", "url": "https://eur-lex.europa.eu/eli/dir/2024/2853/oj" }, { "@type": "WebPage", "name": "European Commission defective-products page", "url": "https://commission.europa.eu/business-economy-euro/doing-business-eu/contract-rules/consumer-contracts/liability-defective-products_en" } ], "dateModified": "2026-08-24", "datePublished": "2026-08-24", "description": "The revised EU Product Liability Directive explicitly includes software and applies to products placed on the market or put into service after 9 December 2026. Teams should create a versioned evidence chain from intended use and foreseeable misuse through architecture, dependencies, tests, release approvals, incidents, corrective updates, adoption, communication, and end of support. Evidence supports safer engineering but does not replace legal advice or make an unsafe product safe.", "headline": "EU Product Liability for Software: Evidence Checklist", "image": "https://wavect.io/img/blog/headers/header_eu-product-liability-software-evidence-2026.svg", "inLanguage": "en", "keywords": "EU Product Liability, Software Evidence, Software Quality", "mainEntityOfPage": { "@id": "https://wavect.io/blog/eu-product-liability-software-evidence-2026/", "@type": "WebPage" }, "publisher": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] }, "url": "https://wavect.io/blog/eu-product-liability-software-evidence-2026/", "wordCount": 963 } ``` ```json { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "item": "https://wavect.io/", "name": "Home", "position": 1 }, { "@type": "ListItem", "item": "https://wavect.io/blog/overview/", "name": "Blog overview", "position": 2 }, { "@type": "ListItem", "item": "https://wavect.io/blog/topics/business-regulation/", "name": "Business and regulation", "position": 3 }, { "@type": "ListItem", "item": "https://wavect.io/blog/clusters/ai-governance/", "name": "AI governance and regulation", "position": 4 }, { "@type": "ListItem", "item": "https://wavect.io/blog/eu-product-liability-software-evidence-2026/", "name": "EU Product Liability for Software: Evidence Checklist | ", "position": 5 } ] } ``` ```json { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "acceptedAnswer": { "@type": "Answer", "text": "The directive's definition of product includes software, and its recitals explain that this includes software supplied through cloud services such as SaaS." }, "name": "Does the revised directive cover SaaS?" }, { "@type": "Question", "acceptedAnswer": { "@type": "Answer", "text": "Member States must apply the national measures to products placed on the market or put into service after 9 December 2026." }, "name": "When do the new rules apply?" }, { "@type": "Question", "acceptedAnswer": { "@type": "Answer", "text": "Software developed or supplied outside a commercial activity is excluded, but commercial integration, services, or business use can change the analysis. Seek legal advice for the specific distribution model." }, "name": "Is free and open-source software excluded?" }, { "@type": "Question", "acceptedAnswer": { "@type": "Answer", "text": "No. Evidence does not make an unsafe product safe. It supports disciplined engineering, faster correction, and an accurate account of what was built and maintained." }, "name": "Will documentation prevent liability?" } ] } ```