the whole job

Product Liability Directive: the whole job, in order

The Product Liability Directive does not ask you to build anything. It decides who pays when a defective product harms a person, and what a court can ask you to show. Here is the preparation as a plan: five phases of evidence and process, with who carries each step, what it produces and the proof it leaves.

last checked 2 November 2026

how to read this plan

Each step has an owner, a kind of work and two outputs. The kinds of work are different jobs: choices that someone with authority signs, records and routines the team builds, and checks that someone keeps running. Nothing here is a legal duty under the directive itself: there is no regulator to satisfy. The steps prepare you for a claim, which can come up to 10 years after a product is placed on the market. The new rules reach products placed on the market or put into service after 9 December 2026, through your national law. Under each step a small note names the article the step answers, or says practice where no text sets it. Insurance appears as a decision for the board; the plan gives no advice on it.

  • decide and documentchoices, policies and records that someone with authority signs
  • build and configuresystems, settings and procedures that make the choice real
  • prove and operatechecks, logs and records that show it keeps working
01

find where the directive reaches you

Know which of your products fall under the new rules, what role you play for each and what stays within your control after release.

  1. list the products and releases under the new rules

    List every product and software release you place on the market or put into service, with the date. Products placed after 9 December 2026 fall under the new rules; earlier ones stay under the old directive as written into national law.

    • owner legal or DPO
    • decide and document
    what it produces
    a product and release list with placing dates
    the proof it leaves
    the list, dated and kept up to date with each release

    the work pagethe control: asset-inventory

    basis PLD Art. 2(1), 21

  2. decide your role for each product

    Mark each product as made by you, sold under your name, a component you supply to others, imported, represented for a maker outside the EU, fulfilled or distributed. Note where you substantially modify someone else's product, because that makes you its manufacturer.

    • owner legal or DPO
    • decide and document
    what it produces
    a role entry per product, with the reasoning
    the proof it leaves
    the entries, reviewed when a product or a contract changes

    basis PLD Art. 4(10), 4(15), 8(1), 8(2)

  3. map what stays within your control

    For each product, list the related services it needs to work, the updates you supply and the third-party components or apps you supply, authorise or present as part of it. These stay within your control after release, and so does your liability for defects they cause.

    • owner head of IT
    • decide and document
    what it produces
    a control map per product
    the proof it leaves
    the map, reviewed with each major release

    basis PLD Art. 4(3), 4(5), 11(2)

you are done with this phase when you can show a product list with dates, a role per product and a map of what you still control.
02

keep the evidence a court can ask for

Be able to show what each release was when it left your hands, and to produce it when a court orders disclosure.

  1. set how long you keep product records

    Set a retention rule that covers the period a claim can be brought: 10 years from placing on the market, restarting after a substantial modification, and up to 25 years where a hidden personal injury is possible. Decide where the records live and who owns them.

    • owner legal or DPO
    • decide and document
    what it produces
    a records retention rule for product evidence
    the proof it leaves
    the rule, approved by management, and a check that old releases can still be found

    basis PLD Art. 16(1), 17(1), 17(2)

  2. tie every release to its tests and components

    For each release, keep the version, the date, the test and review results, the risk notes, the list of components and the instructions shipped with it. A court judges the product as it was when it was placed on the market or left your control.

    • owner head of IT
    • build and configure
    what it produces
    a release record per version
    the proof it leaves
    release records linked to version tags

    the control: sbom-supply-chain

    basis PLD Art. 7(2)

  3. keep a dated record of vulnerabilities and fixes

    Record each vulnerability you learn about, when you learned it, what you decided and when the fix shipped. A defect caused by a missing safety update within your control keeps you liable, so the dates are your evidence.

    • owner head of IT
    • build and configure
    what it produces
    a vulnerability record with dates from report to fix
    the proof it leaves
    the record and the published fixes

    the work pagethe control: vulnerability-management

    basis PLD Art. 11(2)

  4. prepare for a disclosure order

    Know where each kind of record sits, mark what is a trade secret, and be able to explain technical evidence in plain form, since a court can ask for that. If you do not disclose what the court orders, the defect is presumed.

    • owner legal or DPO
    • build and configure
    what it produces
    an evidence index and a trade secret register for product records
    the proof it leaves
    the index and a test retrieval for one release

    basis PLD Art. 9(1), 9(5), 9(6), 10(2)

you are done with this phase when you can retrieve, for any release in the last 10 years, its tests, its components, its vulnerabilities and its updates.
03

decide and run an update policy

Decide how long you keep products safe with updates, make updates reach users and know when an update changes the product.

  1. decide how long you supply security updates

    The directive does not oblige you to update, but a lack of the updates needed to keep a product safe, while it is within your control, keeps you liable. Decide for how long you supply security updates for each product and write down why. Where the CRA applies, align this with the support period.

    • owner board
    • decide and document
    what it produces
    an update policy per product line
    the proof it leaves
    the policy, signed by management

    basis PLD Art. 11(2); CRA Art. 13(8)

  2. make updates reach users and record it

    Ship updates through a route users can follow, tell them what each security update fixes and what to do, and keep a record of what was offered and when. A user's own fault, such as negligently not installing an update, can reduce your liability.

    • owner head of IT
    • build and configure
    what it produces
    an update route and user notices
    the proof it leaves
    the notices sent and the update release log

    basis PLD Art. 13(2)

  3. check each major change for substantial modification

    Before a major update, check whether it changes the product's original performance, purpose or type beyond your initial risk assessment and changes the hazard. A substantial modification makes it a new product for liability and starts a new 10-year period.

    • owner head of IT
    • decide and document
    what it produces
    a change assessment note per major release
    the proof it leaves
    the notes, filed with the release records

    the control: secure-development

    basis PLD Art. 4(18), 17(1)

  4. test how the product behaves with what it connects to

    Test the product with the other products it is expected to be used with, and what happens when a connection is lost. Record the results. A court weighs the foreseeable effect of connected products on safety.

    • owner head of IT
    • prove and operate
    what it produces
    a test plan for connected use
    the proof it leaves
    test reports per release

    the control: secure-development

    basis PLD Art. 7(2)

you are done with this phase when you can show an update policy, a record of updates shipped and a note on each major change.
04

check your supplier and customer terms

Know who made what is inside your product, and make sure your contracts support recourse and evidence.

  1. list components and related services from others

    For each product, list the components and related services supplied by others, who made them and where they are established. You answer for a defective component you built in, and its maker answers alongside you.

    • owner procurement
    • build and configure
    what it produces
    a component and supplier list per product
    the proof it leaves
    the list, updated with each release

    the work pagethe control: supplier-management

    basis PLD Art. 8(1)

  2. review supplier terms on recourse and evidence

    Check what your supplier contracts say about recourse when you pay a claim caused by their part, about cooperation on evidence and about updates. Note that a micro or small software maker may agree with you that you waive recourse against it. Decide what you accept.

    • owner legal or DPO
    • decide and document
    what it produces
    a reviewed set of supplier terms with decisions noted
    the proof it leaves
    the review note and the signed terms

    the work page

    basis PLD Art. 12(1), 12(2), 14

  3. check for an EU operator behind non-EU makers

    Where a product or component comes from a maker outside the EU, find out who the importer or authorised representative is. If you distribute and nobody in the EU can be found, you answer unless you can name your supplier within one month.

    • owner procurement
    • decide and document
    what it produces
    an EU operator entry for each non-EU source
    the proof it leaves
    the entries and the supplier records behind them

    basis PLD Art. 8(1), 8(3)

  4. check what your terms promise end users

    Liability towards an injured person cannot be limited or excluded by contract. Check that your terms and product pages do not suggest otherwise, and keep business-to-business limits for what they can lawfully cover.

    • owner legal or DPO
    • prove and operate
    what it produces
    a reviewed set of customer terms
    the proof it leaves
    the review note with the date

    basis PLD Art. 15

you are done with this phase when you can show a component and supplier list and contract terms reviewed against the directive.
05

decide on insurance and set up a claims route

Make a board decision on cover and know what happens on the day a claim or an evidence request arrives.

  1. review product liability cover as a board decision

    Ask your broker whether your current cover reaches software, related services, data loss and claims brought up to 10 years after release. Record the answer and the board's decision to keep, change or accept the gap.

    • owner board
    • decide and document
    what it produces
    a board decision on product liability cover
    the proof it leaves
    the minute and the broker's written answer

    basis working practice. No legal text sets this.

  2. set a route for claims and evidence requests

    Name who receives a claim, a request to identify a supplier or a court order, and who puts the relevant records on hold. A distributor has one month to name its supplier, and the injured person has three years from learning of the damage, the defect and who is liable.

    • owner legal or DPO
    • build and configure
    what it produces
    a claims route with owners and a legal hold rule
    the proof it leaves
    the route and a test run with an invented request

    the control: incident-management

    basis PLD Art. 8(3), 16(1)

  3. watch national law and published judgments

    Check when your national act comes into force, whether your state keeps or adds rules that remove the state-of-the-art defence, and the final judgments that member states publish. Update the steps above when something changes.

    • owner legal or DPO
    • prove and operate
    what it produces
    a watch list with an owner and a check rhythm
    the proof it leaves
    the watch list with dates of each check and what changed

    basis PLD Art. 18(1), 19(1), 22(1)

you are done with this phase when you can show a board decision on insurance, a claims route with owners and a watch list for national law.

who carries what

The same steps, grouped by the person who has to act.

legal or DPO

head of IT

board

procurement

controls you will need

Each control has its own page: what it is, what to look for, where it goes wrong and the proof it leaves.

    check it yourself

    your next step

    Pick one product or software release you will ship after 9 December 2026 and check that you could hand a court its test records, its update history and its component list.

    see the dates