Product liability and Cyber Resilience Act: readiness for software makers
Manufacturers of software, apps and devices with software selling in the EU, including those based in Switzerland.
Updated: 2026-11
From 9 December 2026, software counts as a product under the new EU Product Liability Directive, with strict liability that can extend to missing security updates. Since September 2026 the Cyber Resilience Act has required reporting of actively exploited vulnerabilities, with full security requirements from December 2027. We get products, processes and evidence ready.
Many software companies have seen product liability as a topic for machinery and consumer goods. Directive (EU) 2024/2853 changes that: software is expressly a product, and a defect can lie in the failure to provide necessary security updates. At the same time, the Cyber Resilience Act requires structured vulnerability management for products with digital elements.
Both can be answered with the same foundations: a product inventory, an update process with commitments, a vulnerability reporting channel and documentation that holds up in a dispute.
What you get
Product classification
For each product: distribution model, target markets, classification under product liability and the CRA, with dates.
Update and support commitments
How long and how often security updates are delivered, and how this is communicated.
Vulnerability process
Procedure from report through assessment and fix to notification of authorities and customers.
Evidence structure
Which records are kept to demonstrate the state of the art in the event of a liability claim.
How it runs
- 01
Inventory
Capture products, versions, distribution channels and components used.
- 02
Classification
Determine duties under product liability and the CRA per product, rate gaps.
- 03
Processes
Define and introduce update commitments, vulnerability management and reporting channels.
- 04
Evidence
Organise documentation and retention so it is available when needed.
Price framing
Readiness analysis with fixed scope per product group; process implementation afterwards as a project.
Indicative, not a binding quote — the frame is confirmed during scoping.
Parent service: Compliance assessment
FAQ
When do the new product liability rules apply?
To products placed on the market from 9 December 2026. Member states must transpose the directive into national law by then.
Does this cover software as a service?
The directive covers software regardless of how it is supplied. Free open-source software supplied outside a commercial activity is excluded.
Does this replace legal advice on liability?
No. We build processes and evidence; questions on liability in individual cases and contract drafting belong to legal advice.
Product liability and Cyber Resilience Act: readiness for software makers
Manufacturers of software, apps and devices with software selling in the EU, including those based in Switzerland.