EU Product Liability Directive Kit

Directive (EU) 2024/2853 · Toledo Technologies LLC

On 8 December 2026, software becomes a product.

Directive (EU) 2024/2853 replaces the 1985 product liability regime. Software, SaaS and AI systems are explicitly “products”. Liability is no-fault: a claimant proves defect, damage and causation — not that you were negligent. The old “the defect appeared later” defence is narrowed where you keep control through updates, and the inability to supply the security updates needed to keep a product safe can be relevant to whether it is defective.

Article 2(1) as published said 9 December 2026. Corrigendum 2026/90364 corrected it to 8 December. Articles 20–22 still say 9 December — those govern transposition and the repeal of 85/374/EEC, not scope. Most commentary still has this wrong.

What you get

00 — Start here. What this is, what it is not, how to use it in an afternoon.
01 — Am I in scope? A decision tree: manufacturer, importer, distributor, component supplier, substantial modification — and the free-and-open-source carve-out for software supplied outside a commercial activity.
02 — What changes from 1985. Before/after for engineering leaders: software as product, the update/control point, disclosure of evidence, the presumptions, the defences, the periods.
03 — Update-supportability evidence. The practical core. Component inventory, end-of-life tracking, stated support windows, end-of-support communication, and how to record a deliberate decision not to update something.
04 — Policy templates. A public security-update support policy, an end-of-support notice, a component EOL register, an internal not-to-patch record.
05 — Board brief. A brief and source appendix for a board or an insurer.

Six editable documents, plus the current combined PDF.

What this kit refuses to do

It is not legal advice, not a certification, and not a compliance determination. Whether a product is defective is decided by a court on the facts.

Where a question genuinely needs a lawyer, the kit says so instead of guessing. There are explicit [VERIFY: …] markers naming exactly what to check and where.

It also tells you things that do not help me sell it. Recital 51 says the directive imposes no obligation to provide updates — there is no patching mandate here, and the kit says so in bold. Recital 24 excludes pure economic loss, so if you are B2B SaaS and your failure mode is downtime rather than personal injury or property damage, your exposure under this directive may be low. That is in the kit too.

The free tool

pld-watch finds runtimes and frameworks in a project that are past their upstream end-of-life date, using the public endoflife.date catalogue. MIT, no dependencies, genuinely free. It is one input to the evidence practice in document 03 — a scanner cannot tell you whether a product is defective.

$29

Vulnerability Handling Starter Pack

The files and habits a team needs before either regulation is a question. RFC 9116 security.txt, a disclosure policy, an intake and triage runbook, the advisory and CVE process, and the five files that belong in every repo. Editable documents and a combined PDF.

Useful with no EU exposure at all. It is the groundwork, not the regulation — and it says plainly when you need one of the kits below instead.

$149

EU Product Liability Directive Kit

Six documents + combined PDF. Single-organisation licence.

$490

Consultancy licence

Same files. Use the templates across unlimited client engagements.

Payment received. Request your kit.

Email me my files

Keep your order reference and use the email link above to request your files. Delivery is manual after payment verification; this page does not send an automatic email.

Questions

Is this legal advice? No. It is engineering and process guidance. The directive is implemented by national law in each Member State, and that national law — not this kit — is what binds you. Get advice from a qualified lawyer in the relevant jurisdiction.

Refunds? The files are delivered manually by email after payment verification. If it is not what you expected, email within 14 days and you get your money back, no argument.

Updates? The purchase is the current version, and you get any revision published in the 12 months after you buy at no extra cost. That is a document-revision commitment, not a promise about what the law will do.

Toledo Technologies LLC · dev@toledotechnologies.com
Not affiliated with, endorsed by, or connected to the European Commission.