MANUFACTURER LIABILITY FOR CYBERSECURITY DEFECTS IN DIGITAL PRODUCTS
doi: https://doi.org/10.56461/iup_rlrc.2026.7.ch21
The proliferation of new digital products on the internal market has evoked the need for a change in product liability rules, with focus on the perils connected with cybersecurity defects of digital products. These vulnerabilities present a significant risk of financial loss, including the potential for digital products to cause damage. The European Union has responded to those risks with a legal overhaul to hold manufacturers accountable for digital product security, centred on two key regulations. The first one is Directive (EU) 2024/2853 on liability for defective products which explicitly expands the definition of the “product” to include software and other digital products, establishing that a product is defective if it fails to meet the required safety level, with cybersecurity requirements becoming an explicit criterion for assessing defectiveness and manufacturer liability. Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements, as a complementary act, sets mandatory cybersecurity standards for all digital products across the European Union. A digital product’s compliance with Regulation (EU) 2024/2847 will be essential when assessing its safety and whether it is defective under the new Product Liability Directive. The aim of this paper, therefore, is to analyse how the new legal framework impacts the manufacturer’s liability for cybersecurity defects in a digital product. The central thesis of this paper is that the manufacturer’s legal position under the new regulation framework has evolved into a state of continuous liability for a defective digital product.
Keywords: cybersecurity defects, digital products, defective products, manufacturer liability, EU cybersecurity regulation.
A Europe fit for the digital age: Empowering people with a new generation of technologies. Available at: https://commission.europa.eu/strategy-and-policy/priorities-2019-2024/europe-fit-digital-age_en (18. 2. 2026)
Bouhafs, H. 2025. Cybersecurity in the Digital Era: Between Digital Transformation and Protection Challenges. Law and World, 11(35), pp. 111–125. https://doi.org/10.36475/11.3.8
Burri, M. & Zihlmann, Z. 2023. The EU Cyber Resilience Act – An Appraisal and Contextualization. Zeitschrift für Europarecht (EuZ), 2, B1-B45. Available at: https://ssrn.com/abstract=4375552 (18. 2. 2026). https://doi.org/10.36862/eiz-euz015
Bygrave, A. L. 2021. Security by Design: Aspirations and Realities in a Regulatory Context. Oslo Law Review, 8(3), pp. 126–177. https://doi.org/10.18261/olr.8.3.2
Car, P. & Luca, S. 2022. EU Cyber Resilience Act: Briefing. Luxembourg: European Parliament. Available at: https://www.europarl.europa.eu/thinktank/hr/document/EPRS_BRI(2022)739259.
Chiara, P. G. 2022. The Cyber Resilience Act: the EU Commission’s proposal for a horizontal regulation on cybersecurity for products with digital elements. International Cybersecurity Law Review, pp. 255–272. https://doi.org/10.1365/s43439-022-00067-6
Chiara, P. G. 2025. Understanding the regulatory approach of the Cyber Resilience Act: protection of fundamental rights in disguise? European Journal of Risk Regulation, 16 (2), pp. 469–484. https://doi.org/10.1017/err.2025.9
Colonna, L. 2025. The end of open source? Regulating open source under the cyber resilience Act and the new product liability directive. Computer Law & Security Review, 56, 106105. https://doi.org/10.1016/j.clsr.2024.106105
Eckhardt, P. & Kotovskaia, A. 2023. The EU’s cybersecurity framework: the interplay between the Cyber Resilience Act and the NIS 2 Directive. International Cybersecurity Law Review, 4, pp. 147–164. https://doi.org/10.1365/s43439-023-00084-z
Fairgrieve, D. & Goldberg, R. S. 2020. Product Liability. 3rd ed. Oxford: Oxford University Press.
González Fuster, G. & Jasmontaite, L. 2020. Cybersecurity Regulation in the European Union: The Digital, the Critical and Fundamental Rights. In: Christen, M. Gordijn, B. & Loi, M. (eds.), The Ethics of Cybersecurity. Berlin: Springer Open, pp. 97–115. https://doi.org/10.1007/978-3-030-29053-5_5
Hacker, P. 2022. The European AI liability directives – Critique of a half-hearted approach and lessons for the future. Computer Law & Security Review, 51, 105871. https://doi.org/10.1016/j.clsr.2023.105871
Howells, G. (ed.). 2007. Law of Product Liability. 2nd ed. London: LexisNexis Butterworths.
Izquierdo Grau, G. 2025. The Development Risks Defence in the Digital Age. European Journal of Risk Regulation, 16(1), pp. 197–216. https://doi.org/10.1017/err.2024.43
Koch, B. A. 2020. Liability for Emerging Digital Technologies: An Overview. Journal of European Tort Law, 11(2), pp. 115–136. https://doi.org/10.1515/jetl-2020-0137
Koch, B. A. et al. 2022. Response of the European Law Institute to the Public Consultation on Civil Liability – Adapting Liability Rules to the Digital Age and Artificial Intelligence. Journal of European Tort Law, 13(1), pp. 25–63. https://doi.org/10.1515/jetl-2022-0002
Li, S. & Faure, M. 2024. The Revised Product Liability Directive: A Law and Economics Analysis. Journal of European Tort Law, 15(2), pp. 140–171. https://doi.org/10.1515/jetl-2024-0010
Li, S. & Schütte, B. 2023. The proposal for a revised Product Liability Directive: The emperor’s new clothes? Maastricht Journal of European and Comparative Law, 30(5), pp. 573–596. https://doi.org/10.1177/1023263X231216941
Micklitz, H.W. 2023. The Role of Standards in Future EU Digital Policy Legislation: A Consumer Perspective, Executive Summary. Brussels: BEUC. Available at: https://www.beuc.eu/sites/default/files/publications/BEUC-X-2023-152_Role_of_Standards_in_Future_EU_Digital_Policy_Legislation-Exec_Summary.pdf
Organization for Economic Co-operation and Development (OECD). 2019. Going Digital: shaping policies, improving lives. Paris: OECD Publishing. Available at: https://www.oecd.org/en/publications/going-digital-shaping-policies-improving-lives_9789264312012-en.html
Rimkutė, D. 2025. The New EU Product Liability Directive: Doctrinal Analysis. Access to Justice in Eastern Europe, 8 (Spec.), pp. 74–97. https://doi.org/10.33327/AJEE-18-8.S-c000160
Schoo, P. 2024. Navigating the CRA: A Brief Analysis of European Cyber Resilience Act and Resulting Actions for Product Development. Proceedings of the 9th International Conference on Data of Things, Big Data and Security, pp. 245–251. https://doi.org/10.5220/0012690500003705
Teichmann, F. 2026. The cyber resilience act as a new paradigm for product security: a compliance roadmap. International Cybersecurity Law Review, 7, pp. 1–17. https://doi.org/10.1365/s43439-025-00162-4
The Impact of the Product Liability Directive on Europe’s Digital Innovation – Creating a Proportionate Product Liability Directive, Brussels: DigitalEurope, 2023, pp. 1–10. Available at: https://cdn.digitaleurope.org/uploads/2023/03/DIGITALEUROPE-PLD-position-March-2023.pdf
Zhao, F., Wallis, J. & Singh, M. 2015. E-government development and the digital economy: A reciprocal relationship. Internet Research, 25(5), pp. 734–766. https://doi.org/10.1108/IntR-02-2014-0055
Zirnstein, Y. 2022. Der Entwurf des Cyber Resilience Act. Computer und Recht 38(11), pp. 707–714. https://doi.org/10.9785/cr-2022-381108
Veldt, G. 2023. The New Product Liability Proposal – Fit for the Digital Age or in Need of Shaping Up? Journal of European Consumer and Market Law, 24, pp. 24–31.
Wagner, G. 2024. Next Generation EU Product Liability – For Digital and Other Products. Journal of European Tort Law, 15(2), pp. 172–224. https://doi.org/10.1515/jetl-2024-0011
Internet sources
American Chamber of Commerce to the EU (AmCham EU). 2023. Our position, Cyber Resilience Act proposal. Available at: https://www.amchameu.eu/system/files/position_papers/cyber_resilience_act_proposal_final.pdf (18. 2. 2026).
Committee for European Construction Equipment (CECE). 2023. CECE issues a position paper on the Cyber Resilience Act. Available at: https://www.cece.eu/news/cece-issues-a-position-paper-on-the-cyber-resilience-act (18. 2. 2026).
DigitalEurope. 2023. Cybersecurity everywhere: deciphering the Cyber Resilience Act. Available at: https://www.digitaleurope.org/ (18. 2. 2026).
Eclipse Foundation. 2023. Open Letter to the European Parliament: Potential Impacts of the Cyber Resilience Act on the Open-Source Ecosystem. Available at: https://www.eclipse.org/ (18. 2. 2026).
ETNO-GSMA. 2023. ETNO-GSMA joint position paper on the Cyber Resilience Act. Available at: https://www.gsma.com/gsmaeurope/wp-content/uploads/2023/03/ETNO-GSMA-joint-CRA-position (18. 2. 2026).
European Cyber Security Organisation (ECSO). 2022. Position Paper, Cyber Resilience Act. Available at: https://ecs-org.eu/ecso-uploads/2023/01/ECSO_position_on_the_CRA.02.pdf (18. 2. 2026).
European Parliamentary Research Service (EPRS). 2023. Briefing: Cyber Resilience Act – Strengthening the Security of Hardware and Software. Luxembourg: European Parliament.
GitHub. 2023. Policy Brief: Navigating the Cyber Resilience Act for Open-Source Communities. Available at: https://github.blog/ (18. 2. 2026).
Legal sources and case law
Directive (EU) 2024/2853 of the European Parliament and of the Council of 23 October 2024 on liability for defective products and repealing Council Directive 85/374/EEC, (2024) OJ L, 2024/2853.
Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market For Digital Services and amending Directive 2000/31/EC, OJ L 277, 27.10.2022 (Digital Services Act)
Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements and amending Regulations (EU) No 168/2013 and (EU) 2019/1020 and Directive (EU) 2020/1828 (Cyber Resilience Act), (2024) OJ L, 2024/2847.
CJEU, C-300/95, Commission of the European Communities v United Kingdom of Great Britain and Northern Ireland, ECLI:EU:C:1997:255
The General Product Safety Regulation, Regulation (EU) 2023/988 of the European Parliament and of the Council of 10 May 2023 on general product safety, amending Regulation (EU) No 1025/2012 of the European Parliament and of the Council and Directive (EU) 2020/1828 of the European Parliament and the Council, and repealing Directive 2001/95/EC of the European Parliament and of the Council and Council Directive 87/357/EEC OJ L 135, 23.5.2023.
Council Directive 85/374/EEC of 25 July 1985 on the approximation of the laws, regulations and administrative provisions of the Member States concerning liability for defective products, (1985) OJ L 210.
Judgment of 10 June 2021, C-65/20, VI v KRONE-Verlag Gesellschaft mbH & Co. KG, ECLI:EU:C:2021:471