Call us now:
This is a very important read and thank you for posting Olaf Classen. While this directive may seem rather innocuous, it raises many concerns for the developers of digitial products and services. Who could be held liable for the safety and security of their products and services, and that includes software.
‘This Directive should therefore clarify that software is a product for the purposes of strict liability, regardless of how it is provided or used…………it should be possible to hold that manufacturer liable for damage caused by the defectiveness of such software’
‘manufacturers should also not be exempted from liability for damage caused by their defective products where the defectiveness is due to the failure to provide software security updates or upgrades necessary to address the product’s vulnerabilities in response to evolving cybersecurity risks’
As it is EU law one wonders the effect on security solution providers, especially following the July 2024 Crowdstrike incident. One would be interested to know if the directive takes precedence over contractual obligations signed between those selling security products and services and their clients?
This directive has implications for insurance. As a Directive it is a type of EU Law, will insurers cover losses due to failures in compliance to the directive? Especially when one considers the effect of the Crowdstrike incident?
Chapter II, SPECIAL PROVISIONS ON LIABILITY FOR DEFECTIVE PRODUCTS, is worth a read.
@Thaddeus Dziekanowski Brian D. McCarthy Faisal Khan Rachel V. Rose, JD, MBA
Veritas GRC
#cybersecurity #cyberriskmanagement #cyberregulation
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7264559413066182659