You Don’t Own the Risk You See. You Own the Risk You Can’t Prove

The Readiness Directive - CEO & Board Edition

From policy confidence to demonstrable control.

Most Boards still believe product liability risk sits below them.

It lives in Quality. It is managed by Regulatory. It becomes visible through Legal.

Operationally, that is convenient. Under the revised EU Product Liability Directive, it is no longer sufficient.

The harder question is no longer only whether the company has a defective product issue. It is whether the organisation can demonstrate control across decisions, changes, systems, and time.

That question reaches the Board.

The Shift: From Defect to Demonstrable Control

The revised Directive reflects a structural change in how product risk is understood.

Products now extend beyond static physical goods. They increasingly include:

• Software-driven products and stand-alone software
• Digital elements and AI systems
• Certain fulfilment and platform-related scenarios
• Post-market changes that alter product behaviour over time

That means the product creating liability may no longer be the exact product originally approved.

The real issue becomes: what changed, why it changed, how those changes were governed, and whether that governance can be demonstrated later.

That is the shift.

The Evidence Shift: Loss of Narrative Control

This is where the risk becomes more serious for Boards.

The revised Directive creates a more claimant-friendly environment through disclosure expectations and presumptions in technically complex situations.

The practical danger is not just the defect itself. It is the loss of narrative control.

If the evidence is incomplete, fragmented, delayed, or opaque, the organisation may lose control of the story before the merits are even properly argued. At that point, the company is no longer being judged on policy intent.

It is being judged on what it can actually show.

The Visibility Illusion

Boards often govern through abstraction.

• Dashboards.
• KPIs.
• Assurance summaries.
• Traffic-light reporting.

That creates a structural blind spot. Liability does not emerge from summaries. It emerges from:

• Fragmented decisions
• Inconsistent escalation
• Software changes without traceable rationale
• Evidence that cannot be aligned across functions
• Systems that do not describe the same reality

Leadership often sees a simplified version of control. What matters later is whether the underlying system could survive scrutiny. That is not the same thing.

The AI and Digital Control Problem

This issue becomes sharper where software and AI are involved. Products do not stop changing at release.

• They are updated.
• They connect to external systems.
• They rely on data.
• They evolve through software, configuration, and digital services.

If AI-driven products are in scope, governance failures may become liability evidence. Weak oversight is no longer just a regulatory problem; it becomes part of the claimant story about lack of control.

That is why post-release governance is no longer a technical sub-process. It is part of the Board’s control environment.

The System Problem, Not the Function Problem

This is not really a Quality problem. It is not really a Regulatory problem. It is not really a Legal problem.

It is a system problem.

Liability tests the organisation collectively. And the system usually fails at the points of connection:

• Decisions made but not documented
• Signals identified but not escalated
• Contracts that cannot be activated because the facts cannot be proven
• Software governance and product governance operating under different rules
• Technical, commercial, and regulatory logic drifting apart

This is why the Directive pushes the issue upward. Not because Boards need to manage every defect. But because Boards are increasingly accountable for whether the organisation can demonstrate coherent control.

SMEs and Start-Ups Are Not Exempt

This is not just a multinational issue. In smaller companies, where one person may wear several hats, the exposure can be even sharper.

If critical decisions live in:

• Slack threads
• Local judgment calls
• Undocumented assumptions
• Disconnected technical systems

...then the company may be agile, but not defensible.

In that environment, evidence discipline becomes a maturity issue. Not just for liability. Also for investors, acquirers, and strategic partners.

Governance: From Structure to Coherence

The real requirement now is coherence. Not just structure. Not just policy. Not just committees.

The real questions are:

• Do decisions align across functions?
• Can the organisation reconstruct events end-to-end?
• Do contracts, insurance, software governance, and product governance describe the same reality?
• Does executive visibility reflect underlying evidential reality, or only a simplified picture of it?

That is the standard that matters.

Critical Questions for the Board

Boards should move past: Are we compliant?

And ask instead:

1. Can we reconstruct one critical issue end-to-end, including the reasoning behind the decisions?
2. Where does our evidence break across systems, functions, or time?
3. How long does it take for a weak signal to reach executive visibility?
4. Are software, AI, and product governance aligned, or operating under different rules?
5. Are we confident in what we cannot currently see?

Those are better Board questions. They are also the ones that matter later.

The Path Forward

The companies that will lead are not necessarily the ones with the most advanced technology. They are the ones that can:

• Connect decisions across the lifecycle
• Align technical, commercial, and regulatory logic
• Preserve traceable reasoning over time
• Maintain evidence strength across systems and functions
• Demonstrate control rather than simply assert it

Liability has always followed control. What has changed is the ability to challenge whether that control actually exists.

That is why this is no longer a functional issue. It is a Board issue.