It will probably be similar to when a physical product is defective because of a faulty 3rd party component.
More importantly, as a professional software developer, the testing of my product should find problems in 3rd party components. If I chose poorly and the 3rd party component doesn't do what it's supposed to do, that's my responsibility. I can't just slough it off onto someone else.
my product should find problems in 3rd party components.
Does that mean that say a security vulnerability in openssl is a responsibility of all software which uses them? I think its unreasonable to expect software projects/products to find things like heartbleed.
What about bugs in kernel/OS? How many user-mode software can find bugs in kernel/OS?
The EU has two primary types of legislation, regulations and directives. There are other things such as recommendations etc, but those are usually pretty clear from their name, so I'll exclude those from the explanation. A simple way to think about a regulation is essentially an EU-wide law, it applies the way it was written in Brussels across all of EU. Directives, that's the one in the article, are more like interfaces. They're a guideline of goals to achieve, and every country must implement their own version of the directive.
Why do directives even exist? Because the legal landscape can be widely different between EU countries. Directives give every country flexibility in implementing them in a way that is consistent with the way their laws work, existing precedents, etc. The downside is obviously that the implementations will somewhat differ from country from country.
This means that unless the implementations between countries are fairly consistent, the definition of what working as intended means will vary from country to country.
Comments
Who decides the definition of "what was suppose to work" in the context of a given software product?
There are times when a feature is used in a way which was not intended by the developers. Now do the developers have to publish their test scenarios?
What if the bug is in 3rd party library? Add to it the complexity of open-source code.
It will probably be similar to when a physical product is defective because of a faulty 3rd party component.
More importantly, as a professional software developer, the testing of my product should find problems in 3rd party components. If I chose poorly and the 3rd party component doesn't do what it's supposed to do, that's my responsibility. I can't just slough it off onto someone else.
Does that mean that say a security vulnerability in openssl is a responsibility of all software which uses them? I think its unreasonable to expect software projects/products to find things like heartbleed.
What about bugs in kernel/OS? How many user-mode software can find bugs in kernel/OS?
The OS is not a 3rd party library. You're confusing two different topics here.
BTW: Software vendors find bugs in the OS all the time.
The EU has two primary types of legislation, regulations and directives. There are other things such as recommendations etc, but those are usually pretty clear from their name, so I'll exclude those from the explanation. A simple way to think about a regulation is essentially an EU-wide law, it applies the way it was written in Brussels across all of EU. Directives, that's the one in the article, are more like interfaces. They're a guideline of goals to achieve, and every country must implement their own version of the directive.
Why do directives even exist? Because the legal landscape can be widely different between EU countries. Directives give every country flexibility in implementing them in a way that is consistent with the way their laws work, existing precedents, etc. The downside is obviously that the implementations will somewhat differ from country from country.
This means that unless the implementations between countries are fairly consistent, the definition of what working as intended means will vary from country to country.
In the end, a court of justice (in EU, not in USA!) does.
It's not a bad first approximation to expect courts in EU to very sensible and fair.
I think the vendor will need to be a lot more clear about what the supported use case is; and what use cases aren't supported.