· ReadyStack
Worked example
Real numbers from this tool, line by line.
A Berlin release engineer ran 12 rules over a 25-line CHANGELOG.md this week and got 15 findings back — 8 of them high. The file was ordinary. That is the point.
On 9 December 2026 every EU Member State applies Directive (EU) 2024/2853, and Directive 85/374/EEC — the 1985 text that never mentioned software — is repealed. Under Art. 4(1) of the new Directive, software is a product. Standalone, embedded, or a model. The release history you keep for your own convenience becomes a record about a product, and under Art. 8 a court can order you to produce it.
Four lines change meaning that morning.
The undated heading. Art. 17(2) runs a ten-year liability window from the day a version was placed on the market. ## 2.4.0 records a version and not a day. The window still exists; it simply has no start you can point at, and the person pointing at it later will not be you.
"Provided AS IS, without warranty of any kind." Art. 15 is one sentence long: liability towards an injured person may not be limited or excluded by a contractual provision. The clause stays in your LICENSE. It keeps working between you and a counterparty who signed something. It stops working against an injured person, which is the only situation it was ever written for.
"Fixed a security issue." Art. 11(2)(c) keeps a defect within the manufacturer's control when it turns on software updates supplied or not supplied. That is the defence and the trap in the same clause: to use it you have to be able to say which defect a release removed. A CVE or GHSA identifier says it. "Security issue" says nothing.
The line that is missing. Annex II(8) of the Cyber Resilience Act (EU) 2024/2847 requires the end date of the support period in the information supplied to users. Art. 11(2)(c) reads the same window from the other side. Most changelogs state no end date at all, and since 11 September 2026 an actively exploited vulnerability has to reach ENISA within 24 hours — Annex II(2) wants a contact in the file for exactly that.
EU Liability Window Lint runs those four facts plus eight more over the open file, in VS Code or in a browser, and hands back a line number and the article behind each finding. On the clean fixture shipped with it — 27 lines, dated releases, CVE-identified fixes, a support window running to 2028-06-30 — it returns 0 findings. On the dirty fixture, 25 lines, it returns 15, covering all 12 rules.
Two of those rules exist because generated text gets them wrong in a specific, repeatable way. deadline_drift flags any line that puts the product-liability change at a date other than 2026-12-09; the sample file says "applies from 2027-06-01", which is the kind of sentence a model produces confidently. old_directive_citation flags text still pointing at 85/374/EEC. stale_support_claim measures the gap: the sample claims active support while its newest dated release sits 683 days behind today.
None of this is legal advice, and the extension does not tell anyone whether they are liable. It tells them which line in their own file does not answer — which is the part a lawyer would otherwise bill for. One hour of EU product-compliance counsel runs around $300, and one repository's release history takes longer than an hour to read.
The free tier finishes the job on one file: all 12 rules, every finding, no key. The $29 tier changes the axis rather than the depth — every changelog in the workspace in one pass, and a dated Markdown and CSV evidence record you keep and file, because Art. 8 asks for the record and not for a screenshot.
15 seconds — what it actually does
Questions people ask
What does EU Liability Window Lint actually do?
It reads a CHANGELOG.md or release-notes file and applies 12 rules drawn from Directive (EU) 2024/2853 and the Cyber Resilience Act (EU) 2024/2847. On the 25-line sample changelog shipped with it, it returns 15 findings: undated releases, an AS-IS clause that Art. 15 voids, security fixes with no CVE, and a citation of the repealed Directive 85/374/EEC.
Who is this for?
Maintainers, release engineers and vendors who place software on the EU market and keep a changelog. From 9 December 2026 software is a product under Art. 4(1) of Directive (EU) 2024/2853, so the release history stops being housekeeping and becomes a record a court can order disclosed under Art. 8.
Why will a free markdown linter not do this?
Markdown linters and spell-checkers read style. None of them know that Art. 15 voids an AS-IS clause against an injured person, that Directive 85/374/EEC is repealed on 2026-12-09, or that Annex II(8) of the Cyber Resilience Act wants a support-end date. A chatbot will cheerfully hand you the wrong applicability year.
What is free and what does the paid version add?
Free: the open file, all 12 rules, every finding with its line number and the article behind it. The clean sample returns 0 findings and the dirty one returns 15. Paid, $29 once: every changelog in the workspace in one pass, plus a dated Markdown and CSV evidence record you keep and file.
What would this cost if a person did it?
One hour of EU product-compliance counsel bills around $300, and reading one repository's release history takes longer than an hour. This lint costs $29 once, runs in the editor or in the browser, and re-runs on every release. one licence key per person or team seat.
Why not just ask ChatGPT or another AI chat?
A general AI chat answers from training data with a cutoff date, cannot read your repository and names no rule version. EU Liability Window Lint checks the file you open against 12 rules from a rule set dated 2026-09-20, and points at the exact line. For a filing, an audit or a client you need that dated result on your own files.
Ask about this tool
One question, answered by the person who built it. Your email only if you want the answer sent.