> Am I on the hook for patching all the systems in the field? What are my obligations here?
If you sell even a single device to Europe, you have, depending on category, for 2 or 5 years to patch every single flaw that appears.
In the first 6 months, if a user reports a flaw, you have to patch it anyway, no matter what it is, unless you can prove that this problem was caused by the user.
After that, you are liable for the rest of your life (and this pierces the corporate veil) for any and all damage your products do, or can be abused for.
If you sell even a single device to Europe, you have, depending on category, for 2 or 5 years to patch every single flaw that appears.
In the first 6 months, if a user reports a flaw, you have to patch it anyway, no matter what it is, unless you can prove that this problem was caused by the user.
After that, you are liable for the rest of your life (and this pierces the corporate veil) for any and all damage your products do, or can be abused for.