Operates a social platform, in Lithuania

Articles 1(2), 16, 19, 23, 24, 34 and 39 to 42, Law on Information Society Services (Informacinės visuomenės paslaugų įstatymas Nr. X-614), as rewritten by Law Nr. XIV-2702 · Read the law's page

• If you provide a very large online platform or very large online search engine, assess and mitigate the systemic risks in Article 34 of Regulation (EU) 2022/2065, including the risks from removing or blocking lawful content and from algorithmic systems, and take account of Lithuanian language norms and usage.
• When a competent institution investigates or inspects you, give the oral and written explanations it asks for, come to its premises when it requires, and give correct, complete and non-misleading information.
• Carry out the commitments you have undertaken and the corrective measures the Communications Regulatory Authority orders, by the deadline it sets.

Articles 14 and 15(3) to (5), Law on Information Society Services (Informacinės visuomenės paslaugų įstatymas Nr. X-614), as rewritten by Law Nr. XIV-2702 · Read the law's page

• To keep the exemption from liability for mere conduit, caching or hosting, meet the conditions in Articles 4 to 6 of Regulation (EU) 2022/2065, which Article 14 of the Law applies.
• If you hold an account on an online platform and an authority that finds unlawful content gives you a binding instruction under the laws on restricting unlawful content, remove the unlawful content you prepared and any unlawful comments beneath it.

Articles 15(1) and (2), 17 and 21, Law on Information Society Services (Informacinės visuomenės paslaugų įstatymas Nr. X-614), as rewritten by Law Nr. XIV-2702 · Read the law's page

• When you have reliable factual data, or a notice that is accurate, complete and substantiated, that content you transmit or store is unlawful, assess it, and if the recipient gives no answer within a reasonable time or no sound explanation, decide to treat the information as unlawful content and restrict access to it.
• If you are a hosting service provider and you restrict access to content as unlawful, give the recipient a reasoned statement of the decision within one working day under Article 17 of Regulation (EU) 2022/2065, if you know the recipient's electronic contact details.
• Tell the police at once if you learn of information that raises a suspicion of a criminal act threatening the life or safety of a person.

Lietuvos Respublikos kibernetinio saugumo įstatymas Nr. XII-1428, as restated by Įstatymo Nr. XIV-2902 pakeitimo įstatymas of 11 July 2024, in force since 18 October 2024, and amended by Nr. XV-894 of 12 May 2026 and Nr. XV-1076 of 25 June 2026 (consolidated edition of 4 July 2026), Art. 14 · Read the law's page

• Adopt and keep current cybersecurity policy documents, periodically analyse and manage your cybersecurity risks, designate the persons responsible for cybersecurity, manage cybersecurity incidents and report on them, secure your supply chain, and deploy technical cybersecurity measures.
• Designate a cybersecurity manager and/or security officer who organises your risk assessment and prepares your risk-assessment reports and risk-management plans for approval, and have your management body, head and designated representative complete cybersecurity training at least once every two years.
• Follow the detailed technical and organisational measures the Government's Cybersecurity Requirements Description sets out; if you are newly registered, you have 12 months from registration to implement the requirements and 24 months to implement the technical requirements the Description names.
• Where you are a DNS service provider, top-level-domain registry, cloud service provider, data-centre service provider, content-delivery-network provider, managed service provider, managed security service provider, electronic-marketplace service provider, internet search engine or social-networking-service-platform provider, or a trust service provider, follow instead the cybersecurity risk-management measures of the European Commission's directly-applicable Implementing Regulation (EU) 2024/2690, binding from the moment you enter the Register rather than the Government's own Requirements Description.
• This binds a cybersecurity subject (essential or important entity) that NKSC has entered in the Cybersecurity Subjects Register under Annex 1 or Annex 2 of the Law, sector lists that reach, among others, an internet search engine, an online marketplace and a social-networking-service platform provider as a "special subject"; the wider sector classes the Annexes also reach (critical-infrastructure operators, energy, transport, health, finance, public administration and others) are reached too, by declaring that you are an essential or important entity.

Lietuvos Respublikos kibernetinio saugumo įstatymas Nr. XII-1428, as restated by Įstatymo Nr. XIV-2902 pakeitimo įstatymas of 11 July 2024, in force since 18 October 2024, and amended by Nr. XV-894 of 12 May 2026 and Nr. XV-1076 of 25 June 2026 (consolidated edition of 4 July 2026), Art. 18 · Read the law's page

• Notify NKSC of a significant cyber incident without delay and in any event within 24 hours of becoming aware of it.
• Follow within 72 hours of becoming aware with the incident's severity and impact assessment and any evidence of compromise; report a minor incident within 72 hours without a separate 24-hour early warning.
• Submit a final report within one month of the day you submitted the early warning (the notification in Article 18(4)(1)), and an interim report on NKSC's request within the deadline NKSC sets.
• If the incident is still ongoing when the final report falls due, submit a progress report, and submit the final report within one month of the day the incident was contained.
• Report to NKSC every cyber incident affecting you, not only a significant one, and every near-miss incident; if you have no statutory duty to report, you may still do so to NKSC voluntarily.
• This binds the same essential and important cybersecurity subjects, including the internet-search-engine, online-marketplace and social-networking-service-platform "special subjects", as this jurisdiction's companion risk-management row.

Lietuvos Respublikos civilinio kodekso šeštosios knygos III dalies XXII skyriaus ketvirtojo skirsnio ir priedo pakeitimo įstatymas Nr. XV-1080 · Read the law's page

• These rules are enacted but do not apply yet: they apply from 9 December 2026, and the Civil Code rules in force until 8 December 2026 keep governing products placed on the market or put into use before then (Art. 3 of Act No. XV-1080).
• If you develop or make a product, software included, or present yourself as its manufacturer by putting your name, trade mark or another distinguishing sign on it, you answer as its manufacturer for damage a defect in it causes (Arts. 6.292(1) and 6.293(1) point 1 and (2)).
• Keep supplying the software updates and upgrades needed to keep the product safe while it is within your control: you keep control if you integrate or supply a component or can supply updates or upgrades yourself or through a third party, and a defect caused by software, by an update or upgrade, or by a missing update needed for safety is not excused because it arose after you placed the product on the market (Arts. 6.292(3) and 6.298(1) point 1).
• Treat safety-relevant cybersecurity requirements and any recall or other corrective action as part of what decides whether your product is defective (Art. 6.294(1) points 6 and 7).
• Allow for what the product learns or acquires after it is placed on the market, because the effect of that ability is weighed in deciding whether it is defective (Art. 6.294(1) point 3).
• Keep evidence you could produce if a court orders you to disclose it: failing to disclose relevant evidence the claimant requested presumes the product defective (Art. 6.297(1) point 1).
• Meet the product-safety requirements that apply to your product: failing a requirement that protects against the risk of the harm suffered presumes it defective (Art. 6.297(1) point 2).
• If you are outside the EU, your importer or authorized representative established in the EU answers for the product in your place, and where there is neither, the fulfilment service provider answers (Art. 6.292(4)).
• If you distribute a product, or run an online platform that lets consumers conclude distance contracts with traders where the conditions of Article 6(3) of Regulation (EU) 2022/2065 are met, name the manufacturer, importer, authorized representative, fulfilment service provider or your own supplier within a month of the injured person's request, or you answer for the damage (Art. 6.292(5)).
• If you substantially modify a product outside the manufacturer's control and then place it on the market or put it into use, you answer as its manufacturer (Art. 6.292(2)).
• If you build a software component into a product, you have no recourse against the maker of a defective software component that was a micro or small enterprise when it placed the component on the market, where you waived recourse in your contract with it (Art. 6.296(2)).
• Free and open-source software developed or supplied outside commercial activity is outside these rules (Art. 6.299(2)).
• A claim must be brought within three years of the day the injured person learned, or should have learned, of the damage, the defect and who the liable operator is, and the right to sue is extinguished ten years after the product was placed on the market or put into use, or 25 years where a court finds that a later-revealed injury prevented suit within ten (Art. 6.300).