[{"data":1,"prerenderedAt":7902},["ShallowReactive",2],{"site:settings":3,"site:navigation":49,"site:footer":126,"page:\u002Fblog":188,"sections:\u002Fblog":223,"feed:\u002Fblog":92,"breadcrumbs:\u002Fblog":224,"blog:list:\u002Fblog":228},{"id":4,"title":5,"callForAction":6,"description":9,"extension":10,"featuredContentPublishTarget":11,"keywords":12,"logo":18,"logoWidth":19,"meta":20,"search":21,"seoTitleSuffix":25,"skipLinkText":26,"socialImage":27,"socials":30,"stem":47,"__hash__":48},"settings\u002Fdata\u002Fsettings.yml","Open Regulatory Compliance Working Group",{"text":7,"href":8},"Get involved","\u002Fparticipate\u002F","The open source community is collaborating to establish common specifications for secure software development based on open source best practices.","yml","orc",[13,14,15,16,17],"regulatory compliance","cybersecurity processes","royalty-free patent licence","open source community collaboration","Eclipse Foundation Specification Process","\u002Fimages\u002Forc-logo.png",120,{},{"label":22,"placeholder":23,"menuLabel":24},"Search","Search the site…","Menu"," | Open Regulatory Compliance Working Group","Skip to main content",{"backgroundImage":28,"eyebrow":29},"\u002Fimages\u002Fog\u002Fbackground.jpg","orcwg.org",[31,35,39,43],{"name":32,"icon":33,"url":34},"LinkedIn","fa6-brands:linkedin-in","https:\u002F\u002Fwww.linkedin.com\u002Fshowcase\u002Fopen-regulatory-compliance\u002F",{"name":36,"icon":37,"url":38},"YouTube","fa6-brands:youtube","https:\u002F\u002Fwww.youtube.com\u002F@ORCWG",{"name":40,"icon":41,"url":42},"Bluesky","fa6-brands:bluesky","https:\u002F\u002Fbsky.app\u002Fprofile\u002Forcwg.org",{"name":44,"icon":45,"url":46},"Mastodon","fa6-brands:mastodon","https:\u002F\u002Ffosstodon.org\u002F@orcwg","data\u002Fsettings","bxtnzYEG4TQ27x8O_VKQIF-gc2dr-DNwF9_OpAZy3LA",{"id":50,"extension":10,"main":51,"meta":123,"stem":124,"__hash__":125},"navigation\u002Fdata\u002Fnavigation.yml",[52,70,82,99],{"text":53,"children":54},"About",[55,58,61,64,67],{"text":56,"href":57},"ORC Working Group","\u002Fabout\u002F",{"text":59,"href":60},"Cyber Resilience SIG","\u002Fspecial-interest-groups\u002Fcyber-resilience\u002F",{"text":62,"href":63},"AI Policy & Compliance SIG","\u002Fspecial-interest-groups\u002Fai-policy-and-compliance\u002F",{"text":65,"href":66},"Steering Committee","\u002Fcommittees\u002Fsteering-committee\u002F",{"text":68,"href":69},"Meeting Minutes","\u002Fcommittees\u002Fminutes\u002F",{"text":71,"children":72},"Membership",[73,76,79],{"text":74,"href":75},"Our Members","\u002Fmembership\u002F",{"text":77,"href":78},"Become a Member","\u002Fmembership\u002Fbecome-a-member\u002F",{"text":80,"href":81},"Participation and Membership FAQ","\u002Fabout\u002Fparticipation-and-membership-faq\u002F",{"id":83,"text":84,"children":85},"cra","Cyber Resilience Act",[86,89,93,96],{"text":87,"href":88},"About CRA","\u002Fcra\u002Fabout",{"text":90,"href":91,"external":92},"CRA FAQ","https:\u002F\u002Fcra.orcwg.org\u002F",true,{"text":94,"href":95},"CRA Resources","\u002Fcra\u002Fresources",{"text":97,"href":98,"external":92},"CRA Hub on GitHub","https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-hub",{"text":100,"children":101},"Resources",[102,105,108,111,114,117,120],{"text":103,"href":104},"Events","\u002Fevents\u002F",{"text":106,"href":107},"Community Calendar","\u002Fresources\u002Fcalendar\u002F",{"text":109,"href":110},"Blog","\u002Fblog\u002F",{"text":112,"href":113},"Videos","\u002Fresources\u002Fvideos\u002F",{"text":115,"href":116},"Learning Hub","\u002Ftraining\u002F",{"text":118,"href":119},"Marketing Resources","\u002Fresources\u002Fmarketing-resources\u002F",{"text":121,"href":122,"external":92},"ORC Store","https:\u002F\u002Feclipse-foundation.store\u002Fcollections\u002Fopen-regulatory-compliance-orc",{},"data\u002Fnavigation","XYDVypNX67n8V4VQI_JTrw0cI16uV5jtctVXjN-DeKo",{"id":127,"backToTopText":128,"copyright":129,"extension":10,"manageCookiesText":130,"meta":131,"sections":132,"socialsHeading":185,"stem":186,"__hash__":187},"footer\u002Fdata\u002Ffooter.yml","Back to the top","Copyright © Eclipse Foundation AISBL. All Rights Reserved.","Manage Cookies",{},[133,150,169],{"id":134,"heading":135,"links":136},"footer-eclipse-foundation","Eclipse Foundation",[137,139,142,145,147],{"text":53,"href":138},"https:\u002F\u002Fwww.eclipse.org\u002Forg\u002F",{"text":140,"href":141},"Projects","https:\u002F\u002Fprojects.eclipse.org\u002F",{"text":143,"href":144},"Collaborations","https:\u002F\u002Fwww.eclipse.org\u002Fcollaborations\u002F",{"text":71,"href":146},"https:\u002F\u002Fwww.eclipse.org\u002Fmembership\u002F",{"text":148,"href":149},"Sponsor","https:\u002F\u002Fwww.eclipse.org\u002Fsponsor\u002F",{"id":151,"heading":152,"showManageCookies":92,"links":153},"footer-legal","Legal",[154,157,160,163,166],{"text":155,"href":156},"Privacy Policy","https:\u002F\u002Fwww.eclipse.org\u002Flegal\u002Fprivacy\u002F",{"text":158,"href":159},"Terms of Use","https:\u002F\u002Fwww.eclipse.org\u002Flegal\u002Fterms-of-use\u002F",{"text":161,"href":162},"Compliance","https:\u002F\u002Fwww.eclipse.org\u002Flegal\u002Fcompliance\u002F",{"text":164,"href":165},"Code of Conduct","https:\u002F\u002Fwww.eclipse.org\u002Forg\u002Fdocuments\u002FCommunity_Code_of_Conduct.php",{"text":167,"href":168},"Legal Resources","https:\u002F\u002Fwww.eclipse.org\u002Flegal\u002F",{"id":170,"heading":171,"links":172},"footer-more","More",[173,176,179,182],{"text":174,"href":175},"Report a Vulnerability","https:\u002F\u002Fwww.eclipse.org\u002Fsecurity\u002F",{"text":177,"href":178},"Service Status","https:\u002F\u002Fstatus.eclipse.org\u002F",{"text":180,"href":181},"Contact Us","https:\u002F\u002Fwww.eclipse.org\u002Forg\u002Ffoundation\u002Fcontact.php",{"text":183,"href":184},"Support","https:\u002F\u002Fwww.eclipse.org\u002Fprojects\u002Fsupport\u002F","Follow Us:","data\u002Ffooter","C-lpCHl9crwF3iQyRSh8y5g9ez5YgF4pi8aTv4pFLBM",{"id":189,"title":109,"aliases":190,"body":191,"breadcrumbTitle":190,"breadcrumbs":190,"date":210,"description":190,"extension":211,"featuredFooter":190,"header":190,"keywords":212,"meta":218,"navigation":92,"path":219,"redirectUrl":190,"rssFeed":190,"seo":220,"seoTitle":190,"socialImage":190,"stem":221,"typography":190,"visibility":190,"width":190,"__hash__":222},"pages\u002Fblog\u002Findex.md",null,{"type":192,"value":193,"toc":207},"minimark",[194,204],[195,196,197],"hero",{},[198,199,201],"template",{"v-slot:title":200},"",[202,203,109],"p",{},[205,206],"blog-post-list",{},{"title":200,"searchDepth":208,"depth":208,"links":209},2,[],"2025-05-29","md",[213,214,215,216,217],"blog","posts","news","announcement","article",{},"\u002Fblog",{"title":109},"blog\u002Findex","lXzQiJYx7JcPLBRt4l_-Vq46RS4dHHnhqK7Qn0WS9nQ",[],[225],{"path":226,"text":227},"\u002F","ORC",[229,547,666,881,1080,1333,1473,1689,1854,1962,2192,2315,2410,2544,2735,2911,2990,3249,3375,3407,3546,3685,3927,4191,4215,4267,4439,4531,4771,4811,4987,5052,5165,5393,5460,5496,5647,5981,6043,6191,6426,6558,6680,6780,6919,7178,7400,7461,7721],{"path":230,"title":231,"date":232,"author":233,"summary":190,"visibility":190,"body":234},"\u002Fblog\u002Forc-monthly-sept2026","ORC Monthly: CRA Reporting Begins, AI SIG Takes Shape, and Learning Hub Grows","2026-10-01","Shanda Giacomoni",{"type":192,"value":235,"toc":540},[236,251,270,277,361,367,370,388,395,401,424,430,479,488,494],[202,237,238,239,244,245,250],{},"11 September marked the first Cyber Resilience Act (CRA) deadline and an important milestone for the ORC community’s work. Months of work went into preparing for it, from testing the Single Reporting Platform to building the ",[240,241,90],"a",{"href":91,"rel":242},[243],"nofollow"," and the ",[240,246,249],{"href":247,"rel":248},"https:\u002F\u002Forcwg.org\u002Ftraining\u002F",[243],"ORC Learning Hub",". But there’s still a lot to do before the remaining CRA obligations apply in 2027.",[202,252,253,254,259,260,264,265],{},"That’s why we hope to see you at ",[240,255,258],{"href":256,"rel":257},"https:\u002F\u002Fcodeandcompliance.orcwg.org\u002Fcode-compliance-2026\u002F",[243],"Code & Compliance"," on 27 October at Maison de la Poste in Brussels. Across four blocks, the day moves from policy objectives to the practical work of complying with the CRA and the AI Act. ORC members save 50 percent with the code ",[261,262,263],"strong",{},"ORCMEMBER50",". ",[240,266,269],{"href":267,"rel":268},"https:\u002F\u002Fluma.com\u002Forc1026",[243],"Register now.",[271,272,274],"h2",{"id":273},"whats-new",[261,275,276],{},"What’s new",[278,279,280,302,320,338,350],"ul",{},[281,282,283,286,287,290,291,295,296,301],"li",{},[261,284,285],{},"ORC Learning Hub:"," Hundreds of learners are now taking Modules 1 and 2 of the ",[240,288,249],{"href":247,"rel":289},[243],". Module 3, ",[292,293,294],"em",{},"Introduction to SBOMs and Vulnerability Management",", is under development. Join the ",[240,297,300],{"href":298,"rel":299},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg\u002Ftree\u002Fmain\u002Fevents\u002Fcra-mondays#october-19-sboms-and-vulnerability-management-cra-training-community-review",[243],"CRA Monday on 19 October"," to help review the module before publication.",[281,303,304,307,308,313,314,319],{},[261,305,306],{},"AI Policy and Compliance SIG:"," The SIG approved its ",[240,309,312],{"href":310,"rel":311},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg\u002Fblob\u002Fmain\u002Fai-policy-and-compliance-sig\u002Fscope.md",[243],"scope"," on 21 September, starting with the EU AI Act. Rachel Foucard of TYPO3 has joined Dave Russo of Red Hat as co-lead. The SIG is also ",[240,315,318],{"href":316,"rel":317},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg\u002Fissues\u002F367",[243],"drafting a joint response"," to the ENISA consultation on AI-assisted software development, due 15 October.",[281,321,322,325,326,331,332,337],{},[261,323,324],{},"OCX 2027 call for proposals:"," ",[240,327,330],{"href":328,"rel":329},"https:\u002F\u002Focxconf.org\u002F",[243],"OCX 2027"," comes to Brussels 13-15 April 2027. ",[240,333,336],{"href":334,"rel":335},"https:\u002F\u002Focxconf.org\u002Fcall-for-proposals\u002F",[243],"Submit a talk"," to the Cybersecurity and Regulatory Compliance track.",[281,339,340,343,344,349],{},[261,341,342],{},"Save the date:"," Code & Compliance returns for its ",[240,345,348],{"href":346,"rel":347},"https:\u002F\u002Fcodeandcompliance.orcwg.org\u002Fcode-compliance-fosdem-edition-2027\u002F",[243],"FOSDEM Edition on 28 January 2027"," in Brussels. This edition is aimed at maintainers and engineers. The call for proposals and registration both open on 27 October.",[281,351,352,355,356,360],{},[261,353,354],{},"Share your SRP story:"," Now that CRA reporting obligations apply, we want to hear how organisations are adapting their vulnerability and incident reporting processes to the Single Reporting Platform. ",[240,357,359],{"href":358},"mailto:shanda.giacomoni@eclipse-foundation.org","Share your experience"," with us to help inform the community’s ongoing work.",[271,362,364],{"id":363},"cra-mondays",[261,365,366],{},"CRA Mondays",[202,368,369],{},"CRA Mondays are back after our summer hiatus. Catch up on September’s recordings:",[278,371,372,380],{},[281,373,374,379],{},[240,375,378],{"href":376,"rel":377},"https:\u002F\u002Fyoutu.be\u002FyXb2k8hbQ5M",[243],"Solving Copyright and Licensing Information in Client-Side JavaScript and CSS"," with Matija Šuklje",[281,381,382,387],{},[240,383,386],{"href":384,"rel":385},"https:\u002F\u002Fyoutu.be\u002FqGzLaMCLuk8",[243],"CRA Meets Machinery Regulation: Decentralised Digital Product Documentation"," with Merzough Münker",[202,389,390,391,394],{},"We’re looking for CRA Mondays speakers for November and December. ",[240,392,393],{"href":358},"Get in touch"," if you have a topic.",[271,396,398],{"id":397},"blogs-you-might-have-missed",[261,399,400],{},"Blogs you might have missed",[278,402,403,410,417],{},[281,404,405],{},[240,406,409],{"href":407,"rel":408},"https:\u002F\u002Forcwg.org\u002Fblog\u002Ffirst-cra-deadline-resources\u002F",[243],"Preparing for the First CRA Deadline: Resources for the Open Source Community",[281,411,412],{},[240,413,416],{"href":414,"rel":415},"https:\u002F\u002Forcwg.org\u002Fblog\u002Fh1-2026-update\u002F",[243],"ORC’s Impact in the First Half of 2026",[281,418,419],{},[240,420,423],{"href":421,"rel":422},"https:\u002F\u002Forcwg.org\u002Fblog\u002Fec-cra-guidelines\u002F",[243],"The European Commission publishes CRA implementation guidelines. Key takeaways for open source",[271,425,427],{"id":426},"upcoming-events",[261,428,429],{},"Upcoming events",[278,431,432,440,447,455,463,471],{},[281,433,434,439],{},[240,435,438],{"href":436,"rel":437},"https:\u002F\u002Fpartiful.com\u002Fe\u002Fdv9qSGilcF1gjVTMmYfh",[243],"Tech Week 2026: EU Cyber Resilience Act, Automating CI\u002FCD Compliance with AI"," | 13 October",[281,441,442,446],{},[240,443,445],{"href":298,"rel":444},[243],"CRA Monday: CRA Training Community Review"," | 19 October",[281,448,449,454],{},[240,450,453],{"href":451,"rel":452},"https:\u002F\u002Ftechexevent.com\u002Feurope\u002F",[243],"TechEx Europe 2026"," | 19-20 October",[281,456,457,462],{},[240,458,461],{"href":459,"rel":460},"https:\u002F\u002Fwww.etsi.org\u002Fevents\u002F2645-etsi-security-conference-oct2026\u002F",[243],"ETSI Security Conference 2026"," | 19-22 October",[281,464,465,470],{},[240,466,469],{"href":467,"rel":468},"https:\u002F\u002Fcodeandcompliance.orcwg.org\u002F",[243],"Code and Compliance"," | 27 October",[281,472,473,478],{},[240,474,477],{"href":475,"rel":476},"https:\u002F\u002Fnsss.se",[243],"Nordic Software Security Summit"," | 4-6 November | Stockholm",[202,480,481,482,487],{},"See all events on the ",[240,483,486],{"href":484,"rel":485},"https:\u002F\u002Forcwg.org\u002Fevents\u002F",[243],"ORC events page",".",[271,489,491],{"id":490},"how-to-participate",[261,492,493],{},"How to participate",[278,495,496,504,518,526,533],{},[281,497,498,499,487],{},"Join our calls on the ",[240,500,503],{"href":501,"rel":502},"https:\u002F\u002Fcalendar.google.com\u002Fcalendar\u002Fu\u002F0\u002Fembed?src=c_7db8e3f13c4fac984103918a97c704bb1d619da0fdb66d33f1747849b6020aea@group.calendar.google.com",[243],"community calendar",[281,505,506,507,512,513,487],{},"Subscribe to the ",[240,508,511],{"href":509,"rel":510},"https:\u002F\u002Faccounts.eclipse.org\u002Fmailing-list\u002Fopen-regulatory-compliance",[243],"mailing list"," or join us on ",[240,514,517],{"href":515,"rel":516},"https:\u002F\u002Fjoin.slack.com\u002Ft\u002Forcwg\u002Fshared_invite\u002Fzt-2vi7gi5ad-re2b35i95ar3WaVF2zoZaA",[243],"Slack",[281,519,520,521,487],{},"Contribute on ",[240,522,525],{"href":523,"rel":524},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg",[243],"GitHub",[281,527,528,529,487],{},"Share news and events with us at ",[240,530,532],{"href":531},"mailto:news@eclipse.org","news@eclipse.org",[281,534,535,487],{},[240,536,539],{"href":537,"rel":538},"https:\u002F\u002Forcwg.org\u002Fmembership\u002Fbecome-a-member\u002F",[243],"Become a member",{"title":200,"searchDepth":208,"depth":208,"links":541},[542,543,544,545,546],{"id":273,"depth":208,"text":276},{"id":363,"depth":208,"text":366},{"id":397,"depth":208,"text":400},{"id":426,"depth":208,"text":429},{"id":490,"depth":208,"text":493},{"path":548,"title":549,"date":550,"author":551,"summary":190,"visibility":190,"body":552},"\u002Fblog\u002Fai-sig-scope","Introducing the ORC AI SIG","2026-09-23","Dave Russo and Rachel Foucard",{"type":192,"value":553,"toc":664},[554,557,571,576,579,582,587,590,604,607,615,620,629,634,637,661],[202,555,556],{},"EU regulatory frameworks have not always accounted for the unique ways open source software is developed and maintained. The EU AI Act represents progress in recognising open source, but adapting the EU’s regulatory framework to open source in practice remains an ongoing process.",[202,558,559,560,565,566,570],{},"Large parts of EU AI Act are already in force, and the standards that will define how it will be implemented are being written right now. That’s exactly why the Open Regulatory Compliance (ORC) Working Group launched the ",[240,561,564],{"href":562,"rel":563},"https:\u002F\u002Forcwg.org\u002Fspecial-interest-groups\u002Fai-policy-and-compliance\u002F",[243],"AI Policy & Compliance Special Interest Group"," (AI SIG), and why we’re sharing the ",[240,567,569],{"href":310,"rel":568},[243],"AI SIG’s scope"," this week.",[202,572,573],{},[261,574,575],{},"Why open source needs a seat at the table",[202,577,578],{},"The AI Act primarily targets companies that provide AI models and systems, and it classifies certain uses as high-risk while placing different obligations on general-purpose models. But open source is not exempt from scrutiny. As open models gain visibility, and as organisations across Europe and beyond look to reduce reliance on proprietary technology, projects that produce these models face the same questions about transparency, data provenance, and security controls, when they enter the market.",[202,580,581],{},"We saw a similar pattern with the Cyber Resilience Act (CRA): the people writing technical standards need to understand how open source actually works, or the results won’t be workable for the community. The AI SIG exists to make sure that happens for AI regulation, too.",[202,583,584],{},[261,585,586],{},"What the AI SIG will do",[202,588,589],{},"The AI SIG supports open source stakeholders in two ways:",[278,591,592,598],{},[281,593,594,597],{},[261,595,596],{},"Inform",": Helping members understand and implement regulatory requirements, starting with the EU AI Act and expanding to other regulations as member interest grows.",[281,599,600,603],{},[261,601,602],{},"Influence",": Engaging with the regulatory bodies to help shape upcoming standards, so they are compatible with how open source is actually developed and used.",[202,605,606],{},"Beyond act-specific work, the group plans to tackle a few broader, recurring problems: clarifying technical definitions (such as the distinction between an AI model and an AI system), documenting the reasoning behind past positions so we’re not relitigating the same questions every time they resurface, and looking at how overlapping regulations can be addressed with a more unified compliance approach.",[202,608,609,610,614],{},"The ",[240,611,59],{"href":612,"rel":613},"https:\u002F\u002Forcwg.org\u002Fspecial-interest-groups\u002Fcyber-resilience\u002F",[243]," continues to lead general CRA work. The two SIGs will work together where AI and cybersecurity requirements intersect, including questions about the CRA’s applicability to AI components and systems.",[202,616,617],{},[261,618,619],{},"A global concern, not just a European one",[202,621,622,623,628],{},"The AI Act is EU legislation but open source is global by nature, so the impact isn’t confined to Europe. Any organisation putting AI systems on the market in the EU needs to comply if its use case falls into a regulated category, regardless of where that organisation is based. And the EU AI Act isn’t the only regulation on the horizon. The Cloud and AI Development Act (CADA), part of the ",[240,624,627],{"href":625,"rel":626},"https:\u002F\u002Fdigital-strategy.ec.europa.eu\u002Fen\u002Flibrary\u002Fproposal-cloud-and-ai-development-act-cada",[243],"EU’s technical sovereignty package",", is currently open for feedback, and several U.S. states have draft AI legislation in progress. The SIG’s scope is deliberately written to cover whichever regulations impact the open source community.",[202,630,631],{},[261,632,633],{},"How to get involved",[202,635,636],{},"If you work with or on AI models and systems, we’d like your input. Getting involved is simple:",[278,638,639,646,654],{},[281,640,506,641],{},[240,642,645],{"href":643,"rel":644},"https:\u002F\u002Faccounts.eclipse.org\u002Fmailing-list\u002Forc-ai-sig",[243],"AI SIG mailing list",[281,647,648,649,653],{},"Join a biweekly SIG call, held on Mondays. No preparation required; check the ",[240,650,503],{"href":651,"rel":652},"https:\u002F\u002Forcwg.org\u002Fresources\u002Fcalendar\u002F",[243]," and drop in to listen before you contribute.",[281,655,656,657,660],{},"Register to join us at ",[240,658,258],{"href":467,"rel":659},[243]," on 27 October 2026, where we will have a block on the “AI Act: Safe integration of open source models”.",[202,662,663],{},"None of this works without a broad range of voices at the table. You don’t need to be an expert to contribute; your experience, questions, and perspective can help shape the work. We hope you’ll get involved as the AI SIG evolves.",{"title":200,"searchDepth":208,"depth":208,"links":665},[],{"path":667,"title":409,"date":668,"author":669,"summary":190,"visibility":190,"body":670},"\u002Fblog\u002Ffirst-cra-deadline-resources","2026-09-02","Juan Rico",{"type":192,"value":671,"toc":874},[672,679,688,691,695,704,707,715,724,731,735,742,745,760,768,772,775,778,785,791,797,803,807,849,858,862],[202,673,674,675,678],{},"The first compliance deadline under the European Union’s Cyber Resilience Act (CRA) is approaching. Starting ",[261,676,677],{},"11 September 2026",", manufacturers and stewards will be required to report actively exploited vulnerabilities and severe incidents affecting the security of products with digital elements.",[202,680,681,682,687],{},"Under the CRA, an early warning must be submitted within 24 hours of becoming aware of an actively exploited vulnerability or severe incident, followed by a more complete notification within 72 hours. Additional reporting requirements apply after those initial notifications. Reports will be submitted through the ",[240,683,686],{"href":684,"rel":685},"https:\u002F\u002Fwww.enisa.europa.eu\u002Ftopics\u002Fproduct-security\u002Fsingle-reporting-platform-srp",[243],"CRA Single Reporting Platform"," established by ENISA.",[202,689,690],{},"A number of resources have been published or updated in recent weeks by the European Commission, ENISA, standards organisations, national cybersecurity authorities, and open source organisations. With so much to wade through, we have collected some of the most relevant resources to get you started.",[271,692,694],{"id":693},"start-with-the-cra-guidance-and-reporting-requirements","Start with the CRA guidance and reporting requirements",[202,696,697,698,703],{},"The European Commission has published its ",[240,699,702],{"href":700,"rel":701},"https:\u002F\u002Fdigital-strategy.ec.europa.eu\u002Fen\u002Flibrary\u002Fcommission-publishes-new-guidance-support-timely-cyber-resilience-act-implementation",[243],"implementation guidance on the CRA",", providing clarification on a range of topics including manufacturers, products with digital elements, open source software, open source software stewards, vulnerability reporting, and other aspects of implementation.",[202,705,706],{},"For the open source community, the guidance is particularly relevant because it provides further clarification on how the CRA applies to open source development and the different roles within the software supply chain.",[202,708,709,710,714],{},"We recently published a ",[240,711,713],{"href":421,"rel":712},[243],"summary of the key points for open source"," following the release of the final guidance.",[202,716,717,718,723],{},"For the September deadline specifically, the Commission has also published a dedicated page on ",[240,719,722],{"href":720,"rel":721},"https:\u002F\u002Fdigital-strategy.ec.europa.eu\u002Fen\u002Fpolicies\u002Fcra-reporting",[243],"CRA reporting obligations",". It explains which vulnerabilities and incidents must be reported, the applicable timelines, how notifications are distributed, and the role of the Single Reporting Platform.",[202,725,609,726,730],{},[240,727,729],{"href":91,"rel":728},[243],"ORC CRA FAQ"," is also a useful starting point for questions about how the CRA applies to developers, maintainers, manufacturers, and other actors in the open source ecosystem. It brings together community FAQs, the European Commission’s official FAQs, and topics where further clarification is still pending.",[271,732,734],{"id":733},"prepare-for-vulnerability-and-incident-reporting","Prepare for vulnerability and incident reporting",[202,736,737,738,687],{},"From 11 September, CRA notifications will be submitted through the ",[240,739,741],{"href":684,"rel":740},[243],"Single Reporting Platform (SRP)",[202,743,744],{},"Manufacturers will use the platform to report actively exploited vulnerabilities and severe security incidents. The notification is addressed to the relevant Computer Security Incident Response Team (CSIRT), with information also made available to ENISA and, in most circumstances, shared with other relevant CSIRTs.",[202,746,747,748,753,754,759],{},"ENISA has published information to help organisations understand how the platform and reporting process will work, including an ",[240,749,752],{"href":750,"rel":751},"https:\u002F\u002Fwww.enisa.europa.eu\u002Fsites\u002Fdefault\u002Ffiles\u002F2026-07\u002FENISA_CRA_SRP_Factsheet_v1.0_0.pdf",[243],"SRP factsheet"," and supporting guidance. The Commission states that the platform will be operational when the reporting obligations begin on 11 September. ORC participated in the testing phase of the SRP and provided feedback on its early implementation, identifying several practical challenges that could not all be addressed before launch. ORC will continue to ",[240,755,758],{"href":756,"rel":757},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg\u002Fissues?q=is%3Aissue%20state%3Aopen%20label%3Asingle-reporting-platform",[243],"collect feedback from the community"," and share it with ENISA as the system is used in practice.",[202,761,762,763,767],{},"Organisations that expect to have ",[240,764,766],{"href":720,"rel":765},[243],"reporting obligations"," may want to review these materials alongside their existing vulnerability management and incident response processes before the deadline.",[271,769,771],{"id":770},"understand-how-the-cra-applies-to-your-role","Understand how the CRA applies to your role",[202,773,774],{},"Not everyone participating in open source has the same responsibilities under the CRA.",[202,776,777],{},"The regulation distinguishes between different actors, including manufacturers and open source software stewards, while people contributing to open source outside the course of a commercial activity are treated differently.",[202,779,780,781,784],{},"For those looking for a structured introduction to the CRA, the ",[240,782,249],{"href":247,"rel":783},[243]," currently provides two introductory courses.",[202,786,787,790],{},[261,788,789],{},"Introduction to the CRA for the Open Source Community"," is designed for developers, maintainers, contributors, and open source project stewards. It covers how the CRA applies to open source projects, the distinction between open source actors and manufacturers, vulnerability handling, SBOMs, and secure-by-design concepts.",[202,792,793,796],{},[261,794,795],{},"Introduction to the CRA for Manufacturers"," is intended for product teams, security and compliance professionals, OSPO leaders, and legal and regulatory teams. It covers manufacturer obligations, organisational responsibilities, supply-chain accountability, and security-by-design requirements.",[202,798,799,800,487],{},"Both courses are available for free through the ",[240,801,249],{"href":247,"rel":802},[243],[271,804,806],{"id":805},"full-list-of-resources","Full list of resources",[278,808,809,815,821,827,832,838,844],{},[281,810,811],{},[240,812,814],{"href":700,"rel":813},[243],"European Commission CRA implementation guidance",[281,816,817],{},[240,818,820],{"href":720,"rel":819},[243],"European Commission: CRA reporting obligations",[281,822,823],{},[240,824,826],{"href":421,"rel":825},[243],"ORC analysis: Key takeaways from the CRA implementation guidance",[281,828,829],{},[240,830,729],{"href":91,"rel":831},[243],[281,833,834],{},[240,835,837],{"href":684,"rel":836},[243],"ENISA: CRA Single Reporting Platform",[281,839,840],{},[240,841,843],{"href":756,"rel":842},[243],"ORC’s feedback on the SRP",[281,845,846],{},[240,847,249],{"href":247,"rel":848},[243],[202,850,851,852,857],{},"The CRA implementation landscape will continue to evolve beyond the September reporting deadline, with most obligations becoming applicable in 2027. ORC will continue to develop and update implementation resources, including work on vulnerability management, due diligence, SBOMs, and security attestations, while tracking relevant guidance and standards. Visit our ",[240,853,856],{"href":854,"rel":855},"https:\u002F\u002Forcwg.org\u002Fcra\u002Fresources\u002F?utm_source=chatgpt.com",[243],"CRA Resources page"," for the latest deliverables and updates.",[271,859,861],{"id":860},"join-us-in-brussels","Join us in Brussels",[202,863,864,865,868,869,873],{},"You can also join us 27 October in Brussels for ",[240,866,258],{"href":467,"rel":867},[243],", where we’ll continue these conversations in person. The programme will focus on practical approaches to developing compliant products, navigating evolving EU regulatory requirements including the CRA and AI Act, and sharing experiences across the open source, industry, policy, and standards communities. ",[240,870,872],{"href":267,"rel":871},[243],"Registration is now open",", and we hope to see you there.",{"title":200,"searchDepth":208,"depth":208,"links":875},[876,877,878,879,880],{"id":693,"depth":208,"text":694},{"id":733,"depth":208,"text":734},{"id":770,"depth":208,"text":771},{"id":805,"depth":208,"text":806},{"id":860,"depth":208,"text":861},{"path":882,"title":883,"date":884,"author":669,"summary":190,"visibility":190,"body":885},"\u002Fblog\u002Fh1-2026-update","ORC’s Impact in the first half of 2026","2026-08-20",{"type":192,"value":886,"toc":1070},[887,896,899,902,909,918,924,933,939,948,954,963,969,981,987,996,1005,1011,1014,1067],[202,888,889,890,895],{},"The first half of 2026 has been pivotal for the ",[240,891,894],{"href":892,"rel":893},"https:\u002F\u002Forcwg.org\u002F",[243],"Open Regulatory Compliance (ORC) Working Group",". Over the past six months, we have solidified our role as the premier community for navigating the intersection of open source software and emerging European regulations.",[202,897,898],{},"By prioritising direct collaboration with regulators and building practical, open source resources, we are shaping how the Cyber Resilience Act (CRA) will be implemented across our ecosystem.",[202,900,901],{},"Here are some of the ORC community’s highlights from the first half of the year regarding our impact on CRA implementation and beyond:",[903,904,906],"h3",{"id":905},"_1-directly-influencing-official-cra-guidance",[261,907,908],{},"1. Directly Influencing Official CRA Guidance",[202,910,911,912,917],{},"Our technical contributions are moving beyond advocacy and into implementation. During Q1, we submitted extensive feedback on the CRA Guidance Package. Our “",[240,913,916],{"href":914,"rel":915},"https:\u002F\u002Forcwg.org\u002Fcra\u002Fresources\u002Fd3-5-white-paper-on-open-source-software-stewards-and-cra\u002F",[243],"Stewards’ Obligations under the CRA","” White Paper is fully aligned with what the European Commission released in the Draft guidance package later in March. We maintained robust engagement with the CRA Expert Group, participating in key sessions in Brussels to ensure open source perspectives are embedded in the regulatory baseline.",[903,919,921],{"id":920},"_2-operationalising-due-diligence",[261,922,923],{},"2. Operationalising Due Diligence",[202,925,926,927,932],{},"As the CRA deadline approaches, the ORC is shifting focus to practical compliance tooling. We are developing a ",[240,928,931],{"href":929,"rel":930},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-due-diligence",[243],"Due Diligence Framework"," to support manufacturers in the execution of their obligations when open source components are integrated in their products.",[903,934,936],{"id":935},"_3-advancing-voluntary-security-attestations",[261,937,938],{},"3. Advancing Voluntary Security Attestations",[202,940,941,942,947],{},"Voluntary attestations are emerging as a vital mechanism to ease the due diligence burden on manufacturers consuming open source components. Following our proposal for a multi-tier attestation process, we launched a comprehensive survey to validate this approach with the ecosystem. ",[240,943,946],{"href":944,"rel":945},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-attestations\u002Fblob\u002Fmain\u002Fevents\u002F2026-02-attestation-survey\u002FVSA%20Survey%20Report%20March%202026.pdf",[243],"The resulting findings"," have already been presented to the CRA Expert Group, revealing significant interest from both manufacturers and Market Surveillance Authorities in the topic, which is now discussed together with due diligence.",[903,949,951],{"id":950},"_4-launching-the-orc-learning-hub",[261,952,953],{},"4. Launching the ORC Learning Hub",[202,955,956,957,962],{},"To close the knowledge gap across the ecosystem, we successfully launched the first phase of the ",[261,958,959],{},[240,960,249],{"href":247,"rel":961},[243],". The platform currently features two foundational modules, one tailored for open source communities and another for manufacturing entities, comprising 28 video presentations and gamified exercises to build widespread CRA readiness.",[903,964,966],{"id":965},"_5-expanding-community-and-cross-regulatory-focus",[261,967,968],{},"5. Expanding Community and Cross-Regulatory Focus",[202,970,971,972,975,976,980],{},"Our membership grew to ",[261,973,974],{},"68 members"," by the end of the first half of the year, backed by expanded synergies, including a formal MoU with OWASP and ECSO. Looking beyond the CRA, we have formally launched the ",[240,977,979],{"href":562,"rel":978},[243],"AI Policy and Compliance Special Interest Group (SIG)"," to begin addressing the impending requirements of the AI Act, starting with early contributions to the European Commission’s AI transparency call for feedback.",[903,982,984],{"id":983},"_6-connecting-the-community-through-events",[261,985,986],{},"6. Connecting the Community through Events",[202,988,989,990,995],{},"We significantly expanded our outreach to critical sectors facing immediate CRA pressures, notably automotive and embedded systems. In addition to hosting 121 participants at our second Code & Compliance Community Day in Brussels, ORC brought visibility to the upcoming regulations that will impact open source to the greater OSS community at the ",[240,991,994],{"href":992,"rel":993},"https:\u002F\u002Fblogs.eclipse.org\u002Fpost\u002Fdaniela-nastase\u002Foc-compliance-ocx26",[243],"Open Community for Compliance"," as part of OCX. In addition, the ORC spread the word at major industry gatherings including Embedded World, the OASDL community day, the Nordic Software Security Summit, the CRA for Automotive event in San Sebastian, and the Automotive Open Source Summit, to name a few.",[202,997,998,999,1004],{},"These engagements, alongside our collaborative ",[240,1000,1003],{"href":1001,"rel":1002},"https:\u002F\u002Fyoutu.be\u002FCQAF4zzpOqM?si=BQgBG1oUHgb7iYSn",[243],"“Unpacking the CRA for the Automotive Industry","” webinar with the SDV Working Group, have allowed us to connect directly with manufacturers to address the practical challenges of managing open source dependencies.",[903,1006,1008],{"id":1007},"looking-ahead-the-roadmap-for-h2-2026",[261,1009,1010],{},"Looking Ahead: The Roadmap for H2 2026",[202,1012,1013],{},"As we transition into the second half of the year, our roadmap is focused on turning these regulatory frameworks into practical, operational realities. To close out 2026, we will be prioritising the following key milestones:",[278,1015,1016,1022,1028,1037],{},[281,1017,1018,1021],{},[261,1019,1020],{},"Closing the Due Diligence Framework:"," We are finalising our due diligence guidelines, with plans to explore converting them into a formal process specification to clarify continuous lifecycle compliance for manufacturers.",[281,1023,1024,1027],{},[261,1025,1026],{},"Implementing Attestations in Practice:"," We are establishing shared community forums to test and validate how voluntary security attestations can practically streamline due diligence in real-world supply chains.",[281,1029,1030,325,1033,1036],{},[261,1031,1032],{},"Extending Our Role in the AI Act Space",[261,1034,1035],{},"through our newly formed AI Policy and Compliance SIG:"," we will be defining clear compliance pathways for open-source AI while deepening our direct engagement with the European Commission’s AI working group.",[281,1038,1039,1047,1048],{},[261,1040,1041,1042,1046],{},"The Next ",[240,1043,1045],{"href":467,"rel":1044},[243],"Code & Compliance on 27 October",":"," We will gather the community at the next edition of our flagship event in Brussels to showcase these milestones, share security best practices, and co-design the future of open-source tech-regulatory resilience. If your organisation is interested in supporting this event and increasing its visibility within the community, sponsorship opportunities are also available.\n",[278,1049,1050,1058],{},[281,1051,1052],{},[240,1053,1055],{"href":267,"rel":1054},[243],[261,1056,1057],{},"Register",[281,1059,1060],{},[240,1061,1064],{"href":1062,"rel":1063},"https:\u002F\u002Fcodeandcompliance.orcwg.org\u002Fbecome-a-sponsor\u002F",[243],[261,1065,1066],{},"Become a Sponsor",[202,1068,1069],{},"Stay tuned, because many more activities are coming!",{"title":200,"searchDepth":208,"depth":208,"links":1071},[1072,1074,1075,1076,1077,1078,1079],{"id":905,"depth":1073,"text":908},3,{"id":920,"depth":1073,"text":923},{"id":935,"depth":1073,"text":938},{"id":950,"depth":1073,"text":953},{"id":965,"depth":1073,"text":968},{"id":983,"depth":1073,"text":986},{"id":1007,"depth":1073,"text":1010},{"path":1081,"title":423,"date":1082,"author":669,"summary":190,"visibility":190,"body":1083},"\u002Fblog\u002Fec-cra-guidelines","2026-07-31",{"type":192,"value":1084,"toc":1323},[1085,1092,1114,1127,1131,1135,1185,1189,1210,1214,1250,1254,1288,1292,1310,1314,1320],[202,1086,1087,1088,487],{},"On July 27th ",[240,1089,1091],{"href":700,"rel":1090},[243],"the European Commission published the Implementation guidance on the application of Regulation (EU) 2024\u002F2847 (the Cyber Resilience Act — CRA)",[202,1093,1094,1095,1098,1099,1102,1103,1106,1107,1110,1111,487],{},"It provides practical clarification of key CRA concepts that directly impact\nthe open source ecosystem, including the criteria for ",[261,1096,1097],{},"placing software on the\nmarket",", the distinction between ",[261,1100,1101],{},"maintainers and contributors",", the\nobligations of ",[261,1104,1105],{},"Open Source Software Stewards",", ",[261,1108,1109],{},"upstream vulnerability\nreporting",", and ",[261,1112,1113],{},"downstream integration requirements",[202,1115,1116,1117,1120,1121,1126],{},"Below is a detailed open-source analysis summarising the guidance’s key\ntakeaways while emphasising the critical advocacy role of the ",[261,1118,1119],{},"Open Regulatory\nCompliance",". Through ongoing engagement with policymakers, the release of\ntechnical assets like the stewards white paper and ",[240,1122,1125],{"href":1123,"rel":1124},"https:\u002F\u002Fec.europa.eu\u002Finfo\u002Flaw\u002Fbetter-regulation\u002Fhave-your-say\u002Finitiatives\u002F16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act\u002FF33391529_en",[243],"engagement in key public\nconsultations",",\nORC ensures that the open source community interests are represented and that\nregulatory frameworks translate effectively into practical, real-world\nimplementation.",[271,1128,1130],{"id":1129},"key-takeaways-from-an-open-source-perspective","Key takeaways from an open source perspective",[903,1132,1134],{"id":1133},"a-placement-on-the-market-monetisation-boundaries","A. Placement on the Market & Monetisation Boundaries",[278,1136,1137,1151,1176],{},[281,1138,1139,1142,1143,1146,1147,1150],{},[261,1140,1141],{},"Commercial vs. Non-Commercial distinctions:"," FOSS is only subject to standard manufacturer obligations if it is ",[292,1144,1145],{},"placed on the Union market in the course of a commercial activity",". Merely publishing, hosting, or openly sharing source code under an open source licence does ",[261,1148,1149],{},"not"," constitute placing software on the market.",[281,1152,1153,1156,1157],{},[261,1154,1155],{},"Monetisation triggers:"," FOSS is considered placed on the market (making the developer\u002Fentity a “manufacturer”) if one of these is true:\n",[278,1158,1159,1164,1170],{},[281,1160,1161,487],{},[261,1162,1163],{},"A price is directly charged for the software or compiled binaries",[281,1165,1166,1169],{},[261,1167,1168],{},"It is bundled with paid technical support services"," exceeding reasonable cost recuperation (including reasonable living expenses for natural persons).",[281,1171,1172,1175],{},[261,1173,1174],{},"It monetises other products\u002Fservices, conditions access on personal data processing"," (unrelated to security\u002Finteroperability), or accepts donations exceeding cost recovery with an intention to make a profit.",[281,1177,1178,1181,1182,1184],{},[261,1179,1180],{},"Dual-Licensing & “Community” Versions:"," Providing a free “community” version alongside a monetised enterprise version does ",[261,1183,1149],{}," bring the community version under manufacturer obligations, provided the free version itself is not monetised.",[903,1186,1188],{"id":1187},"b-responsibility-maintainers-vs-contributors","B. Responsibility: Maintainers vs. Contributors",[278,1190,1191,1204],{},[281,1192,1193,1196,1197,1200,1201,487],{},[261,1194,1195],{},"Contributor protection:"," The guidance explicitly clarifies that natural or legal persons who contribute code (e.g., submitting pull or merge requests) but do not control releases, roadmaps, or governance decisions are ",[261,1198,1199],{},"contributors",", not maintainers, and fall ",[261,1202,1203],{},"outside the scope of the CRA",[281,1205,1206,1209],{},[261,1207,1208],{},"Maintainer responsibility:"," Software is only under the responsibility of natural or legal persons (maintainers) who publish it and exercise primary control over development, releases, and distribution.",[903,1211,1213],{"id":1212},"c-open-source-software-stewards-art-314-art-24","C. Open Source Software Stewards (Art 3(14) & Art 24)",[278,1215,1216,1222],{},[281,1217,1218,1221],{},[261,1219,1220],{},"Definition:"," Stewards are legal persons (such as non-profit foundations) that provide sustained support for FOSS intended for commercial activities but do not place the software on the market themselves.",[281,1223,1224,1227],{},[261,1225,1226],{},"Tiered obligations based on involvement (Art 24(3)):",[278,1228,1229,1238,1244],{},[281,1230,1231,1234,1235,1237],{},[261,1232,1233],{},"Non-Technical Stewards"," (governance, branding, events): Must adopt a cybersecurity policy, but are ",[292,1236,1149],{}," required to report actively exploited vulnerabilities or severe infrastructure incidents.",[281,1239,1240,1243],{},[261,1241,1242],{},"Infrastructure Stewards"," (hosting code repositories, CI\u002FCD pipelines): Must notify ENISA and CSIRTs of severe incidents affecting their IT infrastructure.",[281,1245,1246,1249],{},[261,1247,1248],{},"Engineering Stewards"," (employing developers, directly coordinating releases): Must report actively exploited vulnerabilities they become aware of.",[903,1251,1253],{"id":1252},"d-upstream-downstream-integration-mechanics","D. Upstream & downstream integration mechanics",[278,1255,1256,1265],{},[281,1257,1258,1261,1262,1264],{},[261,1259,1260],{},"Integrator accountability (Art 13(5)):"," Commercial integrators who build FOSS components into their monetised products bear full manufacturer liability for the finished product. Integrating FOSS does ",[261,1263,1149],{}," transfer CRA liability upstream to open source maintainers or stewards.",[281,1266,1267,1270],{},[261,1268,1269],{},"Upstream reporting & fix sharing (Art 13(6)):",[278,1271,1272,1275,1278],{},[281,1273,1274],{},"Integrators discovering vulnerabilities in FOSS components must report them upstream to maintainers, using the guidelines set by the open source project",[281,1276,1277],{},"Integrators developing a patch must share the security fix upstream in a machine-readable format compatible with the project’s licence.",[281,1279,1280,1283,1284,1287],{},[261,1281,1282],{},"Crucially",", maintainers are ",[261,1285,1286],{},"not legally obligated to accept or merge"," proposed upstream security fixes.",[903,1289,1291],{"id":1290},"e-practical-compliance-relief-for-foss","E. Practical compliance relief for FOSS",[278,1293,1294,1300],{},[281,1295,1296,1299],{},[261,1297,1298],{},"Conformity assessment flexibility (Art 32(5)):"," Important Class I and Class II FOSS products placed on the market are permitted to use the internal control procedure (Module A self-assessment), avoiding mandatory third-party audits.",[281,1301,1302,1305,1306,1309],{},[261,1303,1304],{},"Single-Version patching (Art 13(10)):"," Software developers\u002Fmanufacturers may restrict active vulnerability patching to the ",[261,1307,1308],{},"latest release version",", provided downstream users can upgrade free of charge and without incurring additional infrastructure costs.",[271,1311,1313],{"id":1312},"summary","Summary",[202,1315,1316,1317,487],{},"The Commission’s Guidance Package validates much of what the open source\ncommunity advocated for: ",[261,1318,1319],{},"protecting individual contributors, recognising\nnon-profit steward models, and ensuring maintainers are not held liable for\ndownstream commercial usage",[202,1321,1322],{},"The ORC community was fundamental in this process. By serving as a bridge\nbetween the realities of open source development and the complexities of EU\nregulatory frameworks, ORC ensured that policymakers understood and addressed\nthe community’s unique needs. Through targeted technical advocacy, expert\nparticipation in the CRA Expert Group, and coordinated feedback, the ORC\ncommunity did more than just provide input, they acted as a strategic partner\nin translating open source collaboration into the final regulatory outcomes.\nThis achievement cements the ORC community as an essential, authoritative voice\nin shaping digital policy, proving that open source expertise is critical to\ncreating sustainable, innovation-friendly legislation.",{"title":200,"searchDepth":208,"depth":208,"links":1324},[1325,1332],{"id":1129,"depth":208,"text":1130,"children":1326},[1327,1328,1329,1330,1331],{"id":1133,"depth":1073,"text":1134},{"id":1187,"depth":1073,"text":1188},{"id":1212,"depth":1073,"text":1213},{"id":1252,"depth":1073,"text":1253},{"id":1290,"depth":1073,"text":1291},{"id":1312,"depth":208,"text":1313},{"path":1334,"title":1335,"date":1336,"author":1337,"summary":190,"visibility":190,"body":1338},"\u002Fblog\u002Fvoluntary-attestations-survey","Understanding Voluntary Security Attestations: Insights from the Survey","2026-04-30","Æva Black and Greg Wallace",{"type":192,"value":1339,"toc":1462},[1340,1353,1362,1366,1369,1389,1393,1396,1400,1403,1423,1427,1434,1438,1441,1445,1448,1451,1454],[202,1341,1342,1343,1346,1347,1352],{},"With the Cyber Resilience Act (CRA) introducing new expectations for digital\nproducts, the open source community is exploring how to navigate these\nrequirements thoughtfully, while improving long term sustainability of the\necosystem. One potential path is the use of ",[261,1344,1345],{},"Voluntary Security Attestations","\n(",[240,1348,1351],{"href":1349,"rel":1350},"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=OJ:L_202402847#art_25",[243],"defined in art. 25 of the CRA","),\na way for projects to communicate their security practices clearly and\nconsistently.",[202,1354,1355,1356,1361],{},"To better understand the practical opportunities, the ",[240,1357,1360],{"href":1358,"rel":1359},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-attestations",[243],"CRA Attestations project","\nsurveyed 151 developers and commercial users, to see if attestations could\nactually bridge the gap between regulatory needs and the reality of open source\nmaintenance.",[271,1363,1365],{"id":1364},"listening-to-the-ecosystem","Listening to the Ecosystem",[202,1367,1368],{},"The survey, conducted between late January and mid-February 2026, aimed to move\npast assumptions. We focused on three key areas:",[278,1370,1371,1377,1383],{},[281,1372,1373,1376],{},[261,1374,1375],{},"Utility:"," Which security documents actually help a company feel safe using\na project?",[281,1378,1379,1382],{},[261,1380,1381],{},"Feasibility:"," What can a maintainer realistically provide without burning\nout?",[281,1384,1385,1388],{},[261,1386,1387],{},"Sustainability:"," Could this framework create a way for companies to better\nsupport the projects they depend on?",[271,1390,1392],{"id":1391},"key-findings","Key Findings",[202,1394,1395],{},"The data suggests that security attestations can be a valuable tool for\nbuilding trust and ensuring the long-term health of the ecosystem.",[903,1397,1399],{"id":1398},"_1-high-impact-low-friction-practices","1. High-Impact, Low-Friction Practices",[202,1401,1402],{},"The report identified a “sweet spot” of information that is relatively easy for\nproject maintainers to provide and highly valuable for the manufacturers that\nrely on open source. This includes:",[278,1404,1405,1411,1417],{},[281,1406,1407,1410],{},[261,1408,1409],{},"Documented Vulnerability and Security Policies:"," Knowing exactly how a\nproject team approaches secure software development, handles vulnerabilities,\nand communicates and releases fixes.",[281,1412,1413,1416],{},[261,1414,1415],{},"Predictable Release Cadences:"," Understanding how the project signals\nrelease cycles and when major versions will reach end-of-life.",[281,1418,1419,1422],{},[261,1420,1421],{},"Security Reviews:"," External security audits, even occasional ones, act as\nsignificant trust signals.",[903,1424,1426],{"id":1425},"_2-a-bridge-to-financial-sustainability","2. A Bridge to Financial Sustainability",[202,1428,1429,1430,1433],{},"One of the most encouraging findings was the link between compliance and\nsupport. ",[261,1431,1432],{},"57.6% of commercial users"," indicated they would be more willing to\nprovide financial support to a project if it provided attestations that reduced\ntheir own internal auditing or certification costs. This suggests that\n“compliance” doesn’t have to be a burden on open source maintainers; it can\nbecome a common basis for corporate investment in project development and\nmaintenance.",[903,1435,1437],{"id":1436},"_3-global-consensus","3. Global Consensus",[202,1439,1440],{},"Interestingly, the survey found a high degree of alignment across different\nregions and company sizes. Whether in Europe or abroad, the industry\nrespondents largely agreed on what constitutes “good” security information.\nThis consensus is a vital signal that creating a standardised approach should\nbe possible.",[271,1442,1444],{"id":1443},"next-steps","Next Steps",[202,1446,1447],{},"The results of the survey provide a humble but clear roadmap. Moving forward,\nthe CRA Attestations project will focus on developing a better understanding of\nimplementation guidelines for third-party due diligence and how a voluntary\nsecurity attestation programme can support such requirements while respecting\nthe diversity of the open source community.",[202,1449,1450],{},"By focusing on transparency and mutual benefit, we can ensure that the Cyber\nResilience Act strengthens, rather than hinders, the open source spirit.",[903,1452,100],{"id":1453},"resources",[202,1455,1456,1457,487],{},"The report and the raw data are available as part of the resources generated\nby the ",[240,1458,1461],{"href":1459,"rel":1460},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-attestations\u002Ftree\u002Fmain\u002Fevents\u002F2026-02-attestation-survey",[243],"CRA Attestations project here",{"title":200,"searchDepth":208,"depth":208,"links":1463},[1464,1465,1470],{"id":1364,"depth":208,"text":1365},{"id":1391,"depth":208,"text":1392,"children":1466},[1467,1468,1469],{"id":1398,"depth":1073,"text":1399},{"id":1425,"depth":1073,"text":1426},{"id":1436,"depth":1073,"text":1437},{"id":1443,"depth":208,"text":1444,"children":1471},[1472],{"id":1453,"depth":1073,"text":100},{"path":1474,"title":1475,"date":1476,"author":669,"summary":190,"visibility":190,"body":1477},"\u002Fblog\u002Forc-monthly-mar2026","ORC Monthly: Countdown to OCX","2026-03-31",{"type":192,"value":1478,"toc":1681},[1479,1493,1504,1507,1559,1563,1586,1590,1601,1604,1637,1641,1657,1660],[202,1480,1481,1482,1486,1487,1492],{},"With OCX 2026 just weeks away, we’re looking forward to bringing the ORC community together in Brussels for an important milestone, the first-ever ",[240,1483,994],{"href":1484,"rel":1485},"https:\u002F\u002Fwww.ocxconf.org\u002Fevent\u002F2026\u002Fopen-community-for-compliance",[243]," track at OCX. This dedicated track reflects the growing importance of our work, offering a space for developers, policymakers, and industry leaders to exchange practical insights on topics like the Cyber Resilience Act, secure development, and open source compliance. If you’ve been following or contributing to ORC, this is a unique opportunity to connect in person and help shape what comes next. If you haven’t yet ",[240,1488,1491],{"href":1489,"rel":1490},"https:\u002F\u002Fwww.ocxconf.org\u002Fevent\u002F2026\u002Fregister",[243],"registered",", we strongly encourage you to do so and be part of our first time at OCX.",[202,1494,1495,325,1498,1501],{},[292,1496,1497],{},"Timo Perala and Dirk-Willem van Gulik",[1499,1500],"br",{},[292,1502,1503],{},"ORC co-chairs",[271,1505,1506],{"id":273},"What’s New",[278,1508,1509,1526,1547],{},[281,1510,1511,325,1514,325,1516,1521,1522,487],{},[261,1512,1513],{},"CRA Training Session at OCX 2026",[1499,1515],{},[240,1517,1520],{"href":1518,"rel":1519},"https:\u002F\u002Fwww.ocxconf.org\u002Fevent\u002F2026\u002Fworkshops",[243],"Are you ready for the CRA? Learn how the EU regulation will affect open source"," in this hands-on workshop designed to help you understand the practical implications of the Cyber Resilience Act. Included with your OCX registration, this session is a great opportunity to build readiness and ask questions directly with experts. ",[240,1523,1525],{"href":1518,"rel":1524},[243],"Learn more and plan your participation",[281,1527,1528,325,1531,1533,1534,1539,1540,1543,1544,487],{},[261,1529,1530],{},"Call for Speakers: CRA Mondays",[1499,1532],{},"\nWe’re looking for new speakers to join our upcoming ",[240,1535,1538],{"href":1536,"rel":1537},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg\u002Ftree\u002Fmain\u002Fevents\u002Fcra-mondays",[243],"CRA Mondays sessions",". This is a great opportunity to share your experience, discuss challenges, showcase tools, or explore ",[261,1541,1542],{},"topics related to the Cyber Resilience Act"," with a highly engaged ORC community. The series has seen strong momentum over the past few months, and we’re excited to continue building a diverse lineup of talks. If you’re interested in presenting or would like to recommend a speaker, please ",[240,1545,1546],{"href":358},"reach out to Shanda",[281,1548,1549,325,1552,1554,1555,1558],{},[261,1550,1551],{},"ORC at Embedded World 2026",[1499,1553],{},"\nORC returned to Embedded World for a second year, with noticeably increased awareness of the Cyber Resilience Act across the embedded systems community. We had many valuable conversations with organisations looking to better understand CRA requirements, and shared community-driven resources such as the ",[240,1556,90],{"href":91,"rel":1557},[243]," to support their journey.",[271,1560,1562],{"id":1561},"blog-you-might-have-missed","Blog you might have missed",[278,1564,1565,1572,1579],{},[281,1566,1567],{},[240,1568,1571],{"href":1569,"rel":1570},"https:\u002F\u002Fwww.forrester.com\u002Fblogs\u002Fregulators-are-moving-on-sboms-but-is-your-compliance-program-keeping-pace\u002F%20",[243],"Regulators Are Moving On SBOMs — But Is Your Compliance Program Keeping Pace?",[281,1573,1574],{},[240,1575,1578],{"href":1576,"rel":1577},"https:\u002F\u002Forcwg.org\u002Fblog\u002Fcra-draft-guidance\u002F",[243],"Coordinating Open Source Feedback on the CRA Draft Guidance",[281,1580,1581],{},[240,1582,1585],{"href":1583,"rel":1584},"https:\u002F\u002Forcwg.org\u002Fblog\u002Fattestations-update-mar2026\u002F",[243],"Attestations in Progress",[271,1587,1589],{"id":1588},"overheard","Overheard",[202,1591,1592],{},[240,1593,1596],{"href":1594,"rel":1595},"https:\u002F\u002Fwww.linkedin.com\u002Ffeed\u002Fupdate\u002Furn:li:activity:7439709694128041984\u002F",[243],[1597,1598],"img",{"alt":1599,"src":1600},"FreeBSD Foundation shares their first monthly report for our Cyber Resilience Act Readiness project on LinkedIn","\u002Fblog\u002Forc-monthly-mar2026\u002Fimages\u002Fmar-overheard.png",[271,1602,1603],{"id":426},"Upcoming Events",[278,1605,1606,1613,1621,1629],{},[281,1607,1608,1612],{},[240,1609,477],{"href":1610,"rel":1611},"https:\u002F\u002Fnsss.se\u002F",[243]," | 8-10 April 2026",[281,1614,1615,1620],{},[240,1616,1619],{"href":1617,"rel":1618},"https:\u002F\u002Fwww.ocxconf.org\u002Fevent\u002F2026",[243],"Open Community Experience (OCX) 2026"," | 21-23 April 2026",[281,1622,1623,1628],{},[240,1624,1627],{"href":1625,"rel":1626},"https:\u002F\u002Ffoss-north.se\u002F2026\u002F",[243],"foss-north 2026"," | 27-28 April 2026",[281,1630,1631,1636],{},[240,1632,1635],{"href":1633,"rel":1634},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg\u002Ftree\u002Fmain\u002Fevents\u002Fcra-mondays#may-11-using-the-cra-to-understand-systems-in-practice",[243],"CRA Monday: Using the CRA to Understand Systems in Practice"," | 11 May 2026",[271,1638,1640],{"id":1639},"recent-talks-events","Recent Talks & Events",[278,1642,1643,1650],{},[281,1644,1645],{},[240,1646,1649],{"href":1647,"rel":1648},"https:\u002F\u002Fyoutu.be\u002Fns9RBhEsz_U?si=Xdt3QwszlbgBM_ZU",[243],"Lessons from Log4Shell: building a CRA-ready Log4j",[281,1651,1652],{},[240,1653,1656],{"href":1654,"rel":1655},"https:\u002F\u002Fyoutu.be\u002F5B6VXZwZa-c?si=oGEzTc3SZf7SHBXH",[243],"Software Hash Identifier introduction and applications to in-development standards",[271,1658,1659],{"id":490},"How to Participate",[278,1661,1662,1668,1675],{},[281,1663,1664],{},[240,1665,1667],{"href":98,"rel":1666},[243],"Learn",[281,1669,1670],{},[240,1671,1674],{"href":1672,"rel":1673},"https:\u002F\u002Fgithub.com\u002Forcwg",[243],"Contribute",[281,1676,1677],{},[240,1678,1680],{"href":537,"rel":1679},[243],"Join the Working Group",{"title":200,"searchDepth":208,"depth":208,"links":1682},[1683,1684,1685,1686,1687,1688],{"id":273,"depth":208,"text":1506},{"id":1561,"depth":208,"text":1562},{"id":1588,"depth":208,"text":1589},{"id":426,"depth":208,"text":1603},{"id":1639,"depth":208,"text":1640},{"id":490,"depth":208,"text":1659},{"path":1690,"title":1585,"date":1691,"author":1692,"summary":190,"visibility":190,"body":1693},"\u002Fblog\u002Fattestations-update-mar2026","2026-03-10","Æva Black",{"type":192,"value":1694,"toc":1846},[1695,1704,1713,1727,1733,1736,1742,1745,1754,1760,1763,1766,1772,1775,1778,1789,1792,1798,1805,1843],[202,1696,1697,1698,1703],{},"When we first outlined the thinking behind ",[240,1699,1702],{"href":1700,"rel":1701},"https:\u002F\u002Forcwg.org\u002Fblog\u002Fattestations-2025\u002F",[243],"voluntary security attestations in October 2025",", we framed them as a potential lever for two hard problems:",[1705,1706,1707,1710],"ol",{},[281,1708,1709],{},"helping manufacturers meet their Cyber Resilience Act (CRA) obligations, and",[281,1711,1712],{},"improving the long-term sustainability of open source projects.",[202,1714,1715,1716,1720,1721,1726],{},"Since then, the ORC community has continued refining the attestation concept through working sessions, research, and discussions at ",[240,1717,258],{"href":1718,"rel":1719},"https:\u002F\u002Fyoutu.be\u002FTlDH-TixYyY?si=fAegpKCOW6uH-HoA",[243]," and ",[240,1722,1725],{"href":1723,"rel":1724},"https:\u002F\u002Ffosdem.org\u002F2026\u002Fschedule\u002Fevent\u002FPTHENV-sustaining-foss-with-attestations\u002F",[243],"FOSDEM",", including engagement with representatives from BSI and DG-CNECT. As regulatory expectations around the CRA become clearer, we are now able to provide a practical update on how the model is being developed, tested, and refined within the community.",[271,1728,1730],{"id":1729},"a-two-tier-model",[261,1731,1732],{},"A Two-Tier Model",[202,1734,1735],{},"One of the most significant areas of progress has been agreement on a two-tier attestation model, reflecting the diversity of the open source ecosystem.",[903,1737,1739],{"id":1738},"lightweight-attestations",[261,1740,1741],{},"Lightweight Attestations",[202,1743,1744],{},"The lightweight model is designed for projects that are typically used as components or libraries and that may not have significant commercial backing. The goal here is practicality: a concise checklist that signals basic project health, secure development practices, and the ability to coordinate on vulnerabilities.",[202,1746,1747,1748,1753],{},"For well-maintained projects, completing a lightweight attestation should require minimal effort and can be periodically reviewed and updated. The current template draws on existing practices such as OpenSSF Scorecard and SLSA projects, as well as recently-published national cybersecurity standards from the ",[240,1749,1752],{"href":1750,"rel":1751},"https:\u002F\u002Fwww.bsi.bund.de\u002FSharedDocs\u002FDownloads\u002FEN\u002FBSI\u002FPublications\u002FTechGuidelines\u002FTR03185\u002FBSI-TR-03185-2.pdf?__blob=publicationFile&v=5",[243],"German BSI",". It combines information which is easy to verify using publicly available project artefacts and indicates a project’s readiness to respond to cybersecurity vulnerabilities and incidents, in accordance with certain parts of Annex 1 Part II of the CRA.",[903,1755,1757],{"id":1756},"heavyweight-attestations",[261,1758,1759],{},"Heavyweight Attestations",[202,1761,1762],{},"The heavyweight model targets larger and more product-like projects, or ecosystems with substantial industry participation. Examples include platforms, operating systems, and projects that undergo only limited downstream modification when embedded in commercial products.",[202,1764,1765],{},"Based on our community research so far, we believe that, in order for these attestations to provide practical value to manufacturers, they require deeper due diligence and more sustained effort. As a result, they also offer the greatest potential to reduce duplicated compliance work across manufacturers who rely on mature and well-maintained open source software. A draft proposal for the heavyweight model is now under active review, and community feedback is especially important at this stage.",[271,1767,1769],{"id":1768},"growing-clarity-and-open-questions",[261,1770,1771],{},"Growing Clarity and Open Questions",[202,1773,1774],{},"As CRA-related standards move closer to public review within national bodies, the working group’s understanding of expected due diligence has improved. This has begun to ground the attestation work in realistic regulatory expectations.",[202,1776,1777],{},"At the same time, several questions remain open and are being actively explored by the group:",[278,1779,1780,1783,1786],{},[281,1781,1782],{},"How might financial models around attestations work in different jurisdictions and for different types of communities and projects?",[281,1784,1785],{},"How can larger projects engage with transitive dependencies, so that smaller projects benefit when larger ecosystems rely on their work?",[281,1787,1788],{},"What role should third-party attestations have alongside maintainer-issued ones, and what are the situations where these will be valuable to open source communities?",[202,1790,1791],{},"Rather than delaying progress, these questions are shaping our understanding of a model that can adapt to different legal, organisational, and project realities. Ultimately, our goal is to support the broad diversity of open source communities, without creating additional or undue burden upon maintainers, while also opening additional pathways to sustainable funding for projects that wish to participate in them.",[271,1793,1795],{"id":1794},"where-the-project-stands-today-and-next-steps",[261,1796,1797],{},"Where the Project Stands Today and Next Steps",[202,1799,1800,1801,1804],{},"The attestation work has now entered a ",[261,1802,1803],{},"validation and community input phase",", where direct participation is essential. We are actively inviting maintainers, foundations, manufacturers, and policy experts to engage with the work in the following ways:",[278,1806,1807,1820,1833],{},[281,1808,1809,325,1812,1819],{},[261,1810,1811],{},"Review the",[261,1813,1814],{},[240,1815,1818],{"href":1816,"rel":1817},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-attestations\u002Fblob\u002Fmain\u002Fproposals\u002Fgen-two-tier-approach.md#light-weight-voluntary-security-attestations",[243],"lightweight attestation template",", which is now available for broader community feedback",[281,1821,1822,325,1825,1832],{},[261,1823,1824],{},"Provide input on the",[261,1826,1827],{},[240,1828,1831],{"href":1829,"rel":1830},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-attestations\u002Fblob\u002Fmain\u002Fproposals\u002Fgen-two-tier-approach.md#heavy-weight-voluntary-security-attestations",[243],"heavyweight attestation proposal",", particularly if you have experience with cybersecurity standards, compliance or certification, or maintaining large-scale projects",[281,1834,1835,1838,1839,1842],{},[261,1836,1837],{},"Join the bi-weekly working group meetings",", where maintainers, foundations, manufacturers, and policy specialists collaborate on refining the model (see our ",[240,1840,503],{"href":651,"rel":1841},[243],")",[202,1844,1845],{},"As this project is anticipated to reach a stable draft form before summer, now is the time to get involved. Review the proposals, join a working session, and contribute your operational perspective. The next iteration of the attestation model will be shaped by those who participate.",{"title":200,"searchDepth":208,"depth":208,"links":1847},[1848,1852,1853],{"id":1729,"depth":208,"text":1732,"children":1849},[1850,1851],{"id":1738,"depth":1073,"text":1741},{"id":1756,"depth":1073,"text":1759},{"id":1768,"depth":208,"text":1771},{"id":1794,"depth":208,"text":1797},{"path":1855,"title":1578,"date":1856,"author":669,"summary":190,"visibility":190,"body":1857},"\u002Fblog\u002Fcra-draft-guidance","2026-03-09",{"type":192,"value":1858,"toc":1957},[1859,1873,1876,1879,1885,1888,1920,1926,1929,1932,1938,1946,1954],[202,1860,697,1861,1868,1869,1872],{},[240,1862,1865],{"href":1863,"rel":1864},"https:\u002F\u002Fec.europa.eu\u002Finfo\u002Flaw\u002Fbetter-regulation\u002Fhave-your-say\u002Finitiatives\u002F16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en",[243],[261,1866,1867],{},"draft guidance for the implementation of the Cyber Resilience Act (CRA)"," and opened it for public feedback until ",[261,1870,1871],{},"March 31st",". This consultation represents an important opportunity for the open source ecosystem to help refine how the CRA will be interpreted and applied in practice.",[202,1874,1875],{},"Over the past year, the ORC community has held multiple discussions around the CRA implementation that were turned into practical language provided to the European Commission as part of Eclipse Foundation work at the CRA Expert Group. We are proud to see that many of the suggestions made by our community are reflected in the current draft guidance, demonstrating that collaborative dialogue between regulators and the open source ecosystem can lead to meaningful progress.",[202,1877,1878],{},"At the same time, this draft is not the final step. As with any complex regulatory framework, there are still areas where clarification and improvement would benefit both regulators and the broader ecosystem. The public consultation provides a valuable moment for stakeholders to help ensure that the guidance is both effective and workable for organisations building and maintaining digital products.",[903,1880,1882],{"id":1881},"what-is-in-the-guidance",[261,1883,1884],{},"What is in the guidance",[202,1886,1887],{},"This guidance document is highly relevant as it addresses many of the CRA’s most controversial topics, including:",[278,1889,1890,1896,1902,1908,1914],{},[281,1891,1892,1895],{},[261,1893,1894],{},"Who counts as a “manufacturer”",": the guidance clarifies that responsibility can extend beyond the original developer to companies integrating or rebranding software\u002Fcomponents into a product placed on the EU market.",[281,1897,1898,1901],{},[261,1899,1900],{},"Treatment of open source software (OSS)",": it distinguishes voluntary OSS contributors from commercial actors. Pure contributors are generally out of scope, while entities that commercially distribute or integrate OSS into products may assume CRA obligations.",[281,1903,1904,1907],{},[261,1905,1906],{},"Scope of “products with digital elements”",": the document explains more clearly which software, hardware–software combinations, and embedded components fall under CRA, including when standalone software is considered a regulated product.",[281,1909,1910,1913],{},[261,1911,1912],{},"Role of remote or supporting services",": it clarifies when cloud or remote services linked to a product are considered part of the product’s cybersecurity context and therefore relevant for compliance.",[281,1915,1916,1919],{},[261,1917,1918],{},"How to interpret the “support period”",": the guidance gives more detail on how manufacturers should determine and communicate the expected support period, including vulnerability management and security updates during that time.",[903,1921,1923],{"id":1922},"a-collective-effort",[261,1924,1925],{},"A Collective Effort",[202,1927,1928],{},"One of the key strengths of the ORC community is our ability to bring together experts from across industry, open source communities and foundations to analyse regulatory proposals and provide constructive feedback.",[202,1930,1931],{},"The European Commission has demonstrated that it is listening to well-founded input from technical communities. This reinforces the importance of continuing to engage constructively and ensuring that the perspectives of open source developers, maintainers, and organisations are represented.",[903,1933,1935],{"id":1934},"join-the-conversation",[261,1936,1937],{},"Join the Conversation",[202,1939,1940,1941,1945],{},"The ORC Working Group will use its ",[240,1942,1944],{"href":651,"rel":1943},[243],"upcoming meetings"," to review the draft guidance, consolidate feedback, and coordinate community input before submitting our recommendations to the European Commission.",[202,1947,1948,1949,1953],{},"If you are interested in contributing to this effort, we invite you to join our discussions on the ",[240,1950,1952],{"href":509,"rel":1951},[243],"ORC mailing list",". Your perspective can help ensure that the CRA guidance supports both stronger cybersecurity and a thriving open source ecosystem.",[202,1955,1956],{},"Together, we can continue demonstrating that open collaboration leads to better policy outcomes.",{"title":200,"searchDepth":208,"depth":208,"links":1958},[1959,1960,1961],{"id":1881,"depth":1073,"text":1884},{"id":1922,"depth":1073,"text":1925},{"id":1934,"depth":1073,"text":1937},{"path":1963,"title":1964,"date":1965,"author":669,"summary":190,"visibility":190,"body":1966},"\u002Fblog\u002Forc-monthly-feb2026","ORC Monthly: Momentum After FOSDEM","2026-02-26",{"type":192,"value":1967,"toc":2184},[1968,1985,1993,1995,2043,2045,2068,2070,2080,2082,2126,2128,2165,2167],[202,1969,1970,1971,1974,1975,1978,1979,1984],{},"Following a strong presence at FOSDEM and our second Code & Compliance event, conversations around the Cyber Resilience Act (CRA) continue to mature — shifting from awareness to practical implementation. The sessions and workshops helped advance key ORC deliverables, including the ",[261,1972,1973],{},"voluntary security attestations"," project and ongoing work around ",[261,1976,1977],{},"due diligence",". As momentum builds around these critical initiatives, we encourage you to follow ",[240,1980,1983],{"href":1981,"rel":1982},"http:\u002F\u002Forcwg.org\u002Fblog",[243],"orcwg.org\u002Fblog"," for the latest updates and opportunities to get involved.",[202,1986,1987,1989,1991],{},[292,1988,1497],{},[1499,1990],{},[292,1992,1503],{},[271,1994,1506],{"id":273},[278,1996,1997,2016,2030],{},[281,1998,1999,2002,2004,2005,1720,2010,2015],{},[261,2000,2001],{},"Open Community for Compliance at OCX 2026",[1499,2003],{},"\nThe Open Community for Compliance program is shaping up to be a must-attend event, featuring sessions like ",[240,2006,2009],{"href":2007,"rel":2008},"https:\u002F\u002Fblogs.eclipse.org\u002Fpost\u002Fdaniela-nastase\u002Fbeyond-compliance-what-cyber-resilience-act-means-software-trust%20",[243],"Beyond Compliance: What the Cyber Resilience Act Means for Software Trust",[240,2011,2014],{"href":2012,"rel":2013},"https:\u002F\u002Fblogs.eclipse.org\u002Fpost\u002Fdaniela-nastase\u002Fgenerating-sbom-not-enough-java-teams",[243],"Generating an SBOM Is Not Enough for Java Teams",". If you’re navigating CRA readiness or responsible open source practices, this is where the conversation is happening. Register now to secure your spot in Brussels, April 21–23.",[281,2017,2018,2021,2023,2024,2029],{},[261,2019,2020],{},"Code & Compliance – FOSDEM Edition Recordings Available",[1499,2022],{},"\nCatch up on the ",[240,2025,2028],{"href":2026,"rel":2027},"https:\u002F\u002Fyoutube.com\u002Fplaylist?list=PLy7t4z5SYNaTKAWlXT3HAQMy4LgLVA7zf&si=bNuwDlmBGhQsIpSG%20",[243],"full playlist"," from our latest Code & Compliance, featuring expert discussions on open source, compliance realities, and CRA readiness.",[281,2031,2032,2035,2037,2038],{},[261,2033,2034],{},"Eclipse Foundation and ECSO Formalise Cooperation",[1499,2036],{},"\nThe Eclipse Foundation and the European Cyber Security Organisation (ECSO) have signed a Memorandum of Understanding to strengthen collaboration around cybersecurity, standards, and regulatory readiness — reinforcing our shared commitment to a secure and resilient digital ecosystem. ",[240,2039,2042],{"href":2040,"rel":2041},"https:\u002F\u002Fecs-org.eu\u002Fthe-eclipse-foundation-and-ecso-formalise-cooperation-through-new-memorandum-of-understanding\u002F%20",[243],"Learn more",[271,2044,1562],{"id":1561},[278,2046,2047,2054,2061],{},[281,2048,2049],{},[240,2050,2053],{"href":2051,"rel":2052},"https:\u002F\u002Forcwg.org\u002Fblog\u002Ffosdem-follow-up\u002F",[243],"From Code to Compliance at FOSDEM 2026",[281,2055,2056],{},[240,2057,2060],{"href":2058,"rel":2059},"https:\u002F\u002Forcwg.org\u002Fblog\u002Fdue-diligence-dos-attack\u002F",[243],"Please don’t make your CRA due diligence a DoS attack!",[281,2062,2063],{},[240,2064,2067],{"href":2065,"rel":2066},"https:\u002F\u002Forcwg.org\u002Fblog\u002Fstewards-wp-launch\u002F",[243],"ORC’s First Whitepaper on Open Source Software Stewards and the Cyber Resilience Act",[271,2069,1589],{"id":1588},[202,2071,2072],{},[240,2073,2076],{"href":2074,"rel":2075},"https:\u002F\u002Fwww.linkedin.com\u002Ffeed\u002Fupdate\u002Furn:li:activity:7424507291338575872\u002F",[243],[1597,2077],{"alt":2078,"src":2079},"ESCO announces MOU with Eclipse Foundation, photo of signing","\u002Fblog\u002Forc-monthly-feb2026\u002Fimages\u002Ffeb-overheard.png",[271,2081,1603],{"id":426},[278,2083,2084,2092,2100,2108,2116,2121],{},[281,2085,2086,2091],{},[240,2087,2090],{"href":2088,"rel":2089},"https:\u002F\u002Fwww.embedded-world.de\u002Fen",[243],"Embedded World 2026"," | March 10-12, 2026",[281,2093,2094,2099],{},[240,2095,2098],{"href":2096,"rel":2097},"https:\u002F\u002Fwww.enisa.europa.eu\u002Fcybersecurity_standardisation_2026",[243],"10th Cybersecurity Standardisation Conference"," | March 12, 2026",[281,2101,2102,2107],{},[240,2103,2106],{"href":2104,"rel":2105},"https:\u002F\u002F26.foss-backstage.de\u002F",[243],"FOSS Backstage 2026"," | 16-17 March 2026",[281,2109,2110,2115],{},[240,2111,2114],{"href":2112,"rel":2113},"https:\u002F\u002Fopenchainproject.org\u002Fnews\u002F2025\u002F12\u002F09\u002Fopenchain-and-friends-2026",[243],"OpenChain and Friends 2026"," | 24-26 March 2026",[281,2117,2118,1612],{},[240,2119,477],{"href":1610,"rel":2120},[243],[281,2122,2123,1620],{},[240,2124,1619],{"href":1617,"rel":2125},[243],[271,2127,1640],{"id":1639},[278,2129,2130,2137,2144,2151,2158],{},[281,2131,2132,2133],{},"FOSDEM: ",[240,2134,2136],{"href":1723,"rel":2135},[243],"Could Compliance Costs Sustain FOSS? A Theory of Voluntary Attestations",[281,2138,2132,2139],{},[240,2140,2143],{"href":2141,"rel":2142},"https:\u002F\u002Ffosdem.org\u002F2026\u002Fschedule\u002Fevent\u002FDHKYX8-the-cra-isnt-coming-for-you\u002F",[243],"The CRA isn’t coming for your open source community",[281,2145,2146],{},[240,2147,2150],{"href":2148,"rel":2149},"https:\u002F\u002Fyoutu.be\u002FRWG-5oFO9cY?si=Bk0uE0ANVaILqFJy",[243],"Open Source Governance in the Global South: Challenges, Opportunities & Compliance in Africa | CRA Monday",[281,2152,2153],{},[240,2154,2157],{"href":2155,"rel":2156},"https:\u002F\u002Fyoutu.be\u002FdiBqxCtBraI?si=ggirFyfyTvwXKjzA",[243],"Anyone who still puts AI-generated code into circulation has conditional intent to infringe the law | CRA Monday",[281,2159,2160],{},[240,2161,2164],{"href":2162,"rel":2163},"https:\u002F\u002Fyoutube.com\u002Fplaylist?list=PLy7t4z5SYNaTKAWlXT3HAQMy4LgLVA7zf&si=UTCuyQxBh7FdoeEw",[243],"Code & Compliance - FOSDEM Edition",[271,2166,1659],{"id":490},[278,2168,2169,2174,2179],{},[281,2170,2171],{},[240,2172,1667],{"href":98,"rel":2173},[243],[281,2175,2176],{},[240,2177,1674],{"href":1672,"rel":2178},[243],[281,2180,2181],{},[240,2182,1680],{"href":537,"rel":2183},[243],{"title":200,"searchDepth":208,"depth":208,"links":2185},[2186,2187,2188,2189,2190,2191],{"id":273,"depth":208,"text":1506},{"id":1561,"depth":208,"text":1562},{"id":1588,"depth":208,"text":1589},{"id":426,"depth":208,"text":1603},{"id":1639,"depth":208,"text":1640},{"id":490,"depth":208,"text":1659},{"path":2193,"title":2067,"date":2194,"author":669,"summary":190,"visibility":190,"body":2195},"\u002Fblog\u002Fstewards-wp-launch","2026-02-11",{"type":192,"value":2196,"toc":2309},[2197,2203,2206,2217,2223,2226,2229,2235,2238,2276,2282,2285,2288,2294,2303,2306],[202,2198,2199,2200,2202],{},"The adoption of the EU Cyber Resilience Act (CRA) represents a major shift in how cybersecurity responsibilities are defined across the software ecosystem. For the first time, the regulation explicitly recognises ",[292,2201,1105],{}," as a distinct category of legal actors, separate from manufacturers, and subject to a tailored set of obligations.",[202,2204,2205],{},"While this recognition is a positive step for open source, it has also raised many practical questions. Foundations, non-profits, and other organisations that steward open source projects have been asking what this new role means in practice, what responsibilities apply, and how they can prepare without undermining the collaborative nature of open source development.",[202,2207,2208,2209,2213,2214,2216],{},"The whitepaper “",[240,2210,2212],{"href":914,"rel":2211},[243],"Open Source Software Stewards and CRA","” aims to bridge that gap. Based on a close reading of the CRA’s legal text, it provides a clear, practical overview of what the regulation requires from open source stewards, what it does ",[292,2215,1149],{}," require, and where important uncertainties remain. It is not legal advice. Rather, it reflects the collective understanding of contributors actively engaged in open source policy and regulatory discussions.",[271,2218,2220],{"id":2219},"produced-by-the-orc-community",[261,2221,2222],{},"Produced by the ORC Community",[202,2224,2225],{},"This publication is the first whitepaper produced by the Open Regulatory Compliance (ORC) community. From the outset, the goal was to ensure that this guidance was shaped by real-world open source experience, not theoretical assumptions.",[202,2227,2228],{},"The whitepaper was developed collaboratively by members of the ORC community, drawing on expertise from open source foundations, project leaders, security practitioners, and policy specialists. Working together, contributors analysed the CRA text, debated interpretations, and aligned on guidance that is both accurate and grounded in how open source projects actually operate.",[271,2230,2232],{"id":2231},"what-the-whitepaper-covers",[261,2233,2234],{},"What the Whitepaper Covers",[202,2236,2237],{},"The whitepaper focuses on the areas where stewards most need clarity today:",[278,2239,2240,2246,2252,2258,2264,2270],{},[281,2241,2242,2245],{},[261,2243,2244],{},"Clarifying the Open Source Steward role under the CRA",", including how stewards relate to the projects they support and why this new role exists.",[281,2247,2248,2251],{},[261,2249,2250],{},"Defining steward obligations",", outlining what compliance requirements apply and how they differ from those placed on manufacturers.",[281,2253,2254,2257],{},[261,2255,2256],{},"Providing practical examples"," of how stewards can work with projects to establish cybersecurity policies, manage vulnerabilities, and support coordinated disclosure.",[281,2259,2260,2263],{},[261,2261,2262],{},"Explaining interactions with Market Surveillance Authorities",", and how these regulatory relationships fit into CRA compliance.",[281,2265,2266,2269],{},[261,2267,2268],{},"Describing the two-way relationship with CSIRTs",", including how information sharing and coordination are expected to work.",[281,2271,2272,2275],{},[261,2273,2274],{},"Highlighting open questions",", such as how to determine the appropriate Market Surveillance Authority in complex or cross-border cases, and where further regulatory guidance is still needed.",[271,2277,2279],{"id":2278},"a-resource-for-cra-stewards-and-beyond",[261,2280,2281],{},"A Resource for CRA Stewards and Beyond",[202,2283,2284],{},"This whitepaper is intended to be a practical resource for open source stewards navigating the CRA. We also encourage regulators, policymakers, and Market Surveillance Authorities to use it as a reference for understanding how the open source ecosystem functions and how stewardship obligations can be applied proportionately.",[202,2286,2287],{},"We ask the community to share this resource widely with steward organisations, open source projects, legal and compliance teams, and anyone working at the intersection of open source and regulation. Broad awareness and shared understanding are essential to making the CRA work for open source.",[271,2289,2291],{"id":2290},"what-comes-next",[261,2292,2293],{},"What Comes Next",[202,2295,2296,2297,2302],{},"The ORC community has published a broader ",[240,2298,2301],{"href":2299,"rel":2300},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg\u002Fblob\u002Fmain\u002Fcyber-resilience-sig\u002Fdeliverables.md#deliverables",[243],"deliverables plan"," that includes additional whitepapers and guidance documents focused on CRA implementation and open source compliance. With this first whitepaper successfully completed, we are now ready to kick off additional community-led whitepaper projects.",[202,2304,2305],{},"If you are interested in leading or contributing to a future whitepaper, we would love to hear from you. Community leadership and participation are central to the success of ORC, and new contributors are always welcome.",[202,2307,2308],{},"By developing shared, community-driven guidance, the ORC aims to support consistent, practical implementation of the CRA across the open source ecosystem.",{"title":200,"searchDepth":208,"depth":208,"links":2310},[2311,2312,2313,2314],{"id":2219,"depth":208,"text":2222},{"id":2231,"depth":208,"text":2234},{"id":2278,"depth":208,"text":2281},{"id":2290,"depth":208,"text":2293},{"path":2316,"title":2060,"date":2317,"author":2318,"summary":190,"visibility":190,"body":2319},"\u002Fblog\u002Fdue-diligence-dos-attack","2026-02-10","Olle E. Johansson",{"type":192,"value":2320,"toc":2405},[2321,2324,2327,2331,2334,2337,2341,2344,2347,2351,2360,2363,2366,2392,2399,2402],[202,2322,2323],{},"The EU Cyber Resilience Act (CRA) and other regulations stress the importance of understanding your software supply chain. The CRA makes manufacturers responsible not only for their own code and hardware, but for all the components they integrate to their products. This often includes a large amount of open source software.",[202,2325,2326],{},"When carrying out the required due diligence for all components in a product, there’s a real risk of unintentionally contributing to a denial-of-service attack on the open source maintainers. Let’s work together to make sure it doesn’t happen. The Open Regulatory Compliance working group is starting to work on a best current practice, and we’d like to tell you more about this important project.",[271,2328,2330],{"id":2329},"remember-the-log4shell-vulnerability","Remember the Log4shell vulnerability?",[202,2332,2333],{},"Log4shell was a serious vulnerability in the Apache Log4j open source project. It generated a lot of work within IT organisations, both for customers and manufacturers. The main question was “Are we affected?” Trying to find out which products and systems included this critical piece of software became the priority.",[202,2335,2336],{},"This led to a large amount of queries to upstream vendors and open source projects, often requesting a response to be provided in a specific format and within a strict time frame. In many cases, open source maintainers had no business relationship with the companies and no associated revenue stream to pay for this work. Unsuprisingly this led to a lot of frustration. Let’s not repeat that experience.",[271,2338,2340],{"id":2339},"lets-try-to-come-up-with-a-standardised-way-forward","Let’s try to come up with a standardised way forward",[202,2342,2343],{},"If you look at the problem more broadly, open source projects can have a large number of downstream manufacturers and users. Each of those, in turn, has a long list of open source libraries, tools, and platforms. This can lead to a massive communication breakdown at scale.",[202,2345,2346],{},"Open source maintainers are under no obligation to spend their valuable - quite often unpaid - time responding to ad hoc requests in various formats. Receiving a large volume of requests from different, and possibly unknown, sources will cause confusion and unnecessary workload. We want maintainers to focus on their code, the project and in many cases, securing their code and development processes.",[271,2348,2350],{"id":2349},"join-the-work-to-create-a-best-current-practice","Join the work to create a best current practice",[202,2352,2353,2354,2359],{},"In ORC, we are looking into this problem. We have started working on a document that will describe the ",[240,2355,2358],{"href":2356,"rel":2357},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg\u002Fblob\u002Fmain\u002Fcyber-resilience-sig\u002Fwhitepapers\u002Fdue-diligence.md",[243],"best current practice for due diligence"," according to the Cyber Resilience Act.",[202,2361,2362],{},"This community-driven project is led by Timo Perälä from Nokia, and contributions are welcome from manufacturers, open source maintainers, tooling vendors, and policy experts.",[202,2364,2365],{},"You can get involved by:",[278,2367,2368,2374,2382,2389],{},[281,2369,2370,2371,1842],{},"Participating in discussions via the ORC WG Vulnerability Handling Task Force, which meets every other Thursday at 15:00 CET (see our ",[240,2372,503],{"href":651,"rel":2373},[243],[281,2375,2376,2377],{},"Joining asynchronous discussions in the ",[240,2378,2381],{"href":2379,"rel":2380},"https:\u002F\u002Forcwg.slack.com\u002Farchives\u002FC0926JH5Y8M",[243],"vulnerability handling Slack channel",[281,2383,2384,2385],{},"Contributing ideas, use cases, or text to the ",[240,2386,2388],{"href":2356,"rel":2387},[243],"Due Diligence white paper",[281,2390,2391],{},"Helping define practical, automatable checks that work for both manufacturers and open source projects",[202,2393,2394,2395,2398],{},"In addition, the ORC community is working on ",[240,2396,1345],{"href":1700,"rel":2397},[243],", which offer open source projects another way to communicate security posture and support manufacturers with their due diligence process.",[202,2400,2401],{},"If interest and activity grow, the working group may spin up dedicated meetings or channels focused solely on due diligence.",[202,2403,2404],{},"If you care about sustainable open source consumption under the CRA, this work needs your input.",{"title":200,"searchDepth":208,"depth":208,"links":2406},[2407,2408,2409],{"id":2329,"depth":208,"text":2330},{"id":2339,"depth":208,"text":2340},{"id":2349,"depth":208,"text":2350},{"path":2411,"title":2053,"date":2412,"author":669,"summary":190,"visibility":190,"body":2413},"\u002Fblog\u002Ffosdem-follow-up","2026-02-06",{"type":192,"value":2414,"toc":2539},[2415,2418,2438,2447,2451,2458,2465,2476,2485,2498,2502,2508,2515,2518,2526,2530,2533,2536],[202,2416,2417],{},"Over the FOSDEM week, one message became unmistakably clear: attestations and due diligence are no longer optional side topics; they are becoming foundational to the sustainability of open source in a regulated world.",[202,2419,2420,2421,2427,2428,2431,2432,2437],{},"At ",[240,2422,2425],{"href":2423,"rel":2424},"https:\u002F\u002Fwww.eclipse-foundation.events\u002Fevent\u002Fcode-compliance-2026\u002F",[243],[261,2426,258],{},", this reality was already evident in the level of engagement. The event sold out with120+ participants, including maintainers, manufacturers, compliance professionals, policymakers, and tool builders. The participants actively worked through how trust, responsibility, and compliance can be implemented ",[292,2429,2430],{},"together",", without undermining open source collaboration. For those who couldn’t join us, ",[240,2433,2436],{"href":2434,"rel":2435},"https:\u002F\u002Fyoutube.com\u002Fplaylist?list=PLy7t4z5SYNaTKAWlXT3HAQMy4LgLVA7zf&si=LQHqM1ChfPyGj2zV",[243],"session recordings from Code & Compliance"," are now available.",[202,2439,2440,2441,2446],{},"The conversations continued, and the themes of attestations and due diligence kept resurfacing. These were repeatedly discussed across multiple stages and ",[240,2442,2445],{"href":2443,"rel":2444},"https:\u002F\u002Forcwg.org\u002Fblog\u002Ffosdem-2026\u002F",[243],"side events at FOSDEM",", turning separate sessions into a single, shared dialogue.",[271,2448,2450],{"id":2449},"attestations-as-an-opportunity-to-sustain-open-source-communities","Attestations as an opportunity to sustain open source communities",[202,2452,2453,2454,2457],{},"Across both Code & Compliance and FOSDEM, discussions around ",[261,2455,2456],{},"attestations"," consistently converged on one key insight: how to make them practical and proportionate. The attestations are not about adding bureaucracy to open source projects; they are about making existing community work visible, reusable, and valued.",[202,2459,2460,2461,2464],{},"The work being done reflects this shift, with a ",[261,2462,2463],{},"two-tier model"," designed to accommodate the diversity of the ecosystem: lightweight attestations for smaller projects and components, and more in-depth models for larger, product-like projects.",[202,2466,2467,2468,2471,2472,2475],{},"Open source communities already invest significant effort in secure development practices, documentation, release processes, and vulnerability handling. Attestations provide a structured way to surface this work, allowing downstream users to understand ",[292,2469,2470],{},"how"," software is built and maintained, not just ",[292,2473,2474],{},"what"," it contains. This visibility is essential for long-term sustainability.",[202,2477,2478,2479,2484],{},"One particularly engaging session was the ",[240,2480,2483],{"href":2481,"rel":2482},"https:\u002F\u002Ffosdem.org\u002F2026\u002Fschedule\u002Fevent\u002FU9JFC8-sustaining-foss-a-panel-with\u002F",[243],"panel on sustaining FOSS",", which brought together perspectives from open source foundations, industry, and public policy, including representation from the European Commission. The discussion explored what long-term sustainability looks like for open source in an increasingly regulated landscape and how responsibility can be shared across the ecosystem rather than concentrated in any one place.",[202,2486,2487,2488,2492,2493,487],{},"Within the ORC community, ",[240,2489,2491],{"href":1358,"rel":2490},[243],"attestation work"," is already taking shape through a collaborative, open process, with draft attestation models openly available for review and discussion. Community input remains essential at this stage, and maintainers, manufacturers, and other stakeholders are actively invited to engage with the current proposals and share their perspectives through ongoing discussions and a dedicated ",[240,2494,2497],{"href":2495,"rel":2496},"https:\u002F\u002Fec.europa.eu\u002Feusurvey\u002Frunner\u002FCRA-Attestation-Survey-2026-FOSDEM%20",[243],"community survey",[271,2499,2501],{"id":2500},"due-diligence-as-a-cooperative-process","Due diligence as a cooperative process",[202,2503,2504,2505,2507],{},"The conversation on ",[261,2506,1977],{}," followed naturally. Under regulations such as the Cyber Resilience Act, manufacturers are required to demonstrate that they understand and manage the risks in their software supply chains. What the events made clear is that due diligence cannot be achieved through paperwork alone, and it cannot be outsourced or automated without context.",[202,2509,2510,2511,2514],{},"Instead, due diligence depends on shared signals of trust: clear documentation, transparent processes, traceability, and active engagement with upstream projects. ",[261,2512,2513],{},"Attestations"," provide a practical way to make this cooperation visible and reusable, turning community practices into something manufacturers can rely on with confidence.",[202,2516,2517],{},"This reframes due diligence from a compliance burden into a collective responsibility, where value flows in both directions: manufacturers gain clarity and confidence, and open source projects gain recognition, support, and sustainability.",[202,2519,2520],{},[292,2521,2522,2523,487],{},"Join the conversation about due diligence in our Vulnerability Handling meetings every other Thursday starting on Feb 12 at 15.00 CET, 14.00 UTC. See our ",[240,2524,503],{"href":651,"rel":2525},[243],[271,2527,2529],{"id":2528},"why-cooperation-is-non-negotiable","Why cooperation is non-negotiable",[202,2531,2532],{},"A recurring insight across all discussions was simple but powerful: there is no sustainable path forward without cooperation.",[202,2534,2535],{},"Perhaps the most important takeaway from FOSDEM 2026 and the collocated events was the value of bringing the FOSS community together to talk openly about real use cases. Regulations like the CRA will affect everyone differently, but their success will depend on how well we understand those impacts and respond collectively.",[202,2537,2538],{},"FOSDEM reminded us that open source thrives when conversations are inclusive, grounded, and collaborative. Attestations and due diligence aren’t just compliance exercises - they’re opportunities to strengthen trust, resilience, and sustainability across our shared ecosystem.",{"title":200,"searchDepth":208,"depth":208,"links":2540},[2541,2542,2543],{"id":2449,"depth":208,"text":2450},{"id":2500,"depth":208,"text":2501},{"id":2528,"depth":208,"text":2529},{"path":2545,"title":2546,"date":2547,"author":669,"summary":190,"visibility":190,"body":2548},"\u002Fblog\u002Forc-monthly-jan2026","ORC Monthly: A Strong Start to 2026 for Open Source and CRA Compliance","2026-01-29",{"type":192,"value":2549,"toc":2728},[2550,2564,2572,2574,2646,2648,2673,2675,2685,2687,2709,2711],[202,2551,2552,2553,2558,2559,2563],{},"As we publish this month’s ORC update, the community is right in the middle of ",[240,2554,2557],{"href":2555,"rel":2556},"https:\u002F\u002Fopensourceweek.eu\u002F",[243],"Open Source Week"," in Brussels. With FOSDEM and a packed schedule of policy, compliance, and community discussions underway, the energy and relevance of our work has never been clearer. That momentum is echoed by the strong response to our ",[240,2560,258],{"href":2561,"rel":2562},"https:\u002F\u002Fwww.eclipse-foundation.events\u002Fevent\u002Fcode-compliance-2026\u002Fsummary",[243]," event, which sold out! This signals a community that is growing, engaged, and ready to build on its progress. We are starting 2026 with real traction and look forward to making some real progress on the Cyber Resilience Act (and other emerging regulations) over the coming year.",[202,2565,2566,325,2568,2570],{},[292,2567,1497],{},[1499,2569],{},[292,2571,1503],{},[271,2573,1506],{"id":273},[278,2575,2576,2587,2608,2620,2635],{},[281,2577,2578,2579,1106,2582,2586],{},"ORC has ",[261,2580,2581],{},"published its first whitepaper",[240,2583,2585],{"href":914,"rel":2584},[243],"Open Source Software Stewards and the Cyber Resilience Act",", offering practical guidance on how the CRA defines the steward role, what obligations apply, and where open questions remain. Developed collaboratively by the ORC community, the paper reflects real-world open source experience and aims to support proportionate, workable CRA implementation.",[281,2588,2589,2590,2593,2594,2599,2600,325,2602,2607],{},"The full program for the ",[240,2591,994],{"href":1484,"rel":2592},[243]," track at OCX 2026 is ",[240,2595,2598],{"href":2596,"rel":2597},"https:\u002F\u002Fwww.ocxconf.org\u002Fevent\u002F2026\u002Fagenda?categories_bb616033=bb616033-a1a8-40af-84d7-6a5c65a55830",[243],"now live",", featuring sessions that explore secure development practices, regulatory trends like the Cyber Resilience Act, and collaborative approaches to compliance within open source communities. This track brings together developers, legal experts, and industry leaders to share insights and practical guidance. ",[1499,2601],{},[240,2603,2606],{"href":2604,"rel":2605},"https:\u002F\u002Fwww.ocxconf.org\u002Fevent\u002F403bffe2-15d8-49ac-af52-e2781b7296b3\u002Fregistration",[243],"Registration is open",". We hope to see you there.",[281,2609,2610,2611,2616,2617,487],{},"We’re collecting ",[240,2612,2615],{"href":2613,"rel":2614},"https:\u002F\u002Fec.europa.eu\u002Feusurvey\u002Frunner\u002FCRA-Attestation-Survey-2026-FOSDEM",[243],"feedback from industry and open source stakeholders"," to inform the voluntary security attestation efforts. Share your perspective by completing the survey by ",[261,2618,2619],{},"February 17",[281,2621,2622,2623,2630,2631,2634],{},"Roman Zhukov and James Lovegrove’s article “",[240,2624,2627],{"href":2625,"rel":2626},"https:\u002F\u002Fthenewstack.io\u002Fmaking-the-cyber-resilience-act-work-for-open-source\u002F",[243],[292,2628,2629],{},"Making the Cyber Resilience Act Work for Open Source","” was featured in ",[292,2632,2633],{},"The New Stack",", exploring practical approaches for aligning open source stewardship and compliance with the EU’s Cyber Resilience Act and underscoring the importance of collaboration across the ecosystem as the regulation takes shape.",[281,2636,2637,2638,2641,2642,2645],{},"We’re looking to collaborate with ORC members on ",[261,2639,2640],{},"articles and thought leadership"," that help advance understanding of Cyber Resilience Act. With support from the Eclipse Foundation’s experienced writers, we’re especially eager to work with manufacturers to share real-world perspectives. Interested? ",[240,2643,393],{"href":2644},"mailto:marketing@eclipse.org"," and let’s tell these stories together.",[271,2647,1562],{"id":1561},[278,2649,2650,2661],{},[281,2651,2652,325,2658,2660],{},[240,2653,2655],{"href":2443,"rel":2654},[243],[261,2656,2657],{},"FOSDEM and EU Open Source Week 2026: Key Events for the ORC Community",[1499,2659],{},"\nLate January in Brussels has become an important moment for anyone working at the intersection of open source and European regulation. In 2026, FOSDEM and EU Open Source Week again bring together developers, maintainers, policymakers, and organisations that are actively shaping how open source is developed, distributed, and used in Europe.",[281,2662,2663,325,2670,2672],{},[240,2664,2667],{"href":2665,"rel":2666},"https:\u002F\u002Forcwg.org\u002Fblog\u002F2025-achievements\u002F",[243],[261,2668,2669],{},"The ORC Community’s 4 Biggest Achievements of 2025",[1499,2671],{},"\nAs we look back on 2025, it’s clear that this has been a year of remarkable growth and maturation for the ORC community. Our membership has expanded to 63 organisations, reflecting both the rising importance of open, collaborative security practices and the trust our stakeholders place in the work we are doing together.",[271,2674,1589],{"id":1588},[202,2676,2677],{},[240,2678,2681],{"href":2679,"rel":2680},"https:\u002F\u002Fwww.linkedin.com\u002Fposts\u002Follejohansson_cra-eucra-opensource-activity-7406608456775794688-eYHg\u002F",[243],[1597,2682],{"alt":2683,"src":2684},"Olle E Johansson's LinkedIn Finland's proposed law related to the EU Cyber Resilience Act","\u002Fblog\u002Forc-monthly-jan2026\u002Fimages\u002Fjan-overheard.png",[271,2686,1603],{"id":426},[278,2688,2689,2694,2699,2704],{},[281,2690,2691,2099],{},[240,2692,2098],{"href":2096,"rel":2693},[243],[281,2695,2696,2107],{},[240,2697,2106],{"href":2104,"rel":2698},[243],[281,2700,2701,2115],{},[240,2702,2114],{"href":2112,"rel":2703},[243],[281,2705,2706,1620],{},[240,2707,1619],{"href":1617,"rel":2708},[243],[271,2710,1659],{"id":490},[278,2712,2713,2718,2723],{},[281,2714,2715],{},[240,2716,1667],{"href":98,"rel":2717},[243],[281,2719,2720],{},[240,2721,1674],{"href":1672,"rel":2722},[243],[281,2724,2725],{},[240,2726,1680],{"href":537,"rel":2727},[243],{"title":200,"searchDepth":208,"depth":208,"links":2729},[2730,2731,2732,2733,2734],{"id":273,"depth":208,"text":1506},{"id":1561,"depth":208,"text":1562},{"id":1588,"depth":208,"text":1589},{"id":426,"depth":208,"text":1603},{"id":490,"depth":208,"text":1659},{"path":2736,"title":2657,"date":2737,"author":669,"summary":190,"visibility":190,"body":2738},"\u002Fblog\u002Ffosdem-2026","2026-01-12",{"type":192,"value":2739,"toc":2901},[2740,2752,2759,2763,2766,2779,2782,2793,2796,2800,2813,2816,2820,2833,2836,2839,2843,2853,2857,2869,2873,2898],[202,2741,2742,2743,1720,2747,2751],{},"Late January in Brussels has become an important moment for anyone working at the intersection of open source and European regulation. In 2026, ",[240,2744,1725],{"href":2745,"rel":2746},"https:\u002F\u002Ffosdem.org\u002F2026\u002F#",[243],[240,2748,2750],{"href":2555,"rel":2749},[243],"EU Open Source Week"," again bring together developers, maintainers, policymakers, and organisations that are actively shaping how open source is developed, distributed, and used in Europe.",[202,2753,2754,2755,2758],{},"For the ORC community, this week is particularly relevant. The ",[261,2756,2757],{},"Cyber Resilience Act (CRA)"," is moving from interpretation to implementation, and many of the conversations happening during this week focus on what that means in practice.",[271,2760,2762],{"id":2761},"key-events-for-the-orc-community","Key Events for the ORC Community",[903,2764,258],{"id":2765},"code-compliance",[202,2767,2768,2769,2774,2775,2778],{},"As part of EU Open Source Week, ",[240,2770,2772],{"href":2561,"rel":2771},[243],[261,2773,258],{}," takes place on ",[261,2776,2777],{},"Thursday, 29 January"," in Brussels. It is a focused, in-person event that brings together open source communities, industry, and policy experts to discuss compliance challenges in a concrete, technical way.",[202,2780,2781],{},"Discussions focus on topics such as:",[278,2783,2784,2787,2790],{},[281,2785,2786],{},"How open source projects and downstream users can align on security and compliance expectations",[281,2788,2789],{},"The roles and responsibilities of different actors in the open source supply chain",[281,2791,2792],{},"How collaboration between communities, industry, and regulators can reduce friction while improving software security",[202,2794,2795],{},"For the ORC community, this event provides a focused starting point for discussions grounded in real project experience.",[903,2797,2799],{"id":2798},"fosdem-cra-in-practice","FOSDEM: CRA in Practice",[202,2801,2802,2803,2808,2809,2812],{},"At FOSDEM itself, the “",[240,2804,2807],{"href":2805,"rel":2806},"https:\u002F\u002Ffosdem.org\u002F2026\u002Fschedule\u002Ftrack\u002Fcra-in-practice\u002F",[243],"CRA in practice","” devroom on ",[261,2810,2811],{},"Saturday, 31 January"," is one of the most relevant spaces for our community.",[202,2814,2815],{},"This devroom focuses on how the CRA is affecting open source projects today — not in theory, but in code, processes, and governance. Talks and discussions focus on maintainers and contributors who are actively adapting their projects to new regulatory expectations.",[903,2817,2819],{"id":2818},"fosdem-open-source-eu-policy","FOSDEM: Open Source & EU Policy",[202,2821,2822,2823,2826,2827,2832],{},"On ",[261,2824,2825],{},"Sunday, 1 February",", the ",[240,2828,2831],{"href":2829,"rel":2830},"https:\u002F\u002Ffosdem.org\u002F2026\u002Fschedule\u002Ftrack\u002Fopen-source-eu-policy\u002F",[243],"Open Source & EU Policy devroom"," provides a broader policy context.",[202,2834,2835],{},"This devroom brings developers and policymakers into the same conversation. It covers the CRA, but also situates it alongside other EU initiatives that affect open source, such as standardisation, software liability, and digital sovereignty.",[202,2837,2838],{},"This devroom helps clarify why certain policy choices are being made and how community voices can influence outcomes.",[903,2840,2842],{"id":2841},"global-vulnerability-intelligence-platform-gvip-summit","Global Vulnerability Intelligence Platform (GVIP) Summit",[202,2844,609,2845,2774,2849,2852],{},[240,2846,2842],{"href":2847,"rel":2848},"https:\u002F\u002Fwww.gvip-project.org\u002F",[243],[261,2850,2851],{},"Wednesday, 28 January"," in Brussels. The Summit focuses on the rapidly changing landscape of vulnerability information and the challenges facing long-standing systems around funding, scalability, trust, and governance. GVIP brings together a global, multi-stakeholder community to discuss how vulnerability intelligence can remain openly available, reliable, and sustainable over the long term. The ORC Working Group is sponsoring the event, reflecting its interest in strengthening shared approaches to security, governance, and compliance across the open source ecosystem.",[903,2854,2856],{"id":2855},"foss-license-and-security-compliance-tools-workshop","FOSS license and security compliance tools workshop",[202,2858,2859,2860,2863,2864,2868],{},"A one-day workshop on open source licenses and security compliance will take place on ",[261,2861,2862],{},"Friday, 30 January",". The ",[240,2865,2856],{"href":2866,"rel":2867},"https:\u002F\u002Fworkshop.aboutcode.org\u002F",[243]," brings together developers, users, and contributors of open source compliance tools to exchange requirements, share plans, and identify collaboration opportunities. It will focus on tools and practices supporting software provenance, vulnerability management, license detection, SBOM creation and consumption, dependency and container analysis, code scanning, and regulatory compliance, including the Cyber Resilience Act.",[903,2870,2872],{"id":2871},"other-events-during-eu-open-source-week","Other Events During EU Open Source Week",[202,2874,2875,2876,2881,2882,244,2884,2889,2890,2892,2893,487],{},"The week also includes broader policy-focused events such as the ",[240,2877,2880],{"href":2878,"rel":2879},"https:\u002F\u002Fsummit.openforumeurope.org\u002F",[243],"EU Open Source Policy Summit"," on ",[261,2883,2862],{},[240,2885,2888],{"href":2886,"rel":2887},"https:\u002F\u002Fawards.europeanopensource.academy\u002F",[243],"European Open Source Awards"," on the evening of ",[261,2891,2777],{},". While not core ORC events, they provide useful context for the wider discussions taking place and recognise the contributions and achievements of the open source community over the past year. A full overview of additional activities throughout the week is available at ",[240,2894,2897],{"href":2895,"rel":2896},"http:\u002F\u002Fopensourceweek.eu",[243],"opensourceweek.eu",[202,2899,2900],{},"If you are involved in ORC or the broader open source community, this week offers a concentrated view of where open source and regulation are heading and how we can shape that direction together. We hope to see you there!",{"title":200,"searchDepth":208,"depth":208,"links":2902},[2903],{"id":2761,"depth":208,"text":2762,"children":2904},[2905,2906,2907,2908,2909,2910],{"id":2765,"depth":1073,"text":258},{"id":2798,"depth":1073,"text":2799},{"id":2818,"depth":1073,"text":2819},{"id":2841,"depth":1073,"text":2842},{"id":2855,"depth":1073,"text":2856},{"id":2871,"depth":1073,"text":2872},{"path":2912,"title":2669,"date":2913,"author":669,"summary":190,"visibility":190,"body":2914},"\u002Fblog\u002F2025-achievements","2025-12-19",{"type":192,"value":2915,"toc":2984},[2916,2919,2922,2926,2934,2938,2946,2950,2963,2967,2981],[202,2917,2918],{},"As we look back on 2025, it’s clear that this has been a year of remarkable growth and maturation for the ORC community. Our membership has expanded to 63 organisations, reflecting both the rising importance of open, collaborative security practices and the trust our stakeholders place in the work we are doing together.",[202,2920,2921],{},"Over the past year, we have built greater clarity around the Cyber Resilience Act (CRA) and its implications for open source development. Through open dialogue, shared expertise, and a commitment to transparency, our community has refined how we work together. We have introduced clearer processes, improved cross-organisational coordination, and established more predictable pathways for collaboration. This has helped us make considerable progress on many of our key deliverables in 2025, including:",[271,2923,2925],{"id":2924},"_1-faq","1. FAQ",[202,2927,2928,2929,2933],{},"New regulations inevitably raise questions about scope, responsibilities, and real-world impact. Throughout 2025, the ORC community worked collaboratively to develop a comprehensive set of frequently asked questions addressing how the Cyber Resilience Act applies to open source software. This FAQ was shaped by shared expertise and practical experience from across the community and is now available on a ",[240,2930,2932],{"href":91,"rel":2931},[243],"community-built website",", making it easier to access, navigate, and understand for a broad audience.",[271,2935,2937],{"id":2936},"_2-voluntary-security-attestations","2. Voluntary Security Attestations",[202,2939,2940,2941,2945],{},"Launching the ",[240,2942,2944],{"href":1358,"rel":2943},[243],"voluntary security attestations project"," marked an important milestone for the ORC community in 2025. Together, we defined the scope of the work and surfaced key challenges and considerations, including legal, technical, and operational aspects. These discussions were further advanced during a dedicated workshop at Code & Compliance in October, providing valuable input and alignment. As a result, the community is now well-positioned to continue developing this work in 2026.",[271,2947,2949],{"id":2948},"_3-active-engagement-supporting-institutions-in-the-cra-implementation","3. Active engagement supporting institutions in the CRA implementation",[202,2951,2952,2953,2957,2958,1842],{},"One of our most impactful achievements in the first half of 2025 was establishing a clear and effective process for providing coordinated feedback to regulatory bodies. Throughout the year, the ORC community submitted ",[240,2954,2956],{"href":2299,"rel":2955},[243],"multiple contributions",", ensuring that open source perspectives were represented in regulatory discussions at all levels. Several of these inputs have already been reflected in official materials, demonstrating the tangible influence of community-led collaboration (ex. ",[240,2959,2962],{"href":2960,"rel":2961},"https:\u002F\u002Forcwg.org\u002Fblog\u002Ftechnical-description-milestone\u002F",[243],"Technical definitions milestone",[271,2964,2966],{"id":2965},"_4-stewards-and-the-cra-white-paper","4. Stewards and the CRA white paper",[202,2968,2969,2970,2975,2976,2980],{},"In the latter part of 2025, the ORC community prepared its first white paper focused on ",[240,2971,2974],{"href":2972,"rel":2973},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg\u002Fblob\u002Fmain\u002Fcyber-resilience-sig\u002Fwhitepapers\u002Fstewards-and-cra.md",[243],"open source software stewards and the Cyber Resilience Act",". This significant effort brought together our community experts working openly in GitHub and in the open meetings ORC community organises, reflecting the collaborative spirit of the community. To broaden its reach and accessibility, the final paper will be published as a PDF on the ",[240,2977,29],{"href":2978,"rel":2979},"http:\u002F\u002Forcwg.org",[243]," website, supporting those seeking a deeper understanding of the CRA and its implications.",[202,2982,2983],{},"As we close out the year, we can be proud not only of what we accomplished, but how we accomplished it. Our progress in 2025 shows the strength of a community that is willing to learn, adapt, and lead together. With a solid foundation, clearer processes, and an engaged membership continuing to grow, the ORC is entering 2026 with momentum. The work ahead is significant, but so is our collective capacity, and we look forward to building on this year’s achievements to support an even stronger open source ecosystem in the years to come.",{"title":200,"searchDepth":208,"depth":208,"links":2985},[2986,2987,2988,2989],{"id":2924,"depth":208,"text":2925},{"id":2936,"depth":208,"text":2937},{"id":2948,"depth":208,"text":2949},{"id":2965,"depth":208,"text":2966},{"path":2991,"title":2992,"date":2993,"author":669,"summary":190,"visibility":190,"body":2994},"\u002Fblog\u002Forc-monthly-dec2025","ORC Monthly: Celebrating a successful 2025!","2025-12-09",{"type":192,"value":2995,"toc":3240},[2996,2999,3002,3010,3012,3101,3103,3113,3115,3152,3154,3180,3182,3198,3202,3205,3221,3223],[202,2997,2998],{},"As we wrap up 2025, it’s remarkable to look back at how far the ORC community has come since January. What started as a year shaped by uncertainty transformed into one defined by collaboration, expertise-sharing, and a rapidly growing ecosystem (we now have more than 60 members!). From engaging sessions at Code & Compliance to our community’s growing influence in EU policy discussions, 2025 has proven just how essential an open, collaborative approach to regulatory readiness truly is.",[202,3000,3001],{},"We close out the year with deep gratitude and strong momentum heading into 2026.",[202,3003,3004,325,3006,3008],{},[292,3005,1497],{},[1499,3007],{},[292,3009,1503],{},[271,3011,1506],{"id":273},[278,3013,3014,3045,3063],{},[281,3015,3016,3023,3024,3038,3040],{},[261,3017,3018,3019,1046],{},"Registration is open for ",[240,3020,3022],{"href":2561,"rel":3021},[243],"Code & Compliance FOSDEM edition"," Join us in Brussels 29 January 2026 ahead of FOSDEM. The program is coming together nicely and will feature 4 key blocks:",[278,3025,3026,3029,3032,3035],{},[281,3027,3028],{},"ORC’s Compliance Materials: How the open source community is cooperating to build compliance",[281,3030,3031],{},"Compliance for Manufacturers",[281,3033,3034],{},"Simplifying Due Diligence: Attestations, Open Source, and Your Path to Faster, Safer Compliance",[281,3036,3037],{},"CRA & the AI Act for Manufacturers",[1499,3039],{},[240,3041,3044],{"href":3042,"rel":3043},"https:\u002F\u002Fwww.eclipse-foundation.events\u002Fevent\u002Fcode-compliance-2026\u002FregProcessStep1",[243],"Register to join us!",[281,3046,3047,3048],{},"If you’ll be at FOSDEM, make sure to catch these two devrooms closely aligned with ORC’s work:",[278,3049,3050,3056],{},[281,3051,3052,3053],{},"Saturday 31 January 2026: ",[240,3054,2807],{"href":2805,"rel":3055},[243],[281,3057,3058,3059],{},"Sunday 1 February 2026: ",[240,3060,3062],{"href":2829,"rel":3061},[243],"Open Source & EU Policy",[281,3064,3065,3068,3069,3072,3073,3077,3078,3081,3082,3096,3098,2607],{},[261,3066,3067],{},"Register for OCX 2026:"," OCX, the Eclipse Foundation’s annual flagship conference, is coming to Brussels ",[261,3070,3071],{},"21–23 April 2026",". This year includes ",[240,3074,994],{"href":3075,"rel":3076},"https:\u002F\u002Fwww.ocxconf.org\u002Fevent\u002F403bffe2-15d8-49ac-af52-e2781b7296b3\u002Fopen-community-for-compliance",[243],", developed ",[292,3079,3080],{},"by and for"," the ORC community, featuring talks on:",[278,3083,3084,3087,3090,3093],{},[281,3085,3086],{},"collaborative approaches to regulatory readiness",[281,3088,3089],{},"secure development practices",[281,3091,3092],{},"lessons from early CRA implementation",[281,3094,3095],{},"community-driven tooling and best practices",[1499,3097],{},[240,3099,2606],{"href":2604,"rel":3100},[243],[271,3102,1589],{"id":1588},[202,3104,3105],{},[240,3106,3109],{"href":3107,"rel":3108},"https:\u002F\u002Fwww.linkedin.com\u002Fposts\u002Fdigital-resilience-forum_digitalresilienceforum-drf2025-panel-activity-7389429779692744704-uBtb?utm_source=share&utm_medium=member_desktop&rcm=ACoAAAYPUqEBp0WKWGph_vgaFZs7BihQcqkB-_o",[243],[1597,3110],{"alt":3111,"src":3112},"Digital Resilience Forum's LinkedIn post about their Securing the Digital Supply Chain panel","\u002Fblog\u002Forc-monthly-dec2025\u002Fimages\u002Fdec-overheard.png",[271,3114,400],{"id":397},[278,3116,3117,3129,3141],{},[281,3118,3119,325,3126,3128],{},[240,3120,3123],{"href":3121,"rel":3122},"https:\u002F\u002Forcwg.org\u002Fblog\u002Fmanufacturer-cra-adrian-osullivan\u002F",[243],[261,3124,3125],{},"The CRA’s Global Impact: Why Manufacturers Hold the Key",[1499,3127],{},"\nHuawei becomes the first of our strategic members to share their perspective in this ORC blog. Adrian O’Sullivan explores how manufacturers are preparing for CRA obligations and why open collaboration is key.",[281,3130,3131,325,3138,3140],{},[240,3132,3135],{"href":3133,"rel":3134},"https:\u002F\u002Forcwg.org\u002Fblog\u002Ftime-to-speak-simon-phipps\u002F",[243],[261,3136,3137],{},"Time to speak: Contributing to the CRA Standards feedback process",[1499,3139],{},"\nSimon Phipps urges the open source community to more actively shape regulatory outcomes, advocating for unified engagement on policy that affects developers and open source sustainability.",[281,3142,3143,325,3149,3151],{},[240,3144,3146],{"href":2960,"rel":3145},[243],[261,3147,3148],{},"Moving Forward with Clear Technical Definitions Under the CRA",[1499,3150],{},"\nThe European Commission has just published the Implementing Regulation defining the technical description of “important” and “critical” products with digital elements under the Cyber Resilience Act (CRA). In this new blog, Juan Rico breaks down why this matters for open source and ORC’s role moving forward.",[271,3153,1603],{"id":426},[278,3155,3156,3163,3170,3175],{},[281,3157,3158,3162],{},[240,3159,258],{"href":3160,"rel":3161},"https:\u002F\u002Fwww.eclipse-foundation.events\u002Fevent\u002Fcode-compliance-2026",[243]," | 29 January 2026",[281,3164,3165,3169],{},[240,3166,1725],{"href":3167,"rel":3168},"https:\u002F\u002Ffosdem.org\u002F2026\u002F",[243]," | 31 January - 1 February 2026",[281,3171,3172,2107],{},[240,3173,2106],{"href":2104,"rel":3174},[243],[281,3176,3177,1620],{},[240,3178,1619],{"href":1617,"rel":3179},[243],[271,3181,1640],{"id":1639},[278,3183,3184,3191],{},[281,3185,3186],{},[240,3187,3190],{"href":3188,"rel":3189},"https:\u002F\u002Fyoutu.be\u002FG37gXO0KG6I",[243],"CRA Mondays | When Disclosure Fails: Europe’s Struggle with CVD",[281,3192,3193],{},[240,3194,3197],{"href":3195,"rel":3196},"https:\u002F\u002Fyoutu.be\u002F_fGOgByN08c",[243],"CRA Mondays | OSS provenance and code signing: how SignPath Foundation guarantees software integrity for its member projects",[271,3199,3201],{"id":3200},"welcome-orc-members","Welcome ORC Members",[202,3203,3204],{},"The following members joined in November 2025:",[278,3206,3207,3214],{},[281,3208,3209],{},[240,3210,3213],{"href":3211,"rel":3212},"https:\u002F\u002Fsignpath.org\u002F",[243],"SignPath Foundation",[281,3215,3216],{},[240,3217,3220],{"href":3218,"rel":3219},"https:\u002F\u002Fopennebula.io\u002F",[243],"OpenNebula Systems",[271,3222,1659],{"id":490},[278,3224,3225,3230,3235],{},[281,3226,3227],{},[240,3228,1667],{"href":98,"rel":3229},[243],[281,3231,3232],{},[240,3233,1674],{"href":1672,"rel":3234},[243],[281,3236,3237],{},[240,3238,1680],{"href":537,"rel":3239},[243],{"title":200,"searchDepth":208,"depth":208,"links":3241},[3242,3243,3244,3245,3246,3247,3248],{"id":273,"depth":208,"text":1506},{"id":1588,"depth":208,"text":1589},{"id":397,"depth":208,"text":400},{"id":426,"depth":208,"text":1603},{"id":1639,"depth":208,"text":1640},{"id":3200,"depth":208,"text":3201},{"id":490,"depth":208,"text":1659},{"path":3250,"title":3148,"date":3251,"author":669,"summary":190,"visibility":190,"body":3252},"\u002Fblog\u002Ftechnical-description-milestone","2025-12-03",{"type":192,"value":3253,"toc":3370},[3254,3269,3272,3278,3282,3285,3288,3291,3309,3313,3316,3327,3330,3334,3337,3340,3354,3357],[202,3255,3256,3257,3260,3261,3263,3264,487],{},"The European Commission has just published the Implementing Regulation defining the ",[292,3258,3259],{},"technical description"," of “important” and “critical” products with digital elements under the Cyber Resilience Act (CRA).",[1499,3262],{},"\nYou can find the full text here: ",[240,3265,3268],{"href":3266,"rel":3267},"https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg_impl\u002F2025\u002F2392\u002Foj",[243],"Regulation (EU) 2025\u002F2392 – Technical Description of Important and Critical Products",[202,3270,3271],{},"This is a significant moment in the CRA journey. For the first time, manufacturers, integrators, and open source communities have a clear, legally binding definition of which technologies fall into the higher-risk categories. For anyone building or maintaining software used across Europe, this clarity matters.",[202,3273,3274,3275],{},"From the perspective of the Open Regulatory Compliance (ORC) Working Group, this regulation is especially important for one reason: ",[261,3276,3277],{},"it finally gives open source stewards and maintainers the information they need to understand where their work fits within the CRA framework.",[271,3279,3281],{"id":3280},"why-this-matters-for-open-source","Why this matters for open source",[202,3283,3284],{},"Many of the technologies listed as “important” are widely built, maintained, or influenced by open source communities: browsers, operating systems, VPN clients, identity systems, network tools, package managers, secure-element firmware… the list is long.",[202,3286,3287],{},"Until now, projects had to guess whether they would be treated as “important” under the CRA, and uncertainty is never a good foundation for long-term planning.",[202,3289,3290],{},"This new regulation does two things:",[1705,3292,3293,3301],{},[281,3294,3295,3298,3300],{},[261,3296,3297],{},"It removes ambiguity.",[1499,3299],{},"\nProjects now know whether their core functionality matches a regulated category. This helps maintainers and foundations anticipate documentation needs, security-process expectations, and integration paths for manufacturers who rely on their work.",[281,3302,3303,3306,3308],{},[261,3304,3305],{},"It reinforces the need for structured governance in these cases.",[1499,3307],{},"\nAs CRA obligations become clearer, open source projects will increasingly depend on strong governance, documented processes, and reliable vulnerability-handling mechanisms. This is exactly why ORC exists: to help communities and ecosystems prepare without overwhelming individual contributors.",[271,3310,3312],{"id":3311},"the-practical-impact-for-foss-projects","The Practical Impact for FOSS Projects",[202,3314,3315],{},"With the technical descriptions officially published:",[278,3317,3318,3321,3324],{},[281,3319,3320],{},"Open source projects can start aligning documentation, security policies, SBOM workflows, and governance practices with the CRA reality.",[281,3322,3323],{},"Foundations and stewards gain a clearer mandate to provide structured processes that manufacturers can trust.",[281,3325,3326],{},"Manufacturers now have an easier path to determine when and how they can rely on open source components in regulated contexts.",[202,3328,3329],{},"Open source will play a central role in CRA compliance, but only if communities can demonstrate predictable, transparent, and trustworthy security practices. Regulation (EU) 2025\u002F2392 gives us a shared starting point.",[271,3331,3333],{"id":3332},"orcs-role-moving-forward","ORC’s role moving forward",[202,3335,3336],{},"At ORC, we’ve spent the last year working to ensure that open source perspectives are reflected in CRA implementation. This new regulation includes elements that our community actively contributed to, a small but meaningful sign that the European Commission understands the importance of open source in Europe’s digital infrastructure.",[202,3338,3339],{},"Now the real work begins:",[278,3341,3342,3345,3348,3351],{},[281,3343,3344],{},"refining our guidance, including the due diligence processes for manufacturers integrating open source technologies,",[281,3346,3347],{},"expanding community-driven best practices,",[281,3349,3350],{},"maturing the attestation model under Article 25,",[281,3352,3353],{},"and supporting maintainers and stewards as they navigate the new landscape.",[202,3355,3356],{},"The publication of these technical descriptions is not the end of the discussion; it’s the beginning of coordinated, practical implementation. Open source is part of Europe’s backbone, and the CRA gives us an opportunity to reinforce that role with clarity, structure, and shared responsibility.",[202,3358,3359,3360,3365,3366,487],{},"If you care about the future of open source in Europe, this is the moment to get involved. The ORC Working Group is already deep into the practical work. ",[240,3361,3364],{"href":3362,"rel":3363},"https:\u002F\u002Forcwg.org\u002Fparticipate\u002F",[243],"Be part of our regular discussions"," and join our events, like ",[240,3367,3369],{"href":2561,"rel":3368},[243],"Code and Compliance FOSDEM Edition",{"title":200,"searchDepth":208,"depth":208,"links":3371},[3372,3373,3374],{"id":3280,"depth":208,"text":3281},{"id":3311,"depth":208,"text":3312},{"id":3332,"depth":208,"text":3333},{"path":3376,"title":3377,"date":3378,"author":669,"summary":190,"visibility":190,"body":3379},"\u002Fblog\u002Fcra-monday-piet-devaere","When Disclosure Fails: Europe’s Struggle with CVD | CRA Monday","2025-11-27",{"type":192,"value":3380,"toc":3405},[3381,3388,3391,3394,3397,3400],[202,3382,3383,3384,3387],{},"In this week’s CRA Monday session, we welcomed security consultant ",[261,3385,3386],{},"Piet De Vaere"," for a thought-provoking talk on the realities of coordinated vulnerability disclosure (CVD) in Europe.",[202,3389,3390],{},"Pete opened with a real incident from earlier this year, when he discovered a flaw in his bank’s online-banking login flow. The issue, rooted in how concurrent login requests are handled, could allow an attacker to hijack a user’s banking session with almost no visible warning. His walkthrough shows how even seemingly simple authentication flows can conceal serious design vulnerabilities.",[202,3392,3393],{},"But the technical bug was only half the story. Pete then shared the unexpected challenges he faced when trying to report it — from mandatory ID-verification requirements to NDA-style disclosure terms and stalled communication with both the bank and the national CERT. His experience highlights how current CVD processes, even under NIS2 and the evolving CRA landscape, can unintentionally discourage responsible reporting.",[202,3395,3396],{},"To move forward, Pete suggests rethinking CVD policies as commitments from organisations (not rulebooks imposed on reporters) and encourages the open source community and European institutions to explore better disclosure practices together.",[202,3398,3399],{},"You can watch the full recording below:",[3401,3402],"youtube",{"description":3403,"id":3404,"title":3190,"uploadDate":3378},"Coordinated Vulnerability Disclosure (CVD) is written into NIS2 and the Cyber Resilience Act as a cornerstone of Europe’s cybersecurity policy. In practice, though, the system is failing. When Piet De Vaere, Product Cybersecurity Consultant, reported a vulnerability in a major Belgian bank through the official channels, he was met with bureaucracy, legal threats, and a total lack of technical engagement; both from both the bank and Belgium’s national cybersecurity authority. What should have been a routine disclosure turned into a long standoff that perfectly illustrates how Europe’s CVD framework is broken.","G37gXO0KG6I",{"title":200,"searchDepth":208,"depth":208,"links":3406},[],{"path":3408,"title":3409,"date":3410,"author":3411,"summary":190,"visibility":190,"body":3412},"\u002Fblog\u002Fstewards-cra-wp","Understanding Open Source Stewards and the Cyber Resilience Act","2025-11-12","Marta Rybczynska",{"type":192,"value":3413,"toc":3541},[3414,3422,3425,3428,3432,3435,3438,3441,3444,3455,3458,3462,3465,3473,3477,3484,3518,3528,3535,3538],[202,3415,3416,3417,3421],{},"The “",[240,3418,3420],{"href":2972,"rel":3419},[243],"Open Source Stewards and the Cyber Resilience Act","” white paper explores a new role introduced by the EU Cyber Resilience Act (CRA): the open source steward. This is a newly introduced actor that doesn’t fit neatly into the existing categories of manufacturers or distributors but still carries specific obligations under the CRA.",[202,3423,3424],{},"Open source stewards are organisations, such as foundations, non-profits, or companies, that support open source projects without directly commercialising them. Because this role has never been formally defined before, there are many questions about what responsibilities stewards have and how those responsibilities interact with open source development practices.",[202,3426,3427],{},"This white paper aims to bring clarity to the topic. It outlines what open source stewards need to understand about their obligations, what processes may need to evolve, and where more discussion is needed.",[271,3429,3431],{"id":3430},"why-this-whitepaper-is-needed","Why This Whitepaper Is Needed",[202,3433,3434],{},"The CRA was written with traditional manufacturing and software supply chains in mind, not the collaborative, decentralised nature of open source.",[202,3436,3437],{},"The addition of the “Open Source Software Steward” role came after long discussions between legislators and the open source community. It is a step forward, but it is not always clear how the reality of software development can fit the requirements.",[202,3439,3440],{},"For example, in its current form, the legislation assumes a model where the steward imposes policies on a project. In reality, many open source projects create and maintain their own security policies, with stewards providing coordination and infrastructure rather than direction. Another example is the definition of the security policy, which under the CRA includes different elements than what projects had established and used for years.",[202,3442,3443],{},"Through community discussions, it became clear that such cases require explanation and an attempt to find a process that will both satisfy legal requirements and the typical workflows. The white paper is meant to:",[278,3445,3446,3449,3452],{},[281,3447,3448],{},"Help stewards and the projects they support understand how they will work together to comply with the CRA.",[281,3450,3451],{},"Highlight the nuances of steward–project relationships that regulators may not have fully anticipated.",[281,3453,3454],{},"Provide context for policymakers, manufacturers, and notified bodies on how open source stewards fit into the CRA ecosystem.",[202,3456,3457],{},"It’s both a practical reference for today’s stewards and a reference point for regulators as they interpret and implement the law.",[271,3459,3461],{"id":3460},"what-weve-done-so-far","What We’ve Done So Far",[202,3463,3464],{},"The work began with an empty file and the goal of mapping every article of the CRA that references open source stewards. From there, the group identified a series of key topics that needed attention, including security policy, integration with CSIRTs and notified bodies, and the handling of voluntary and mandatory vulnerability notifications.",[202,3466,3467,3468,3472],{},"As of now, the group has produced a ",[240,3469,3471],{"href":2972,"rel":3470},[243],"first draft of the white paper",", which is open for community review. Everyone interested in the topic is invited to read and provide feedback.",[271,3474,3476],{"id":3475},"how-to-get-involved","How to Get Involved",[202,3478,3479,3480,3483],{},"If you have about ",[261,3481,3482],{},"15 minutes",", that’s all it takes to read the document and share your thoughts. You can comment directly via:",[278,3485,3486,3494,3503],{},[281,3487,3488,2881,3491],{},[261,3489,3490],{},"Pull requests or issues",[240,3492,525],{"href":2972,"rel":3493},[243],[281,3495,3496,3499,3500,1842],{},[261,3497,3498],{},"Discussion at the Vulnerability Handling Task Force,"," which meets every second Thursday (see the ",[240,3501,503],{"href":651,"rel":3502},[243],[281,3504,3505,325,3508,325,3514,3517],{},[261,3506,3507],{},"The",[261,3509,3510],{},[240,3511,3513],{"href":515,"rel":3512},[243],"ORC Slack",[261,3515,3516],{},"channel #tf-vulnerability-handling",", where ongoing conversations take place.",[202,3519,3520,3521,3524,3525,487],{},"The goal is to finalise the white paper by ",[261,3522,3523],{},"November 30, 2025",", with all feedback submitted by ",[261,3526,3527],{},"November 20",[202,3529,3530,3531,3534],{},"We’re also actively looking for ",[261,3532,3533],{},"additional resources or references"," about open source stewardship. If you know of relevant studies, papers, or examples, please share them so that we can build a more comprehensive picture and ensure the community speaks with one clear voice.",[202,3536,3537],{},"After this review round, the group plans to incorporate community input, polish the text, and publish the final version. Future updates may follow once open questions are resolved.",[202,3539,3540],{},"If you’re new to the topic, this is an excellent time to get involved. Whether you’re part of an open source project, a steward organisation, or a manufacturer working with open source software, your insights can help shape how the CRA is interpreted and implemented in practice.",{"title":200,"searchDepth":208,"depth":208,"links":3542},[3543,3544,3545],{"id":3430,"depth":208,"text":3431},{"id":3460,"depth":208,"text":3461},{"id":3475,"depth":208,"text":3476},{"path":3547,"title":3125,"date":3548,"author":3549,"summary":190,"visibility":190,"body":3550},"\u002Fblog\u002Fmanufacturer-cra-adrian-osullivan","2025-11-04","Adrian O’Sullivan",{"type":192,"value":3551,"toc":3680},[3552,3557,3560,3563,3569,3572,3581,3588,3592,3598,3603,3607,3613,3616,3619,3649,3656,3660,3663,3666,3669,3674,3677],[202,3553,3554],{},[261,3555,3556],{},"The idea of regulating open source software is likely to spark anxiety, especially when it touches on security. But in this case, much of that worry is misplaced. The Cyber Resilience Act (CRA) was carefully drafted so that the weight of compliance falls primarily on manufacturers – those of us monetising products built on open source – not on the open source community itself. Its intent is clear: to make products more secure, protecting everyday consumers like you and me. While there may have been some initial apprehension, the CRA in its current, revised version ultimately represents an opportunity, not a threat.",[202,3558,3559],{},"The Cyber Resilience Act (CRA), even though it is a European Regulation, has a truly global impact. For an organisation such as Huawei, which is headquartered outside of Europe but sell products with digital elements (PDEs) in Europe, the CRA applies to us.. As anyone who works in international markets knows, you must follow the laws of the land. For Huawei, when we sell to the European market, we work closely with our product delivery teams to ensure our products comply with the local requirements. While local regulations are nothing new, the CRA’s impact is truly global, not only for multinational manufacturers, but also because it extends to open source, which is inherently global.",[202,3561,3562],{},"As someone who has worked with open source software for the majority of my career, I quickly saw the implications of the CRA on OSS. For example, if a European company consumes an open source project hosted outside of Europe into a product, that connection brings the project under the CRA’s scope. Whether the project is under a foundation acting as an open source software steward or maintained by individuals, what matters isn’t where the project is based, but where the product is used. That’s why the CRA’s impact is global. Early on, I noticed a wave of fear, with some open source community members even taking down their projects. Confronted with headlines about hefty fines – up to €15 million or 2.5% of revenue – they wondered whether they themselves could be held liable.",[202,3564,3565,3566],{},"The good news is that the open source community engaged early and helped shape the CRA so that, in its current form, it should not be seen as a threat. On the contrary, ",[261,3567,3568],{},"it has the potential to strengthen consumer trust in open source.",[202,3570,3571],{},"Let me explain.",[202,3573,3574,3575,3580],{},"When the early conversations around Open Regulatory Compliance working group began, I was already deeply involved in the Eclipse Foundation through the ",[240,3576,3579],{"href":3577,"rel":3578},"https:\u002F\u002Foniroproject.org\u002F",[243],"Oniro"," Working Group, which I had joined from its inception. From the outset, I was aware of the effort, but my interest grew as it became clear what this work aimed to achieve: building consensus. After all, we were all reading the Cyber Resilience Act, but not everyone is a lawyer, a standards specialist, or a policy expert",[202,3582,609,3583,3587],{},[240,3584,3586],{"href":892,"rel":3585},[243],"Eclipse Open Regulatory Compliance"," Working Group provided a space where we could collectively interpret the text, ask the right questions, and align our understanding. A good example is the FAQ we developed. I led the manufacturer section in one of the first meetups, gathering perspectives from different manufacturers on issues like what “open source due diligence” really means in practice. That kind of input has shaped key deliverables, from a planned white paper on security attestations to ongoing work on manufacturer responsibilities. Not every question has a final answer yet – some are marked as open in the FAQ as they depend on forthcoming standards and guidelines – but the process itself has been invaluable.",[271,3589,3591],{"id":3590},"in-the-end-we-are-all-trying-to-solve-the-same-problem","In the end, we are all trying to solve the same problem",[202,3593,3594,3595,3597],{},"What matters is that this is a community effort. Instead of each of us trying to navigate the CRA in isolation, we’re working together to share interpretations, resolve uncertainties, and ultimately ensure a stronger, shared understanding.",[1499,3596],{},"\nOne of the key points for manufacturers is that many of us rely on the same open source components. We’re all building products on top of a shared code base, which means we’re facing the same challenges. Instead of each of us trying to solve them alone, it makes sense to build consensus – especially when it comes to understanding how to meet the obligations of the Cyber Resilience Act while incorporating those open source components into our products. In the end, we’re all trying to solve the same problem. So it’s better to join forces rather than each of us repeating the same work.",[202,3599,3600],{},[261,3601,3602],{},"Ultimately, it is this joint effort – by manufacturers, open source stewards, and other stakeholders with real skin in the game – that will help build consumer trust in open source.",[271,3604,3606],{"id":3605},"knowledge-is-power","Knowledge is power",[202,3608,3609,3610,487],{},"So how do we share the good news and put CRA fears to rest? The answer lies in ",[261,3611,3612],{},"education",[202,3614,3615],{},"At recent conferences, I was surprised to meet people in large global organisations who had never even heard of it. It was a clear reminder that awareness cannot be taken for granted.",[202,3617,3618],{},"Here is what I recommend:",[278,3620,3621,3627,3633,3639],{},[281,3622,3623,3626],{},[261,3624,3625],{},"Internal communication plans and training programs"," are essential, tailored to the needs of each department since the CRA touches everyone.",[281,3628,3629,3632],{},[261,3630,3631],{},"Securing buy-in from senior leadership"," is especially important, because once executives understand the real obligations and potential financial penalties, they will prioritise giving teams the time and space to engage. At Huawei, we’ve been fortunate to have strong support from senior leadership right from the start. Their buy-in has been crucial in ensuring that all internal organisations are aligned and engaged. That’s something I would recommend to any manufacturer, regardless of size, even if you’re a company of just 50 people.",[281,3634,3635,3638],{},[261,3636,3637],{},"Securing buy-in across departments"," is also relevant, because requirements under the CRA extend to areas that might not expect it, such as technical documentation. Technical writers, for example, will face new standards that affect how documentation must be produced. Without leadership support, it’s difficult to bring everyone on board. Clear communication across the organisation is therefore vital to ensure that every team understands and meets its obligations.",[281,3640,3641,3644,3645,3648],{},[261,3642,3643],{},"Targeted education"," is key: creating multiple training formats at different levels – from quick, high-level briefings to detailed, department-specific materials – so that every team, whether it’s engineering, compliance, or technical documentation, understands what’s required of them. This is also where ",[261,3646,3647],{},"community resources and knowledge sharing are invaluable",", providing shared assets that organisations can adapt to educate their own people.",[202,3650,3651,3652,3655],{},"In short, ",[261,3653,3654],{},"internal training programs, securing buy-in, and tailoring training"," are the pillars of ensuring organisations are truly prepared for the CRA.",[271,3657,3659],{"id":3658},"everyone-wants-secure-open-source-and-strong-best-practices","Everyone wants secure open source and strong best practices",[202,3661,3662],{},"To sum up, I believe the CRA will ultimately be a positive force for open source. For the first time, the relationship between manufacturers and open source is explicitly recognised in regulation, clarifying roles and responsibilities that were previously undefined. At the end of the day, everyone wants secure open source and strong best practices; there’s no debate about that. My hope is that the CRA will encourage more manufacturers, especially those that have traditionally only consumed open source, to begin contributing back. At Huawei, we’ve long been active in contributing to projects and working with open source stewards, but I see this as an opportunity for many others to get more involved upstream. That could mean new contributors bringing code, documentation, or security expertise into these communities. If that happens, open source won’t just grow in participation – it will grow in quality and security. Regulation, in this sense, may actually strengthen open source by drawing in new voices and building even greater trust in the software we all rely on.",[202,3664,3665],{},"The same will hold true for other legislation that’s on the horizon. For example, the AI Act introduces specific obligations for open source, particularly for general-purpose AI models, raising new questions about what “open source AI” actually means. Looking ahead, I see the ORC Working Group expanding its focus to these emerging regulations as well, helping the open source community navigate their long-term impact. After all, it’s called the “Open Regulatory Compliance” Working Group for a reason.",[3667,3668],"hr",{},[202,3670,3671],{},[1597,3672],{"alt":3549,"src":3673},"\u002Fblog\u002Fmanufacturer-cra-adrian-osullivan\u002Fimages\u002FAdrianOSullivan.jpg",[202,3675,3676],{},"Adrian O’Sullivan is the Director of the European Open Source Program Office at Huawei. He has a passion for creating technology that can help solve the issues that challenge the world we live in. He loves to work with diverse teams and collaborate globally. Therefore, Adrian was attracted to the global collaboration for shared success that he witnessed open source communities generate. Adrian feels lucky to be in a position to help direct how Huawei’s Consumer, Carrier, Cloud & AI Businesses make use of and participate in open source projects to build the products to meet Huawei customer’s needs.",[202,3678,3679],{},"In Europe, Adrian directs investment and resources into a large array of open source communities, from the Eclipse Foundation to the Linux Foundation Europe and more. Personally, he also loves to contribute time back into these communities, in a wide range of roles, such as being an Advisory Board member of the Linux Foundation Europe, a Project Technical Lead in the Linux Foundation ONAP project to the Steering Committee representative of both the Eclipse Foundation Oniro and Open Regulatory Compliance Working Groups. Adrian works on helping Huawei navigate the implications of new European regulations such as the Cyber Resilience and AI Acts, establishing best practices on how to safely consume open source into the products Huawei brings to the market, by working with both the Eclipse Open Regulatory Compliance and Linux Foundation Global Cyber Policy Working Groups. Adrian has also driven activities to bring open source and standard communities closer together, such as being the leader of the CEN-CENELEC Open Source Solutions business model team representing NSAI-National Standards Authority of Ireland. In Ireland. Adrian also represents Huawei Business interests as the lead Huawei representative within IBEC - Irish Business and Employers’ Confederation.",{"title":200,"searchDepth":208,"depth":208,"links":3681},[3682,3683,3684],{"id":3590,"depth":208,"text":3591},{"id":3605,"depth":208,"text":3606},{"id":3658,"depth":208,"text":3659},{"path":3686,"title":3137,"date":3548,"author":3687,"summary":190,"visibility":190,"body":3688},"\u002Fblog\u002Ftime-to-speak-simon-phipps","Simon Phipps",{"type":192,"value":3689,"toc":3919},[3690,3702,3705,3711,3714,3717,3723,3726,3730,3734,3737,3740,3754,3759,3762,3897,3901,3916],[202,3691,3692,3693,3695,3696,3698,3699,487],{},"As the ",[261,3694,2757],{}," moves closer to implementation, much of the attention has focused on the regulation itself. But what’s equally important, and often overlooked, is the process that will define ",[292,3697,2470],{}," these rules are applied in practice: the development of ",[261,3700,3701],{},"harmonised standards",[202,3703,3704],{},"These standards are not just technical details; they will shape what “compliance” looks like for years to come. They will decide what counts as secure development, vulnerability handling, or how the different products can demonstrate compliance. And for the open source community, they represent a unique opportunity to ensure that the rules reflect how open collaboration actually works.",[271,3706,3708],{"id":3707},"why-engagement-matters",[261,3709,3710],{},"Why engagement matters",[202,3712,3713],{},"If the people who build, maintain, and steward open source software don’t participate in the standardisation process, decisions risk being made without understanding the realities of open development. This could lead to frameworks that are hard to apply, create unnecessary barriers, or discourage participation in open projects, impacting not only Open Source developers, but all downstream manufacturers who use Open Source components and code",[202,3715,3716],{},"By contributing feedback, open source communities and developers can help shape standards that are practical, inclusive, and effective**.**",[271,3718,3720],{"id":3719},"a-shared-responsibility",[261,3721,3722],{},"A shared responsibility",[202,3724,3725],{},"The CRA’s success depends on collaboration between policymakers, industry, and the open source ecosystem. Contributing to the standards process is a concrete way to make that collaboration real. It’s not about bureaucracy, it’s about ensuring that Europe’s approach to digital trust and resilience is built on open, transparent, and sustainable foundations.",[271,3727,3728],{"id":3475},[261,3729,633],{},[903,3731,3733],{"id":3732},"horizontal-standards","Horizontal standards",[202,3735,3736],{},"Manufacturers seeking presumed conformity with the Cyber Resilience Act will likely rely on standards currently under development. These horizontal standards addressing aspects common to all manufacturers, are being formalised by CEN\u002FCENELEC JTC 13 WG 9 across four project teams (PT1-PT4).",[202,3738,3739],{},"Each team’s deliverable is released for public review upon completion. The following parts of pEN 40000, “Cybersecurity requirements for products with digital elements,” have been released to date:",[278,3741,3742,3745,3748,3751],{},[281,3743,3744],{},"PT1 - pEN 40000-1-2 Principles for cyber resilience",[281,3746,3747],{},"PT2 - Not yet public",[281,3749,3750],{},"PT3 - Not yet public",[281,3752,3753],{},"PT4 - pEN 40000-1-1 Vocabulary",[3755,3756,3758],"h4",{"id":3757},"where-to-review","Where To Review",[202,3760,3761],{},"You can comment on this via your national standards organisation, in most cases after creating an account and logging in:",[3763,3764,3765,3788],"table",{},[3766,3767,3768],"thead",{},[3769,3770,3771,3775,3779,3782,3785],"tr",{},[3772,3773,3774],"th",{},"Country",[3772,3776,3778],{"align":3777},"center","PT1",[3772,3780,3781],{},"PT2",[3772,3783,3784],{},"PT3",[3772,3786,3787],{"align":3777},"PT4",[3789,3790,3791,3813,3834,3855,3876],"tbody",{},[3769,3792,3793,3797,3803,3805,3807],{},[3794,3795,3796],"td",{},"Belgium - NBN",[3794,3798,3799],{"align":3777},[240,3800,3778],{"href":3801,"rel":3802},"https:\u002F\u002Fapp.nbn.be\u002Fdata\u002Fr\u002Fplatform\u002Fpublic-portal\u002Fview-standard?p3_item_id=3430775&p3_language_code=en&p3_reference=prEN%2040000-1-2%3A2025&p3_source=ES&clear=3&session=7311569572713",[243],[3794,3804],{},[3794,3806],{},[3794,3808,3809],{"align":3777},[240,3810,3787],{"href":3811,"rel":3812},"https:\u002F\u002Fapp.nbn.be\u002Fdata\u002Fr\u002Fplatform\u002Fpublic-portal\u002Fview-standard?p3_item_id=3430769&p3_language_code=en&p3_reference=prEN%2040000-1-1%3A2025&p3_source=ES&clear=3&session=7311569572713",[243],[3769,3814,3815,3818,3824,3826,3828],{},[3794,3816,3817],{},"UK - BSI",[3794,3819,3820],{"align":3777},[240,3821,3778],{"href":3822,"rel":3823},"https:\u002F\u002Fstandardsdevelopment.bsigroup.com\u002Fprojects\u002F2025-01809",[243],[3794,3825],{},[3794,3827],{},[3794,3829,3830],{"align":3777},[240,3831,3787],{"href":3832,"rel":3833},"https:\u002F\u002Fstandardsdevelopment.bsigroup.com\u002Fprojects\u002F2025-03261",[243],[3769,3835,3836,3839,3845,3847,3849],{},[3794,3837,3838],{},"Germany - DIN",[3794,3840,3841],{"align":3777},[240,3842,3778],{"href":3843,"rel":3844},"https:\u002F\u002Fwww.din.de\u002Fde\u002Fmitwirken\u002Fentwuerfe\u002Fne-stellung\u002Fwdc-beuth:din21:396310071",[243],[3794,3846],{},[3794,3848],{},[3794,3850,3851],{"align":3777},[240,3852,3787],{"href":3853,"rel":3854},"https:\u002F\u002Fwww.din.de\u002Fde\u002Fmitwirken\u002Fentwuerfe\u002Fne-stellung\u002Fwdc-beuth:din21:396310000",[243],[3769,3856,3857,3860,3866,3868,3870],{},[3794,3858,3859],{},"Estonia - EVS (no login needed)",[3794,3861,3862],{"align":3777},[240,3863,3778],{"href":3864,"rel":3865},"https:\u002F\u002Fkomport.evs.ee\u002FDefault.aspx?s=standardCommenting&doc=19694",[243],[3794,3867],{},[3794,3869],{},[3794,3871,3872],{"align":3777},[240,3873,3787],{"href":3874,"rel":3875},"https:\u002F\u002Fkomport.evs.ee\u002FDefault.aspx?s=standardCommenting&doc=19689",[243],[3769,3877,3878,3881,3887,3889,3891],{},[3794,3879,3880],{},"Spain - UNE",[3794,3882,3883],{"align":3777},[240,3884,3778],{"href":3885,"rel":3886},"https:\u002F\u002Fwww.une.org\u002Fencuentra-tu-norma\u002Fbusca-tu-norma\u002Fproyecto\u002F?c=P0062803",[243],[3794,3888],{},[3794,3890],{},[3794,3892,3893],{"align":3777},[240,3894,3787],{"href":3895,"rel":3896},"https:\u002F\u002Fwww.une.org\u002Fencuentra-tu-norma\u002Fbusca-tu-norma\u002Fproyecto\u002F?c=P0062802",[243],[903,3898,3900],{"id":3899},"vertical-standards","Vertical Standards",[202,3902,3903,3904,3909,3910,3915],{},"The process to contribute to vertical standards is different at this stage and was covered by Jordan Maris in our last CRA Monday session, “",[240,3905,3908],{"href":3906,"rel":3907},"https:\u002F\u002Fyoutu.be\u002FlCGBoNm0G08",[243],"From closed rooms to open dialogue: how to participate in CRA vertical standards","”, through ",[240,3911,3914],{"href":3912,"rel":3913},"https:\u002F\u002Flabs.etsi.org\u002F",[243],"ETSI labs"," it is possible to contribute and give direct feedback to the teams working on those vertical standards. At this stage, the process for contributing to vertical standards differs.",[202,3917,3918],{},"The standards shaping CRA compliance are being written now, and open source voices need to be part of that conversation. Whether through national standards bodies or open consultation channels, every contribution matters. Getting involved today helps establish a regulatory framework that will foster open collaboration.",{"title":200,"searchDepth":208,"depth":208,"links":3920},[3921,3922,3923],{"id":3707,"depth":208,"text":3710},{"id":3719,"depth":208,"text":3722},{"id":3475,"depth":208,"text":633,"children":3924},[3925,3926],{"id":3732,"depth":1073,"text":3733},{"id":3899,"depth":1073,"text":3900},{"path":3928,"title":3929,"date":3930,"author":669,"summary":190,"visibility":190,"body":3931},"\u002Fblog\u002Forc-monthly-oct2025","ORC Monthly: Shape the next ORC events and join the attestations project","2025-11-03",{"type":192,"value":3932,"toc":4182},[3933,3940,3954,3962,3964,4050,4052,4062,4066,4075,4077,4105,4107,4135,4137,4140,4163,4165],[202,3934,3935,3936,487],{},"Our first Code & Compliance event was a success! Thank you to everyone who joined, asked tough questions, and shared insights across talks and panels. A particular highlight was the Attestations workshop, which sparked constructive debates and set us up for continued conversations in the coming months. The session recordings are now available on ",[240,3937,36],{"href":3938,"rel":3939},"https:\u002F\u002Fwww.youtube.com\u002Fplaylist?list=PLy7t4z5SYNaSwD6AGfFCeCc39ISaNccYc",[243],[202,3941,3942,3943,3947,3948,3953],{},"We’re already looking ahead with the next ",[240,3944,3946],{"href":2561,"rel":3945},[243],"Code & Compliance booked for 29 January 2026"," in Brussels (ahead of FOSDEM). We’d love your proposals and ideas; submit them through the ",[240,3949,3952],{"href":3950,"rel":3951},"https:\u002F\u002Fwww-eur.cvent.com\u002Fc\u002Fabstracts\u002Ff6fc6f69-b49f-4a3a-8238-49e285d2d05e",[243],"call for proposals"," and help shape the program.",[202,3955,3956,325,3958,3960],{},[292,3957,1497],{},[1499,3959],{},[292,3961,1503],{},[271,3963,1506],{"id":273},[278,3965,3966,3980,3999,4026,4034],{},[281,3967,3968,3971,3972,3975,3976,3979],{},[261,3969,3970],{},"Mark your calendars for the next Code & Compliance:"," We’ll be back in Brussels 29 January 2026. The next Code & Compliance event will take place ahead of FOSDEM, offering another opportunity for developers, policymakers, and compliance professionals to meet in person. The ",[240,3973,3952],{"href":3950,"rel":3974},[243]," is open until ",[261,3977,3978],{},"25 November 2025",". We encourage everyone to share ideas for sessions, panels, and workshops that help us prepare for the Cyber Resilience Act.",[281,3981,3982,3985,3986,3990,3991,3995,3996,487],{},[261,3983,3984],{},"Voluntary Security Attestations:"," Following a productive workshop at Code & Compliance, work has begun to turn community ideas into practice. The new ",[240,3987,3989],{"href":1358,"rel":3988},[243],"Voluntary Security Attestations Project"," is now live on GitHub. For background and context, read this ",[240,3992,3994],{"href":1700,"rel":3993},[243],"blog post by Æva Black",". To get involved, join the bi-weekly Tuesday calls listed on the ",[240,3997,503],{"href":651,"rel":3998},[243],[281,4000,4001,4004,4005,4007,4008,4010,4011,325,4015,4010,4017,4022,4023],{},[261,4002,4003],{},"ORC at OCX 2026",": The ",[292,4006,994],{}," track is the place for the ORC community at OCX 2026, and the call for proposals is now open. This track will spotlight how open collaboration shapes regulatory readiness and secure development practices. ",[1499,4009],{},"\n→ ",[240,4012,4014],{"href":1484,"rel":4013},[243],"Track Overview",[1499,4016],{},[240,4018,4021],{"href":4019,"rel":4020},"https:\u002F\u002Fwww.ocxconf.org\u002Fevent\u002F2026\u002Fcall-for-proposals",[243],"Submit a Proposal"," by ",[261,4024,4025],{},"13 November 2025",[281,4027,4028,4031,4032,487],{},[261,4029,4030],{},"Call for Events"," – Do you have an upcoming event of interest to the ORC community? Share it with us at ",[240,4033,532],{"href":531},[281,4035,4036,4039,4040,1720,4045,4049],{},[261,4037,4038],{},"New Resources for New Members:"," A fresh “how to contribute” ",[240,4041,4044],{"href":4042,"rel":4043},"https:\u002F\u002Fyoutu.be\u002FQamKa_fcyUo",[243],"video",[240,4046,213],{"href":4047,"rel":4048},"https:\u002F\u002Forcwg.org\u002Fblog\u002Fhow-to-contribute\u002F",[243]," are now available to help onboard newcomers.",[271,4051,1589],{"id":1588},[202,4053,4054],{},[240,4055,4058],{"href":4056,"rel":4057},"https:\u002F\u002Fwww.linkedin.com\u002Fposts\u002Frogerriera28_scc4cra-overview-activity-7383356133157093376-pXgh\u002F",[243],[1597,4059],{"alt":4060,"src":4061},"Roger Riera's LinkedIn post about 𝗦𝗶𝗺𝗽𝗹𝗶𝗳𝗶𝗲𝗱 𝗖𝗖 𝗳𝗼𝗿 𝗖𝗥𝗔 𝘃𝟭.𝟭","\u002Fblog\u002Forc-monthly-oct2025\u002Fimages\u002Foct-overheard.png",[271,4063,4065],{"id":4064},"in-the-news","In the news",[278,4067,4068],{},[281,4069,4070],{},[240,4071,4074],{"href":4072,"rel":4073},"https:\u002F\u002Fredmonk.com\u002Fblog\u002F2025\u002F10\u002F09\u002Frmc-cra-eclipsefoundation\u002F",[243],"A RedMonk Conversation: CRA – The First Horizontal Regulation of the Software Industry",[271,4076,1603],{"id":426},[278,4078,4079,4087,4095,4100],{},[281,4080,4081,4086],{},[240,4082,4085],{"href":4083,"rel":4084},"https:\u002F\u002Fwww.ocxconf.org\u002Fevent\u002F403bffe2-15d8-49ac-af52-e2781b7296b3\u002Fwebinar-week",[243],"OCX Webinar Week"," | 3 - 7 November 2025",[281,4088,4089,4094],{},[240,4090,4093],{"href":4091,"rel":4092},"https:\u002F\u002Fnerdearla.es\u002Fen\u002F",[243],"Nerdearla Spain 2025"," | 13 - 15 November 2025",[281,4096,4097,3162],{},[240,4098,258],{"href":3160,"rel":4099},[243],[281,4101,4102,1620],{},[240,4103,1619],{"href":1617,"rel":4104},[243],[271,4106,1640],{"id":1639},[278,4108,4109,4115,4122,4129],{},[281,4110,4111],{},[240,4112,4114],{"href":3938,"rel":4113},[243],"Code & Compliance | October 2025",[281,4116,4117],{},[240,4118,4121],{"href":4119,"rel":4120},"https:\u002F\u002Fyoutu.be\u002FWmHI4-6qsNg",[243],"Unpacking the CRA | Upcoming Deliverables and Deadlines",[281,4123,4124],{},[240,4125,4128],{"href":4126,"rel":4127},"https:\u002F\u002Fyoutu.be\u002F2JfterY07j8",[243],"CRA Mondays | Demystifying “simplified CC for CRA”",[281,4130,4131],{},[240,4132,4134],{"href":3906,"rel":4133},[243],"CRA Mondays | From closed rooms to open dialogue: how to participate in CRA vertical standards",[271,4136,3201],{"id":3200},[202,4138,4139],{},"The following members joined in October 2025:",[278,4141,4142,4149,4156],{},[281,4143,4144],{},[240,4145,4148],{"href":4146,"rel":4147},"https:\u002F\u002Fwww.sotec.eu\u002F",[243],"SOTEC",[281,4150,4151],{},[240,4152,4155],{"href":4153,"rel":4154},"https:\u002F\u002Fwww.ziur.eus\u002Feu\u002F",[243],"ZIUR Foundation",[281,4157,4158],{},[240,4159,4162],{"href":4160,"rel":4161},"https:\u002F\u002Fubuntu.com\u002F",[243],"Canonical Group",[271,4164,1659],{"id":490},[278,4166,4167,4172,4177],{},[281,4168,4169],{},[240,4170,1667],{"href":98,"rel":4171},[243],[281,4173,4174],{},[240,4175,1674],{"href":1672,"rel":4176},[243],[281,4178,4179],{},[240,4180,1680],{"href":537,"rel":4181},[243],{"title":200,"searchDepth":208,"depth":208,"links":4183},[4184,4185,4186,4187,4188,4189,4190],{"id":273,"depth":208,"text":1506},{"id":1588,"depth":208,"text":1589},{"id":4064,"depth":208,"text":4065},{"id":426,"depth":208,"text":1603},{"id":1639,"depth":208,"text":1640},{"id":3200,"depth":208,"text":3201},{"id":490,"depth":208,"text":1659},{"path":4192,"title":4193,"date":4194,"author":233,"summary":190,"visibility":190,"body":4195},"\u002Fblog\u002Fcra-monday-jordan-maris","From Closed Rooms to Open Dialogue: How to Participate in CRA Vertical Standards | CRA Mondays","2025-10-30",{"type":192,"value":4196,"toc":4213},[4197,4200,4206,4209],[202,4198,4199],{},"As the Cyber Resilience Act moves from legislation to implementation, the conversation is shifting from drafting rules to defining vertical standards — the technical requirements that will shape how software projects demonstrate compliance. This CRA Mondays session looks at how open source communities can engage in that process, helping ensure that standards development reflects the realities of open collaboration.",[202,4201,4202,4205],{},[261,4203,4204],{},"Jordan Maris",", EU Policy Analyst at the Open Source Initiative (OSI), shares practical insights on where and how developers and organizations can get involved. As he explains, “If open source isn’t represented in these standards discussions, we’ll end up with rules that don’t fit how our communities actually build software.”",[202,4207,4208],{},"Watch the full session below:",[3401,4210],{"description":4211,"id":4212,"title":4134,"uploadDate":4194},"The development of vertical standards under the Cyber Resilience Act (CRA) is a critical step toward implementation, yet these processes are often opaque and difficult for stakeholders that are not members of the standardization bodies to engage with. This presentation introduces a new open platform designed to make participation accessible to the wider community. It enables developers, manufacturers, and open source contributors to review, comment, and share feedback, creating a bridge between technical expertise and regulatory work.","lCGBoNm0G08",{"title":200,"searchDepth":208,"depth":208,"links":4214},[],{"path":4216,"title":4217,"date":4218,"author":233,"summary":190,"visibility":190,"body":4219},"\u002Fblog\u002Fcra-monday-roger-riera","Demystifying \"simplified CC for CRA\" | CRA Mondays","2025-10-28",{"type":192,"value":4220,"toc":4265},[4221,4232,4239,4242,4245,4248,4251,4254,4259],[202,4222,4223,4224,4227,4228,4231],{},"The latest CRA Monday featured ",[261,4225,4226],{},"Roger Riera",", a technical manager at Applus+ Laboratories and Type A member of the European Commission’s Cyber Resilience Act (CRA) Expert Group. Roger introduced his work on a new methodology called the ",[292,4229,4230],{},"Simplified Common Criteria for CRA",", or sCC4CRA**,** a practical framework designed to help manufacturers perform self-assessments under the CRA.",[202,4233,4234,4235,4238],{},"Roger began by explaining how the CRA allows manufacturers of “default” products to self-assess compliance through Module A of the New Legislative Framework. The goal, he said, was to translate the rigour of ",[292,4236,4237],{},"Common Criteria (CC)"," into a more accessible, self-contained model that could support conformity with CRA requirements — without the heavy formality that often makes CC certification intimidating.",[202,4240,4241],{},"“Common Criteria isn’t the problem,” Roger noted. “It’s a mature, logical methodology — we just need to adapt its language and process to make it usable under the CRA.”",[202,4243,4244],{},"The sCC4CRA methodology mirrors the familiar structure of Common Criteria but uses plain, CRA-aligned terminology and concepts. It includes both a high-level overview and a detailed step-by-step playbook, hosted publicly on GitHub to allow community feedback and version control. Each chapter aligns with the key elements of CRA compliance — from risk assessment and security objectives to testing, SBOM management, and vulnerability analysis — while remaining adaptable to future standardization updates.",[202,4246,4247],{},"During the discussion, participants raised questions about the balance between simplification and assurance, as well as how the approach connects with open source ecosystems, the upcoming Product Liability Directive, and ENISA guidance under NIS 2. Roger emphasized that sCC4CRA is not a replacement for other standards but rather a bridge — one that aims to make compliance more transparent and achievable.",[202,4249,4250],{},"“My goal,” he explained, “is to make CRA compliance practical for manufacturers who don’t have a team of certification experts. If we can lower the entry barrier, we can raise the baseline of security across the ecosystem.”",[202,4252,4253],{},"In closing, Roger shared that he continues to refine the methodology alongside his colleagues in the standardization community and invited contributions from anyone interested in testing or improving the framework. The full methodology is publicly available on GitHub, and Roger plans to release supporting templates and training materials in the near future.",[4255,4256,4258],"h1",{"id":4257},"watch-the-video","Watch the Video",[3401,4260],{"description":4261,"id":4262,"title":4263,"uploadDate":4264},"Let's unpack the sCC4CRA methodology, specially designed to facilitate early compliance for default products, based on EUCC, fully self-assessed and simplified for CRA. This session covers: - What is sCC4CRA and why it matters - EUCC vs sCC4CRA: key differences - sCC4CRA alignment with standardisation work - how to use sCC4CRA - Future and next steps","2JfterY07j8","CRA Mondays | Demystifying \"simplified CC for CRA\"","2025-10-17",{"title":200,"searchDepth":208,"depth":208,"links":4266},[],{"path":4268,"title":4269,"date":4270,"author":1692,"summary":190,"visibility":190,"body":4271},"\u002Fblog\u002Fattestations-2025","Building an Understanding of Voluntary Security Attestations and Their Role in Sustaining Open Source Communities","2025-10-14",{"type":192,"value":4272,"toc":4433},[4273,4279,4293,4296,4299,4308,4314,4317,4337,4340,4346,4349,4383,4386,4390,4393,4430],[271,4274,4276],{"id":4275},"what-are-voluntary-security-attestations",[261,4277,4278],{},"What Are Voluntary Security Attestations?",[202,4280,4281,4282,4286,4287,4292],{},"In the context of the EU’s ",[240,4283,4285],{"href":1349,"rel":4284},[243],"Cyber Resilience Act, Article 25",", these could be documents that describe the security practices, processes, attributes, or assurances associated with an open source project. They could be publicly shared, perhaps in a code repository or alongside a build binary, or they could be privately shared, for example, as ",[240,4288,4291],{"href":4289,"rel":4290},"https:\u002F\u002Ffreebsdfoundation.org\u002Fblog\u002Ffreebsd-foundation-delivers-v1-of-freebsd-ssdf-attestation-to-support-cybersecurity-compliance\u002F",[243],"FreeBSD has done",". However, we don’t really know what they should be, just yet, and defining that together is the purpose of this new project.",[202,4294,4295],{},"We think voluntary security attestations (not to be confused with root-of-trust attestations) will serve as a reusable statement that supports downstream compliance obligations: instead of every manufacturer individually reviewing a project’s code and processes, or doing an assessment of the project to a CRA product vertical standard (if one were applicable to the project), an attestation from the project could reduce the manufacturer’s CRA compliance costs.",[202,4297,4298],{},"On the one hand, this reduces duplication of effort across manufacturers and provides manufacturers with consistent, trustworthy information. On the other hand, this gives manufacturers a more tangible motivation to support the secure development of projects critical to their products.",[202,4300,4301,4302,4307],{},"Since a lot of folks across open source communities have been concerned about how the CRA will affect their projects, this bears repeating – ",[292,4303,4304,487],{},[292,4305,4306],{},"voluntary security attestations are voluntary","** Based on our understanding of the legal text, no open source project is required to produce these, and can, quite reasonably, refuse to do so indefinitely. Open source projects can choose whether to produce them, and if they do, the attestations could be a valuable tool for creating a new pathway to incentivise manufacturers to support the open source projects they rely on.",[271,4309,4311],{"id":4310},"why-are-attestations-relevant",[261,4312,4313],{},"Why Are Attestations Relevant?",[202,4315,4316],{},"Attestations matter to several different groups:",[278,4318,4319,4325,4331],{},[281,4320,4321,4324],{},[261,4322,4323],{},"Manufacturers",": Under the CRA, manufacturers bear liability for ensuring compliance of the commercial products they place on the European market. Attestations can reduce the work manufacturers must perform independently by providing them with documentation they can trust and, thereby, encouraging upstream collaboration and participation.",[281,4326,4327,4330],{},[261,4328,4329],{},"Open Source Stewards",": A steward is a legal entity that supports one or more open source projects by, for example, providing a point of contact for vulnerability reporting. While the CRA does not impose legal obligations on stewards, Article 25 establishes an optional mechanism for stewards to help manufacturers by providing voluntary security attestations. Through this, open source stewards have access to a new mechanism to incentivise manufacturers to give back, financially or otherwise, to sustain the projects they depend on.",[281,4332,4333,4336],{},[261,4334,4335],{},"OSS Developers",": Many open source projects don’t have a legal entity, which complicates the stewardship model (the CRA definition of a steward requires it to be a legal entity, not an individual\u002Fnatural person). Attestations could help open a path toward lightweight, accessible options for open source developers to support market compliance efforts without becoming overwhelmed.",[202,4338,4339],{},"In short, attestations create a bridge between regulatory compliance and the open source development model, while protecting projects from being unfairly burdened.",[271,4341,4343],{"id":4342},"developing-attestation-resources-together",[261,4344,4345],{},"Developing Attestation Resources Together",[202,4347,4348],{},"The need for clarity around voluntary security attestations has inspired a community-driven effort to explore the potential requirements of voluntary security attestations in the context of CRA Article 25. We are creating a new project, which will focus on delivering:",[278,4350,4351,4357,4363,4369],{},[281,4352,4353,4356],{},[261,4354,4355],{},"A Framework",": Mapping the landscape of what is possible, recommended, and practical when it comes to attestations.",[281,4358,4359,4362],{},[261,4360,4361],{},"A Sample Attestation",": A useful template document that projects and stewards can adapt for their own projects, making compliance easier and more consistent across the ecosystem.",[281,4364,4365,4368],{},[261,4366,4367],{},"Community Forum & Collaboration",": Creating space for open discussions with other foundations, organisations, and open source stakeholders to explore models of economic support tied to attestations.",[281,4370,4371,4374,4375,4382],{},[261,4372,4373],{},"Public Engagement",": Hosting discussions at events such as the ",[240,4376,4379,4380],{"href":4377,"rel":4378},"https:\u002F\u002Fwww.eclipse-foundation.events\u002Fevent\u002FCode-and-compliance-Community-Day-2025\u002Fagenda-at-glance?session=79c33d1a-7425-4580-b17e-668317da191e",[243],"Attestations Workshop at ",[292,4381,258],{}," and (hopefully) FOSDEM. These gatherings will help ensure the work reflects the input of many voices, not just a single organisation.",[202,4384,4385],{},"All of these resources will be developed in the open and made accessible to everyone, including open source projects, industry stakeholders, and policymakers shaping the CRA.",[271,4387,4388],{"id":3475},[261,4389,3476],{},[202,4391,4392],{},"As this community effort begins, we invite everyone in the open source ecosystem to participate in shaping the future of voluntary security attestations. Here are some ways to get involved:",[278,4394,4395,4405,4413,4424],{},[281,4396,4397,4404],{},[261,4398,4399,4400],{},"Join the conversation at ",[240,4401,258],{"href":4402,"rel":4403},"https:\u002F\u002Fwww.eclipse-foundation.events\u002Fevent\u002FCode-and-compliance-Community-Day-2025",[243],", where the first public workshop on attestations will be held.",[281,4406,4407,4412],{},[261,4408,506,4409],{},[240,4410,1952],{"href":509,"rel":4411},[243],": updates and calls for feedback will be shared there.",[281,4414,4415,4418,4419],{},[261,4416,4417],{},"Join the Matrix Room"," available at ",[240,4420,4423],{"href":4421,"rel":4422},"https:\u002F\u002Fmatrix.to\u002F#\u002F#oss-attestations:fosdem.org",[243],"OSS-Attestations:matrix.org",[281,4425,4426,4429],{},[261,4427,4428],{},"Look out for the upcoming GitHub repository"," where drafts, proposals, and templates will be developed in the open.",[202,4431,4432],{},"This work on attestations is not about imposing new requirements; it’s about identifying and proposing new mechanisms, flowing from CRA’s Article 25, to measure and increase sustainable investments in securing open source software and reducing compliance burdens for manufacturers’ use of open source software. With your input, we can shape solutions that work for all stakeholders.",{"title":200,"searchDepth":208,"depth":208,"links":4434},[4435,4436,4437,4438],{"id":4275,"depth":208,"text":4278},{"id":4310,"depth":208,"text":4313},{"id":4342,"depth":208,"text":4345},{"id":3475,"depth":208,"text":3476},{"path":4440,"title":4441,"date":4442,"author":233,"summary":190,"visibility":190,"body":4443},"\u002Fblog\u002Fcode-compliance-maintainers","Preparing Manufacturers for the CRA at Code & Compliance","2025-10-09",{"type":192,"value":4444,"toc":4528},[4445,4450,4460,4463,4466,4470,4508,4511,4514],[202,4446,609,4447,4449],{},[261,4448,2757],{}," is reshaping how manufacturers approach software security and compliance. With key deadlines fast approaching, it’s crucial to understand what’s required and how to get there efficiently and collaboratively.",[202,4451,4452,4453,4459],{},"That’s exactly what ",[240,4454,4456],{"href":4402,"rel":4455},[243],[261,4457,4458],{},"Code & Compliance Community Day"," is designed to help you do.",[202,4461,4462],{},"The CRA will require all manufacturers placing products with digital elements on the EU market to meet strict cybersecurity and documentation obligations. That means attestations, SBOMs, secure development processes, and coordinated vulnerability management could soon be a core part of doing business.",[202,4464,4465],{},"At Code & Compliance Community Day, you’ll gain actionable insights from open source experts and industry peers who are already tackling these challenges head-on. This event brings together manufacturers, open source stewards, and maintainers to explore how collaboration and shared best practices can streamline compliance.",[271,4467,4469],{"id":4468},"highlights-for-manufacturers","Highlights for Manufacturers",[1705,4471,4472,4484,4492,4500],{},[281,4473,4474,4477,4479,4480,4483],{},[261,4475,4476],{},"Lessons from Industry Leaders",[1499,4478],{},"\nHear directly from ",[261,4481,4482],{},"Red Hat, Nokia, and The QT Company"," as they share how they’re preparing their organisations for CRA compliance. These sessions will offer practical guidance, from implementing internal processes to engaging with open source communities more effectively.",[281,4485,4486,4489,4491],{},[261,4487,4488],{},"Attestations Workshop",[1499,4490],{},"\nThis interactive session will focus on exploring the potential requirements around voluntary security attestations. Participants will take the first steps to creating a framework and sample attestations. By participating, manufacturers can have an early voice in the processes that will guide compliance across the ecosystem.",[281,4493,4494,4497,4499],{},[261,4495,4496],{},"Exploring the New Relationship in the CRA-World",[1499,4498],{},"\nThe session “Towards a New Collaboration Paradigm: Manufacturers, Stewards, and Maintainers” explores how each of these communities can build a stronger ecosystem together. Learn how transparency can reduce friction and foster trust across the software supply chain.",[281,4501,4502,4505,4507],{},[261,4503,4504],{},"CRA tooling",[1499,4506],{},"\nFinding effective tools to demonstrate compliance with the CRA is one of the biggest challenges manufacturers face. This session will showcase solutions from the OCCTET project, highlighting open source tooling that can support manufacturers on their CRA compliance journey.",[202,4509,4510],{},"If you’re a manufacturer navigating the CRA, this is the place to connect with peers and experts who understand your challenges. Walk away with clarity, confidence, and concrete next steps for compliance.",[202,4512,4513],{},"Join us to be part of the growing community shaping a more secure, collaborative, and compliant open source future.",[202,4515,4516,1720,4521],{},[240,4517,4520],{"href":4518,"rel":4519},"https:\u002F\u002Fwww.eclipse-foundation.events\u002Fevent\u002FCode-and-compliance-Community-Day-2025\u002Fagenda-at-glance",[243],"Explore the full agenda",[240,4522,4525],{"href":4523,"rel":4524},"https:\u002F\u002Fwww.eclipse-foundation.events\u002Fevent\u002FCode-and-compliance-Community-Day-2025\u002Fregister",[243],[261,4526,4527],{},"register today",{"title":200,"searchDepth":208,"depth":208,"links":4529},[4530],{"id":4468,"depth":208,"text":4469},{"path":4532,"title":4533,"date":4534,"author":669,"summary":190,"visibility":190,"body":4535},"\u002Fblog\u002Focr-monthly-sept2025","ORC Monthly: FAQ Momentum, Code & Compliance, and EU Consultations","2025-10-06",{"type":192,"value":4536,"toc":4762},[4537,4556,4559,4567,4569,4639,4641,4651,4653,4662,4664,4696,4698,4714,4716,4719,4742,4744],[202,4538,4539,4540,4545,4546,4550,4551,4555],{},"As we move into autumn, the momentum in our community continues to build. A particular highlight is the upcoming ",[240,4541,4544],{"href":4542,"rel":4543},"https:\u002F\u002Fwww.eclipse-foundation.events\u002Fevent\u002FCode-and-compliance-Community-Day-2025\u002Fsummary",[243],"Code & Compliance Community Day 2025",", taking place 22–23 October. The ",[240,4547,4549],{"href":4518,"rel":4548},[243],"program"," is shaping up beautifully, with speakers being announced daily. This is your opportunity to connect with leading voices at the intersection of software compliance and open source. So now is the time to ",[240,4552,4554],{"href":4542,"rel":4553},[243],"register"," and secure your spot.",[202,4557,4558],{},"We look forward to seeing many of you there as we continue to explore how open source can drive resilience, trust, and compliance across digital ecosystems.",[202,4560,4561,4563,4565],{},[292,4562,1497],{},[1499,4564],{},[292,4566,1503],{},[271,4568,1506],{"id":273},[278,4570,4571,4577,4584,4594,4604,4615,4627],{},[281,4572,4573,4576],{},[261,4574,4575],{},"Momentum Behind the CRA FAQ",": The FAQ work has been revamped, with the proposal of an editorial structure and reorganization of the topics and processes, it will be easier to consume and contribute.",[281,4578,4579,4581,4582,487],{},[261,4580,4030],{},": Do you have an upcoming event of interest to the ORC community? Share it with us at ",[240,4583,532],{"href":531},[281,4585,4586,4039,4588,1720,4591,4049],{},[261,4587,4038],{},[240,4589,4044],{"href":4042,"rel":4590},[243],[240,4592,213],{"href":4047,"rel":4593},[243],[281,4595,4596,4599,4600,4603],{},[261,4597,4598],{},"OSS Stewards and the CRA White Paper:"," Work is progressing on the ",[240,4601,2212],{"href":2972,"rel":4602},[243]," white paper, which will serve as a key reference for understanding responsibilities under the Cyber Resilience Act. Join the vulnerability handling task force meeting to get engage and contribute to it.",[281,4605,4606,4609,4610,487],{},[261,4607,4608],{},"ETSI launches early public consultations on draft CRA vertical standards",": For the first time, ETSI is making drafts of standards available for public consultation much earlier than usual in the standardisation process. This pilot initiative puts into practice two key principles of international standardisation & ETSI’s values: openness and inclusiveness. ",[240,4611,4614],{"href":4612,"rel":4613},"https:\u002F\u002Fwww.stan4cra.eu\u002Fetsi-tc-cyber?utm_source=linkedin&utm_medium=social&utm_campaign=etsi-early-consultation-tc-cyber",[243],"STAN4CR",[281,4616,4617,4620,4621,4626],{},[261,4618,4619],{},"EU Survey on Critical Open Source Software"," – The ",[240,4622,4625],{"href":4623,"rel":4624},"https:\u002F\u002Fec.europa.eu\u002Feusurvey\u002Frunner\u002FFOSSEPS_Governance_and_Sustainability_Survey",[243],"European Commission conducted a survey"," on the governance and sustainability of critical open source software. It aims to identify best practices, shape future EU policies, and strengthen digital sovereignty. The survey was scheduled to close on 5 October 2025.",[281,4628,4629,4632,4633,4638],{},[261,4630,4631],{},"Public Consultations:"," The European Commission has launched a consultation on the ",[240,4634,4637],{"href":4635,"rel":4636},"https:\u002F\u002Fsingle-market-economy.ec.europa.eu\u002Fnews\u002Fcommission-seeks-views-future-european-standardisation-2025-09-24_en",[243],"revision of the Standardisation Regulation",". This is an opportunity to provide views on the future of European standardisation and its role in supporting innovation and competitiveness.",[271,4640,1589],{"id":1588},[202,4642,4643],{},[240,4644,4647],{"href":4645,"rel":4646},"https:\u002F\u002Fwww.linkedin.com\u002Fposts\u002Fdaniel-thompson-yvetot-a98301222_hey-linkedin-your-webview-is-not-secure-activity-7369326902353821696-pV6R?utm_source=share&utm_medium=member_desktop&rcm=ACoAAAYPUqEBp0WKWGph_vgaFZs7BihQcqkB-_o",[243],[1597,4648],{"alt":4649,"src":4650},"Daniel Thompson-Yvetot's LinkedIn post the website's security according to Google","\u002Fblog\u002Focr-monthly-sept2025\u002Fimages\u002Fsept-overheard.png",[271,4652,4065],{"id":4064},[278,4654,4655],{},[281,4656,4657],{},[240,4658,4661],{"href":4659,"rel":4660},"https:\u002F\u002Fwww.iotinsider.com\u002Findustries\u002Fsecurity\u002Fonekey-report-reveals-the-cra-is-not-being-prioritised\u002F%20",[243],"ONEKEY report reveals the CRA is not being prioritised",[271,4663,1603],{"id":426},[278,4665,4666,4674,4682,4688],{},[281,4667,4668,4673],{},[240,4669,4672],{"href":4670,"rel":4671},"https:\u002F\u002Fwww.etsi.org\u002Fevents\u002Fupcoming-events\u002F2481-etsi-security-conference-oct2025",[243],"ETSI Security Conference 2025"," | 6-9 October 2025",[281,4675,4676,4681],{},[240,4677,4680],{"href":4678,"rel":4679},"https:\u002F\u002Fwww.enisa.europa.eu\u002Fevents\u002Fcra-making-the-eu-market-resilient",[243],"CRA – Making the EU Market Resilient"," | 8 October 2025",[281,4683,4684,4687],{},[240,4685,4458],{"href":4542,"rel":4686},[243]," | 22-23 October 2025",[281,4689,4690,4695],{},[240,4691,4694],{"href":4692,"rel":4693},"https:\u002F\u002Fdigitalresilienceforum.com\u002F",[243],"Digital Resilience Forum"," | 29 October 2025",[271,4697,1640],{"id":1639},[278,4699,4700,4707],{},[281,4701,4702],{},[240,4703,4706],{"href":4704,"rel":4705},"https:\u002F\u002Fyoutu.be\u002FNglPCEu4pok",[243],"CRA Mondays | Unlocking Software Supply Chain Security: Updates from Ecma TC54 and OWASP",[281,4708,4709],{},[240,4710,4713],{"href":4711,"rel":4712},"https:\u002F\u002Fyoutu.be\u002FJnk_I2mI5xQ",[243],"CRA Mondays | Why Do You Trust Software? Operationalizing CRA with the Eclipse Trustable Software Framework",[271,4715,3201],{"id":3200},[202,4717,4718],{},"The following members joined in September 2025:",[278,4720,4721,4728,4735],{},[281,4722,4723],{},[240,4724,4727],{"href":4725,"rel":4726},"https:\u002F\u002Fwww.ifross.org\u002F",[243],"ifrOSS",[281,4729,4730],{},[240,4731,4734],{"href":4732,"rel":4733},"https:\u002F\u002Fossmalta.eu\u002F",[243],"Open Source Society Malta",[281,4736,4737],{},[240,4738,4741],{"href":4739,"rel":4740},"https:\u002F\u002Fwww.osadl.org\u002F",[243],"Open Source Automation Development Lab (OSADL)",[271,4743,1659],{"id":490},[278,4745,4746,4751,4756],{},[281,4747,4748],{},[240,4749,1667],{"href":98,"rel":4750},[243],[281,4752,4753],{},[240,4754,1674],{"href":1672,"rel":4755},[243],[281,4757,4758],{},[240,4759,1680],{"href":4760,"rel":4761},"https:\u002F\u002Forcwg.org\u002Fmembership\u002F",[243],{"title":200,"searchDepth":208,"depth":208,"links":4763},[4764,4765,4766,4767,4768,4769,4770],{"id":273,"depth":208,"text":1506},{"id":1588,"depth":208,"text":1589},{"id":4064,"depth":208,"text":4065},{"id":426,"depth":208,"text":1603},{"id":1639,"depth":208,"text":1640},{"id":3200,"depth":208,"text":3201},{"id":490,"depth":208,"text":1659},{"path":4772,"title":4773,"date":4774,"author":233,"summary":190,"visibility":190,"body":4775},"\u002Fblog\u002Fcra-monday-john-ellis","Why Do You Trust Software? | CRA Mondays","2025-10-03",{"type":192,"value":4776,"toc":4809},[4777,4780,4783,4786,4789,4792,4795,4802,4804],[202,4778,4779],{},"In this edition of CRA Mondays, we welcomed John Ellis, President and Head of Product at CodeThink, to discuss the trustworthiness of software in the context of the Cyber Resilience Act (CRA). With extensive experience leading high-performance software projects across industries like automotive, finance, medical, and IoT, John brought a broad and practical perspective to the conversation.",[202,4781,4782],{},"John began with a provocative question: “Why do you trust software?” This simple but powerful prompt set the stage for a discussion on the assumptions we make about technology and how those assumptions can sometimes fail. As he pointed out, even when software is widely deployed and heavily tested, it does not automatically mean it is trustworthy.",[202,4784,4785],{},"Throughout the session, John shared examples of how software vulnerabilities can ripple across industries. He referenced recent high-profile incidents, such as the CrowdStrike outage, to illustrate how failures in trusted systems can have global consequences. These stories underscored the need for more robust approaches to both risk management and regulatory frameworks.",[202,4787,4788],{},"One of the key themes of John’s talk was the gap between testing and trust. “Tested does not equal trustable,” he emphasized, highlighting that while testing is essential, it must be paired with processes that ensure long-term reliability and accountability. He also explored how concepts like insurance risk metrics and cross-industry standards could bring new transparency to the conversation.",[202,4790,4791],{},"The session wrapped up with a lively Q&A, where attendees raised questions about how organizations can communicate CRA concerns to executives, apply trustable software frameworks in practice, and align with regulatory expectations. These exchanges reinforced the importance of building shared understanding across developers, regulators, and businesses.",[202,4793,4794],{},"CRA Mondays continue to provide a space for open source contributors, experts, and community members to unpack the implications of the CRA. If you missed this session, we encourage you to watch the full recording.",[202,4796,4797,4798,487],{},"See below for the video. Learn more about ORC and join the conversation: ",[240,4799,29],{"href":4800,"rel":4801},"https:\u002F\u002Forcwg.org",[243],[4255,4803,4258],{"id":4257},[3401,4805],{"description":4806,"id":4807,"title":4706,"uploadDate":4808},"Modern products—from cars and planes to medical devices and consumer gadgets—depend on millions of lines of software hidden deep inside. The EU Cyber Resilience Act (CRA) now requires manufacturers and suppliers to prove that this software is secure, maintained, and resilient over the long term. But while the CRA defines what must be achieved, the industry is still asking how.\nThe Eclipse Trustable Software Framework (TSF) may provide part of the answer. Built around six trustable tenets and exploring a FICO-style Trustable Score, TSF suggests a path for making software trust more measurable and auditable. In this session, we’ll discuss how TSF could complement CRA obligations, where it may help engineers, executives, and regulators, and why open collaboration is essential to shaping the future of trustable software.","Jnk_I2mI5xQ","2025-09-25",{"title":200,"searchDepth":208,"depth":208,"links":4810},[],{"path":4812,"title":4813,"date":4814,"author":669,"summary":190,"visibility":190,"body":4815},"\u002Fblog\u002Fhow-to-contribute","How to Start Contributing to ORC Deliverables","2025-09-12",{"type":192,"value":4816,"toc":4982},[4817,4829,4832,4838,4841,4867,4870,4896,4902,4905,4945,4952,4958,4961,4972,4975],[202,4818,4819,4820,4822,4823,487],{},"Contributing to the Open Regulatory Compliance (ORC) Working Group is one of the most effective ways to help shape how the ",[261,4821,2757],{}," impacts the open source ecosystem. If you’re new to the group or simply wondering where to begin, the best starting point is our ",[240,4824,4827],{"href":4825,"rel":4826},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg\u002Fblob\u002Fmain\u002Fcyber-resilience-sig\u002Fdeliverables.md",[243],[261,4828,2301],{},[202,4830,4831],{},"This plan provides a clear overview of the focus areas identified by the working group, the projects currently in progress, and the deliverables that have already been completed. It’s designed to give you both visibility into our work and an entry point to participate.",[271,4833,4835],{"id":4834},"what-youll-find-in-the-deliverables-plan",[261,4836,4837],{},"What You’ll Find in the Deliverables Plan",[202,4839,4840],{},"The deliverables plan organises our work into four main categories:",[278,4842,4843,4849,4855,4861],{},[281,4844,4845,4848],{},[261,4846,4847],{},"Documentation"," – Referencing assets that address common questions and concerns around the CRA.",[281,4850,4851,4854],{},[261,4852,4853],{},"Inputs and Contributions"," – Responses the working group has provided to standardisation bodies through requests, open consultations, or CRA expert group feedback.",[281,4856,4857,4860],{},[261,4858,4859],{},"White Papers"," – Covering key topics that deepen understanding of the CRA and its essential elements.",[281,4862,4863,4866],{},[261,4864,4865],{},"Specifications"," – Community-developed standards that propose technical solutions to CRA implementation challenges.",[202,4868,4869],{},"Each deliverable listed in the table provides key details:",[278,4871,4872,4878,4884,4890],{},[281,4873,4874,4877],{},[261,4875,4876],{},"Status"," – whether a deliverable is planned, in progress, cancelled, or completed.",[281,4879,4880,4883],{},[261,4881,4882],{},"Name"," – the title of the deliverable.",[281,4885,4886,4889],{},[261,4887,4888],{},"Owner"," – the task force or subgroup responsible for development.",[281,4891,4892,4895],{},[261,4893,4894],{},"Timing"," – draft and final due dates.",[271,4897,4899],{"id":4898},"understanding-the-status-indicators",[261,4900,4901],{},"Understanding the Status Indicators",[202,4903,4904],{},"To help you quickly see where things stand, each deliverable is assigned a status:",[278,4906,4907,4913,4925,4934],{},[281,4908,4909,4912],{},[261,4910,4911],{},"No icon"," – Planned but not yet started.",[281,4914,4915,325,4918,4924],{},[261,4916,4917],{},"Work in Progress",[261,4919,4920],{},[4921,4922,4923],"code",{},"✍️","– Actively discussed and developed in the group’s regular meetings.",[281,4926,4927,325,4930,4933],{},[261,4928,4929],{},"Cancelled",[261,4931,4932],{},"❌","– Considered but deprioritised as no longer relevant.",[281,4935,4936,325,4939,4944],{},[261,4937,4938],{},"Submitted",[261,4940,4941],{},[4921,4942,4943],{},"🚀","– Completed deliverables, marked with a launch icon.",[202,4946,4947,4948,4951],{},"Each deliverable also links to a more detailed description, including: an abstract describing its intent, the target stakeholders, and the current draft. Where available, you’ll also find a ",[261,4949,4950],{},"link to the work-in-progress version",", making it easy to contribute directly.",[271,4953,4955],{"id":4954},"how-you-can-contribute",[261,4956,4957],{},"How You Can Contribute",[202,4959,4960],{},"The deliverables plan isn’t just a tracking tool; it’s your roadmap for contribution. By browsing the plan, you can:",[278,4962,4963,4966,4969],{},[281,4964,4965],{},"See which topics are under active discussion.",[281,4967,4968],{},"Understand the scope and objectives of each deliverable.",[281,4970,4971],{},"Access draft versions and contribute your expertise.",[202,4973,4974],{},"All deliverables clearly outline their type, license, target stakeholders, and ownership, so you know how your input can add value.",[202,4976,4977,4978,4981],{},"If you’re ready to get started, the ",[240,4979,2301],{"href":4825,"rel":4980},[243]," is the first place to look. It’s where you’ll gain visibility into the ongoing activities of the ORC community and find the best opportunities to contribute to our shared mission: ensuring that open source software remains secure, resilient, and compliant with European regulations.",{"title":200,"searchDepth":208,"depth":208,"links":4983},[4984,4985,4986],{"id":4834,"depth":208,"text":4837},{"id":4898,"depth":208,"text":4901},{"id":4954,"depth":208,"text":4957},{"path":4988,"title":4989,"date":4990,"author":233,"summary":190,"visibility":190,"body":4991},"\u002Fblog\u002F20-foundation-members","ORC Working Group Welcomes our 20th Foundation Member","2025-09-10",{"type":192,"value":4992,"toc":5047},[4993,4996,5000,5003,5006,5010,5013,5021,5029,5033,5036,5044],[202,4994,4995],{},"The Open Regulatory Compliance (ORC) Working Group is built on the power of collaboration, and today, we celebrate an exciting milestone—surpassing 20 foundation members! This achievement is a testament to the strength of our community, uniting industry leaders, open source foundations and developers to tackle regulatory challenges together.",[271,4997,4999],{"id":4998},"a-community-driven-milestone","A community-driven milestone",[202,5001,5002],{},"Organisations from across the open source and technology ecosystems are coming together to ensure that compliance remains manageable, practical, and aligned with the needs of open source development. With the support of foundations such as The Apache Software Foundation, OWASP, Python Foundation, and many others, we are shaping the future of open compliance with a shared vision and commitment to collaboration.",[202,5004,5005],{},"This milestone is more than just a number—it represents a growing commitment from both industry and foundations to work together on a common goal: ensuring that open source software remains a trusted and viable choice in regulated environments.",[271,5007,5009],{"id":5008},"why-foundations-matter-in-compliance","Why foundations matter in compliance",[202,5011,5012],{},"Foundations play a critical role in ensuring the long-term sustainability and governance of open source projects. Their involvement in ORC brings together diverse perspectives, fosters best practices, and strengthens the credibility of compliance solutions. As stewards of open source communities, foundations represent entire ecosystems, making their engagement vital in shaping compliance frameworks that are both practical and fair.",[202,5014,5015],{},[240,5016,5017],{"href":75},[1597,5018],{"alt":5019,"src":5020},"Logos of 20 foundation level ORC members","\u002Fblog\u002F20-foundation-members\u002Fimages\u002Forc-foundation-members.png",[202,5022,5023,5024,5028],{},"This latest milestone underscores the growing recognition that compliance is not just a challenge for individual organisations—it’s a shared responsibility that requires collective action. ",[240,5025,5027],{"href":98,"rel":5026},[243],"ORC’s work"," is proof that open collaboration leads to better, more effective solutions that align with industry and regulatory expectations.",[271,5030,5032],{"id":5031},"join-us-to-shape-the-future","Join us to shape the future",[202,5034,5035],{},"The ORC Working Group is still growing, and we invite more organisations to join us in shaping the next phase of open regulatory compliance. Whether you’re a software vendor, manufacturer, foundation, or open source contributor, your voice matters in this conversation.",[202,5037,5038,5039,5043],{},"To our members: thank you. Your contributions, insights, and commitment make ORC a force for positive change. And to those ",[240,5040,5042],{"href":537,"rel":5041},[243],"considering joining",", we welcome you to be part of this exciting journey. We hope you can help us shape the future of open compliance.",[202,5045,5046],{},"Here’s to our growing community and to the continued success of open collaboration!",{"title":200,"searchDepth":208,"depth":208,"links":5048},[5049,5050,5051],{"id":4998,"depth":208,"text":4999},{"id":5008,"depth":208,"text":5009},{"id":5031,"depth":208,"text":5032},{"path":5053,"title":5054,"date":4990,"author":669,"summary":190,"visibility":190,"body":5055},"\u002Fblog\u002Fcra-monday-ecma-oswap","Unlocking Software Supply Chain Security: Updates from Ecma TC54 and OWASP | CRA Mondays",{"type":192,"value":5056,"toc":5159},[5057,5066,5070,5077,5085,5088,5092,5098,5105,5108,5112,5118,5125,5128,5132,5135,5142,5144,5147,5152,5154],[202,5058,5059],{},[292,5060,5061,5062,5065],{},"This post is part of our CRA Mondays series. It captures a recent session featuring ",[261,5063,5064],{},"Samina Husain (Ecma International), Steve Spring (Chair of Ecma TC54), and Philippe Ombredanne (AboutCode)",", exploring the ongoing work in Ecma’s TC54 committee and its alignment with the EU’s Cyber Resilience Act (CRA).",[903,5067,5069],{"id":5068},"spotlight-on-ecma-tc54","Spotlight on Ecma TC54",[202,5071,5072,5073,5076],{},"The session opened with ",[261,5074,5075],{},"Samina Husain",", Secretary General of Ecma International, introducing the history and role of Ecma in standardisation and its recent focus on the CRA. She explained how Ecma collaborated with OWASP to publish the CycloneDX specification as Ecma-424, highlighting the speed and efficiency of their process:",[5078,5079,5080],"blockquote",{},[202,5081,5082],{},[292,5083,5084],{},"“We came together, did strong due diligence, and produced the CycloneDX standard very quickly.”",[202,5086,5087],{},"Samina emphasised the importance of ESBOMs (extended software bill of materials) for transparency and compliance and outlined how Ecma continues to expand work in areas such as package URLs, lifecycle events, and sustainability specifications.",[903,5089,5091],{"id":5090},"software-and-system-transparency","Software and System Transparency",[202,5093,5094,5097],{},[261,5095,5096],{},"Steve Spring"," provided a deep dive into TC54’s current and future initiatives. He described how TC54 draws inspiration from the success of TC-39 (the JavaScript standards committee), but applies it to transparency and supply chain security:",[5078,5099,5100],{},[202,5101,5102],{},[292,5103,5104],{},"“TC54 is capable of delivering international standards with the rigor you’d expect — but at a much higher velocity.”",[202,5106,5107],{},"Steve explained the broad scope of CycloneDX, including upcoming 1.7 and 2.0 versions, which expand into sustainability, threat modeling, and behavior analysis. He highlighted the importance of preparing for future regulatory needs:",[903,5109,5111],{"id":5110},"package-url-and-version-ranges","Package URL and Version Ranges",[202,5113,5114,5117],{},[261,5115,5116],{},"Philippe Ombredanne"," focused on the Package URL (purl) and version range (vers) specifications, which are critical for accurately identifying and tracking software across ecosystems. He noted that adoption is accelerating:",[5078,5119,5120],{},[202,5121,5122],{},[292,5123,5124],{},"“Support for PURL is being merged into the CVE schema at the same level as CPEs — this is huge for making vulnerabilities more actionable.”",[202,5126,5127],{},"Philippe also stressed the need for reliable tools and benchmarks to validate SBOMs and prevent inaccurate data from undermining supply chain security.",[903,5129,5131],{"id":5130},"why-this-matters-for-cra","Why This Matters for CRA",[202,5133,5134],{},"The discussion reinforced how Ecma TC54’s work connects directly to CRA compliance. ESBOMs, lifecycle event tracking, and transparency APIs all help organisations meet regulatory requirements while fostering best practices in security and software development. As one participant put it:",[5078,5136,5137],{},[202,5138,5139],{},[292,5140,5141],{},"“Transparency isn’t just about meeting regulations — it’s about building trust and resilience into the digital supply chain.”",[3667,5143],{},[202,5145,5146],{},"This presentation is valuable for anyone involved in compliance, open source governance, or cybersecurity. It illustrates how industry collaboration is shaping practical tools to meet the CRA’s ambitious goals.",[202,5148,4797,5149,487],{},[240,5150,29],{"href":4800,"rel":5151},[243],[4255,5153,4258],{"id":4257},[3401,5155],{"description":5156,"id":5157,"title":4706,"uploadDate":5158},"At the heart of the EU Cyber Resilience Act (CRA) and other emerging EU regulations lies a critical focus on supply chain security and Software Bill of Materials (SBOM). Ecma TC54, in collaboration with OWASP, is advancing this agenda through its work on “Software and system transparency.”\nIn this session, you will gain insights into key initiatives shaping the future of software transparency—from OWASP CycloneDX to new efforts around software identifiers (PURL), Common Lifecycle Enumeration (CLE), and the Transparency Exchange API (TEA) for automating the delivery of transparency artefacts across the supply chain.\nThe session will also provide an overview of Ecma International’s role as a global standards organisation. A Q&A segment will give you the chance to engage directly with experts on these critical CRA-related standards.","NglPCEu4pok","2025-09-08",{"title":200,"searchDepth":208,"depth":208,"links":5160},[5161,5162,5163,5164],{"id":5068,"depth":1073,"text":5069},{"id":5090,"depth":1073,"text":5091},{"id":5110,"depth":1073,"text":5111},{"id":5130,"depth":1073,"text":5131},{"path":5166,"title":5167,"date":5168,"author":669,"summary":190,"visibility":190,"body":5169},"\u002Fblog\u002Forc-monthly-aug2025","ORC Monthly: Recent press release, white paper on Open Source Stewards and the CRA and Code & Compliance","2025-08-27",{"type":192,"value":5170,"toc":5385},[5171,5174,5183,5192,5194,5258,5260,5270,5272,5302,5304,5352,5354,5357,5366,5368],[202,5172,5173],{},"As summer winds down, ORC is gearing up for a busy event season. From global security summits to community-driven gatherings, this fall will be packed with opportunities to connect, share knowledge, and advance the conversation around the Cyber Resilience Act and upcoming regulations.",[202,5175,5176,5177,5182],{},"One event you won’t want to miss: ",[240,5178,5180],{"href":4542,"rel":5179},[243],[261,5181,4458],{}," taking place in Brussels, 22–23 October. This event will bring together developers, compliance experts, and regulators to share knowledge and advance collaboration around the CRA and open source compliance. We hope to see many of you there.",[202,5184,5185,5187,5189],{},[292,5186,233],{},[1499,5188],{},[292,5190,5191],{},"Senior Marketing Manager, ORC",[271,5193,1506],{"id":273},[278,5195,5196,5205,5220,5227,5240],{},[281,5197,5198,5199,5204],{},"ORC’s ",[240,5200,5203],{"href":5201,"rel":5202},"https:\u002F\u002Fnewsroom.eclipse.org\u002Fnews\u002Fannouncements\u002Fopen-regulatory-compliance-working-group-welcomes-new-members-and-provides-first",[243],"recent press release"," highlighting our growth and achievements has generated meaningful industry attention, reflecting the timely interest in the Cyber Resilience Act (CRA) and the broader push for open regulatory compliance. See the cover below.",[281,5206,5207,5208,5215,5216],{},"Work continues on the ",[240,5209,5212],{"href":5210,"rel":5211},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg\u002Fblob\u002Fmain\u002Fcyber-resilience-sig\u002Fdeliverables.md#35-white-paper-open-source-software-stewards-and-cra",[243],[261,5213,5214],{},"Open Source Stewards and the CRA"," white paper, with valuable input coming from across the working group. This resource will outline the obligations, restrictions, and potential penalties that Stewards may face under the Cyber Resilience Act. Community members can learn more and contribute to the discussion on ",[240,5217,525],{"href":5218,"rel":5219},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg\u002Fpull\u002F150",[243],[281,5221,5222,5223,5226],{},"The open source community, and ORC members in particular, have reported and commented on the initial draft of the ",[261,5224,5225],{},"Vulnerability Handling CEN\u002FCENELEC"," work, which currently equates open source with a supplier. We will closely monitor the evolution of this work, as it could have a major impact on the community.",[281,5228,5229,5230,5235,5236,5239],{},"We’re excited to announce the launch of a dedicated ",[240,5231,5234],{"href":5232,"rel":5233},"https:\u002F\u002Forcwg.org\u002Fblog\u002F",[243],"blog section on orcwg.org",". We’d love to highlight voices from across the community. If you’re interested in contributing a post, please ",[240,5237,5238],{"href":531},"reach out to our team"," to discuss your ideas.",[281,5241,5242,5243,5245,5246,5249,5250,264,5253],{},"Our popular ",[261,5244,366],{}," series resumes on ",[261,5247,5248],{},"September 1"," with the session ",[292,5251,5252],{},"Unlocking Software Supply Chain Security: Updates from Ecma TC54 and OWASP",[240,5254,5257],{"href":5255,"rel":5256},"https:\u002F\u002Fcalendar.google.com\u002Fcalendar\u002Fevent?action=TEMPLATE&tmeid=NGo1YWhzZ3YydG1rb2dmZzVrcGcxZnEzdGpfMjAyNTA5MDFUMTUwMDAwWiBjXzdkYjhlM2YxM2M0ZmFjOTg0MTAzOTE4YTk3YzcwNGJiMWQ2MTlkYTBmZGI2NmQzM2YxNzQ3ODQ5YjYwMjBhZWFAZw&tmsrc=c_7db8e3f13c4fac984103918a97c704bb1d619da0fdb66d33f1747849b6020aea%40group.calendar.google.com",[243],"Add it to your calendar.",[271,5259,1589],{"id":1588},[202,5261,5262],{},[240,5263,5266],{"href":5264,"rel":5265},"https:\u002F\u002Fwww.linkedin.com\u002Fposts\u002Frozhukov_asw-cra-osps-activity-7366121452388921346-QYX3?utm_source=share&utm_medium=member_desktop&rcm=ACoAAAYPUqEBp0WKWGph_vgaFZs7BihQcqkB-_o",[243],[1597,5267],{"alt":5268,"src":5269},"Roman Zhukov's LinkedIn post about his recent podcast appearance","\u002Fblog\u002Forc-monthly-aug2025\u002Fimages\u002Faug-overheard.webp",[271,5271,4065],{"id":4064},[278,5273,5274,5281,5288,5295],{},[281,5275,5276],{},[240,5277,5280],{"href":5278,"rel":5279},"https:\u002F\u002Fwww.heise.de\u002Fnews\u002FCyber-Resilience-Act-Initiative-der-Eclipse-Foundation-hilft-bei-Compliance-10525852.html",[243],"Cyber Resilience Act: Eclipse Foundation initiative helps with compliance",[281,5282,5283],{},[240,5284,5287],{"href":5285,"rel":5286},"https:\u002F\u002Fdevops.com\u002Feclipse-foundation-publishes-toolkit-to-simplify-cra-compliance\u002F",[243],"Eclipse Foundation Publishes Toolkit to Simplify CRA Compliance",[281,5289,5290],{},[240,5291,5294],{"href":5292,"rel":5293},"https:\u002F\u002Fvmblog.com\u002Farchive\u002F2025\u002F08\u002F15\u002Fthabang-mashologu-on-open-regulatory-compliance-orc-momentum-and-the-launch-of-the-occtet-project-vmblog-qa.aspx",[243],"Thabang Mashologu on Open Regulatory Compliance (ORC) Momentum and the Launch of the OCCTET Project",[281,5296,5297],{},[240,5298,5301],{"href":5299,"rel":5300},"https:\u002F\u002Ftechstrong.tv\u002Fvideos\u002Finterviews\u002Fempowering-open-source-insights-from-eclipse-foundations-thabang-mashologu",[243],"Empowering Open Source: Insights from Eclipse Foundation’s Thabang Mashologu",[271,5303,1603],{"id":426},[278,5305,5306,5314,5322,5330,5337,5342,5347],{},[281,5307,5308,5313],{},[240,5309,5312],{"href":5310,"rel":5311},"https:\u002F\u002Fcomply.land\u002F",[243],"Comply.Land"," | 11 September 2025 - 12 September 2025",[281,5315,5316,5321],{},[240,5317,5320],{"href":5318,"rel":5319},"https:\u002F\u002Fwww.bitkom.org\u002FForum-Open-Source-2025",[243],"Bitkom Open Source Forum 2025"," | 18 September 2025",[281,5323,5324,5329],{},[240,5325,5328],{"href":5326,"rel":5327},"https:\u002F\u002Fwww.thethingsconference.com\u002F",[243],"The Things Conference"," | 23 - 24 September 2025",[281,5331,5332,5336],{},[240,5333,477],{"href":5334,"rel":5335},"https:\u002F\u002Fnsss.se\u002Fy2025\u002F",[243]," | 1-3 October 2025",[281,5338,5339,4673],{},[240,5340,4672],{"href":4670,"rel":5341},[243],[281,5343,5344,4681],{},[240,5345,4680],{"href":4678,"rel":5346},[243],[281,5348,5349,4687],{},[240,5350,4458],{"href":4542,"rel":5351},[243],[271,5353,3201],{"id":3200},[202,5355,5356],{},"The following members joined in August 2025:",[278,5358,5359],{},[281,5360,5361],{},[240,5362,5365],{"href":5363,"rel":5364},"https:\u002F\u002Fwww.niis.org\u002F",[243],"Nordic Institute for Interoperability Solutions (NIIS)",[271,5367,1659],{"id":490},[278,5369,5370,5375,5380],{},[281,5371,5372],{},[240,5373,1667],{"href":98,"rel":5374},[243],[281,5376,5377],{},[240,5378,1674],{"href":1672,"rel":5379},[243],[281,5381,5382],{},[240,5383,1680],{"href":4760,"rel":5384},[243],{"title":200,"searchDepth":208,"depth":208,"links":5386},[5387,5388,5389,5390,5391,5392],{"id":273,"depth":208,"text":1506},{"id":1588,"depth":208,"text":1589},{"id":4064,"depth":208,"text":4065},{"id":426,"depth":208,"text":1603},{"id":3200,"depth":208,"text":3201},{"id":490,"depth":208,"text":1659},{"path":5394,"title":5395,"date":5396,"author":669,"summary":190,"visibility":190,"body":5397},"\u002Fblog\u002Fcra-monday-sebastien-occtet","The OCCTET Project: Tooling for CRA Compliance with Sébastien Heurtematte | CRA Mondays","2025-08-25",{"type":192,"value":5398,"toc":5456},[5399,5404,5407,5421,5428,5430,5436,5440],[202,5400,5401],{},[292,5402,5403],{},"This post is part of our CRA Mondays series. It captures a session originally\nhosted earlier this year with Sébastien Heurtematte, coordinator of the OCCTET project. While\nthe discussion took place several months ago, the insights remain highly\nrelevant as CRA implementation continues to evolve.",[202,5405,5406],{},"This session featured Sébastien Heurtematte, coordinator of the OCCTET project, an EU-funded initiative designed to help SMEs navigate the challenges of cybersecurity compliance under the EU’s Cyber Resilience Act (CRA). In it, he discussed:",[278,5408,5409,5412,5415,5418],{},[281,5410,5411],{},"The key implications of the CRA for SMEs and open source software",[281,5413,5414],{},"The challenges and opportunities in open source security and compliance",[281,5416,5417],{},"How the OCCTET Project Supports CRA Compliance Through Self-Assessment and Tooling",[281,5419,5420],{},"How SMEs and Open Source Communities can work together and get involved in the OCCTET project?",[202,5422,5423,5424,487],{},"See below for the video. Learn more about ORC and join the\nconversation: ",[240,5425,29],{"href":5426,"rel":5427},"https:\u002F\u002Fwww.orcwg.org",[243],[271,5429,4258],{"id":4257},[3401,5431],{"description":5432,"id":5433,"title":5434,"uploadDate":5435},"Welcome to the first episode of CRA Mondays, a series of insightful conversations hosted by the Open Regulatory Compliance (ORC) Working Group, focused on exploring the real-world impact and implementation of the EU’s Cyber Resilience Act (CRA) and related regulatory frameworks in open source and digital innovation. In this session Sébastien Heurtematte, the coordinator of the OCCTET project, an EU-funded initiative designed to help SMEs navigate the challenges of cybersecurity compliance under the EU’s Cyber Resilience Act (CRA), will discuss: - The key implications of the CRA for SMEs and open source software - The challenges and opportunities in open source security and compliance - How the OCCTET Project Supports CRA Compliance Through Self-Assessment and Tooling - How SMEs and Open Source Communities can work together and get involved in the OCCTET project?","1CWy55AhEnc","CRA Mondays | Sébastien Heurtematte on OCCTET Project - Tooling for CRA Compliance","2025-04-29",[271,5437,5439],{"id":5438},"session-links","Session Links",[278,5441,5442,5449],{},[281,5443,5444],{},[240,5445,5448],{"href":5446,"rel":5447},"https:\u002F\u002Focctet.eu",[243],"More about OCCTET",[281,5450,5451],{},[240,5452,5455],{"href":5453,"rel":5454},"https:\u002F\u002Focctet.eu\u002Fresources\u002Fworkshop\u002Fneeds-analysis\u002Fneeds-analysis-workshop-report.pdf",[243],"Needs Analysis workshop results",{"title":200,"searchDepth":208,"depth":208,"links":5457},[5458,5459],{"id":4257,"depth":208,"text":4258},{"id":5438,"depth":208,"text":5439},{"path":5461,"title":5462,"date":5463,"author":669,"summary":190,"visibility":190,"body":5464},"\u002Fblog\u002Fhow-to-stop-worrying-and-love-the-nlf-with-fukami","How to stop worrying and love the NLF with Fukami | CRA Mondays","2025-08-14",{"type":192,"value":5465,"toc":5493},[5466,5471,5474,5477,5480,5485,5487],[202,5467,5468],{},[292,5469,5470],{},"This post is part of our CRA Mondays series. It captures a session originally\nhosted earlier this year with Fukami, EU Policy Advisor at the OpenSSF. While\nthe discussion took place several months ago, the insights remain highly\nrelevant as CRA implementation continues to evolve.",[202,5472,5473],{},"CRA Mondays are a series of conversations hosted by the Open Regulatory\nCompliance (ORC) Working Group, focused on exploring the real-world impact and\nimplementation of the EU’s Cyber Resilience Act (CRA) and related regulatory\nframeworks in open source and digital innovation.",[202,5475,5476],{},"What is the New Legislative Framework (NLF), and how does it shape EU product\nlegislation, including the Cyber Resilience Act (CRA)? In this episode of CRA\nMondays, Fukami, EU Policy Advisor at the OpenSSF, breaks down the NLF as the\nlegal backbone supporting the enforcement of internal market rules in the EU.",[202,5478,5479],{},"You’ll gain a clearer understanding of how the NLF provides a common framework\nfor future legislation, including tools like market oversight, CE marking,\nstandardisation, and the Blue Guide. This presentation is especially\nvaluable for anyone involved in compliance, open source, or placing\nproducts on the European market.",[202,5481,5423,5482,487],{},[240,5483,29],{"href":5426,"rel":5484},[243],[271,5486,4258],{"id":4257},[3401,5488],{"description":5489,"id":5490,"title":5491,"uploadDate":5492},"What is the New Legislative Framework (NLF), and how does it shape EU product legislation, including the Cyber Resilience Act (CRA)? In this episode of CRA Mondays, Fukami, EU Policy Advisor at the OpenSSF, breaks down the NLF as the legal backbone supporting the enforcement of internal market rules in the EU.\nYou'll gain a clearer understanding of how the NLF provides a common framework for future legislation, including tools like market oversight, CE marking, standardisation, and the Blue Guide. This presentation is especially valuable for anyone involved in compliance, open source, or placing products on the European market.","7CbHwsKVD80","CRA Mondays | How to stop worrying and love the NLF","2025-05-28",{"title":200,"searchDepth":208,"depth":208,"links":5494},[5495],{"id":4257,"depth":208,"text":4258},{"path":5497,"title":5498,"date":5499,"author":669,"summary":190,"visibility":190,"body":5500},"\u002Fblog\u002Fcode-complaince-what-to-expect","Code & Compliance Community Day 2025: What to Expect in Brussels","2025-08-13",{"type":192,"value":5501,"toc":5640},[5502,5509,5513,5526,5574,5578,5581,5588,5608,5611,5615,5630,5633],[202,5503,5504,5505,5508],{},"Here’s a preview of the topics and sessions shaping Code & Compliance Community Day 2025, taking place ",[261,5506,5507],{},"October 22–23, 2025 in Brussels",". This event brings together open source maintainers, compliance leads, manufacturers, and institutional stakeholders to reflect on the Cyber Resilience Act’s (CRA) first year and help shape what comes next.",[271,5510,5512],{"id":5511},"agenda-highlights","Agenda highlights",[202,5514,2822,5515,2826,5518,5521,5522,5525],{},[261,5516,5517],{},"October 22",[240,5519,4549],{"href":4518,"rel":5520},[243]," kicks off with an afternoon session to frame the community’s shared purpose, followed by a ",[261,5523,5524],{},"full day of sessions"," on October 23. These sessions include:",[278,5527,5528,5543,5550,5558,5566],{},[281,5529,5530,5533,5535,5536,5539,5540,5542],{},[261,5531,5532],{},"Opening Session: Setting the Stage for CRA Readiness",[1499,5534],{},"\nThis opening block will frame the day’s discussions with a deep dive into the evolving ",[292,5537,5538],{},"stewardship role"," under the CRA and explore the importance of ",[292,5541,2456],{}," in demonstrating compliance. It sets the foundation for the workshop sessions that follow.",[281,5544,5545,5547,5549],{},[261,5546,4488],{},[1499,5548],{},"\nAn interactive session on producing and managing attestations to meet CRA compliance requirements, with practical examples and discussion.",[281,5551,5552,5555,5557],{},[261,5553,5554],{},"Sessions on Modern Tooling for Compliance and Collaboration",[1499,5556],{},"\nExplore the latest tools and frameworks designed to support CRA readiness, streamline attestations, and enhance collaboration across the software supply chain.",[281,5559,5560,5563,5565],{},[261,5561,5562],{},"Sessions Exploring the Evolving Roles of Manufacturers, Maintainers, and Stewards",[1499,5564],{},"\nDelve into how the CRA is redefining responsibilities, accountability, and cooperation between upstream and downstream stakeholders.",[281,5567,5568,5571,5573],{},[261,5569,5570],{},"Sessions Highlighting CRA Adoption in Key Industry Verticals",[1499,5572],{},"\nHear how leaders from sectors like automotive, energy, and healthcare are adapting to CRA requirements, each with unique risk profiles and implementation strategies.",[271,5575,5577],{"id":5576},"why-you-should-join-us","Why you should join us",[202,5579,5580],{},"The program is designed to deepen your understanding of the CRA’s impact and highlight the ongoing activities (such as those lef by the ORC working group, ETSI, CEN\u002FCENELEC and publicly funded programs) that are essential to follow to on your CRA compliance journey. Expect disscussions that bridge policy, tooling, real‑world case studies, and open source governance.",[271,5582,5584,5585],{"id":5583},"colocated-solving-the-standardisation-dilemma","Co‑located: ",[292,5586,5587],{},"Solving the Standardisation Dilemma",[202,5589,5590,5591,5594,5595,5598,5599,5607],{},"Ahead of the Code & Compliance programming, ",[292,5592,5593],{},"Open Forum Europe"," will host a ",[261,5596,5597],{},"roundtable on standardisation reform",", titled ",[261,5600,5601,5602,5606],{},"“",[240,5603,5587],{"href":5604,"rel":5605},"https:\u002F\u002Fopenforumeurope.org\u002Fevent\u002Fsolving-the-standardisation-dilemma\u002F",[243],".”"," This event explores whether Europe’s Standardisation System can adapt to fast‑moving, agile software sectors like open source, or if structural reform is needed.",[202,5609,5610],{},"This session is a perfect complement to the main event and is free to attend. When you register for Code & Compliance, you will be asked whether you plan to attend this workshop. ",[271,5612,5614],{"id":5613},"register-and-participate","Register and participate",[202,5616,5617,5618,5621,5622,5629],{},"To help us plan effectively and reduce no‑shows, a ",[261,5619,5620],{},"nominal registration fee"," will be charged for attendees of the Code & Compliance Community Day. Members of the ORC Working Group are eligible for a ",[240,5623,5626],{"href":5624,"rel":5625},"https:\u002F\u002Fwww.eclipse-foundation.events\u002Fevent\u002FCode-and-compliance-Community-Day-2025\u002Fregistration-fees",[243],[261,5627,5628],{},"30% discount"," on the registration fee.",[202,5631,5632],{},"Secure your spot today to be part of the discussions shaping CRA compliance, open source governance, and standards reform in Europe.",[202,5634,5635,5639],{},[240,5636,5638],{"href":4523,"rel":5637},[243],"Register now"," and join us in Brussels.",{"title":200,"searchDepth":208,"depth":208,"links":5641},[5642,5643,5644,5646],{"id":5511,"depth":208,"text":5512},{"id":5576,"depth":208,"text":5577},{"id":5583,"depth":208,"text":5645},"Co‑located: Solving the Standardisation Dilemma",{"id":5613,"depth":208,"text":5614},{"path":5648,"title":5649,"date":5650,"author":669,"summary":190,"visibility":190,"body":5651},"\u002Fblog\u002Forc-monthly-july2025","ORC Monthly: Regulatory Submissions and Code & Compliance Community Day","2025-07-30",{"type":192,"value":5652,"toc":5973},[5653,5680,5683,5691,5693,5807,5809,5819,5827,5829,5861,5863,5897,5906,5908,5911,5954,5956],[202,5654,5655,5656,5661,5662,5667,5668,5673,5674,5679],{},"As we dive into the summer months, we’re combining our June and July updates into a single post, because June was packed. In June alone, we contributed to the ",[240,5657,5660],{"href":5658,"rel":5659},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg\u002Fblob\u002Fmain\u002Fcyber-resilience-sig\u002Fdeliverables.md#23-contribution-to-open-source-eu-guidance-on-open-source-hardware",[243],"EU’s draft guidance on open source hardware",", submitted detailed comments on the ",[240,5663,5666],{"href":5664,"rel":5665},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg\u002Fblob\u002Fmain\u002Fcyber-resilience-sig\u002Fdeliverables.md#25-comments-on-cencenelec-pt-1-standard",[243],"CEN\u002FCENELEC PT 1 Standard",", and provided feedback on the proposed ",[240,5669,5672],{"href":5670,"rel":5671},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg\u002Fblob\u002Fmain\u002Fcyber-resilience-sig\u002Fdeliverables.md#26-feedback-on-cybersecurity-act-csa-revision",[243],"Cybersecurity Act (CSA) Revision",". We also offered further refinements to the ",[240,5675,5678],{"href":5676,"rel":5677},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg\u002Fblob\u002Fmain\u002Fcyber-resilience-sig\u002Fdeliverables.md#27-comments-to-eu-guidance-on-open-source",[243],"EU’s guidance on open source"," in general. These submissions reflect the ORC’s growing role as a trusted voice in the policy conversation around open source and cybersecurity in Europe.",[202,5681,5682],{},"To improve the community’s efficiency, we have refined our internal review and feedback process, enabling us to respond more quickly and effectively to fast-moving developments. This momentum puts us in a strong position to continue influencing these conversations in a way that represents the interests of the open source community.",[202,5684,5685,325,5687,5689],{},[292,5686,1497],{},[1499,5688],{},[292,5690,1503],{},[271,5692,1506],{"id":273},[278,5694,5695,5702,5711,5719,5728,5762],{},[281,5696,5697,5698,5701],{},"Save the date for ",[240,5699,469],{"href":4542,"rel":5700},[243],". Preparations are already in motion for the first edition of Code and Compliance Community Day, set to take place in Brussels on October 22 and 23. If you’re interested in shaping the program or contributing to the content, now is the time to get involved.",[281,5703,5704,5705,5710],{},"The first drafts of the horizontal standards from CEN\u002FCENELEC have been released for internal review. The ORC submitted ",[240,5706,5709],{"href":5707,"rel":5708},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg\u002Fblob\u002Fmain\u002Fcyber-resilience-sig\u002Fcoordination\u002Fcen-cenelec-wg-9\u002Fdeliverable-2-5.md",[243],"feedback to PT1"," and is currently preparing input for Part 3 (PT3).",[281,5712,5713,5714,487],{},"While the CRA remains the core focus of the Working Group, we’ve also provided consolidated input on related legislative efforts, including the proposed revisions to the Cybersecurity Act (CSA). You can read our comments ",[240,5715,5718],{"href":5716,"rel":5717},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg\u002Fblob\u002Fmain\u002Fcyber-resilience-sig\u002Fcoordination\u002Fenisa\u002Fdeliverable-2-6.md",[243],"here",[281,5720,5721,5722,5727],{},"The ORC community collaborated to deliver ",[240,5723,5726],{"href":5724,"rel":5725},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg\u002Fblob\u002Fmain\u002Fcyber-resilience-sig\u002Fcoordination\u002Feuropean-commission\u002Fdeliverable-2-8.md",[243],"feedback on the European Commission’s consultation on the Standardisation Regulation No 1025\u002F2012",". Our response emphasised how the process can evolve to better accommodate the open source ecosystem as an essential stakeholder.",[281,5729,5730,5731,5735,5736],{},"Our weekly ",[240,5732,366],{"href":5733,"rel":5734},"https:\u002F\u002Fwww.youtube.com\u002Fplaylist?list=PLy7t4z5SYNaT-DjqGR0ORSSZGZYW8qmRs",[243]," series is taking a break over the summer months.  If you missed any of the discussions, now’s a great time to catch up on the recordings and stay informed on the latest CRA-related topics, including:",[278,5737,5738,5745,5752,5759],{},[281,5739,5740],{},[240,5741,5744],{"href":5742,"rel":5743},"https:\u002F\u002Fyoutu.be\u002FSP1xjDDLt9U?si=oINjRY8IHMy1NBxi",[243],"The CRA: Why even your fridge might need a lawyer",[281,5746,5747],{},[240,5748,5751],{"href":5749,"rel":5750},"https:\u002F\u002Fyoutu.be\u002F5t9EGPTll64?si=eY7lCE-vaSLRHmvO",[243],"Supply-chain Levels for Software Artifacts (SLSA)",[281,5753,5754],{},[240,5755,5758],{"href":5756,"rel":5757},"https:\u002F\u002Fyoutu.be\u002F7CbHwsKVD80?si=CXlxksgYXEeQdL8H",[243],"How to stop worrying and love the NLF",[281,5760,5761],{},"And more",[281,5763,5764,5765,5800,5802,5803,487],{},"The ORC is currently developing a series of white papers focused on key aspects of cybersecurity and open source. Topics include:",[278,5766,5767,5774,5781,5788,5795],{},[281,5768,5769],{},[240,5770,5773],{"href":5771,"rel":5772},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg\u002Fblob\u002Fmain\u002Fcyber-resilience-sig\u002Fdeliverables.md#31-white-paper-on-sboms",[243],"SBOMs",[281,5775,5776],{},[240,5777,5780],{"href":5778,"rel":5779},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg\u002Fblob\u002Fmain\u002Fcyber-resilience-sig\u002Fdeliverables.md#32-white-paper-on-due-diligence-obligation-of-manufacturers",[243],"Due diligence obligation of manufacturers",[281,5782,5783],{},[240,5784,5787],{"href":5785,"rel":5786},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg\u002Fblob\u002Fmain\u002Fcyber-resilience-sig\u002Fdeliverables.md#33-white-paper-on-security-attestations",[243],"Security attestations",[281,5789,5790],{},[240,5791,5794],{"href":5792,"rel":5793},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg\u002Fblob\u002Fmain\u002Fcyber-resilience-sig\u002Fdeliverables.md#34-white-paper-on-types-of-open-source-projects",[243],"Types of open source projects",[281,5796,5797],{},[240,5798,2212],{"href":5210,"rel":5799},[243],[1499,5801],{},"If you’re interested in contributing your expertise or reviewing drafts, we welcome your participation. Learn more and get involved on ",[240,5804,525],{"href":5805,"rel":5806},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg\u002Fblob\u002Fmain\u002Fcyber-resilience-sig\u002Fdeliverables.md#3-white-papers",[243],[271,5808,1589],{"id":1588},[202,5810,5811],{},[240,5812,5815],{"href":5813,"rel":5814},"https:\u002F\u002Fmastodon.social\u002F@bagder\u002F114835333719454616",[243],[1597,5816],{"alt":5817,"src":5818},"Daniel Stenberg's Mastodon post linked to his article Cyber Risk Assessment Request","\u002Fblog\u002Forc-monthly-july2025\u002Fimages\u002Fjuly-overheard.png",[202,5820,5821,5822],{},"We’re also on Mastodon: ",[240,5823,5826],{"href":5824,"rel":5825},"https:\u002F\u002Fmastodon.social\u002F@orcwg@fosstodon.org",[243],"@orcwg",[271,5828,1603],{"id":426},[278,5830,5831,5839,5844,5849,5856],{},[281,5832,5833,5838],{},[240,5834,5837],{"href":5835,"rel":5836},"https:\u002F\u002Fevents.linuxfoundation.org\u002Fopen-source-summit-europe\u002F",[243],"Open Source Summit Europe"," | 25 - 27 August 2025",[281,5840,5841,5313],{},[240,5842,5312],{"href":5310,"rel":5843},[243],[281,5845,5846,5329],{},[240,5847,5328],{"href":5326,"rel":5848},[243],[281,5850,5851,5855],{},[240,5852,5854],{"href":5334,"rel":5853},[243],"Nordic Software Security Summi","t | 1-3 October 2025",[281,5857,5858,4687],{},[240,5859,4458],{"href":4542,"rel":5860},[243],[271,5862,1640],{"id":1639},[278,5864,5865,5872,5879,5886,5889],{},[281,5866,5867],{},[240,5868,5871],{"href":5869,"rel":5870},"https:\u002F\u002Fyoutu.be\u002F5t9EGPTll64?si=E0qgPU9-dwcXM01T",[243],"CRA Mondays | Supply-chain Levels for Software Artifacts (SLSA) | Arnaud Le Hors",[281,5873,5874],{},[240,5875,5878],{"href":5876,"rel":5877},"https:\u002F\u002Fyoutu.be\u002FSP1xjDDLt9U?si=Dl-i1MVQhuauDikq",[243],"CRA Mondays | The CRA: Why even your fridge might need a lawyer | Pedro Demolder",[281,5880,5881],{},[240,5882,5885],{"href":5883,"rel":5884},"https:\u002F\u002Fyoutu.be\u002FgSonHFkmuyQ?si=JHF9TQCEJaPIifFG",[243],"Unpacking the CRA: From Draft to Delivery – ORC Working Group’s first deliverables",[281,5887,5888],{},"Digital Enterprise Show - Malaga June 2025",[281,5890,5891,5896],{},[240,5892,5895],{"href":5893,"rel":5894},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg\u002Ftree\u002Fmain\u002Fevents\u002F2025-07-global-digital-collaboration",[243],"Global Digital Collaboration Conference"," - well-attended sessions on “Soverign by Design”",[202,5898,5899],{},[240,5900,5902],{"href":5813,"rel":5901},[243],[1597,5903],{"alt":5904,"src":5905},"Speaker at Global Digital Collaboration Conference","\u002Fblog\u002Forc-monthly-july2025\u002Fimages\u002Fjuly-events.png",[271,5907,3201],{"id":3200},[202,5909,5910],{},"The following members joined in June and July 2025:",[278,5912,5913,5920,5927,5934,5941,5947],{},[281,5914,5915],{},[240,5916,5919],{"href":5917,"rel":5918},"https:\u002F\u002Fwww.eclipse.org\u002Fmembership\u002Fshow-member\u002F?member_id=731",[243],"Red Hat",[281,5921,5922],{},[240,5923,5926],{"href":5924,"rel":5925},"https:\u002F\u002Fwww.eclipse.org\u002Fmembership\u002FshowMember.php?member_id=1592",[243],"Google",[281,5928,5929],{},[240,5930,5933],{"href":5931,"rel":5932},"https:\u002F\u002Fwww.eclipse.org\u002Fmembership\u002FshowMember.php?member_id=1752",[243],"Open Source Matters",[281,5935,5936],{},[240,5937,5940],{"href":5938,"rel":5939},"https:\u002F\u002Fwww.eclipse.org\u002Fmembership\u002FshowMember.php?member_id=1697",[243],"Ekxide IO",[281,5942,5943],{},[240,5944,525],{"href":5945,"rel":5946},"https:\u002F\u002Fwww.eclipse.org\u002Fmembership\u002FshowMember.php?member_id=1754",[243],[281,5948,5949],{},[240,5950,5953],{"href":5951,"rel":5952},"https:\u002F\u002Fwww.eclipse.org\u002Fmembership\u002Fshow-member\u002F?member_id=1196",[243],"Microsoft",[271,5955,1659],{"id":490},[278,5957,5958,5963,5968],{},[281,5959,5960],{},[240,5961,1667],{"href":98,"rel":5962},[243],[281,5964,5965],{},[240,5966,1674],{"href":1672,"rel":5967},[243],[281,5969,5970],{},[240,5971,1680],{"href":4760,"rel":5972},[243],{"title":200,"searchDepth":208,"depth":208,"links":5974},[5975,5976,5977,5978,5979,5980],{"id":273,"depth":208,"text":1506},{"id":1588,"depth":208,"text":1589},{"id":426,"depth":208,"text":1603},{"id":1639,"depth":208,"text":1640},{"id":3200,"depth":208,"text":3201},{"id":490,"depth":208,"text":1659},{"path":5982,"title":5983,"date":5984,"author":669,"summary":190,"visibility":190,"body":5985},"\u002Fblog\u002Fstd-code-complaince-2025","Save the Date: Code and Compliance Community Day 2025","2025-07-15",{"type":192,"value":5986,"toc":6041},[5987,6002,6010,6021,6038],[202,5988,5989,5990,5993,5994,5997,5998,6001],{},"We’re excited to announce ",[261,5991,5992],{},"Code and Compliance Community Day 2025",", a two-part event taking place ",[261,5995,5996],{},"October 22–23, 2025",", in ",[261,5999,6000],{},"Brussels, Belgium",". This new event builds on the momentum of recent community gatherings and ongoing collaboration around open source and regulatory compliance.",[202,6003,6004,6005,6009],{},"Designed to support the growing ",[240,6006,6008],{"href":892,"rel":6007},[243],"Open Regulatory Compliance"," (ORC) community, this gathering will explore how to align open source development practices with evolving global regulations. Whether you’re already part of the ORC Working Group or newly interested in building trusted and compliant open source technologies, this event offers valuable insights and connections.",[202,6011,6012,6013,6016,6017,6020],{},"The program will kick off with an ",[261,6014,6015],{},"afternoon session on October 22",", followed by a ",[261,6018,6019],{},"full day of talks and discussions on October 23",". We’re working closely with the ORC community to shape a program that reflects the priorities and needs of contributors, adopters, and stakeholders across regulated industries.",[202,6022,6023,6024,6027,6028,6030,6031,325,6034],{},"📅 ",[261,6025,6026],{},"Save the date"," and make plans to join us in Brussels!",[1499,6029],{},"\n📝 ",[261,6032,6033],{},"Registration is now open.",[240,6035,6037],{"href":4542,"rel":6036},[243],"Learn more and register here.",[202,6039,6040],{},"We look forward to seeing you there.",{"title":200,"searchDepth":208,"depth":208,"links":6042},[],{"path":6044,"title":6045,"date":6046,"author":669,"summary":190,"visibility":190,"body":6047},"\u002Fblog\u002Fmm-recap","Maintainer Month Recap: What the CRA Means for You","2025-06-20",{"type":192,"value":6048,"toc":6184},[6049,6064,6068,6081,6085,6102,6106,6122,6126,6129,6158,6165,6169,6181],[202,6050,6051,6052,6059,6060,487],{},"Last month we teamed up with GitHub to host ",[292,6053,5601,6054,5606],{},[240,6055,6058],{"href":6056,"rel":6057},"https:\u002F\u002Fwww.youtube.com\u002Flive\u002FDLxZdU8kzxM?si=gozZMsz91lj-c1j2",[243],"The Cyber Resilience Act and Open Source: What Maintainers Really Need to Know"," The one-hour panel zeroed in on the top worries we hear from open source project maintainers and contributors. Below is a recap—and, more importantly, where you’ll find the detailed answers in the ORC working group’s ",[240,6061,90],{"href":6062,"rel":6063},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-hub\u002Fblob\u002Fmain\u002Ffaq.md",[243],[271,6065,6067],{"id":6066},"_1-does-the-cra-actually-apply-to-my-project","1. “Does the CRA actually apply to my project?”",[202,6069,6070,6071,6074,6075,6080],{},"The panel’s first takeaway was simple: most volunteer-run FOSS projects ",[261,6072,6073],{},"are not manufacturers"," under the law. If you just publish code on GitHub, chances are you’re out of scope. The CRA only kicks in when software is shipped as part of a “product with digital elements.” For the fine print—including the edge-cases the speakers walked through—see “",[240,6076,6079],{"href":6077,"rel":6078},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-hub\u002Fblob\u002Fmain\u002Ffaq.md#faq-tmp-133b",[243],"Am I subject to the CRA?","” in the FAQ.",[271,6082,6084],{"id":6083},"_2-what-happens-if-i-accept-donations-or-sponsorships","2. “What happens if I accept donations or sponsorships?”",[202,6086,6087,6088,6091,6092,6095,6096,6101],{},"A second hot topic was whether a project starts looking like a ",[292,6089,6090],{},"manufacturer"," once money changes hands. The consensus: taking GitHub Sponsors or ad-hoc donations ",[261,6093,6094],{},"does not, by itself, turn you into a CRA manufacturer or steward."," The law focuses on commercial placement of products, not community fundraising. Check the FAQ entry on ",[240,6097,6100],{"href":6098,"rel":6099},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-hub\u002Fblob\u002Fmain\u002Ffaq.md#faq-tmp-133c",[243],"monetising open source projects"," for the nuances.",[271,6103,6105],{"id":6104},"_3-will-i-be-fined-if-something-goes-wrong","3. “Will I be fined if something goes wrong?”",[202,6107,6108,6109,6112,6113,6116,6117,487],{},"Finally, the panel addressed the elephant in the room: penalties. Under the current text, liability sits with the entity that ",[292,6110,6111],{},"places"," the product on the EU market. ",[261,6114,6115],{},"Maintainers therefore face no fines unless they also meet the definition of a manufacturer or steward."," Even so, the panel urged projects to document their release process and spell out who does what. For the full breakdown, see the FAQ section on ",[240,6118,6121],{"href":6119,"rel":6120},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-hub\u002Fblob\u002Fmain\u002Ffaq.md#faq-tmp-133d",[243],"penalties for maintainers",[271,6123,6125],{"id":6124},"still-curious-check-the-cra-faq","Still Curious? Check the CRA FAQ",[202,6127,6128],{},"We ran out of time before we could tackle every audience question, but many of them are already answered in the working group’s living CRA FAQ. Here are three good examples:",[278,6130,6131,6140,6149],{},[281,6132,6133,6134,6139],{},"“How can a commercial producer keep track of all the indirect dependencies pulled in by package managers?” The discussion “",[240,6135,6138],{"href":6136,"rel":6137},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-hub\u002Fissues\u002F87",[243],"What do I need to do about my dependencies?","” covers this topic.",[281,6141,6142,6143,6148],{},"“What exactly qualifies as a ‘Product with Digital Elements’ under the CRA?” The answer under “",[240,6144,6147],{"href":6145,"rel":6146},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-hub\u002Fblob\u002Fmain\u002Ffaq.md#faq-tmp-2",[243],"What kinds of products are regulated by the CRA?","” may help provide some clarity.",[281,6150,6151,6152,6157],{},"“Where does the CRA overlap with the proposed Product Liability Directive (PLD)?” See the open discussion “",[240,6153,6156],{"href":6154,"rel":6155},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-hub\u002Fissues\u002F76",[243],"How do I respond to a legal challenge?","”",[202,6159,6160,6161,6164],{},"You’ll find these answers—and many more in progress—inside the ",[240,6162,729],{"href":6062,"rel":6163},[243],". If your question isn’t covered yet, open an issue or add a comment so the community can tackle it together.",[271,6166,6168],{"id":6167},"keep-learning-stay-involved","Keep Learning & Stay Involved",[202,6170,6171,6172,6175,6176,6180],{},"The CRA is evolving, and so is the guidance. Bookmark the full ",[240,6173,90],{"href":6062,"rel":6174},[243]," and drop your questions—or pull requests—there. If you missed the live stream, you can ",[240,6177,6179],{"href":6056,"rel":6178},[243],"watch the replay"," anytime on YouTube.",[202,6182,6183],{},"Open discussion is how we protect open source. Let’s keep the conversation going.",{"title":200,"searchDepth":208,"depth":208,"links":6185},[6186,6187,6188,6189,6190],{"id":6066,"depth":208,"text":6067},{"id":6083,"depth":208,"text":6084},{"id":6104,"depth":208,"text":6105},{"id":6124,"depth":208,"text":6125},{"id":6167,"depth":208,"text":6168},{"path":6192,"title":6193,"date":6194,"author":669,"summary":190,"visibility":190,"body":6195},"\u002Fblog\u002Forc-monthly-may2025","ORC Monthly: Deliverables Plan in Motion, New Task Force Forming and CRA Maintainers Recap","2025-06-04",{"type":192,"value":6196,"toc":6418},[6197,6211,6219,6221,6263,6267,6297,6299,6307,6316,6319,6321,6353,6355,6391,6399,6401],[202,6198,6199,6200,6204,6205,6210],{},"We’re pleased to share that we’ve moved from planning to execution. The ",[240,6201,6203],{"href":4825,"rel":6202},[243],"Cyber Resilience SIG’s deliverables plan"," has been expanded with clear, actionable projects, which will each be supported by a dedicated task force. This marks a significant milestone in our collective efforts to operationalise our goals. We invite all interested community members to get involved: whether by joining a task force aligned with your expertise or stepping up as a contributor. Check out the list of ",[240,6206,6209],{"href":6207,"rel":6208},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg\u002Ftree\u002Fmain\u002Fcyber-resilience-sig#current-task-forces",[243],"current task forces and their leads"," and reach out directly to participate.",[202,6212,6213,6215,6217],{},[292,6214,1497],{},[1499,6216],{},[292,6218,1503],{},[271,6220,1506],{"id":273},[278,6222,6223,6236,6244,6247,6255],{},[281,6224,6225,6230,6231,6235],{},[240,6226,6229],{"href":6227,"rel":6228},"https:\u002F\u002Fmaintainermonth.github.com\u002Fschedule\u002F2025-05-27-CRA",[243],"CRA for maintainers webinar"," was a blast – full of energy, good questions from a deeply engaged audience, and strong support for the community-driven ",[240,6232,90],{"href":6233,"rel":6234},"https:\u002F\u002Fgithub.com\u002Forgs\u002Forcwg\u002Fprojects\u002F7",[243],". It was a standout session in this year’s Maintainer Month.",[281,6237,609,6238,6243],{},[240,6239,6242],{"href":6240,"rel":6241},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-hub\u002Fblob\u002Fmain\u002Finventory.md",[243],"inventory of CRA resources"," is now under community review. Don’t miss the opportunity to provide your feedback on it.",[281,6245,6246],{},"Discussions are ongoing across multiple ESO-led meetings (CEN\u002FCENELEC and ETSI), and members of the ORC community are participating to help represent open source perspectives. One highlight: vulnerability reporting is now being tackled by a dedicated task force. If you care about this topic, stay tuned and join the Task Force.",[281,6248,6249,6250,487],{},"Inspired by conversations with stakeholders less familiar with how open source operates, the ORC WG has started working on a ",[240,6251,6254],{"href":6252,"rel":6253},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-hub\u002Fblob\u002Fproject-types\u002Fwhite-papers\u002Fproject-types\u002Fproject-types.md",[243],"white paper on types of open source projects",[281,6256,6257,6258,487],{},"Interest in CRA-related discussions is growing across events and conferences. During our latest outreach and engagement call, we talked about ways to coordinate participation and create shared assets to support speakers. You’ll find more details in the ",[240,6259,6262],{"href":6260,"rel":6261},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg\u002Fblob\u002Fmain\u002Foutreach-and-engagement\u002Fminutes\u002F2025\u002F2025-05-22-MoM-orcwg-outreach-and-engagement.md",[243],"meeting minutes",[271,6264,6266],{"id":6265},"top-conversations-in-the-cra-faq","Top Conversations in the CRA FAQ",[278,6268,6269,6276,6283,6290],{},[281,6270,6271,6272],{},"Under the CRA, do I need to notify ENISA of all vulnerabilities in my project? I’ve heard about a 24h rule - ",[240,6273,6274],{"href":6274,"rel":6275},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-hub\u002Fissues\u002F32",[243],[281,6277,6278,6279],{},"Bad evil software with vulnerabilities for training and education - ",[240,6280,6281],{"href":6281,"rel":6282},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-hub\u002Fissues\u002F235",[243],[281,6284,6285,6286],{},"I am building an embedded O\u002FS with Yocto and selling a product with it. Is the product an “important product”?- ",[240,6287,6288],{"href":6288,"rel":6289},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-hub\u002Fissues\u002F193",[243],[281,6291,6292,6293],{},"What are the implications for stewards that don’t comply with CRA - ",[240,6294,6295],{"href":6295,"rel":6296},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-hub\u002Fissues\u002F216",[243],[271,6298,1589],{"id":1588},[202,6300,6301,6302,6306],{},"The ORC working group partnered with GitHub to present “",[240,6303,6058],{"href":6304,"rel":6305},"https:\u002F\u002Fwww.youtube.com\u002Flive\u002FDLxZdU8kzxM?si=-5KRopxPbUdencNn",[243],"” as part of maintainer month.",[6308,6309,6310],"media",{},[202,6311,6312],{},[1597,6313],{"alt":6314,"src":6315},"Social media image of Maintianer month stream","\u002Fblog\u002Forc-monthly-may2025\u002Fimages\u002Fmay-overheard.png",[202,6317,6318],{},"With over 200 live attendees, 1000+ views in 12 hours following the event, and over 100 comments during the session, it was a great talk shared with our community and allowed us to reach new people.",[271,6320,1603],{"id":426},[278,6322,6323,6331],{},[281,6324,6325,6330],{},[240,6326,6329],{"href":6327,"rel":6328},"https:\u002F\u002Fwww.des-show.com\u002F",[243],"Digital Enterprise Show"," | 10-12 June 2025",[281,6332,6333,6338,6339,6341,6342,6347,6348,487],{},[240,6334,6337],{"href":6335,"rel":6336},"https:\u002F\u002Flu.ma\u002Fgc25",[243],"Global Collaboration on Wallets and Credentials"," | 1-2 July 2025 | Geneva",[1499,6340],{},"\nORC will be partnering with the ",[240,6343,6346],{"href":6344,"rel":6345},"https:\u002F\u002Fdataspace.eclipse.org\u002F",[243],"Eclipse Dataspace Working Group"," to plan a breakout session, ",[240,6349,6352],{"href":6350,"rel":6351},"https:\u002F\u002Fglobaldigitalcollaboration.org\u002Fagenda?day=2025-07-02",[243],"“Sovereignty by Design: Regulatory Compliance, the CRA” on Day 2",[271,6354,1640],{"id":1639},[278,6356,6357,6364,6369,6376,6383],{},[281,6358,6359],{},[240,6360,6363],{"href":6361,"rel":6362},"https:\u002F\u002Fyoutu.be\u002FzSsGLJTgWvU",[243],"CRA Mondays | Olle E. Johansson - The path to a global vulnerability management platform",[281,6365,6366],{},[240,6367,6058],{"href":6304,"rel":6368},[243],[281,6370,6371],{},[240,6372,6375],{"href":6373,"rel":6374},"https:\u002F\u002Fyoutu.be\u002F7CbHwsKVD80?si=rH-4fwhIHKNpPM1y",[243],"CRA Mondays | How to stop worrying and love the NLF - Fukami",[281,6377,6378],{},[240,6379,6382],{"href":6380,"rel":6381},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg\u002Ftree\u002Fmain\u002Fevents\u002Fcra-mondays#%EF%B8%8F-may-12-2025-maxim-baele-on-owasp-samm",[243],"CRA Mondays | OWASP SAMM - Maxim Baele",[281,6384,6385,6390],{},[240,6386,6389],{"href":6387,"rel":6388},"https:\u002F\u002Fwww.automotive-oss.org\u002F",[243],"Automotive Open Source Summit"," - We hosted an ORC table to share insights on how the CRA may affect open source, connecting with members from various automotive initiatives.",[6308,6392,6393],{},[202,6394,6395],{},[1597,6396],{"alt":6397,"src":6398},"ORC booth at Automotive Open Source Summit","\u002Fblog\u002Forc-monthly-may2025\u002Fimages\u002Fmay-events.png",[271,6400,1659],{"id":490},[278,6402,6403,6408,6413],{},[281,6404,6405],{},[240,6406,1667],{"href":98,"rel":6407},[243],[281,6409,6410],{},[240,6411,1674],{"href":1672,"rel":6412},[243],[281,6414,6415],{},[240,6416,1680],{"href":4760,"rel":6417},[243],{"title":200,"searchDepth":208,"depth":208,"links":6419},[6420,6421,6422,6423,6424,6425],{"id":273,"depth":208,"text":1506},{"id":6265,"depth":208,"text":6266},{"id":1588,"depth":208,"text":1589},{"id":426,"depth":208,"text":1603},{"id":1639,"depth":208,"text":1640},{"id":490,"depth":208,"text":1659},{"path":6427,"title":6428,"date":6429,"author":669,"summary":190,"visibility":190,"body":6430},"\u002Fblog\u002Fmm-felix-reda","Maintainer Month Speaker Spotlight: Felix Reda","2025-05-26",{"type":192,"value":6431,"toc":6551},[6432,6438,6441,6450,6453,6457,6460,6464,6467,6471,6480,6484,6498,6506,6514,6518],[202,6433,6434,6435,5606],{},"As part of Maintainer Month—a time to recognize and support the open source maintainers who keep our digital infrastructure running—Open Regulatory Compliance (ORC) is hosting a special panel on 27 May. Among the featured speakers is Felix Reda, who will share insights in the session titled, “",[240,6436,6058],{"href":6227,"rel":6437},[243],[202,6439,6440],{},"Felix (he\u002Fthey) is the Director of Developer Policy at GitHub. He has been shaping digital policy for over ten years, including serving as a Member of the European Parliament from 2014 to 2019. His areas of interest encompass copyright, freedom of expression, and the sustainability of the open source ecosystem. Felix serves on the board of the Open Knowledge Foundation Germany. He holds an M.A. in Political Science and Communications Science from the University of Mainz, Germany.",[6308,6442,6444],{"size":6443},"natural",[202,6445,6446],{},[1597,6447],{"alt":6448,"src":6449},"Felix Reda","\u002Fblog\u002Fmm-felix-reda\u002Fimages\u002Ffelix.png",[202,6451,6452],{},"We asked Felix a couple of questions so that attendees could learn a bit more about his work and his thoughts on the Cyber Resilience Act in advance of the session later this month.",[271,6454,6456],{"id":6455},"can-you-tell-us-a-bit-about-your-background-including-your-work-with-cybersecurity-andor-the-cyber-resilience-act-cra","Can you tell us a bit about your background, including your work with cybersecurity and\u002For the Cyber Resilience Act (CRA)?",[202,6458,6459],{},"I am a former Member of the European Parliament. When I got elected in 2014, open source was not a subject of EU laws and rarely featured in policy discussions. I managed to convince the European Commission to start spending part of the EU budget on the security of open source software after the Heartbleed vulnerability (EU-FOSSA pilot project) and included an early mention of free and open source software in the 2019 Digital Content Directive. Just like with the CRA, my objective back then was to ensure that regulation would support open source developers rather than burdening them with regulations that fail to consider their contributions to the public interest. I think the negotiations on the Cyber Resilience Act has shown that the EU legislator has been willing to learn about open source, but we will have to continue to work together across government, industry, and the open source community to get the details of the legislation right.",[271,6461,6463],{"id":6462},"how-would-you-describe-the-cra-to-someone-who-doesnt-understand-it-why-should-we-care","How would you describe the CRA to someone who doesn’t understand it? Why should we care?",[202,6465,6466],{},"The CRA has a noble goal: To protect consumers of software products from all kinds of cyber threats. Nobody wants their smart fridge to become part of a botnet or their smartphone to stop receiving security updates just a couple of years after purchase. The CRA makes software manufacturers responsible for the security of their offerings. Where it gets tricky is when trying to assign that responsibility in complex supply chains that include a lot of under-resourced, critical open source components. The CRA generally puts the responsibility on those commercialising the software, but the devil lies in the details. We want to balance the laudable goal of increased software security with keeping the barriers of entry to open source development low and making sure that open source maintainers are supported in their hard work for the public good.",[271,6468,6470],{"id":6469},"how-do-you-see-the-cra-impacting-open-source-projects-and-the-people-who-maintain-them","How do you see the CRA impacting open source projects and the people who maintain them?",[202,6472,6473,6474,6479],{},"I think the software industry will adapt to tighter cybersecurity legislation, but making sure that solo maintainers or small projects that don’t have the resources to hire a lawyer know exactly what to do will be the greatest challenge. That’s why we are working with the European Commission and the open source community on guidance that should bring greater clarity about which open source projects fall under the CRA and which do not. GitHub has ",[240,6475,6478],{"href":6476,"rel":6477},"https:\u002F\u002Fgithub.blog\u002Fopen-source\u002Fmaintainers\u002Fwhat-the-eus-new-software-legislation-means-for-developers\u002F",[243],"published a blog post"," that summarises key passages of the law, but open questions remain that should be answered in the guidance.",[271,6481,6483],{"id":6482},"what-advice-would-you-give-to-maintainers-of-open-source-software-right-now-what-steps-should-they-be-taking-if-any","What advice would you give to maintainers of open source software right now? What steps should they be taking, if any?",[202,6485,6486,6487,6492,6493,487],{},"If you receive a scary-looking letter full of legalese from a company demanding that you demonstrate your compliance with the Cyber Resilience Act, don’t panic! The reason the company is contacting you is most likely that the company is legally required to ensure its open source dependencies are secure - that doesn’t automatically mean that any legal obligations fall on you. In the best case, the company will offer to help you invest in security and contribute its own vulnerability fixes back to the project. That can even end up benefiting your project and its users. GitHub offers security resources such as the ",[240,6488,6491],{"href":6489,"rel":6490},"https:\u002F\u002Fresources.github.com\u002Fgithub-secure-open-source-fund\u002F",[243],"GitHub Secure Open Source Fund",", or our ",[240,6494,6497],{"href":6495,"rel":6496},"https:\u002F\u002Fopensource.guide\u002Fsecurity-best-practices-for-your-project\u002F",[243],"Open Source Guide: Security Best Practices for Your Project",[6308,6499,6500],{},[202,6501,6502],{},[1597,6503],{"alt":6504,"src":6505},"Maintainer month panelists' headshots","\u002Fblog\u002Fmm-felix-reda\u002Fimages\u002Fcra-mm.png",[202,6507,6508,6513],{},[240,6509,6512],{"href":6510,"rel":6511},"https:\u002F\u002Fcalendar.google.com\u002Fcalendar\u002Fevent?action=TEMPLATE&tmeid=NmM2dGcyZjNqMTNjZGwxYXZudWVzdGhjbWIgY183ZGI4ZTNmMTNjNGZhYzk4NDEwMzkxOGE5N2M3MDRiYjFkNjE5ZGEwZmRiNjZkMzNmMTc0Nzg0OWI2MDIwYWVhQGc&tmsrc=c_7db8e3f13c4fac984103918a97c704bb1d619da0fdb66d33f1747849b6020aea%40group.calendar.google.com",[243],"Add it to your calendar"," to join.",[271,6515,6517],{"id":6516},"participate-with-the-orc","Participate with the ORC",[278,6519,6520,6536,6541,6546],{},[281,6521,6522,6523,1106,6528,1110,6532],{},"Follow us on social: ",[240,6524,6527],{"href":6525,"rel":6526},"https:\u002F\u002Fbsky.app\u002Fprofile\u002Forcwg.bsky.social",[243],"BlueSky",[240,6529,32],{"href":6530,"rel":6531},"https:\u002F\u002Fwww.linkedin.com\u002Fshowcase\u002F105844805\u002Fadmin\u002Fdashboard\u002F",[243],[240,6533,36],{"href":6534,"rel":6535},"https:\u002F\u002Fwww.youtube.com\u002Fplaylist?list=PLy7t4z5SYNaQEyXv253SI6PDdPjbYXcNV",[243],[281,6537,6538],{},[240,6539,1667],{"href":98,"rel":6540},[243],[281,6542,6543],{},[240,6544,1674],{"href":1672,"rel":6545},[243],[281,6547,6548],{},[240,6549,1680],{"href":4760,"rel":6550},[243],{"title":200,"searchDepth":208,"depth":208,"links":6552},[6553,6554,6555,6556,6557],{"id":6455,"depth":208,"text":6456},{"id":6462,"depth":208,"text":6463},{"id":6469,"depth":208,"text":6470},{"id":6482,"depth":208,"text":6483},{"id":6516,"depth":208,"text":6517},{"path":6559,"title":6560,"date":6561,"author":669,"summary":190,"visibility":190,"body":6562},"\u002Fblog\u002Fmm-maarten-aertsen","Maintainer Month Speaker Spotlight: Maarten Aertsen","2025-05-22",{"type":192,"value":6563,"toc":6673},[6564,6570,6573,6581,6584,6588,6597,6599,6602,6605,6608,6612,6615,6618,6622,6625,6628,6631,6638,6643,6645],[202,6565,6566,6567,5606],{},"In honour of Maintainer Month, Open Regulatory Compliance (ORC) will host a panel with GitHub on 27 May focused on one of the most pressing topics facing open source maintainers today. Maarten Aertsen is among the expert speakers featured in the discussion, “",[240,6568,6058],{"href":6227,"rel":6569},[243],[202,6571,6572],{},"Maarten is an engineer interested in the legal, social and economic factors underlying the Internet’s core technologies. He works as senior internet technologist at NLnet Labs, a small, independent public benefit organisation contributing to the robustness, security and reliability of the Internet and the privacy of its users. It’s open source software and work on open standards for the Domain Name System and (safe) inter-domain routing are in use globally. Maarten serves on the ICANN Security and Stability Advisory Committee (SSAC), which engages in ongoing threat assessment and risk analysis of the Internet’s naming and address allocation services.",[6308,6574,6575],{"size":6443},[202,6576,6577],{},[1597,6578],{"alt":6579,"src":6580},"Maarten Aertsen","\u002Fblog\u002Fmm-maarten-aertsen\u002Fimages\u002Fmaarten.jpg",[202,6582,6583],{},"We asked Maarten a couple of questions so that attendees could learn a bit more about his work and his thoughts on the Cyber Resilience Act in advance of the session next week.",[271,6585,6587],{"id":6586},"can-you-tell-us-a-bit-about-your-background-including-your-work-with-the-cyber-resilience-act-cra","Can you tell us a bit about your background including your work with the Cyber Resilience Act (CRA)?",[202,6589,6590,6591,6596],{},"By sheer coincidence, I was one of the first people to look at the CRA’s implications for Free and Open Source Software (FOSS) and raise awareness to bring others in to engage with policy makers, back in Fall 2022. A tweet about my analysis got me in touch with the European Commission and thus started - what at times felt like a roller-coaster - to discover how policy-making in Brussels works. From then until the end of negotiations on December 15, 2023, raising awareness and channelling feedback soon became a significant time-investment. There’s a ",[240,6592,6595],{"href":6593,"rel":6594},"https:\u002F\u002Fblog.nlnetlabs.nl\u002Fwhat-i-learned-in-brussels-the-cyber-resilience-act\u002F#learning-foss-policy-engagement-from-scratch",[243],"lightning talk at FOSDEM"," on my journey, for those who are interested, but the bottom line is that I am quite familiar with how the CRA came about.",[271,6598,6463],{"id":6462},[202,6600,6601],{},"The CRA is the European Union introducing rules for digital products on its market. The aim of the law is to raise the floor on security practices amongst developers, generally, but puts obligations only where software is monetised. The CRA has a nuanced approach with respect to FOSS.",[202,6603,6604],{},"You should care about the rules the CRA introduces if you are making money on software in the EU. Or, if you are interested in understanding the first attempt to regulate the market for software.",[202,6606,6607],{},"Contributing to FOSS is not impacted. Individuals maintaining open source projects that are not monetising are not impacted either. Obligations for organisations maintaining open source projects are hard to summarise in a single sentence but are nuanced.",[271,6609,6611],{"id":6610},"from-your-perspective-what-are-the-biggest-opportunitiesor-challengesthe-cra-presents-for-the-tech-ecosystem","From your perspective, what are the biggest opportunities—or challenges—the CRA presents for the tech ecosystem?",[202,6613,6614],{},"Manufacturers, those that make money on software products on the EU market, will have obligations going forward. I believe most of the opportunities and challenges of the CRA for open source projects will flow from how manufacturers choose to act upon these obligations, in particular, in their interactions with upstream maintainers of dependencies they bundle into their products.",[202,6616,6617],{},"One of these obligations is to share security patches they apply to dependencies with the upstream maintainer. One change maintainers may therefore see, is more contributions from manufacturers. Notably, there is no obligation on a maintainer to engage. But I am personally hopeful that this obligation on manufacturers will move some of them from passive consumer to active contributor or supporter, with a positive effect on sustainability or security. We’ll know in a few years.",[271,6619,6621],{"id":6620},"what-are-some-common-misconceptions-about-the-cra-that-you-think-need-clearing-up","What are some common misconceptions about the CRA that you think need clearing up?",[202,6623,6624],{},"If you heard that the CRA will have a large impact on FOSS, your knowledge may be outdated. As a result of FOSS advocacy, the CRA changed substantially between the first proposal and the published law. And so many of the early concerns, including some of mine, are no longer an issue.",[202,6626,6627],{},"The CRA, as published, has a nuanced approach to FOSS. But for those that make money off software on the EU market, there are obligations. The law will be a game-changer for the software industry.",[202,6629,6630],{},"I hope the panel will help people forget outdated concerns, identify what the CRA means to them, and what steps they can take to learn more.",[6308,6632,6633],{},[202,6634,6635],{},[1597,6636],{"alt":6504,"src":6637},"\u002Fblog\u002Fmm-maarten-aertsen\u002Fimages\u002Fcra-mm.png",[202,6639,6640,6513],{},[240,6641,6512],{"href":6510,"rel":6642},[243],[271,6644,6517],{"id":6516},[278,6646,6647,6658,6663,6668],{},[281,6648,6522,6649,1106,6652,1110,6655],{},[240,6650,6527],{"href":6525,"rel":6651},[243],[240,6653,32],{"href":6530,"rel":6654},[243],[240,6656,36],{"href":6534,"rel":6657},[243],[281,6659,6660],{},[240,6661,1667],{"href":98,"rel":6662},[243],[281,6664,6665],{},[240,6666,1674],{"href":1672,"rel":6667},[243],[281,6669,6670],{},[240,6671,1680],{"href":4760,"rel":6672},[243],{"title":200,"searchDepth":208,"depth":208,"links":6674},[6675,6676,6677,6678,6679],{"id":6586,"depth":208,"text":6587},{"id":6462,"depth":208,"text":6463},{"id":6610,"depth":208,"text":6611},{"id":6620,"depth":208,"text":6621},{"id":6516,"depth":208,"text":6517},{"path":6681,"title":6682,"date":6683,"author":669,"summary":190,"visibility":190,"body":6684},"\u002Fblog\u002Fmm-daniel-stenberg","Maintainer Month Speaker Spotlight: Daniel Stenberg","2025-05-20",{"type":192,"value":6685,"toc":6773},[6686,6692,6695,6703,6706,6709,6712,6716,6719,6723,6726,6728,6731,6738,6743,6745],[202,6687,6688,6689,5606],{},"On 27 May, Open Regulatory Compliance (ORC) is hosting a panel in support of GitHub’s Maintainer Month, a month dedicated for open source maintainers to gather, share, and be celebrated. Daniel Stenberg is one of the speakers in the ORC’s panel, “",[240,6690,6058],{"href":6227,"rel":6691},[243],[202,6693,6694],{},"Daniel is a Swedish internet protocol expert and developer who has participated in and worked with open source for 30 years. He is most known for being the founder and lead developer of the curl project, one of the most widely used software components in the world.",[6308,6696,6697],{"size":6443},[202,6698,6699],{},[1597,6700],{"alt":6701,"src":6702},"Daniel Stenberg","\u002Fblog\u002Fmm-daniel-stenberg\u002Fimages\u002Fdaniel.jpg",[202,6704,6705],{},"We asked Daniel a couple of questions so that attendees could learn a bit more about his work and his thoughts on the Cyber Resilience Act in advance of the session later this month.",[271,6707,6708],{"id":6455},"Can you tell us a bit about your background including your work with cybersecurity and\u002For the Cyber Resilience Act (CRA)?",[202,6710,6711],{},"I’ve maintained and shipped a popular open source project for three decades. You cannot avoid working with cybersecurity when working with open source projects. Also, as we ship a product that runs in billions of devices and products, we have been trying to stay educated and informed about the CRA and how the CRA is going to affect us.",[271,6713,6715],{"id":6714},"what-do-you-hope-attendees-will-learn-from-your-panel-discussion","What do you hope attendees will learn from your panel discussion?",[202,6717,6718],{},"I hope the discussion will help distribute knowledge and awareness of the CRA. I hope attendees will learn not only that the CRA exists but also some of its fundamentals and how they are intended to work and affect (and not affect) open source projects.",[271,6720,6722],{"id":6721},"what-do-you-see-happening-in-the-open-source-ecosystem-that-is-helping-open-source-maintainers-navigate-the-cra","What do you see happening in the open source ecosystem that is helping open source maintainers navigate the CRA?",[202,6724,6725],{},"First, most small scale open source projects will not be affected at all by the CRA - and most open source projects are small scale. I think every open source project should do what we always do: strive towards gradually improving and continue to ship great stuff.",[271,6727,6621],{"id":6620},[202,6729,6730],{},"Potentially - and ideally - we will see a greater concern from those users of open source who build commercial products and services on top of open source components to contribute back and make sure the fundamentals they decide to build on are solid, secure, and safe. Meaning that even if CRA might not directly address most open source projects, the effect of the CRA might still mean that they get more attention from the ones who are affected by the CRA and are using those open source projects.",[6308,6732,6733],{},[202,6734,6735],{},[1597,6736],{"alt":6504,"src":6737},"\u002Fblog\u002Fmm-daniel-stenberg\u002Fimages\u002Fcra-mm.png",[202,6739,6740,6513],{},[240,6741,6512],{"href":6510,"rel":6742},[243],[271,6744,6517],{"id":6516},[278,6746,6747,6758,6763,6768],{},[281,6748,6522,6749,1106,6752,1110,6755],{},[240,6750,6527],{"href":6525,"rel":6751},[243],[240,6753,32],{"href":6530,"rel":6754},[243],[240,6756,36],{"href":6534,"rel":6757},[243],[281,6759,6760],{},[240,6761,1667],{"href":98,"rel":6762},[243],[281,6764,6765],{},[240,6766,1674],{"href":1672,"rel":6767},[243],[281,6769,6770],{},[240,6771,1680],{"href":4760,"rel":6772},[243],{"title":200,"searchDepth":208,"depth":208,"links":6774},[6775,6776,6777,6778,6779],{"id":6455,"depth":208,"text":6708},{"id":6714,"depth":208,"text":6715},{"id":6721,"depth":208,"text":6722},{"id":6620,"depth":208,"text":6621},{"id":6516,"depth":208,"text":6517},{"path":6781,"title":6782,"date":6783,"author":669,"summary":190,"visibility":190,"body":6784},"\u002Fblog\u002Fmm-save-the-date","Save the Date: ORC Celebrates GitHub Maintainer Month with CRA Panel","2025-05-12",{"type":192,"value":6785,"toc":6914},[6786,6793,6799,6802,6805,6822,6828,6870,6877,6884,6886],[202,6787,6788,6789,6792],{},"On 27 May, Open Regulatory Compliance is hosting a panel, “",[240,6790,6058],{"href":6227,"rel":6791},[243],",” which will be live-streamed by GitHub as part of Maintainer Month. Maintainer Month is a month dedicated for open source maintainers to gather and share helpful information, making it the perfect opportunity for ORC to unite industry experts to discuss the Cyber Resilience Act (CRA) and provide helpful guidance for maintainers to follow as they navigate new regulations.",[271,6794,6796],{"id":6795},"why-you-should-attend",[261,6797,6798],{},"Why You Should Attend",[202,6800,6801],{},"Many open source maintainers are concerned about their obligations under the EU Cyber Resilience Act. This webinar will clarify who is actually affected, what obligations apply, and how to determine if your project falls within the scope of the CRA. We’ll cut through the uncertainty and provide practical guidance to help maintainers understand their position.",[202,6803,6804],{},"Questions we’ll strive to cover during this panel discussion:",[278,6806,6807,6810,6813,6816,6819],{},[281,6808,6809],{},"Does the CRA apply to my open source project?",[281,6811,6812],{},"What’s the difference between a “manufacturer,” “steward,” and regular contributor?",[281,6814,6815],{},"How does accepting donations or sponsorships affect CRA obligations?",[281,6817,6818],{},"What minimal requirements apply to open source stewards?",[281,6820,6821],{},"How should maintainers respond to compliance requests from companies?",[271,6823,6825],{"id":6824},"event-details",[261,6826,6827],{},"Event Details",[202,6829,6023,6830,6833,6834,6836,6837,6840,6841,6843,6844,6847,6848,1720,6852,6856,6858,6859,6862,6863,6865,6866,6869],{},[261,6831,6832],{},"Date:"," 27 May 2025",[1499,6835],{},"\n🕒 ",[261,6838,6839],{},"Time:"," 6 pm CET \u002F 9 am PDT",[1499,6842],{},"\n📍 ",[261,6845,6846],{},"Location:"," Virtual; ",[240,6849,6851],{"href":6227,"rel":6850},[243],"Watch the stream",[240,6853,6855],{"href":6510,"rel":6854},[243],"add it to your calendar",[1499,6857],{},"\n💡 ",[261,6860,6861],{},"Who Should Attend:"," Any maintainers or members of the open source community whether seeking guidance or already engaging with the impact of the CRA.",[1499,6864],{},"\n🎟️ ",[261,6867,6868],{},"Cost:"," Free to attend!",[202,6871,6872,6873,6876],{},"Curious to see how the Open Regulatory Compliance Working Group is putting these ideas into practice? Check our ",[240,6874,525],{"href":1672,"rel":6875},[243]," and join the community.",[6308,6878,6879],{},[202,6880,6881],{},[1597,6882],{"alt":6504,"src":6883},"\u002Fblog\u002Fmm-save-the-date\u002Fimages\u002Fcra-mm.png",[271,6885,6517],{"id":6516},[278,6887,6888,6899,6904,6909],{},[281,6889,6522,6890,1106,6893,1110,6896],{},[240,6891,6527],{"href":6525,"rel":6892},[243],[240,6894,32],{"href":6530,"rel":6895},[243],[240,6897,36],{"href":6534,"rel":6898},[243],[281,6900,6901],{},[240,6902,1667],{"href":98,"rel":6903},[243],[281,6905,6906],{},[240,6907,1674],{"href":1672,"rel":6908},[243],[281,6910,6911],{},[240,6912,1680],{"href":4760,"rel":6913},[243],{"title":200,"searchDepth":208,"depth":208,"links":6915},[6916,6917,6918],{"id":6795,"depth":208,"text":6798},{"id":6824,"depth":208,"text":6827},{"id":6516,"depth":208,"text":6517},{"path":6920,"title":6921,"date":6922,"author":669,"summary":190,"visibility":190,"body":6923},"\u002Fblog\u002Forc-monthly-april2025","ORC Monthly: CRA Monday launched, feedback submitted, and deliverables plan expanded","2025-04-30",{"type":192,"value":6924,"toc":7169},[6925,6936,6939,6947,6949,7026,7030,7053,7055,7065,7067,7093,7097,7122,7124,7127,7150,7152],[202,6926,6927,6928,6935],{},"We’re pleased to share that, following active community discussions and collaboration, we have submitted feedback to the European Commission on the ",[240,6929,6932],{"href":6930,"rel":6931},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-hub\u002Fblob\u002Fmain\u002Fproduct-definitions\u002Finput-to-draft-regulation.md",[243],[292,6933,6934],{},"Definition of Important and Critical Product Categories",". This contribution reflects our collective understanding of how the CRA definitions intersect with open source development and distribution.",[202,6937,6938],{},"Thank you to everyone who contributed time, insight, and expertise to this effort.",[202,6940,6941,6943,6945],{},[292,6942,1497],{},[1499,6944],{},[292,6946,1503],{},[271,6948,1506],{"id":273},[278,6950,6951,6961,6984,6992,6995,7006,7015],{},[281,6952,6953,6954,6960],{},"Feedback on the ",[240,6955,6958],{"href":6956,"rel":6957},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-hub\u002Ftree\u002Fmain\u002Fproduct-definitions",[243],[292,6959,6934],{}," was submitted.",[281,6962,6963,6964,6967,6968,6973,6974,6977,6978,6983],{},"The first ",[261,6965,6966],{},"CRA Monday"," session featured Sebastien Heurtematte providing an ",[240,6969,6972],{"href":6970,"rel":6971},"https:\u002F\u002Fyoutu.be\u002F1CWy55AhEnc",[243],"overview of the OCCTET project",". These sessions will take place bi-weekly (details in the ",[240,6975,503],{"href":501,"rel":6976},[243],") and ",[240,6979,6982],{"href":6980,"rel":6981},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg\u002Fissues?q=is%3Aissue+state%3Aopen+label%3Acra-mondays",[243],"proposals for future sessions"," can be submitted through GitHub - all suggestions are welcome.",[281,6985,6986,6987,6991],{},"The Cyber Resilience SIG continues to refine and expand the ",[240,6988,2301],{"href":6989,"rel":6990},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg\u002Ftree\u002Fmain\u002Fcyber-resilience-sig#deliverables",[243],", which outlines the expected outputs related to CRA engagement. New content includes additional detail on timelines, responsibilities, and links to in-progress work.",[281,6993,6994],{},"Members of the ORC Working Group participated in the joint CEN\u002FCENELEC–ETSI workshop in Brussels, supporting coordination between European Standardization Organizations (ESOs) on CRA-related work.",[281,6996,6997,7002,7003,7005],{},[240,6998,7001],{"href":6999,"rel":7000},"https:\u002F\u002Fec.europa.eu\u002Ftransparency\u002Fexpert-groups-register\u002Fscreen\u002Fmeetings\u002Fconsult?lang=en&meetingId=48259&fromExpertGroups=true",[243],"Minutes from the first meeting of the CRA Expert Group"," are now available. ",[1499,7004],{},"\nMore recently, a working group of the CRA Expert Group focused on open source brought together a strong group of participants, including companies and foundations from across the ecosystem. Feedback on the meeting was generally positive, with the European Commission demonstrating openness to suggestions and a clear shift toward collaborative problem-solving, particularly on definition-related topics.",[281,7007,7008,7009,7014],{},"Work on SBOMs continues to gain traction across a range of ecosystems. From OWASP initiatives to ",[240,7010,7013],{"href":7011,"rel":7012},"https:\u002F\u002Fgithub.com\u002Fanthonyharrison\u002Fdistro2SBOM\u002Fpull\u002F26",[243],"distro2SBOM",", we’re seeing meaningful contributions emerge in broader and increasingly diverse communities.",[281,7016,2420,7017,7022,7023,487],{},[240,7018,7021],{"href":7019,"rel":7020},"https:\u002F\u002Fwww.linkedin.com\u002Fcompany\u002Ffoss-north\u002F",[243],"foss-north"," Olle E. Johansson and Salve J. Nielsen organised a CRA FAQ booth to gather input from attendees. Their contributions will help inform updates to the community-driven ",[240,7024,90],{"href":6062,"rel":7025},[243],[271,7027,7029],{"id":7028},"top-conversations","Top Conversations",[278,7031,7032,7039,7046],{},[281,7033,7034],{},[240,7035,7038],{"href":7036,"rel":7037},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-hub\u002Fissues\u002F90",[243],"Multiple CRA Verticals cover my Product",[281,7040,7041],{},[240,7042,7045],{"href":7043,"rel":7044},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-hub\u002Fissues\u002F133",[243],"I’m worried about the CRA and am considering shuttering my projects, what should I know?",[281,7047,7048],{},[240,7049,7052],{"href":7050,"rel":7051},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-hub\u002Fissues\u002F77",[243],"What implications does “indirect” usage (i.e., as a dependency of a regulated project) create for me?",[271,7054,1589],{"id":1588},[202,7056,7057],{},[240,7058,7061],{"href":7059,"rel":7060},"https:\u002F\u002Fwww.linkedin.com\u002Fposts\u002Follejohansson_orcwg-cra-eucra-activity-7317915673605644292-nkl8?utm_source=share&utm_medium=member_desktop&rcm=ACoAAAYPUqEBp0WKWGph_vgaFZs7BihQcqkB-_o",[243],[1597,7062],{"alt":7063,"src":7064},"Olle E Johansson's LinkedIn post: Had a great foss-north conference in Gothenburg! Met a lot of old and new friends. Salve and I set up a CRA FAQ booth to gather issues for the hashtag#ORCWG working group- and got a lot of really good questions, that we tried to capture on video.","\u002Fblog\u002Forc-monthly-april2025\u002Fimages\u002Fmay-overheard.png",[271,7066,1603],{"id":426},[278,7068,7069,7076,7081],{},[281,7070,7071,7075],{},[240,7072,6389],{"href":7073,"rel":7074},"https:\u002F\u002Fwww.automotive-oss.org\u002Fevent\u002Fd8cae729-ea4c-4a9a-8bb4-a42ab995e055\u002Fsummary",[243]," | May 13, 2025 | Starnberg, Germany",[281,7077,7078,6330],{},[240,7079,6329],{"href":6327,"rel":7080},[243],[281,7082,7083,7086,7087,6341,7089,7092],{},[240,7084,6337],{"href":6335,"rel":7085},[243]," | 1-2 July 2025 | Geneva ",[1499,7088],{},[240,7090,6346],{"href":6344,"rel":7091},[243]," to plan a breakout session “Sovereignty by Design”. Additional event details will be posted in the coming weeks.",[271,7094,7096],{"id":7095},"recent-talks","Recent Talks",[278,7098,7099,7107,7114],{},[281,7100,7101,7106],{},[240,7102,7105],{"href":7103,"rel":7104},"https:\u002F\u002Fwww.linkedin.com\u002Fposts\u002Ftobielangel_the-cra-is-here-lets-build-bridges-activity-7315085681586819073-U2RX\u002F",[243],"The CRA is here. Let’s build bridges!"," - Tobie Langel presented at the Swedish OSPO Network workshop on “Managing implications of the CRA and PLD on Open Source”",[281,7108,7109,7113],{},[240,7110,7112],{"href":6970,"rel":7111},[243],"CRA Monday - OCCTET Overview with Sebastien Heurtematte"," - In this first edition of the CRA Mondays series, Sebastien Heurtematte, OCCTET Project Coordinator, provides an overview of OCCTET—an EU-funded initiative that supports SMEs in meeting cybersecurity compliance requirements under the Cyber Resilience Act (CRA).",[281,7115,7116,7121],{},[240,7117,7120],{"href":7118,"rel":7119},"https:\u002F\u002Fwww.youtube.com\u002Fwatch?v=Gz6T9Ycxo7I",[243],"Unpacking the CRA: How the Open Source Community is Collaborating on Open Regulatory Compliance"," - Tobie Langel stepped in to provide the broader open source community an update on the work ORC is doing in relation to the Cyber Resilience Act (CRA).",[271,7123,3201],{"id":3200},[202,7125,7126],{},"The following members have joined in since our last edition:",[278,7128,7129,7136,7143],{},[281,7130,7131],{},[240,7132,7135],{"href":7133,"rel":7134},"https:\u002F\u002Fwww.eclipse.org\u002Fmembership\u002Fshow-member\u002F?member_id=1745",[243],"Apell ASBL",[281,7137,7138],{},[240,7139,7142],{"href":7140,"rel":7141},"https:\u002F\u002Fwww.eclipse.org\u002Fmembership\u002Fshow-member\u002F?member_id=1474",[243],"Apex.AI Inc",[281,7144,7145],{},[240,7146,7149],{"href":7147,"rel":7148},"https:\u002F\u002Fwww.eclipse.org\u002Fmembership\u002Fshow-member\u002F?member_id=1504",[243],"IMEC",[271,7151,1659],{"id":490},[278,7153,7154,7159,7164],{},[281,7155,7156],{},[240,7157,1667],{"href":98,"rel":7158},[243],[281,7160,7161],{},[240,7162,1674],{"href":1672,"rel":7163},[243],[281,7165,7166],{},[240,7167,1680],{"href":4760,"rel":7168},[243],{"title":200,"searchDepth":208,"depth":208,"links":7170},[7171,7172,7173,7174,7175,7176,7177],{"id":273,"depth":208,"text":1506},{"id":7028,"depth":208,"text":7029},{"id":1588,"depth":208,"text":1589},{"id":426,"depth":208,"text":1603},{"id":7095,"depth":208,"text":7096},{"id":3200,"depth":208,"text":3201},{"id":490,"depth":208,"text":1659},{"path":7179,"title":7180,"date":7181,"author":669,"summary":190,"visibility":190,"body":7182},"\u002Fblog\u002Forc-monthly-march2025","ORC Monthly: Cyber Resilience Spec Project, Deliverables Plan and Feedback for the European Commission","2025-03-25",{"type":192,"value":7183,"toc":7391},[7184,7187,7195,7197,7238,7240,7272,7274,7276,7284,7293,7301,7309,7315,7317,7353,7355,7358,7372,7374],[202,7185,7186],{},"The Cyber Resilience SIG reached a critical milestone by defining a scope of work for 2025. The Cyber Resilience Practices Spec project has also launched, with project proposal and feedback open for review and contribution. The Open Regulatory Compliance WG attended several recent industry events including Embedded World 2025.",[202,7188,7189,7191,7193],{},[292,7190,1497],{},[1499,7192],{},[292,7194,1503],{},[271,7196,1506],{"id":273},[278,7198,7199,7211,7222,7231],{},[281,7200,7201,7206,7207,487],{},[240,7202,7205],{"href":7203,"rel":7204},"https:\u002F\u002Fprojects.eclipse.org\u002Fprojects\u002Ftechnology.crp",[243],"Cyber Resilience Practices Specification project"," has been launched. This project aims to provide specifications to support the implementation of the CRA horizontal standards. You can review the proposal ",[240,7208,5718],{"href":7209,"rel":7210},"https:\u002F\u002Fprojects.eclipse.org\u002Fproposals\u002Fcyber-resilience-practices",[243],[281,7212,7213,7214,7217,7218],{},"The Cyber Resilience SIG ",[240,7215,2301],{"href":6989,"rel":7216},[243]," was approved, including scope and areas of prioritisation. Check it out and learn more about our activities and how to contribute: ",[240,7219,7220],{"href":7220,"rel":7221},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg\u002Ftree\u002Fmain\u002Fcyber-resilience-sig",[243],[281,7223,7224,7225,7230],{},"At the ",[240,7226,7229],{"href":7227,"rel":7228},"https:\u002F\u002Fwww.enisa.europa.eu\u002Fevents\u002Fcybersecurity_standardisation_2025",[243],"9th Cybersecurity Standardisation Conference"," on Thursday, March 20 ORC WG Senior Technical Lead Tobie Langel spoke at a panel called, “Overarching Cybersecurity by Standards.”",[281,7232,7233,7234,487],{},"Program Manager, Juan Rico, represented the ORC WG at Embedded World 2025. The Cyber Resilience Act was a hot topic in the embedded community with many organisations discussing their approach to compliance and voicing their concerns about the ",[240,7235,7237],{"href":6062,"rel":7236},[243],"unanswered questions",[271,7239,7029],{"id":7028},[278,7241,7242,7258,7265],{},[281,7243,7244,7245,264,7250,7253,7254,487],{},"The Cyber Resilience Act requires the European Commission to specify the ",[240,7246,7249],{"href":7247,"rel":7248},"https:\u002F\u002Fec.europa.eu\u002Finfo\u002Flaw\u002Fbetter-regulation\u002Fhave-your-say\u002Finitiatives\u002F14449-Technical-description-of-important-and-critical-products-with-digital-elements_en",[243],"technical description of important and critical products with digital elements",[261,7251,7252],{},"Feedback is due by April 15, 2025",". Join the discussion on ORC’s ",[240,7255,7257],{"href":6956,"rel":7256},[243],"CRA Hub",[281,7259,7260],{},[240,7261,7264],{"href":7262,"rel":7263},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-hub\u002Fissues\u002F170",[243],"Can a project be without a steward?",[281,7266,7267,7268,487],{},"Does a definition of a product category matter to a manufacturer or open source maintainer? The ORC WG is collecting feedback from the open source world and you can ",[240,7269,7271],{"href":6956,"rel":7270},[243],"contribute via pull requests",[271,7273,1589],{"id":1588},[271,7275,1603],{"id":426},[202,7277,7278,7283],{},[240,7279,7282],{"href":7280,"rel":7281},"https:\u002F\u002Fwww.first.org\u002Fconference\u002Fvulncon2025\u002F",[243],"CVE\u002FFIRST VulnCon 2025 & Annual CNA Summit | April 7-10"," - Collaborate with various vulnerability management and cybersecurity professionals to develop forward leaning ideas that can be taken back to individual programs for action to benefit the vulnerability management ecosystem.",[278,7285,7286],{},[281,7287,7288,7289,487],{},"Marta Rybczynska and Mikael Barbero of the Eclipse Foundation will host a talk called, “Towards a Vulnerability Reporting Specification.” The talk can also be attended virtually for those not able to attend in-person. ",[240,7290,5638],{"href":7291,"rel":7292},"https:\u002F\u002Fwww.first.org\u002Fconference\u002Fvulncon2025\u002F#Registration-Information",[243],[202,7294,7295,7300],{},[240,7296,7299],{"href":7297,"rel":7298},"https:\u002F\u002Fwww.ds.dk\u002Fen\u002Four-services\u002Fworkshop-cyber-resilience-act",[243],"Workshop: Cyber Resilience Act and the horizontal standard | April 8"," - The workshop will provide a comprehensive understanding of how standards can effectively mitigate risks, enhance cybersecurity posture, and ensure that products and services are aligned with the legal expectations set forth by the Act.",[278,7302,7303],{},[281,7304,7305,7306],{},"Tobie Langel will present at the workshop, which is available to attend online as well as in-person. ",[240,7307,269],{"href":7297,"rel":7308},[243],[202,7310,7311],{},[240,7312,7314],{"href":484,"rel":7313},[243],"View all events",[271,7316,7096],{"id":7095},[278,7318,7319,7327],{},[281,7320,7321,7322],{},"Recap from Victor Roland: ",[240,7323,7326],{"href":7324,"rel":7325},"https:\u002F\u002Fblog.obeosoft.com\u002Fa-two-day-panel-on-the-cyber-resilience-act-cra",[243],"A two-day panel on the Cyber Resilience Act (CRA)",[281,7328,7329,7330],{},"CRA ORC WG Workshop - 30 January\n",[278,7331,7332,7339,7346],{},[281,7333,7334],{},[240,7335,7338],{"href":7336,"rel":7337},"https:\u002F\u002Fyoutu.be\u002FjcaU3AX7llk?si=YwrihjfkgndC_uBw",[243],"CRA Implementation for Open Source & How ORC Contributes to the Landscape",[281,7340,7341],{},[240,7342,7345],{"href":7343,"rel":7344},"https:\u002F\u002Fyoutu.be\u002FDHp9SxpxIss",[243],"Anticipating the Cyber Resilience Act: The CCNL’s practical guide",[281,7347,7348],{},[240,7349,7352],{"href":7350,"rel":7351},"https:\u002F\u002Fyoutu.be\u002FXXyVTzkoZrk",[243],"ORC Workshop Wrap-up",[271,7354,3201],{"id":3200},[202,7356,7357],{},"The following members have joined in March 2025:",[278,7359,7360,7363,7366,7369],{},[281,7361,7362],{},"Clever Cloud SAS",[281,7364,7365],{},"Debian France",[281,7367,7368],{},"Drupal Association",[281,7370,7371],{},"Ferrous Systems GmbH",[271,7373,1659],{"id":490},[278,7375,7376,7381,7386],{},[281,7377,7378],{},[240,7379,1667],{"href":98,"rel":7380},[243],[281,7382,7383],{},[240,7384,1674],{"href":1672,"rel":7385},[243],[281,7387,7388],{},[240,7389,1680],{"href":4760,"rel":7390},[243],{"title":200,"searchDepth":208,"depth":208,"links":7392},[7393,7394,7395,7396,7397,7398,7399],{"id":273,"depth":208,"text":1506},{"id":7028,"depth":208,"text":7029},{"id":1588,"depth":208,"text":1589},{"id":426,"depth":208,"text":1603},{"id":7095,"depth":208,"text":7096},{"id":3200,"depth":208,"text":3201},{"id":490,"depth":208,"text":1659},{"path":7401,"title":7402,"date":7403,"author":669,"summary":190,"visibility":190,"body":7404},"\u002Fblog\u002Forc-at-embedded-world-2025","Meet Open Regulatory Compliance at Embedded World 2025","2025-03-06",{"type":192,"value":7405,"toc":7456},[7406,7409,7417,7421,7424,7428,7437,7441,7453],[202,7407,7408],{},"Embedded systems are at the heart of modern industry, powering everything from automotive applications to industrial automation. But as software continues to define embedded technologies, new regulations like the Cyber Resilience Act (CRA) are set to reshape how manufacturers and developers approach security and compliance. With its broad-reaching impact, the CRA raises many questions—especially for those working with open source. That’s where the Eclipse Open Regulatory Compliance (ORC) Working Group comes in.",[202,7410,7411,7412,7416],{},"Join us at ",[240,7413,7415],{"href":2088,"rel":7414},[243],"Embedded World 2025",", March 11-13, 2025, to explore how the ORC is helping the embedded community navigate the CRA and other emerging regulations.",[271,7418,7420],{"id":7419},"what-you-need-to-know-about-the-cra","What You Need to Know About the CRA",[202,7422,7423],{},"The Cyber Resilience Act introduces new requirements to ensure that software and hardware products meet strict cybersecurity standards. While its goal is to enhance security across the European market, it brings challenges for embedded technology providers, especially when integrating open source components. Compliance will require a clear understanding of software supply chain security, vulnerability management, and risk assessment—all of which the ORC is actively working to address.",[271,7425,7427],{"id":7426},"how-orc-can-help","How ORC Can Help",[202,7429,7430,7431,7436],{},"ORC is dedicated to supporting the open source ecosystem in achieving regulatory compliance. By working closely with industry leaders, open source foundations and developers, we collaborate on best practices, develop resources like our ",[240,7432,7434],{"href":6062,"rel":7433},[243],[261,7435,90],{},", contribute to standardization activities in CEN\u002FCENELEC and track evolving regulations that impact embedded systems. Our work ensures that organisations can meet compliance requirements without stifling innovation.",[271,7438,7440],{"id":7439},"meet-with-us-at-embedded-world","Meet with Us at Embedded World",[202,7442,7443,7444,7449,7450,7452],{},"Want to learn more about how the CRA will impact your products? Looking for a strategic approach to regulatory compliance? ",[240,7445,7448],{"href":7446,"rel":7447},"https:\u002F\u002Fshare.hsforms.com\u002F2-2ittHfSQfW6GifzqlCC1w38167",[243],"Book a meeting"," with us at ",[261,7451,7415],{}," to discuss the ORC Working Group and how you can get involved.",[202,7454,7455],{},"We look forward to seeing you there!",{"title":200,"searchDepth":208,"depth":208,"links":7457},[7458,7459,7460],{"id":7419,"depth":208,"text":7420},{"id":7426,"depth":208,"text":7427},{"id":7439,"depth":208,"text":7440},{"path":7462,"title":7463,"date":7464,"author":669,"summary":190,"visibility":190,"body":7465},"\u002Fblog\u002Forc-monthly-feb2025","ORC Monthly: CRA Expert Group, Recent Workshops, and More","2025-02-26",{"type":192,"value":7466,"toc":7711},[7467,7470,7478,7480,7514,7516,7524,7531,7544,7546,7556,7558,7564,7571,7578,7583,7588,7591,7598,7606,7614,7616,7624,7637,7639,7642,7692,7694],[202,7468,7469],{},"The Open Regulatory Compliance WG has created new resources on GitHub for those who are just getting started or who want to learn how to contribute. We hosted our first workshop in Brussels, joined the EU Open Source Policy Summit and attended the first CRA Expert Group meeting, had multiple community members present during FOSDEM, and developed a deliverables plan that better defines next steps and how others can contribute.",[202,7471,7472,7474,7476],{},[292,7473,1497],{},[1499,7475],{},[292,7477,1503],{},[271,7479,1506],{"id":273},[278,7481,7482,7490,7499,7506],{},[281,7483,6963,7484,7489],{},[240,7485,7488],{"href":7486,"rel":7487},"https:\u002F\u002Fblogs.eclipse.org\u002Fpost\u002Fjuan-rico\u002Fcomposition-cyber-resilience-act-cra-expert-group-key-step-toward-collaborative",[243],"CRA Expert Group"," meeting was held in Brussels in February with the goal of turning the CRA into action. This group will advise the Commission on issues such as the “implementation guidance” and advice for the implementation of the CRA. Attending members from open source foundations and the IT industry shared reports from the field and outlined due diligence requirements as a critical area for guidance, as well as guidance on components.",[281,7491,7492,7493,7498],{},"Attendees of the ",[240,7494,7497],{"href":7495,"rel":7496},"https:\u002F\u002Fwww.linkedin.com\u002Fposts\u002Fopen-regulatory-compliance_cra-compliance-cra-activity-7290690120972722176-FyE6\u002F?utm_source=share&utm_medium=member_desktop",[243],"ORC workshop in Brussels"," drafted a deliverables plan that outlines the community’s next steps. Join the bi-weekly SIG calls to learn more and contribute.",[281,7500,7224,7501,7505],{},[240,7502,2880],{"href":7503,"rel":7504},"https:\u002F\u002Fwww.linkedin.com\u002Fposts\u002Fdin-ev_ofe-standards-opensource-activity-7292456560549634051-KnsJ\u002F?utm_source=share&utm_medium=member_desktop",[243],", ORC joined a panel to explore how procedural standards being developed for the Cyber Resilience Act, AI Act, Data Act, and Interoperable Europe Act can align with the development and business models of free and open source software.",[281,7507,7508,7509,487],{},"The Standardization Request for the CRA standards was published on 3 February. In this document, the EU directs the European standards organisations to develop specific standards supporting the CRA. The standards development is organized into three milestones with specific deadlines. ",[240,7510,7513],{"href":7511,"rel":7512},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-hub\u002Fblob\u002Fmain\u002Fstandards.md",[243],"Read the summary here for the most essential info",[271,7515,7029],{"id":7028},[202,7517,7518,7523],{},[240,7519,7522],{"href":7520,"rel":7521},"https:\u002F\u002Fwww.eclipse.org\u002Fmhonarc\u002Flists\u002Fopen-regulatory-compliance\u002Fmsg00646.html",[243],"[open-regulatory-compliance] ENISA 2025-2027 Programming Document"," Posted by Roman Zhukov",[202,7525,7526],{},[240,7527,7530],{"href":7528,"rel":7529},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-hub\u002Fissues\u002F60",[243],"What are the timelines for standards drafting and compliance? Manufacturer FAQ",[202,7532,7533,325,7538,7543],{},[240,7534,7537],{"href":7535,"rel":7536},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-hub\u002Fissues\u002F16",[243],"So I “monetise” on an open source project, what does it mean for me?",[240,7539,7542],{"href":7540,"rel":7541},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-hub\u002Fissues?q=is%3Aissue%20state%3Aopen%20%20sort%3Acomments-desc%20label%3AFAQ",[243],"FAQ"," – During the CRA Expert Group meeting in Brussels, ORC shared this question as an example of maintainer concerns about the CRA.",[271,7545,1589],{"id":1588},[202,7547,7548],{},[240,7549,7552],{"href":7550,"rel":7551},"https:\u002F\u002Fwww.linkedin.com\u002Fposts\u002Fchristopher-jenkins-26602025_redhat-compliance-cra-activity-7290814212681990147-aNdq",[243],[1597,7553],{"alt":7554,"src":7555},"Christopher Jenkins's LinkedIn post: Another great example of cooperation between Red Hat and the wider open source communities. Many thanks to the Open Regulatory Compliance Working Group for hosting such a lively day of collaboration and workshops around the Cyber Resilience Act in Brussels. This image sums up quite a lot … we’re here but we really need to understand what’s next and how we (projects, stewards and manufacturers) can really work together to understand and harmonise the standards together. Did you noticed that I used the word “together“ twice? That’s because we can’t do this in separate, disparate solos - collaboration is key.","\u002Fblog\u002Forc-monthly-feb2025\u002Fimages\u002Ffeb-overheard.png",[271,7557,1603],{"id":426},[202,7559,7560],{},[240,7561,7563],{"href":501,"rel":7562},[243],"Cyber Resilience SIG | Monday, March 3 (Occurs Biweekly)",[202,7565,7566,7570],{},[240,7567,7569],{"href":2088,"rel":7568},[243],"Embedded World 2025 | Tuesday, March 11"," - ORC will be part of the Eclipse Foundation booth, stop by to chat with Juan Rico, ORC Program Manager.",[202,7572,7573,7577],{},[240,7574,7576],{"href":7227,"rel":7575},[243],"9th Cybersecurity Standardisation Conference | Thursday, March 20"," - Tobie Langel is speaking on the panel “Overarching cybersecurity by standards”.",[202,7579,7580,7283],{},[240,7581,7282],{"href":7280,"rel":7582},[243],[202,7584,7585],{},[240,7586,7314],{"href":484,"rel":7587},[243],[271,7589,7590],{"id":4064},"In the News",[202,7592,7593,7597],{},[240,7594,7596],{"href":6476,"rel":7595},[243],"What the EU’s new software legislation means for developers"," - Felix Reda, GitHub Blog",[202,7599,7600,7605],{},[240,7601,7604],{"href":7602,"rel":7603},"https:\u002F\u002Fosb-alliance.de\u002Ffeatured\u002Fneues-vom-cyber-resilience-act",[243],"Neues vom Cyber Resilience Act – Ein Blick hinter die Kulissen"," - Open Source Business Alliance",[202,7607,7608,7613],{},[240,7609,7612],{"href":7610,"rel":7611},"https:\u002F\u002Fopensource.org\u002Fblog\u002F2024-end-of-year-review-policy-and-standards",[243],"2024 end-of-year review: policy and standards"," - Open Source Initiative",[271,7615,7096],{"id":7095},[6308,7617,7618],{},[202,7619,7620],{},[1597,7621],{"alt":7622,"src":7623},"Screenshot of the recording 'The CRA has landed. Now what?'","\u002Fblog\u002Forc-monthly-feb2025\u002Fimages\u002Ffeb-events.png",[202,7625,7626,7627,7632,7633],{},"Watch: ",[240,7628,7631],{"href":7629,"rel":7630},"https:\u002F\u002Fwww.youtube.com\u002Fwatch?v=BGOi9JUJRMI&list=PLy7t4z5SYNaQEyXv253SI6PDdPjbYXcNV&index=6",[243],"The CRA has landed. Now what?"," | ",[240,7634,7636],{"href":6534,"rel":7635},[243],"View all talks",[271,7638,3201],{"id":3200},[202,7640,7641],{},"The following members joined in January and February 2025:",[278,7643,7644,7650,7657,7664,7671,7678,7685],{},[281,7645,7646],{},[240,7647,7362],{"href":7648,"rel":7649},"https:\u002F\u002Fwww.clever-cloud.com\u002F",[243],[281,7651,7652],{},[240,7653,7656],{"href":7654,"rel":7655},"https:\u002F\u002Fwww.doubleopen.org\u002F",[243],"Double Open",[281,7658,7659],{},[240,7660,7663],{"href":7661,"rel":7662},"https:\u002F\u002Fwww.huawei.com\u002Fca\u002F",[243],"Huawei Technologies Co., LTD.",[281,7665,7666],{},[240,7667,7670],{"href":7668,"rel":7669},"https:\u002F\u002Fwww.mercedes-benz-techinnovation.com\u002Fen",[243],"Mercedes-Benz Tech Innovation GmbH",[281,7672,7673],{},[240,7674,7677],{"href":7675,"rel":7676},"https:\u002F\u002Fwww.nokia.com\u002F",[243],"Nokia",[281,7679,7680],{},[240,7681,7684],{"href":7682,"rel":7683},"https:\u002F\u002Fwww.siemens.com\u002Fglobal\u002Fen.html",[243],"Siemens AG",[281,7686,7687],{},[240,7688,7691],{"href":7689,"rel":7690},"https:\u002F\u002Fwww.sonatype.com\u002F",[243],"Sonatype Inc.",[271,7693,1659],{"id":490},[278,7695,7696,7701,7706],{},[281,7697,7698],{},[240,7699,1667],{"href":98,"rel":7700},[243],[281,7702,7703],{},[240,7704,1674],{"href":1672,"rel":7705},[243],[281,7707,7708],{},[240,7709,1680],{"href":4760,"rel":7710},[243],{"title":200,"searchDepth":208,"depth":208,"links":7712},[7713,7714,7715,7716,7717,7718,7719,7720],{"id":273,"depth":208,"text":1506},{"id":7028,"depth":208,"text":7029},{"id":1588,"depth":208,"text":1589},{"id":426,"depth":208,"text":1603},{"id":4064,"depth":208,"text":7590},{"id":7095,"depth":208,"text":7096},{"id":3200,"depth":208,"text":3201},{"id":490,"depth":208,"text":1659},{"path":7722,"title":7723,"date":7724,"author":669,"summary":190,"visibility":190,"body":7725},"\u002Fblog\u002Fcra-expert-group-2024","The composition of the Cyber Resilience Act (CRA) Expert Group: a key step toward Collaborative Cybersecurity Policy","2024-12-19",{"type":192,"value":7726,"toc":7895},[7727,7734,7738,7747,7785,7788,7792,7795,7830,7836,7840,7843,7850,7853,7857,7869,7872,7876,7889],[202,7728,7729,7730,7733],{},"The European Commission revealed on December 11 the members of its ",[261,7731,7732],{},"Cyber Resilience Act (CRA) Expert Group",", following a public call for applications that ran in October of this year. This diverse group brings together individual experts, industry leaders, Member State agencies, and non-governmental organizations (NGOs), reflecting the wide-ranging impact of the Cyber Resilience Act.",[271,7735,7737],{"id":7736},"the-tasks-of-the-cra-expert-group","The tasks of the CRA Expert Group",[202,7739,7740,7741,7746],{},"The CRA Expert Group has been tasked with supporting European Commission’s Directorate-General for Communications Networks, Content, and Technology (",[240,7742,7745],{"href":7743,"rel":7744},"https:\u002F\u002Fcommission.europa.eu\u002Fabout\u002Fdepartments-and-executive-agencies\u002Fcommunications-networks-content-and-technology_en",[243],"DG CONNECT",") in several critical areas:",[1705,7748,7749,7759,7766,7773],{},[281,7750,7751,7752,1720,7755,7758],{},"Assisting in the preparation of ",[261,7753,7754],{},"policy initiatives",[261,7756,7757],{},"delegated acts"," related to the cybersecurity of digital products. Delegated acts are non-legislative acts adopted by the European Commission that serve to amend or supplement the non-essential elements of the legislation.",[281,7760,7761,7762,7765],{},"Facilitating collaboration between ",[261,7763,7764],{},"Member States",", stakeholders, and the European Commission on the implementation of cybersecurity policies.",[281,7767,7768,7769,7772],{},"Offering guidance to stakeholders to aid ",[261,7770,7771],{},"compliance with Union legislation"," and ensure a smooth implementation process.",[281,7774,7775,7776,1106,7779,1110,7782,487],{},"Sharing best practices and experiences, particularly in areas like ",[261,7777,7778],{},"standardization",[261,7780,7781],{},"security marks",[261,7783,7784],{},"support for small and medium-sized enterprises (SMEs)",[202,7786,7787],{},"These tasks underline the importance of broad stakeholder participation in shaping cybersecurity policy, ensuring that new regulations align with industry realities and address the evolving challenges of the digital landscape.",[271,7789,7791],{"id":7790},"a-broad-and-diverse-membership","A broad and diverse membership",[202,7793,7794],{},"The CRA Expert Group is composed of representatives from multiple sectors:",[278,7796,7797,7803,7809,7815],{},[281,7798,7799,7802],{},[261,7800,7801],{},"Individual experts",", selected for their specialized knowledge in cybersecurity.",[281,7804,7805,7808],{},[261,7806,7807],{},"Industry stakeholders",", including major International European companies and trade associations but also International American companies such as Cisco and Microsoft (with GitHub as a key subsidiary).",[281,7810,7811,7814],{},[261,7812,7813],{},"Member State representatives",", with countries like Spain and Belgium contributing multiple agencies, while others such as Germany and Denmark have no representation.",[281,7816,7817,7820,7821,1106,7824,7827,7828,487],{},[261,7818,7819],{},"4 NGOs",", of which three are open source software foundations: ",[261,7822,7823],{},"The Apache Software Foundation",[261,7825,7826],{},"OpenSSF",", and the ",[261,7829,135],{},[202,7831,7832,7835],{},[261,7833,7834],{},"The inclusion of open source foundations underscores the essential role of open source software in the global digital ecosystem."," These NGOs bring valuable insights into the unique challenges and opportunities of open source security, contributing to a well-rounded perspective on the CRA’s implementation.",[271,7837,7839],{"id":7838},"collaboration-as-the-cornerstone-of-strengthened-security","Collaboration as the cornerstone of strengthened security",[202,7841,7842],{},"The makeup of the CRA Expert Group reflects the EU’s dedication to a collaborative, multi-stakeholder approach to cybersecurity. By engaging voices from industry, government, and civil society, the group is positioned to tackle the CRA’s objectives while addressing the growing complexity of cybersecurity threats.",[202,7844,7845,7846,7849],{},"The Eclipse Foundation welcomes the opportunity to work closely with fellow NGOs and other stakeholders in the Expert Group. This collective effort aims to ensure the CRA fosters a ",[261,7847,7848],{},"dynamic, secure, and innovative open source ecosystem","—one that benefits not only Europe but also the global community.",[202,7851,7852],{},"Achieving these goals will require ongoing dialogue, technical expertise, and a shared resolve to meet cybersecurity challenges head-on. The Eclipse Foundation is committed to advancing solutions that reconcile regulatory demands with the core principles of openness and innovation that drive the open source model.",[271,7854,7856],{"id":7855},"eclipse-foundation-and-open-regulatory-compliance-wg","Eclipse Foundation and Open Regulatory Compliance WG",[202,7858,609,7859,7861,7862,7868],{},[261,7860,135],{},", through the ",[261,7863,7864],{},[240,7865,5],{"href":7866,"rel":7867},"http:\u002F\u002Fwww.orcwg.org\u002F",[243]," (ORC WG), serves as a collaborative hub where the open source community is warmly invited to share their insights, concerns, and contributions regarding regulatory compliance. Recognizing that the voice of the open source ecosystem is critical in shaping policies like the CRA, the ORC WG acts as a bridge between the community and key stakeholders, including industry leaders, policymakers, and regulatory bodies.",[202,7870,7871],{},"By fostering an open and inclusive environment, the ORC WG ensures that the thoughts and contributions of the open source community are heard and effectively communicated to the institutions that matter most. Together, we aim to advocate for an open, secure, and innovation-friendly future while addressing the challenges posed by new regulations.",[271,7873,7875],{"id":7874},"join-the-orc-wg-and-make-your-voice-heard","Join the ORC WG and Make Your Voice Heard!",[202,7877,7878,7881,7882,7885,7886],{},[261,7879,7880],{},"We invite you to join us in Brussels during FOSDEM week","! On January 29th, we’ll be hosting our event, ",[292,7883,7884],{},"“The EU Cyber Resilience Act is Here! Now What?”",", where we’ll discuss the implications of the CRA. Then, on January 30th, we’ll dive into the “Open Regulatory Compliance Working Group Activities”, showcasing our ongoing efforts and opportunities for collaboration. ",[261,7887,7888],{},"We look forward to welcoming you!",[202,7890,7891,7892,487],{},"For further details on the CRA Expert Group and its members, visit the European Commission’s Expert Groups Register. To get involved with the Open Regulatory Compliance Working Group, visit ",[240,7893,29],{"href":4800,"rel":7894},[243],{"title":200,"searchDepth":208,"depth":208,"links":7896},[7897,7898,7899,7900,7901],{"id":7736,"depth":208,"text":7737},{"id":7790,"depth":208,"text":7791},{"id":7838,"depth":208,"text":7839},{"id":7855,"depth":208,"text":7856},{"id":7874,"depth":208,"text":7875},1792684537994]