[{"data":1,"prerenderedAt":474},["ShallowReactive",2],{"site:settings":3,"site:navigation":49,"site:footer":126,"page:\u002Fblog\u002Fec-cra-guidelines":188,"sections:\u002Fblog\u002Fec-cra-guidelines":465,"feed:\u002Fblog\u002Fec-cra-guidelines":468,"breadcrumbs:\u002Fblog\u002Fec-cra-guidelines":469},{"id":4,"title":5,"callForAction":6,"description":9,"extension":10,"featuredContentPublishTarget":11,"keywords":12,"logo":18,"logoWidth":19,"meta":20,"search":21,"seoTitleSuffix":25,"skipLinkText":26,"socialImage":27,"socials":30,"stem":47,"__hash__":48},"settings\u002Fdata\u002Fsettings.yml","Open Regulatory Compliance Working Group",{"text":7,"href":8},"Get involved","\u002Fparticipate\u002F","The open source community is collaborating to establish common specifications for secure software development based on open source best practices.","yml","orc",[13,14,15,16,17],"regulatory compliance","cybersecurity processes","royalty-free patent licence","open source community collaboration","Eclipse Foundation Specification Process","\u002Fimages\u002Forc-logo.png",120,{},{"label":22,"placeholder":23,"menuLabel":24},"Search","Search the site…","Menu"," | Open Regulatory Compliance Working Group","Skip to main content",{"backgroundImage":28,"eyebrow":29},"\u002Fimages\u002Fog\u002Fbackground.jpg","orcwg.org",[31,35,39,43],{"name":32,"icon":33,"url":34},"LinkedIn","fa6-brands:linkedin-in","https:\u002F\u002Fwww.linkedin.com\u002Fshowcase\u002Fopen-regulatory-compliance\u002F",{"name":36,"icon":37,"url":38},"YouTube","fa6-brands:youtube","https:\u002F\u002Fwww.youtube.com\u002F@ORCWG",{"name":40,"icon":41,"url":42},"Bluesky","fa6-brands:bluesky","https:\u002F\u002Fbsky.app\u002Fprofile\u002Forcwg.org",{"name":44,"icon":45,"url":46},"Mastodon","fa6-brands:mastodon","https:\u002F\u002Ffosstodon.org\u002F@orcwg","data\u002Fsettings","bxtnzYEG4TQ27x8O_VKQIF-gc2dr-DNwF9_OpAZy3LA",{"id":50,"extension":10,"main":51,"meta":123,"stem":124,"__hash__":125},"navigation\u002Fdata\u002Fnavigation.yml",[52,70,82,99],{"text":53,"children":54},"About",[55,58,61,64,67],{"text":56,"href":57},"ORC Working Group","\u002Fabout\u002F",{"text":59,"href":60},"Cyber Resilience SIG","\u002Fspecial-interest-groups\u002Fcyber-resilience\u002F",{"text":62,"href":63},"AI Policy & Compliance SIG","\u002Fspecial-interest-groups\u002Fai-policy-and-compliance\u002F",{"text":65,"href":66},"Steering Committee","\u002Fcommittees\u002Fsteering-committee\u002F",{"text":68,"href":69},"Meeting Minutes","\u002Fcommittees\u002Fminutes\u002F",{"text":71,"children":72},"Membership",[73,76,79],{"text":74,"href":75},"Our Members","\u002Fmembership\u002F",{"text":77,"href":78},"Become a Member","\u002Fmembership\u002Fbecome-a-member\u002F",{"text":80,"href":81},"Participation and Membership FAQ","\u002Fabout\u002Fparticipation-and-membership-faq\u002F",{"id":83,"text":84,"children":85},"cra","Cyber Resilience Act",[86,89,93,96],{"text":87,"href":88},"About CRA","\u002Fcra\u002Fabout",{"text":90,"href":91,"external":92},"CRA FAQ","https:\u002F\u002Fcra.orcwg.org\u002F",true,{"text":94,"href":95},"CRA Resources","\u002Fcra\u002Fresources",{"text":97,"href":98,"external":92},"CRA Hub on GitHub","https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-hub",{"text":100,"children":101},"Resources",[102,105,108,111,114,117,120],{"text":103,"href":104},"Events","\u002Fevents\u002F",{"text":106,"href":107},"Community Calendar","\u002Fresources\u002Fcalendar\u002F",{"text":109,"href":110},"Blog","\u002Fblog\u002F",{"text":112,"href":113},"Videos","\u002Fresources\u002Fvideos\u002F",{"text":115,"href":116},"Learning Hub","\u002Ftraining\u002F",{"text":118,"href":119},"Marketing Resources","\u002Fresources\u002Fmarketing-resources\u002F",{"text":121,"href":122,"external":92},"ORC Store","https:\u002F\u002Feclipse-foundation.store\u002Fcollections\u002Fopen-regulatory-compliance-orc",{},"data\u002Fnavigation","XYDVypNX67n8V4VQI_JTrw0cI16uV5jtctVXjN-DeKo",{"id":127,"backToTopText":128,"copyright":129,"extension":10,"manageCookiesText":130,"meta":131,"sections":132,"socialsHeading":185,"stem":186,"__hash__":187},"footer\u002Fdata\u002Ffooter.yml","Back to the top","Copyright © Eclipse Foundation AISBL. All Rights Reserved.","Manage Cookies",{},[133,150,169],{"id":134,"heading":135,"links":136},"footer-eclipse-foundation","Eclipse Foundation",[137,139,142,145,147],{"text":53,"href":138},"https:\u002F\u002Fwww.eclipse.org\u002Forg\u002F",{"text":140,"href":141},"Projects","https:\u002F\u002Fprojects.eclipse.org\u002F",{"text":143,"href":144},"Collaborations","https:\u002F\u002Fwww.eclipse.org\u002Fcollaborations\u002F",{"text":71,"href":146},"https:\u002F\u002Fwww.eclipse.org\u002Fmembership\u002F",{"text":148,"href":149},"Sponsor","https:\u002F\u002Fwww.eclipse.org\u002Fsponsor\u002F",{"id":151,"heading":152,"showManageCookies":92,"links":153},"footer-legal","Legal",[154,157,160,163,166],{"text":155,"href":156},"Privacy Policy","https:\u002F\u002Fwww.eclipse.org\u002Flegal\u002Fprivacy\u002F",{"text":158,"href":159},"Terms of Use","https:\u002F\u002Fwww.eclipse.org\u002Flegal\u002Fterms-of-use\u002F",{"text":161,"href":162},"Compliance","https:\u002F\u002Fwww.eclipse.org\u002Flegal\u002Fcompliance\u002F",{"text":164,"href":165},"Code of Conduct","https:\u002F\u002Fwww.eclipse.org\u002Forg\u002Fdocuments\u002FCommunity_Code_of_Conduct.php",{"text":167,"href":168},"Legal Resources","https:\u002F\u002Fwww.eclipse.org\u002Flegal\u002F",{"id":170,"heading":171,"links":172},"footer-more","More",[173,176,179,182],{"text":174,"href":175},"Report a Vulnerability","https:\u002F\u002Fwww.eclipse.org\u002Fsecurity\u002F",{"text":177,"href":178},"Service Status","https:\u002F\u002Fstatus.eclipse.org\u002F",{"text":180,"href":181},"Contact Us","https:\u002F\u002Fwww.eclipse.org\u002Forg\u002Ffoundation\u002Fcontact.php",{"text":183,"href":184},"Support","https:\u002F\u002Fwww.eclipse.org\u002Fprojects\u002Fsupport\u002F","Follow Us:","data\u002Ffooter","C-lpCHl9crwF3iQyRSh8y5g9ez5YgF4pi8aTv4pFLBM",{"id":189,"title":190,"aliases":191,"author":192,"body":193,"breadcrumbTitle":191,"breadcrumbs":191,"date":458,"description":191,"extension":459,"featuredFooter":191,"keywords":191,"meta":460,"navigation":92,"path":461,"redirectUrl":191,"seo":462,"seoTitle":191,"socialImage":191,"stem":463,"summary":191,"typography":191,"visibility":191,"width":191,"__hash__":464},"blog\u002Fblog\u002Fec-cra-guidelines.md","The European Commission publishes CRA implementation guidelines. Key takeaways for open source",null,"Juan Rico",{"type":194,"value":195,"toc":445},"minimark",[196,208,231,244,249,254,307,311,332,336,372,376,410,414,432,436,442],[197,198,199,200,207],"p",{},"On July 27th ",[201,202,206],"a",{"href":203,"rel":204},"https:\u002F\u002Fdigital-strategy.ec.europa.eu\u002Fen\u002Flibrary\u002Fcommission-publishes-new-guidance-support-timely-cyber-resilience-act-implementation",[205],"nofollow","the European Commission published the Implementation guidance on the application of Regulation (EU) 2024\u002F2847 (the Cyber Resilience Act — CRA)",".",[197,209,210,211,215,216,219,220,223,224,227,228,207],{},"It provides practical clarification of key CRA concepts that directly impact\nthe open source ecosystem, including the criteria for ",[212,213,214],"strong",{},"placing software on the\nmarket",", the distinction between ",[212,217,218],{},"maintainers and contributors",", the\nobligations of ",[212,221,222],{},"Open Source Software Stewards",", ",[212,225,226],{},"upstream vulnerability\nreporting",", and ",[212,229,230],{},"downstream integration requirements",[197,232,233,234,237,238,243],{},"Below is a detailed open-source analysis summarising the guidance’s key\ntakeaways while emphasising the critical advocacy role of the ",[212,235,236],{},"Open Regulatory\nCompliance",". Through ongoing engagement with policymakers, the release of\ntechnical assets like the stewards white paper and ",[201,239,242],{"href":240,"rel":241},"https:\u002F\u002Fec.europa.eu\u002Finfo\u002Flaw\u002Fbetter-regulation\u002Fhave-your-say\u002Finitiatives\u002F16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act\u002FF33391529_en",[205],"engagement in key public\nconsultations",",\nORC ensures that the open source community interests are represented and that\nregulatory frameworks translate effectively into practical, real-world\nimplementation.",[245,246,248],"h2",{"id":247},"key-takeaways-from-an-open-source-perspective","Key takeaways from an open source perspective",[250,251,253],"h3",{"id":252},"a-placement-on-the-market-monetisation-boundaries","A. Placement on the Market & Monetisation Boundaries",[255,256,257,273,298],"ul",{},[258,259,260,263,264,268,269,272],"li",{},[212,261,262],{},"Commercial vs. Non-Commercial distinctions:"," FOSS is only subject to standard manufacturer obligations if it is ",[265,266,267],"em",{},"placed on the Union market in the course of a commercial activity",". Merely publishing, hosting, or openly sharing source code under an open source licence does ",[212,270,271],{},"not"," constitute placing software on the market.",[258,274,275,278,279],{},[212,276,277],{},"Monetisation triggers:"," FOSS is considered placed on the market (making the developer\u002Fentity a “manufacturer”) if one of these is true:\n",[255,280,281,286,292],{},[258,282,283,207],{},[212,284,285],{},"A price is directly charged for the software or compiled binaries",[258,287,288,291],{},[212,289,290],{},"It is bundled with paid technical support services"," exceeding reasonable cost recuperation (including reasonable living expenses for natural persons).",[258,293,294,297],{},[212,295,296],{},"It monetises other products\u002Fservices, conditions access on personal data processing"," (unrelated to security\u002Finteroperability), or accepts donations exceeding cost recovery with an intention to make a profit.",[258,299,300,303,304,306],{},[212,301,302],{},"Dual-Licensing & “Community” Versions:"," Providing a free “community” version alongside a monetised enterprise version does ",[212,305,271],{}," bring the community version under manufacturer obligations, provided the free version itself is not monetised.",[250,308,310],{"id":309},"b-responsibility-maintainers-vs-contributors","B. Responsibility: Maintainers vs. Contributors",[255,312,313,326],{},[258,314,315,318,319,322,323,207],{},[212,316,317],{},"Contributor protection:"," The guidance explicitly clarifies that natural or legal persons who contribute code (e.g., submitting pull or merge requests) but do not control releases, roadmaps, or governance decisions are ",[212,320,321],{},"contributors",", not maintainers, and fall ",[212,324,325],{},"outside the scope of the CRA",[258,327,328,331],{},[212,329,330],{},"Maintainer responsibility:"," Software is only under the responsibility of natural or legal persons (maintainers) who publish it and exercise primary control over development, releases, and distribution.",[250,333,335],{"id":334},"c-open-source-software-stewards-art-314-art-24","C. Open Source Software Stewards (Art 3(14) & Art 24)",[255,337,338,344],{},[258,339,340,343],{},[212,341,342],{},"Definition:"," Stewards are legal persons (such as non-profit foundations) that provide sustained support for FOSS intended for commercial activities but do not place the software on the market themselves.",[258,345,346,349],{},[212,347,348],{},"Tiered obligations based on involvement (Art 24(3)):",[255,350,351,360,366],{},[258,352,353,356,357,359],{},[212,354,355],{},"Non-Technical Stewards"," (governance, branding, events): Must adopt a cybersecurity policy, but are ",[265,358,271],{}," required to report actively exploited vulnerabilities or severe infrastructure incidents.",[258,361,362,365],{},[212,363,364],{},"Infrastructure Stewards"," (hosting code repositories, CI\u002FCD pipelines): Must notify ENISA and CSIRTs of severe incidents affecting their IT infrastructure.",[258,367,368,371],{},[212,369,370],{},"Engineering Stewards"," (employing developers, directly coordinating releases): Must report actively exploited vulnerabilities they become aware of.",[250,373,375],{"id":374},"d-upstream-downstream-integration-mechanics","D. Upstream & downstream integration mechanics",[255,377,378,387],{},[258,379,380,383,384,386],{},[212,381,382],{},"Integrator accountability (Art 13(5)):"," Commercial integrators who build FOSS components into their monetised products bear full manufacturer liability for the finished product. Integrating FOSS does ",[212,385,271],{}," transfer CRA liability upstream to open source maintainers or stewards.",[258,388,389,392],{},[212,390,391],{},"Upstream reporting & fix sharing (Art 13(6)):",[255,393,394,397,400],{},[258,395,396],{},"Integrators discovering vulnerabilities in FOSS components must report them upstream to maintainers, using the guidelines set by the open source project",[258,398,399],{},"Integrators developing a patch must share the security fix upstream in a machine-readable format compatible with the project’s licence.",[258,401,402,405,406,409],{},[212,403,404],{},"Crucially",", maintainers are ",[212,407,408],{},"not legally obligated to accept or merge"," proposed upstream security fixes.",[250,411,413],{"id":412},"e-practical-compliance-relief-for-foss","E. Practical compliance relief for FOSS",[255,415,416,422],{},[258,417,418,421],{},[212,419,420],{},"Conformity assessment flexibility (Art 32(5)):"," Important Class I and Class II FOSS products placed on the market are permitted to use the internal control procedure (Module A self-assessment), avoiding mandatory third-party audits.",[258,423,424,427,428,431],{},[212,425,426],{},"Single-Version patching (Art 13(10)):"," Software developers\u002Fmanufacturers may restrict active vulnerability patching to the ",[212,429,430],{},"latest release version",", provided downstream users can upgrade free of charge and without incurring additional infrastructure costs.",[245,433,435],{"id":434},"summary","Summary",[197,437,438,439,207],{},"The Commission’s Guidance Package validates much of what the open source\ncommunity advocated for: ",[212,440,441],{},"protecting individual contributors, recognising\nnon-profit steward models, and ensuring maintainers are not held liable for\ndownstream commercial usage",[197,443,444],{},"The ORC community was fundamental in this process. By serving as a bridge\nbetween the realities of open source development and the complexities of EU\nregulatory frameworks, ORC ensured that policymakers understood and addressed\nthe community’s unique needs. Through targeted technical advocacy, expert\nparticipation in the CRA Expert Group, and coordinated feedback, the ORC\ncommunity did more than just provide input, they acted as a strategic partner\nin translating open source collaboration into the final regulatory outcomes.\nThis achievement cements the ORC community as an essential, authoritative voice\nin shaping digital policy, proving that open source expertise is critical to\ncreating sustainable, innovation-friendly legislation.",{"title":446,"searchDepth":447,"depth":447,"links":448},"",2,[449,457],{"id":247,"depth":447,"text":248,"children":450},[451,453,454,455,456],{"id":252,"depth":452,"text":253},3,{"id":309,"depth":452,"text":310},{"id":334,"depth":452,"text":335},{"id":374,"depth":452,"text":375},{"id":412,"depth":452,"text":413},{"id":434,"depth":447,"text":435},"2026-07-31","md",{},"\u002Fblog\u002Fec-cra-guidelines",{"title":190},"blog\u002Fec-cra-guidelines","bGbFy9bT1wxFRikHkZ5V552qRrO7kmMrFZ5Rw03zp6Q",[466],{"path":467,"visibility":191},"\u002Fblog",false,[470,473],{"path":471,"text":472},"\u002F","ORC",{"path":467,"text":109},1792684541520]