[{"data":1,"prerenderedAt":368},["ShallowReactive",2],{"site:settings":3,"site:navigation":49,"site:footer":126,"page:\u002Fblog\u002Fmm-recap":188,"sections:\u002Fblog\u002Fmm-recap":359,"feed:\u002Fblog\u002Fmm-recap":362,"breadcrumbs:\u002Fblog\u002Fmm-recap":363},{"id":4,"title":5,"callForAction":6,"description":9,"extension":10,"featuredContentPublishTarget":11,"keywords":12,"logo":18,"logoWidth":19,"meta":20,"search":21,"seoTitleSuffix":25,"skipLinkText":26,"socialImage":27,"socials":30,"stem":47,"__hash__":48},"settings\u002Fdata\u002Fsettings.yml","Open Regulatory Compliance Working Group",{"text":7,"href":8},"Get involved","\u002Fparticipate\u002F","The open source community is collaborating to establish common specifications for secure software development based on open source best practices.","yml","orc",[13,14,15,16,17],"regulatory compliance","cybersecurity processes","royalty-free patent licence","open source community collaboration","Eclipse Foundation Specification Process","\u002Fimages\u002Forc-logo.png",120,{},{"label":22,"placeholder":23,"menuLabel":24},"Search","Search the site…","Menu"," | Open Regulatory Compliance Working Group","Skip to main content",{"backgroundImage":28,"eyebrow":29},"\u002Fimages\u002Fog\u002Fbackground.jpg","orcwg.org",[31,35,39,43],{"name":32,"icon":33,"url":34},"LinkedIn","fa6-brands:linkedin-in","https:\u002F\u002Fwww.linkedin.com\u002Fshowcase\u002Fopen-regulatory-compliance\u002F",{"name":36,"icon":37,"url":38},"YouTube","fa6-brands:youtube","https:\u002F\u002Fwww.youtube.com\u002F@ORCWG",{"name":40,"icon":41,"url":42},"Bluesky","fa6-brands:bluesky","https:\u002F\u002Fbsky.app\u002Fprofile\u002Forcwg.org",{"name":44,"icon":45,"url":46},"Mastodon","fa6-brands:mastodon","https:\u002F\u002Ffosstodon.org\u002F@orcwg","data\u002Fsettings","bxtnzYEG4TQ27x8O_VKQIF-gc2dr-DNwF9_OpAZy3LA",{"id":50,"extension":10,"main":51,"meta":123,"stem":124,"__hash__":125},"navigation\u002Fdata\u002Fnavigation.yml",[52,70,82,99],{"text":53,"children":54},"About",[55,58,61,64,67],{"text":56,"href":57},"ORC Working Group","\u002Fabout\u002F",{"text":59,"href":60},"Cyber Resilience SIG","\u002Fspecial-interest-groups\u002Fcyber-resilience\u002F",{"text":62,"href":63},"AI Policy & Compliance SIG","\u002Fspecial-interest-groups\u002Fai-policy-and-compliance\u002F",{"text":65,"href":66},"Steering Committee","\u002Fcommittees\u002Fsteering-committee\u002F",{"text":68,"href":69},"Meeting Minutes","\u002Fcommittees\u002Fminutes\u002F",{"text":71,"children":72},"Membership",[73,76,79],{"text":74,"href":75},"Our Members","\u002Fmembership\u002F",{"text":77,"href":78},"Become a Member","\u002Fmembership\u002Fbecome-a-member\u002F",{"text":80,"href":81},"Participation and Membership FAQ","\u002Fabout\u002Fparticipation-and-membership-faq\u002F",{"id":83,"text":84,"children":85},"cra","Cyber Resilience Act",[86,89,93,96],{"text":87,"href":88},"About CRA","\u002Fcra\u002Fabout",{"text":90,"href":91,"external":92},"CRA FAQ","https:\u002F\u002Fcra.orcwg.org\u002F",true,{"text":94,"href":95},"CRA Resources","\u002Fcra\u002Fresources",{"text":97,"href":98,"external":92},"CRA Hub on GitHub","https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-hub",{"text":100,"children":101},"Resources",[102,105,108,111,114,117,120],{"text":103,"href":104},"Events","\u002Fevents\u002F",{"text":106,"href":107},"Community Calendar","\u002Fresources\u002Fcalendar\u002F",{"text":109,"href":110},"Blog","\u002Fblog\u002F",{"text":112,"href":113},"Videos","\u002Fresources\u002Fvideos\u002F",{"text":115,"href":116},"Learning Hub","\u002Ftraining\u002F",{"text":118,"href":119},"Marketing Resources","\u002Fresources\u002Fmarketing-resources\u002F",{"text":121,"href":122,"external":92},"ORC Store","https:\u002F\u002Feclipse-foundation.store\u002Fcollections\u002Fopen-regulatory-compliance-orc",{},"data\u002Fnavigation","XYDVypNX67n8V4VQI_JTrw0cI16uV5jtctVXjN-DeKo",{"id":127,"backToTopText":128,"copyright":129,"extension":10,"manageCookiesText":130,"meta":131,"sections":132,"socialsHeading":185,"stem":186,"__hash__":187},"footer\u002Fdata\u002Ffooter.yml","Back to the top","Copyright © Eclipse Foundation AISBL. All Rights Reserved.","Manage Cookies",{},[133,150,169],{"id":134,"heading":135,"links":136},"footer-eclipse-foundation","Eclipse Foundation",[137,139,142,145,147],{"text":53,"href":138},"https:\u002F\u002Fwww.eclipse.org\u002Forg\u002F",{"text":140,"href":141},"Projects","https:\u002F\u002Fprojects.eclipse.org\u002F",{"text":143,"href":144},"Collaborations","https:\u002F\u002Fwww.eclipse.org\u002Fcollaborations\u002F",{"text":71,"href":146},"https:\u002F\u002Fwww.eclipse.org\u002Fmembership\u002F",{"text":148,"href":149},"Sponsor","https:\u002F\u002Fwww.eclipse.org\u002Fsponsor\u002F",{"id":151,"heading":152,"showManageCookies":92,"links":153},"footer-legal","Legal",[154,157,160,163,166],{"text":155,"href":156},"Privacy Policy","https:\u002F\u002Fwww.eclipse.org\u002Flegal\u002Fprivacy\u002F",{"text":158,"href":159},"Terms of Use","https:\u002F\u002Fwww.eclipse.org\u002Flegal\u002Fterms-of-use\u002F",{"text":161,"href":162},"Compliance","https:\u002F\u002Fwww.eclipse.org\u002Flegal\u002Fcompliance\u002F",{"text":164,"href":165},"Code of Conduct","https:\u002F\u002Fwww.eclipse.org\u002Forg\u002Fdocuments\u002FCommunity_Code_of_Conduct.php",{"text":167,"href":168},"Legal Resources","https:\u002F\u002Fwww.eclipse.org\u002Flegal\u002F",{"id":170,"heading":171,"links":172},"footer-more","More",[173,176,179,182],{"text":174,"href":175},"Report a Vulnerability","https:\u002F\u002Fwww.eclipse.org\u002Fsecurity\u002F",{"text":177,"href":178},"Service Status","https:\u002F\u002Fstatus.eclipse.org\u002F",{"text":180,"href":181},"Contact Us","https:\u002F\u002Fwww.eclipse.org\u002Forg\u002Ffoundation\u002Fcontact.php",{"text":183,"href":184},"Support","https:\u002F\u002Fwww.eclipse.org\u002Fprojects\u002Fsupport\u002F","Follow Us:","data\u002Ffooter","C-lpCHl9crwF3iQyRSh8y5g9ez5YgF4pi8aTv4pFLBM",{"id":189,"title":190,"aliases":191,"author":192,"body":193,"breadcrumbTitle":191,"breadcrumbs":191,"date":352,"description":191,"extension":353,"featuredFooter":191,"keywords":191,"meta":354,"navigation":92,"path":355,"redirectUrl":191,"seo":356,"seoTitle":191,"socialImage":191,"stem":357,"summary":191,"typography":191,"visibility":191,"width":191,"__hash__":358},"blog\u002Fblog\u002Fmm-recap.md","Maintainer Month Recap: What the CRA Means for You",null,"Juan Rico",{"type":194,"value":195,"toc":343},"minimark",[196,218,223,237,241,258,262,278,282,285,316,324,328,340],[197,198,199,200,212,213,217],"p",{},"Last month we teamed up with GitHub to host ",[201,202,203,204,211],"em",{},"“",[205,206,210],"a",{"href":207,"rel":208},"https:\u002F\u002Fwww.youtube.com\u002Flive\u002FDLxZdU8kzxM?si=gozZMsz91lj-c1j2",[209],"nofollow","The Cyber Resilience Act and Open Source: What Maintainers Really Need to Know",".”"," The one-hour panel zeroed in on the top worries we hear from open source project maintainers and contributors. Below is a recap—and, more importantly, where you’ll find the detailed answers in the ORC working group’s ",[205,214,90],{"href":215,"rel":216},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-hub\u002Fblob\u002Fmain\u002Ffaq.md",[209],".",[219,220,222],"h2",{"id":221},"_1-does-the-cra-actually-apply-to-my-project","1. “Does the CRA actually apply to my project?”",[197,224,225,226,230,231,236],{},"The panel’s first takeaway was simple: most volunteer-run FOSS projects ",[227,228,229],"strong",{},"are not manufacturers"," under the law. If you just publish code on GitHub, chances are you’re out of scope. The CRA only kicks in when software is shipped as part of a “product with digital elements.” For the fine print—including the edge-cases the speakers walked through—see “",[205,232,235],{"href":233,"rel":234},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-hub\u002Fblob\u002Fmain\u002Ffaq.md#faq-tmp-133b",[209],"Am I subject to the CRA?","” in the FAQ.",[219,238,240],{"id":239},"_2-what-happens-if-i-accept-donations-or-sponsorships","2. “What happens if I accept donations or sponsorships?”",[197,242,243,244,247,248,251,252,257],{},"A second hot topic was whether a project starts looking like a ",[201,245,246],{},"manufacturer"," once money changes hands. The consensus: taking GitHub Sponsors or ad-hoc donations ",[227,249,250],{},"does not, by itself, turn you into a CRA manufacturer or steward."," The law focuses on commercial placement of products, not community fundraising. Check the FAQ entry on ",[205,253,256],{"href":254,"rel":255},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-hub\u002Fblob\u002Fmain\u002Ffaq.md#faq-tmp-133c",[209],"monetising open source projects"," for the nuances.",[219,259,261],{"id":260},"_3-will-i-be-fined-if-something-goes-wrong","3. “Will I be fined if something goes wrong?”",[197,263,264,265,268,269,272,273,217],{},"Finally, the panel addressed the elephant in the room: penalties. Under the current text, liability sits with the entity that ",[201,266,267],{},"places"," the product on the EU market. ",[227,270,271],{},"Maintainers therefore face no fines unless they also meet the definition of a manufacturer or steward."," Even so, the panel urged projects to document their release process and spell out who does what. For the full breakdown, see the FAQ section on ",[205,274,277],{"href":275,"rel":276},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-hub\u002Fblob\u002Fmain\u002Ffaq.md#faq-tmp-133d",[209],"penalties for maintainers",[219,279,281],{"id":280},"still-curious-check-the-cra-faq","Still Curious? Check the CRA FAQ",[197,283,284],{},"We ran out of time before we could tackle every audience question, but many of them are already answered in the working group’s living CRA FAQ. Here are three good examples:",[286,287,288,298,307],"ul",{},[289,290,291,292,297],"li",{},"“How can a commercial producer keep track of all the indirect dependencies pulled in by package managers?” The discussion “",[205,293,296],{"href":294,"rel":295},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-hub\u002Fissues\u002F87",[209],"What do I need to do about my dependencies?","” covers this topic.",[289,299,300,301,306],{},"“What exactly qualifies as a ‘Product with Digital Elements’ under the CRA?” The answer under “",[205,302,305],{"href":303,"rel":304},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-hub\u002Fblob\u002Fmain\u002Ffaq.md#faq-tmp-2",[209],"What kinds of products are regulated by the CRA?","” may help provide some clarity.",[289,308,309,310,315],{},"“Where does the CRA overlap with the proposed Product Liability Directive (PLD)?” See the open discussion “",[205,311,314],{"href":312,"rel":313},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-hub\u002Fissues\u002F76",[209],"How do I respond to a legal challenge?","”",[197,317,318,319,323],{},"You’ll find these answers—and many more in progress—inside the ",[205,320,322],{"href":215,"rel":321},[209],"ORC CRA FAQ",". If your question isn’t covered yet, open an issue or add a comment so the community can tackle it together.",[219,325,327],{"id":326},"keep-learning-stay-involved","Keep Learning & Stay Involved",[197,329,330,331,334,335,339],{},"The CRA is evolving, and so is the guidance. Bookmark the full ",[205,332,90],{"href":215,"rel":333},[209]," and drop your questions—or pull requests—there. If you missed the live stream, you can ",[205,336,338],{"href":207,"rel":337},[209],"watch the replay"," anytime on YouTube.",[197,341,342],{},"Open discussion is how we protect open source. Let’s keep the conversation going.",{"title":344,"searchDepth":345,"depth":345,"links":346},"",2,[347,348,349,350,351],{"id":221,"depth":345,"text":222},{"id":239,"depth":345,"text":240},{"id":260,"depth":345,"text":261},{"id":280,"depth":345,"text":281},{"id":326,"depth":345,"text":327},"2025-06-20","md",{},"\u002Fblog\u002Fmm-recap",{"title":190},"blog\u002Fmm-recap","H6vjWACI7SbvOVXcgP4m6mbFVpsli5q61kiRoyHRLcE",[360],{"path":361,"visibility":191},"\u002Fblog",false,[364,367],{"path":365,"text":366},"\u002F","ORC",{"path":361,"text":109},1792684543815]