[{"data":1,"prerenderedAt":347},["ShallowReactive",2],{"site:settings":3,"site:navigation":49,"site:footer":126,"page:\u002Fblog\u002Ftechnical-description-milestone":188,"sections:\u002Fblog\u002Ftechnical-description-milestone":338,"feed:\u002Fblog\u002Ftechnical-description-milestone":341,"breadcrumbs:\u002Fblog\u002Ftechnical-description-milestone":342},{"id":4,"title":5,"callForAction":6,"description":9,"extension":10,"featuredContentPublishTarget":11,"keywords":12,"logo":18,"logoWidth":19,"meta":20,"search":21,"seoTitleSuffix":25,"skipLinkText":26,"socialImage":27,"socials":30,"stem":47,"__hash__":48},"settings\u002Fdata\u002Fsettings.yml","Open Regulatory Compliance Working Group",{"text":7,"href":8},"Get involved","\u002Fparticipate\u002F","The open source community is collaborating to establish common specifications for secure software development based on open source best practices.","yml","orc",[13,14,15,16,17],"regulatory compliance","cybersecurity processes","royalty-free patent licence","open source community collaboration","Eclipse Foundation Specification Process","\u002Fimages\u002Forc-logo.png",120,{},{"label":22,"placeholder":23,"menuLabel":24},"Search","Search the site…","Menu"," | Open Regulatory Compliance Working Group","Skip to main content",{"backgroundImage":28,"eyebrow":29},"\u002Fimages\u002Fog\u002Fbackground.jpg","orcwg.org",[31,35,39,43],{"name":32,"icon":33,"url":34},"LinkedIn","fa6-brands:linkedin-in","https:\u002F\u002Fwww.linkedin.com\u002Fshowcase\u002Fopen-regulatory-compliance\u002F",{"name":36,"icon":37,"url":38},"YouTube","fa6-brands:youtube","https:\u002F\u002Fwww.youtube.com\u002F@ORCWG",{"name":40,"icon":41,"url":42},"Bluesky","fa6-brands:bluesky","https:\u002F\u002Fbsky.app\u002Fprofile\u002Forcwg.org",{"name":44,"icon":45,"url":46},"Mastodon","fa6-brands:mastodon","https:\u002F\u002Ffosstodon.org\u002F@orcwg","data\u002Fsettings","bxtnzYEG4TQ27x8O_VKQIF-gc2dr-DNwF9_OpAZy3LA",{"id":50,"extension":10,"main":51,"meta":123,"stem":124,"__hash__":125},"navigation\u002Fdata\u002Fnavigation.yml",[52,70,82,99],{"text":53,"children":54},"About",[55,58,61,64,67],{"text":56,"href":57},"ORC Working Group","\u002Fabout\u002F",{"text":59,"href":60},"Cyber Resilience SIG","\u002Fspecial-interest-groups\u002Fcyber-resilience\u002F",{"text":62,"href":63},"AI Policy & Compliance SIG","\u002Fspecial-interest-groups\u002Fai-policy-and-compliance\u002F",{"text":65,"href":66},"Steering Committee","\u002Fcommittees\u002Fsteering-committee\u002F",{"text":68,"href":69},"Meeting Minutes","\u002Fcommittees\u002Fminutes\u002F",{"text":71,"children":72},"Membership",[73,76,79],{"text":74,"href":75},"Our Members","\u002Fmembership\u002F",{"text":77,"href":78},"Become a Member","\u002Fmembership\u002Fbecome-a-member\u002F",{"text":80,"href":81},"Participation and Membership FAQ","\u002Fabout\u002Fparticipation-and-membership-faq\u002F",{"id":83,"text":84,"children":85},"cra","Cyber Resilience Act",[86,89,93,96],{"text":87,"href":88},"About CRA","\u002Fcra\u002Fabout",{"text":90,"href":91,"external":92},"CRA FAQ","https:\u002F\u002Fcra.orcwg.org\u002F",true,{"text":94,"href":95},"CRA Resources","\u002Fcra\u002Fresources",{"text":97,"href":98,"external":92},"CRA Hub on GitHub","https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-hub",{"text":100,"children":101},"Resources",[102,105,108,111,114,117,120],{"text":103,"href":104},"Events","\u002Fevents\u002F",{"text":106,"href":107},"Community Calendar","\u002Fresources\u002Fcalendar\u002F",{"text":109,"href":110},"Blog","\u002Fblog\u002F",{"text":112,"href":113},"Videos","\u002Fresources\u002Fvideos\u002F",{"text":115,"href":116},"Learning Hub","\u002Ftraining\u002F",{"text":118,"href":119},"Marketing Resources","\u002Fresources\u002Fmarketing-resources\u002F",{"text":121,"href":122,"external":92},"ORC Store","https:\u002F\u002Feclipse-foundation.store\u002Fcollections\u002Fopen-regulatory-compliance-orc",{},"data\u002Fnavigation","XYDVypNX67n8V4VQI_JTrw0cI16uV5jtctVXjN-DeKo",{"id":127,"backToTopText":128,"copyright":129,"extension":10,"manageCookiesText":130,"meta":131,"sections":132,"socialsHeading":185,"stem":186,"__hash__":187},"footer\u002Fdata\u002Ffooter.yml","Back to the top","Copyright © Eclipse Foundation AISBL. All Rights Reserved.","Manage Cookies",{},[133,150,169],{"id":134,"heading":135,"links":136},"footer-eclipse-foundation","Eclipse Foundation",[137,139,142,145,147],{"text":53,"href":138},"https:\u002F\u002Fwww.eclipse.org\u002Forg\u002F",{"text":140,"href":141},"Projects","https:\u002F\u002Fprojects.eclipse.org\u002F",{"text":143,"href":144},"Collaborations","https:\u002F\u002Fwww.eclipse.org\u002Fcollaborations\u002F",{"text":71,"href":146},"https:\u002F\u002Fwww.eclipse.org\u002Fmembership\u002F",{"text":148,"href":149},"Sponsor","https:\u002F\u002Fwww.eclipse.org\u002Fsponsor\u002F",{"id":151,"heading":152,"showManageCookies":92,"links":153},"footer-legal","Legal",[154,157,160,163,166],{"text":155,"href":156},"Privacy Policy","https:\u002F\u002Fwww.eclipse.org\u002Flegal\u002Fprivacy\u002F",{"text":158,"href":159},"Terms of Use","https:\u002F\u002Fwww.eclipse.org\u002Flegal\u002Fterms-of-use\u002F",{"text":161,"href":162},"Compliance","https:\u002F\u002Fwww.eclipse.org\u002Flegal\u002Fcompliance\u002F",{"text":164,"href":165},"Code of Conduct","https:\u002F\u002Fwww.eclipse.org\u002Forg\u002Fdocuments\u002FCommunity_Code_of_Conduct.php",{"text":167,"href":168},"Legal Resources","https:\u002F\u002Fwww.eclipse.org\u002Flegal\u002F",{"id":170,"heading":171,"links":172},"footer-more","More",[173,176,179,182],{"text":174,"href":175},"Report a Vulnerability","https:\u002F\u002Fwww.eclipse.org\u002Fsecurity\u002F",{"text":177,"href":178},"Service Status","https:\u002F\u002Fstatus.eclipse.org\u002F",{"text":180,"href":181},"Contact Us","https:\u002F\u002Fwww.eclipse.org\u002Forg\u002Ffoundation\u002Fcontact.php",{"text":183,"href":184},"Support","https:\u002F\u002Fwww.eclipse.org\u002Fprojects\u002Fsupport\u002F","Follow Us:","data\u002Ffooter","C-lpCHl9crwF3iQyRSh8y5g9ez5YgF4pi8aTv4pFLBM",{"id":189,"title":190,"aliases":191,"author":192,"body":193,"breadcrumbTitle":191,"breadcrumbs":191,"date":331,"description":191,"extension":332,"featuredFooter":191,"keywords":191,"meta":333,"navigation":92,"path":334,"redirectUrl":191,"seo":335,"seoTitle":191,"socialImage":191,"stem":336,"summary":191,"typography":191,"visibility":191,"width":191,"__hash__":337},"blog\u002Fblog\u002Ftechnical-description-milestone.md","Moving Forward with Clear Technical Definitions Under the CRA",null,"Juan Rico",{"type":194,"value":195,"toc":324},"minimark",[196,217,220,227,232,235,238,241,261,265,268,280,283,287,290,293,307,310],[197,198,199,200,204,205,208,209,216],"p",{},"The European Commission has just published the Implementing Regulation defining the ",[201,202,203],"em",{},"technical description"," of “important” and “critical” products with digital elements under the Cyber Resilience Act (CRA).",[206,207],"br",{},"\nYou can find the full text here: ",[210,211,215],"a",{"href":212,"rel":213},"https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg_impl\u002F2025\u002F2392\u002Foj",[214],"nofollow","Regulation (EU) 2025\u002F2392 – Technical Description of Important and Critical Products",".",[197,218,219],{},"This is a significant moment in the CRA journey. For the first time, manufacturers, integrators, and open source communities have a clear, legally binding definition of which technologies fall into the higher-risk categories. For anyone building or maintaining software used across Europe, this clarity matters.",[197,221,222,223],{},"From the perspective of the Open Regulatory Compliance (ORC) Working Group, this regulation is especially important for one reason: ",[224,225,226],"strong",{},"it finally gives open source stewards and maintainers the information they need to understand where their work fits within the CRA framework.",[228,229,231],"h2",{"id":230},"why-this-matters-for-open-source","Why this matters for open source",[197,233,234],{},"Many of the technologies listed as “important” are widely built, maintained, or influenced by open source communities: browsers, operating systems, VPN clients, identity systems, network tools, package managers, secure-element firmware… the list is long.",[197,236,237],{},"Until now, projects had to guess whether they would be treated as “important” under the CRA, and uncertainty is never a good foundation for long-term planning.",[197,239,240],{},"This new regulation does two things:",[242,243,244,253],"ol",{},[245,246,247,250,252],"li",{},[224,248,249],{},"It removes ambiguity.",[206,251],{},"\nProjects now know whether their core functionality matches a regulated category. This helps maintainers and foundations anticipate documentation needs, security-process expectations, and integration paths for manufacturers who rely on their work.",[245,254,255,258,260],{},[224,256,257],{},"It reinforces the need for structured governance in these cases.",[206,259],{},"\nAs CRA obligations become clearer, open source projects will increasingly depend on strong governance, documented processes, and reliable vulnerability-handling mechanisms. This is exactly why ORC exists: to help communities and ecosystems prepare without overwhelming individual contributors.",[228,262,264],{"id":263},"the-practical-impact-for-foss-projects","The Practical Impact for FOSS Projects",[197,266,267],{},"With the technical descriptions officially published:",[269,270,271,274,277],"ul",{},[245,272,273],{},"Open source projects can start aligning documentation, security policies, SBOM workflows, and governance practices with the CRA reality.",[245,275,276],{},"Foundations and stewards gain a clearer mandate to provide structured processes that manufacturers can trust.",[245,278,279],{},"Manufacturers now have an easier path to determine when and how they can rely on open source components in regulated contexts.",[197,281,282],{},"Open source will play a central role in CRA compliance, but only if communities can demonstrate predictable, transparent, and trustworthy security practices. Regulation (EU) 2025\u002F2392 gives us a shared starting point.",[228,284,286],{"id":285},"orcs-role-moving-forward","ORC’s role moving forward",[197,288,289],{},"At ORC, we’ve spent the last year working to ensure that open source perspectives are reflected in CRA implementation. This new regulation includes elements that our community actively contributed to, a small but meaningful sign that the European Commission understands the importance of open source in Europe’s digital infrastructure.",[197,291,292],{},"Now the real work begins:",[269,294,295,298,301,304],{},[245,296,297],{},"refining our guidance, including the due diligence processes for manufacturers integrating open source technologies,",[245,299,300],{},"expanding community-driven best practices,",[245,302,303],{},"maturing the attestation model under Article 25,",[245,305,306],{},"and supporting maintainers and stewards as they navigate the new landscape.",[197,308,309],{},"The publication of these technical descriptions is not the end of the discussion; it’s the beginning of coordinated, practical implementation. Open source is part of Europe’s backbone, and the CRA gives us an opportunity to reinforce that role with clarity, structure, and shared responsibility.",[197,311,312,313,318,319,216],{},"If you care about the future of open source in Europe, this is the moment to get involved. The ORC Working Group is already deep into the practical work. ",[210,314,317],{"href":315,"rel":316},"https:\u002F\u002Forcwg.org\u002Fparticipate\u002F",[214],"Be part of our regular discussions"," and join our events, like ",[210,320,323],{"href":321,"rel":322},"https:\u002F\u002Fwww.eclipse-foundation.events\u002Fevent\u002Fcode-compliance-2026\u002Fsummary",[214],"Code and Compliance FOSDEM Edition",{"title":325,"searchDepth":326,"depth":326,"links":327},"",2,[328,329,330],{"id":230,"depth":326,"text":231},{"id":263,"depth":326,"text":264},{"id":285,"depth":326,"text":286},"2025-12-03","md",{},"\u002Fblog\u002Ftechnical-description-milestone",{"title":190},"blog\u002Ftechnical-description-milestone","emk8iL08CEYjLugwgTs53kdm-u0Eon9SmuZSypx3raY",[339],{"path":340,"visibility":191},"\u002Fblog",false,[343,346],{"path":344,"text":345},"\u002F","ORC",{"path":340,"text":109},1792684542381]