Code & Compliance 2026

Bridging the regulatory gap

A full day at Maison de la Poste in Brussels on what the Cyber Resilience Act and the AI Act mean for open source software and the products built on it.

Tuesday 27 October 2026, 09:00–17:35, Maison de la Poste, Brussels

Programme Speakers Venue and practical details

Save the date

The day starts in

Days

Hours

Minutes

Seconds

Add to calendar

Practical details

One day, one room, every side of open source compliance.

Venue details

Tuesday 27 October

From 09:00, with the closing remarks at 17:35.

Maison de la Poste

In Brussels, in a room small enough to talk in.

For the people who make compliance work

Product manufacturers, open source programme offices, industry associations, and policy, security and legal professionals.

The programme

Four sessions, from policy to practice

Each session brings talks and ends with a panel. The programme is being finalised: sessions and speakers may still change.

See the programme online

09:00
Shaping the digital compliance landscape
- 09:10 Welcome to Code & Compliance: Gaël Blondelle, Eclipse Foundation
- 09:30 Open Regulatory Compliance: progress, priorities and what’s next: Juan Rico, ORC
- 09:50 Panel, navigating the regulatory landscape, from policy objectives to practical implementation: Carlos Lopez (European Commission), Dirk-Willem van Gulik (Apache Software Foundation), Jaroslav Reznik (Red Hat) and Arnaud Martin (Agoria), moderated by Juan Rico
10:50
Securing products and demonstrating compliance in the times of the CRA
- 10:50 The CRA: status, next steps and how to support the implementation process: Tommaso Bernabò, European Commission
- 11:10 Due diligence obligations for the integration of open source components: Timo Perälä, Nokia
- 11:30 The role of open source stewards during the product lifetime: Pavel Hruza, Red Hat
- 11:50 Overview of ENISA’s SBOMs efforts: Ioanna Georgiadou, ENISA
- 12:10 Panel, SBOMs and their real impact on the industry: Olle E. Johanson (Edvina.net), Bartłomiej Głuch (Kombud Group S.A.) and Ioanna Georgiadou (ENISA), moderated by Juan Rico
14:00
AI Act: safe integration of open source models
- 14:00 AI Office: Miriam D’Arrigo, European Commission
- 14:20 Eclipse Enclave project, agentic AI and regulatory compliance in practice: Philip Langer, EclipseSource
- 14:40 Overlapping regulations for open source: Æva Black, Null Point Studio
- 15:00 Panel, code, weights and regulation, the new blueprint for open AI security: Jordan Maris (Open Source Initiative), James Lovegrove (Red Hat) and Philippe Ombredanne (AboutCode), moderated by Rachel Foucard
16:15
Simplifying compliance for industrial scale
- 16:15 Physical machinery documentation turned into compliance assets, the EnduraDocs case: Merzough Münker, EnduraDocs
- 16:35 Transparency upstream, evidence downstream, manufacturers and open source under the CRA: William Janssen, TrustEngine
- 16:55 Panel, shared responsibility, who owns open source security?: Carlos Serratos (Arm), Amelia Alder (Knorr-Bremse) and Gregor Bransky (Layer 9 Solutions), moderated by Marta Garcia
- 17:35 Closing remarks: Timo Perälä and Dirk-Willem van Gulik

Speakers

Who you will hear from

Talks from the European Commission, ENISA, industry and open source communities, and four panels with many more voices.

Gaël Blondelle

Eclipse Foundation

Welcome

Juan Rico

ORC

Host and moderator

Tommaso Bernabò

European Commission

The CRA, status and next steps

Timo Perälä

Nokia

Due diligence obligations

Pavel Hruza

Red Hat

Open source stewards

Ioanna Georgiadou

ENISA

SBOMs

Miriam D’Arrigo

European Commission

AI Office

Philip Langer

EclipseSource

Agentic AI and compliance

Æva Black

Null Point Studio

Overlapping regulations

Merzough Münker

EnduraDocs

Documentation as compliance assets

William Janssen

TrustEngine

Manufacturers and open source

From the blog

The four panels, in detail

October 14 2026