Skip to main content
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [List Home]
Re: [open-regulatory-compliance] CRA: Online survey for Free Software Stewards, for Free Software projects and for manufacturers
Also the rest of the questions is also problematic:

"What do you need from the open-source developers to fulfil the CRA requirements?" → Which Open Source developers ?

"What would you consider if somebody asks you to become a steward?" → Who? On which legal basis? Either we are or we are not, based on the CRA and its guidance. 

"In the event that there is proof that an open-source component fulfils the CRA requirements, is there a willingness to receive money for this as a steward (from the manufacturers) or to pay for it (to developers)?" → I don't have any idea what this means. What kind of "proof"? Willingness from whom?

"What help do you need (from manufacturer, regulators/authorities, sponsor companies, vulnerability program leaders, etc.) to fulfil CRA requirements?" → Assuming what?

"Do you think manufacturers must support stewards?" → "must" is what sense? According to the CRA? If it's regulated by the CRA, there is no matter of "thinking". Either it's an obligation, or it is not.


On Sun, Jul 13, 2025 at 9:08 PM Stéfane Fermigier <sf@xxxxxxxxxxxxx> wrote:
Sorry, but this questionnaire assumes that an entity can't be both a manufacturer and a steward ("Do you consider yourself a Manufacturer and a Steward, but for different projects?")

But, from an email last year:

"We have been advised by the EU that we are both manufacturer and steward depending on the position in the supply chain of activity. Indeed, we are also distributor/importer depending on pst in the channel.  Again, something for EU guidance to further flesh out. "

Or from this week, via Jordan Maris:

"I can tell you what I think will be the case, based on the discussions i've had with officials: first things first, and perhaps this can be some good news: if everything goes as planned, you will be able to consider your commercially and open source licensed versions as separate products. You will be the manufacturer of the commercially licenced version, and the steward of open source version."

Note that this is something I have been arguing for since late 2022 or early 2023. So it would be good if it is actually the case that one entity can be both a manufacturer and a steward for the same product (depending not on the product itself, but on the commercial and contractual relationship attached to it).


Also, there is no way to go back to revise a previous answer, which is both annoying (I had to start again in incognito mode) and will probably lead to biased results.

  S.


On Sun, Jul 13, 2025 at 4:08 PM Alexander Sander via open-regulatory-compliance <open-regulatory-compliance@xxxxxxxxxxx> wrote:
Hi all

We created a CRA questionnaire as part of the "Dialogue for
Cybersecurity". The questionnaires were developed to gain important
insights into the EU Cyber Resilience Act (CRA) and its impact.

There are questionnaires for Free Software projects, manufacturers and
potential Free Software stewards.

The responses will help us understand what guidance is needed and this
will feed into our work across the Free Software ecosystem and with the
European Commission to support the CRA implementation.

Potential Free Software stewards (EN)
https://dialog-cybersicherheit.limesurvey.net/146965?lang=en

Free Software projects (EN)
https://dialog-cybersicherheit.limesurvey.net/241948?lang=en

Manufacturer (EN)
https://dialog-cybersicherheit.limesurvey.net/582853?lang=en

The questionnaire will be open for responses until August 31. Please
note that all responses received by July 30 will be included in an
initial evaluation. These preliminary results will be presented as part
of a presentation at FrOSCon [1]. Of course, any feedback received after
July 30 will also be considered in the final analysis. We appreciate
your participation and support! Note: The feedback will be published
anonymously. Thank you for your support.

Best
Alex

[1]
https://programm.froscon.org/froscon2025/talk/0a656836-cb27-4ef1-80e1-d64c553a96ca/


--
Alexander Sander - Senior Policy Consultant
Free Software Foundation Europe e.V.
Revaler Str. 19, 10245 Berlin |
+49 (0)30 2759 5290 |
Registered at Amtsgericht Hamburg, VR 17030  |
(fsfe.org/join)

_______________________________________________
open-regulatory-compliance mailing list
open-regulatory-compliance@xxxxxxxxxxx
To unsubscribe from this list, visit https://accounts.eclipse.org


--
Stefane Fermigier - http://fermigier.com/ - http://twitter.com/sfermigier - http://linkedin.com/in/sfermigier
Founder & CEO, Abilian - Enterprise Social Software - http://www.abilian.com/
Co-Founder & Co-Chairman, National Council for Free & Open Source Software (CNLL) - http://cnll.fr/
Co-Founder & Co-chair, Association Professionnelle Européenne du Logiciel Libre (APELL) - https://www.apell.info/ 
Founder, EuroStack Directory Project - https://euro-stack.com/


--
Stefane Fermigier - http://fermigier.com/ - http://twitter.com/sfermigier - http://linkedin.com/in/sfermigier
Founder & CEO, Abilian - Enterprise Social Software - http://www.abilian.com/
Co-Founder & Co-Chairman, National Council for Free & Open Source Software (CNLL) - http://cnll.fr/
Co-Founder & Co-chair, Association Professionnelle Européenne du Logiciel Libre (APELL) - https://www.apell.info/ 
Founder, EuroStack Directory Project - https://euro-stack.com/

Back to the top