Skip to main content

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [List Home]
Re: [open-regulatory-compliance] Placing software on the market - General issues

Very interestingly, looking at some of the draft documents shared with the CRA Expert Group in the last few days address these very specific points.

Looking at those documents is turns out—unsurpringly—that the truth lies somewhere in the middle:
  1. Each individual purchase (even of the same bit-to-bit equivalent software) is a different product.
  2. Each individual product is placed on the market separately and made available separately.
  3. HOWEVER, products available for download on a given platform are all considered to be placed on market on the day the software first becomes available for purchase on that platform, regardless of when it is first sold.
  4. BUT HOLD UP: If the same software (whether bit-for-bit equivalent or slightly modified but not modified enough that it meets the threshold for substantial modifications) is offered for download on another platform at a later date, copies of the software downloaded from that second platform will share a different date at which they were placed on the market: the date at which the software was first became available for download on that second platform.
I hope your mind is as blown as mine right now.

Bringing this back to your initial set of comments and questions, here's how I'd answer them given this new perspective:

Case:
A manufacturer finished the development of software 1.0 and makes it downloadable on a website and an app store for European customers. European customers download the software from the website or the app store.


It's important to clarify whether the software is available on both the website and an appstore at the same time. If they are available at the same time, all copies sold will share the same date at which they were placed on the market; the date at which they became available for download. If there's a delay in, for example, the app store offering the software for download, software purchased from the app store will have a later date at which it was placed on the market.

Statement 1:
Software 1.0 is the product with digital elements and the first download is the first making available – placing on the market – of software 1.0.

More precisely, the software is placed on the market the day it first becomes available for a purchase, regardless of whether or not a copy is actually sold that day.
 
Any other download of software 1.0 is another making available. Any other distribution via distribution channels are other instances of making available of software 1.0.

No. Every other distribution channel will create a new date at which the products purchased through that distribution channel are considered to be placed on the market.
 
Placing on the market of software 1.0 can happen only once.

No. It's going to happen once per distribution channel for digital goods and one per production or "first entry into the EU" (for lack of a shorter explanation) for physical goods 

 

Statement 2:
When software 1.0 has been modified or repaired to 1.1 and this is not considered as a substantial modification, the download and distribution of software 1.1 is still making available.

True unless it is done through a new channel. 

Statement 3:
When software 1.0 has been modified or repaired to 2.0 and this modification is seen as a substantial modification, the first download of software 2.0 is the first making available on the market – placing on the market.

 

So I believe each copy of V2 is a new product and we're back at the considerations mentioned for Statement 1 here.

Question:
What is seen as a product regarding software?

Each individual copy that is purchased is a separate product under the CRA.
 
Do you agree to this view and statements?
This is a crucial viewpoint for Support Period and legacy products. In that view, Legacy software is still downloadable on the website without the danger of falling under the CRA.

So with that better understanding in mind, I believe that the answer here is that legacy software that is available for download won't fall under the CRA unless it becomes available through new distribution channels, in which case only the copies downloaded through that new distribution channel would be in scope!?

Software sold in physical form will fall under the CRA as new copies are made / imported in the EU, even if the software contained on the disc is bit-for-bit identical to copies that were imported / produced before the deadline.

On Thu, Oct 16, 2025 at 7:25 PM Dirk-Willem van Gulik via open-regulatory-compliance <open-regulatory-compliance@xxxxxxxxxxx> wrote:
On 16 Oct 2025, at 18:33, Brian Fox via open-regulatory-compliance <open-regulatory-compliance@xxxxxxxxxxx> wrote:

> As I've followed along this thread, some additional thoughts come to mind. Some package registries like Central, are essentially immutable. This interpretation on downloads I think means that the 5 year support clause never ends as long as something is available to download. Note: Not everything in Central is open source these days, some things are commercial-ish so lets assume there are at least a minimal CRA implication for these things. Does that mean that manufacturers need to be able to fully "disappear" old software to start the 5 year clock ticking? Does a book need to get removed from a library or archive to take if off the market?

I think we could tackle these as feedback to the OSS Guidance document; e.g - very loosely written something akin to below:

Would that help ?

Dw.


        Example Z

        A company or open source steward[1] A distributes its component intended for integration via a package repository B on the first of January 2030 as 'version 1'.

        Company C and D fetch this component shortly thereafter and places a product  digital element on the market with a reasonable economic life of 5 years.

        A maintains this component actively and updates this component regularly; each time increasing the version.

        With company C pickling up a new versin from B and generally doing a release shortly thereafter.  Company D does not make any further releases after Januari 2030[3]

        A maintains a list of versions that are end-of-live and no longer supported[4].  In Februari 2035 A declares version 1 as End of Life.

        A is not obligated to notify B. A is not obligated, nor able, to notify C or D with whom it has no relation.

        B is not obligated to remove v1 of A its package from its repository - but may take technical measures to mark this version EOL.

        A (in case of it being a company) and C continue to meet their support obligations for current and new sales.

        D has to withdraw its product from the market[4]; and D is to provide support on A its version to any for the remaining years[5]



_______________________________________________
open-regulatory-compliance mailing list
open-regulatory-compliance@xxxxxxxxxxx
To unsubscribe from this list, visit https://accounts.eclipse.org

Back to the top