[open-regulatory-compliance] Update to the Stewards white paper

[Juan Rico <juan.rico@xxxxxxxxxxxxxxxxxxxxxx>]

Dear ORC Community,

I'm happy to share that Mikael Barbero has updated the Stewards white paper to include the latest pieces of information available after the release of the last CRA guidance package.

Please take a look at the current version here, and share your thoughts and comments.

"Version 2.0 incorporates clarifications from the European Commission's draft guidance on the application of the CRA (Ares(2026)2319816, published 3 March 2026 for public consultation). Key additions and changes:

• Steward definition context expanded: sustained support taxonomy, per-project determination, dual roles, not-for-profit exemption (Definition and Context)
• Graduated reporting framework: three-tier model linking reporting duties to support type: non-technical, IT infrastructure, or engineering (Reporting Obligations Scaled by Type of Support)
• "Becoming aware" threshold: aligned with NIS 2 and GDPR precedent (Becoming Aware)
• Upstream reporting and sharing security fixes: Article 13(6) obligations and their interaction with the steward role (Upstream Reporting)
• Contributors and downstream uses: contributor protection and manufacturer due diligence (Contributors and Downstream Uses)
• Illustrative scenarios expanded: eight concrete cases covering all three reporting tiers (Illustrative Scenarios)
• Open questions updated: split into resolved vs. remaining (Open Questions)"

Best regards,

Juan

--

Juan Rico

Senior Manager ORC, Oniro and Cloud Programs | Eclipse Foundation Europe GmbH | X | LinkedIn | YouTube | Instagram | Bluesky | Mastodon

Eclipse Foundation: The Community for Open Collaboration and Innovation

Berliner Allee 47, 64295 Darmstadt

Handelsregister: Darmstadt HRB 92821

Managing Directors: Gaël Blondelle, Mike Milinkovich, Michael Plagge