Skip to main content
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [List Home]
Re: [open-regulatory-compliance] Update on reporting obligations for open source software stewards
On 9/5/2026 2:39 AM, Arnout Engelen wrote:
I read that to mean "the circumstances described in Article 24(3)" (and I guess further guidance or precedent that may come in the future).

The text of the CRA is linked at the top of the FAQ, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:L_202402847

Thanks.   Here is Article 24(3) text:

3.   The obligations laid down in Article 14(1) shall apply to open-source software stewards to the extent that they are involved in the development of the products with digital elements. The obligations laid down in Article 14(3) and (8) shall apply to open-source software stewards to the extent that severe incidents having an impact on the security of products with digital elements affect network and information systems provided by the open-source software stewards for the development of such products.

[Scott] I would interpret this to say that the Article 14(1,3,8) obligations apply if severe incidents can affect product security that use/depend upon oss...e.g. frameworks/libraries/comm infrastructure/tools platforms, etc.

1) Is that a correct interpretation, or does the legalese restrict or broaden the scope beyond my interpretation?

2) If correct, my interpretation would suggest a very broad application...e.g. any project (used/depended upon by commercial systems) that has 'severe' security implications on network and information systems (use internet for install/update?).  As an example:  would this include openssl, encryption impls, dependency mgmt systems?

Thanks.




Arnout

On Sat, Sep 5, 2026, at 00:19, Scott Lewis via open-regulatory-compliance wrote:

Could you please point to where 'under certain circumstances' is defined/detailed?  And is there any online version of the CRA text?...so that the relevant Articles could be pointed to?

Thx.

On 9/4/2026 1:00 PM, Juan Rico via open-regulatory-compliance wrote:
Dear ORC community, and especially to those planning to act as stewards!

The European Commission has updated the EC CRA FAQ today bringing clarity to a topic that has been largely discussed.

The new FAQ entry published today 5.5 says:
"5.5 Are open-source software stewards subject to reporting obligations under the CRA?
Article 24(3) of the CRA establishes that reporting obligations laid down in Article 14, paragraphs (1), (3) and (8), apply to open-source software stewards under certain
circumstances.
In accordance with Article 71(2) of the CRA, Article 24(3) shall apply from 11 December 2027."

Hope this helps, have a great weekend.
Juan

--
Juan Rico
Senior Manager ORC, Oniro and Cloud Programs | Eclipse Foundation Europe GmbH | X | LinkedIn | YouTube | Instagram | Bluesky | Mastodon

Eclipse Foundation: The Community for Open Collaboration and Innovation


Berliner Allee 47, 64295 Darmstadt

Handelsregister: Darmstadt HRB 92821


Managing Directors: Gaël Blondelle, Mike Milinkovich, Michael Plagge


_______________________________________________
open-regulatory-compliance mailing list
open-regulatory-compliance@xxxxxxxxxxx
To unsubscribe from this list, visit https://accounts.eclipse.org
_______________________________________________
open-regulatory-compliance mailing list
To unsubscribe from this list, visit https://accounts.eclipse.org


Back to the top