Re: [open-regulatory-compliance] 24(3) not referencing 14(2), 14(4)

[Dirk-Willem van Gulik <dirkx@xxxxxxxxxxxx>]

> On 7 Sep 2026, at 12:28, Maarten Aertsen via open-regulatory-compliance <open-regulatory-compliance@xxxxxxxxxxx> wrote:
> 
> hi,
> 
> On Mon Sep 7, 2026 at 11:28 CEST, Steffen Zimmermann via open-regulatory-compliance wrote:
>>  4.  Whether stewards are bound by the deadlines of Article 14(2) and (4) is unregulated. Article 24(3) does not refer to those paragraphs; ENISA’s SRP FAQ nevertheless applies them to stewards. Because of Article 64(10)(b) the question has no consequences in terms of penalties.
> 
> I think I asked the policymakers about this when this language was introduced. I would be surprised if one could get away with this; the intent seems to be pretty clear, even though the writing may be shoddy. ymmv

I am a bit torn on this as well - this came up quite a few times; most of us also had legal folks look at it. 

And yet this came to, I think, a surprise for most of us. So that begs the question - can we rely on that FAQ - it is not as formal as say, guidance.

Now given the fact that the regulators are far from ready & the EU itself curates that FAQ - the real risk absent of some outside actor, like an Underwriter not feeling like paying out, seems very theoretical.

That said - an advantage fpr open source more or less ignoring this & starting Sept. 11 is that we do not have to resolve the complexities for things we may accidentally be a manufacturer for & it means we get `practice' :)

Dw