[
Date Prev][
Date Next][
Thread Prev][
Thread Next][
Date Index][
Thread Index]
[
List Home]
|
Re: [open-regulatory-compliance] 24(3) not referencing 14(2), 14(4)
|
But Dirk, why do you say nothing will be reported? If it’s indeed a KEV with actual IoC in the manufacturer’s product, then the incident must be reported under threat of penalties. A manufacturer suffering under an exploit or severe incident cannot just walk away from their problem because the “fault” lies in some OSS component.
On 7 Sep 2026, at 13:46, Daniel Thompson-Yvetot via open-regulatory-compliance <
open-regulatory-compliance@xxxxxxxxxxx> wrote:
Let’s play, “Is it law?”
The CRA’s clauses and its annexes including revisions, delegated and implementing acts if they are published in the EU journal: law
Harmonised vertical and horizontal standards: law
Recitals: not law
FAQ: not law
GUIDANCE: not law
My opinion: not law
Will your Market Surveillance Authority use “not law” to interpret the law? Yes, at their discretion.
Right - but while we increasingly seem to move towards the letter of the law on this European stuff - it is still the case that the spirit, or intention, of the law matters quite a bit in pretty much all EU countries.
And this was (I think) clearly not intended and I am pretty sure is not in the spirit of the law either.
I.e. article 14 / mandatory reporting is pretty much entirely `useless' if the 80% gorilla that is open source and underpins everything is not doing it during those initial 14 months.
Dw.
> On 7 Sep 2026, at 12:28, Maarten Aertsen via open-regulatory-compliance <open-regulatory-compliance@xxxxxxxxxxx> wrote:
>
> hi,
>
> On Mon Sep 7, 2026 at 11:28 CEST, Steffen Zimmermann via open-regulatory-compliance wrote:
>> 4. Whether stewards are bound by the deadlines of Article 14(2) and (4) is unregulated. Article 24(3) does not refer to those paragraphs; ENISA’s SRP FAQ nevertheless applies them to stewards. Because of Article 64(10)(b) the question has no consequences in terms of penalties.
>
> I think I asked the policymakers about this when this language was introduced. I would be surprised if one could get away with this; the intent seems to be pretty clear, even though the writing may be shoddy. ymmv
I am a bit torn on this as well - this came up quite a few times; most of us also had legal folks look at it.
And yet this came to, I think, a surprise for most of us. So that begs the question - can we rely on that FAQ - it is not as formal as say, guidance.
Now given the fact that the regulators are far from ready & the EU itself curates that FAQ - the real risk absent of some outside actor, like an Underwriter not feeling like paying out, seems very theoretical.
That said - an advantage fpr open source more or less ignoring this & starting Sept. 11 is that we do not have to resolve the complexities for things we may accidentally be a manufacturer for & it means we get `practice' :)
Dw
_______________________________________________
open-regulatory-compliance mailing list
open-regulatory-compliance@xxxxxxxxxxx
To unsubscribe from this list, visit https://accounts.eclipse.org
_______________________________________________
open-regulatory-compliance mailing list
open-regulatory-compliance@xxxxxxxxxxxTo unsubscribe from this list, visit
https://accounts.eclipse.org
