[open-regulatory-compliance] Trial version of a Product vs “community”/F

[Matija Šuklje <matija.suklje@xxxxxxxxxxx>]

Dear all,

I have a bit of an odd “hypothetical” to discuss.

The Product is dual-licensed FOSS OR EULA – the customer may chose between the 
two licenses for the exact same software, the paid subscription benefits apply 
regardless. In this context, I have no doubt that CompanyA is Manufacturer for 
the Product, regardless whether a customer decided to have the FOSS license 
apply.

Now, if, in addition to that, CompanyA offers a FOSS “communty edition” that 
is an identical or an open-core version of the Product, before the EC 
Guidelines, I was certain CompanyA was a Steward for this FOSS version. After 
the final version of the EC Guidelines, I have my doubts, which confuses me. 
(See examples 29-31 in § 3.5 Illustrative scenarios / ¶ 89):

> Example 30: Company A publishes a FOSS under its own name or trademark and
> offers it as a paid version, which includes certain benefits such as 
> technical assistance or performance optimisation. Developers from companies 
> B, C and D contribute to the FOSS’s maintenance, but it remains under the 
> control of company A. 
> Company A is considered a manufacturer to that FOSS. 
> Companies B, C and D are not subject to obligations under the CRA for that 
> specific FOSS. If they integrate that FOSS into their own products with 
> digital elements, they are required to exercise due diligence in accordance 
> with Article 13(5)

Now, what if, instead, CompanyA were to offer a free-of-charge, proprietary 
Trial Version of the Product, which it does not monetise (it collects only a 
contact to promote its Product), and it explicitly states it is not intended 
for production use.

Does it still qualify as the Trial Version’s Manufacturer?

If so, are the rules for what constitutes a timely security update for such a 
trial version any different than for the actual Product? If so, is it enough 
to have security patches for the trial version only on a quarterly basis?

I think the answer would be pretty straight-forward for a clearly testing/
beta/RC version, that is made available only for a limited (testing) time. 
(see EC Guidelines, § 2.3 Computer code / ¶ 22).

But if this is instead more of an “use this Trial Version to test (almost all 
of) the features of the Product, and it’s very much not intended for 
production use, but if you want to run it internally or are stupid enough to 
run your private website on it and something breaks, don’t come crying unless 
you want to pay for the Product” affair, I do wonder …


cheers,
Matija
-- 
Liferay International
Director, Legal and Associate General Counsel
(FOSS Licensing & Community Legal Affairs)
matija.suklje@xxxxxxxxxxx