Re: [open-regulatory-compliance] Trial version of a Product vs “communi

[Roman Zhukov <rzhukov@xxxxxxxxxx>]

Hi Matija,

Thanks for bringing this up and yes - it's all very confusing. Don't feel yourself lonely in all this. Here is my view.

• Placing the product on the EU market (definition is coming from the Blue Guide) is not exactly the same as selling it. Therefore, providing it free of charge can also constitute placing it on the market. From that point, the licence doesn't matter.
• When you say "FOSS Product" and "FOSS Product Comunity Edition" it sounds like there are 2 different things, because the name (and in some cases trademark) is different. So, you can be manufacture for "FOSS Product" and steward for  "FOSS Product Community Edition". In this case you need to clearly distinguish in the docs what you provide for each of them. E.g, declare that no paid services are available for the the latter.
• Free version topic is different. First of all, determine if it's FOSS or not (mind the concrete definition in the CRA, which may or may not equal OSI or other definitions) to avail of the "FOSS is out of scope" route.
• Unfortunately, there is no clear criteria that "not for producion" is out of scope. Thus you should carefully evaluate your Free version if it's: Unfinished code; Sample or demo code provided as part of tutorials or training materials; Unfinished software, such as alpha versions, beta versions or release candidates, provided that the unfinished software is made available only for the time necessary to test it and gather feedback.
• Be careful with collecting contact data for the free version - if may fall under PII processing and, therefore, automatically makes you a manufacturer no matter what.
  

Happy to hear otehr opinions and discuss. 

--

Roman Zhukov

Principal Architect - Security Communities Lead

Book time with Roman

On Thu, Sep 10, 2026 at 9:00 PM Matija Šuklje via open-regulatory-compliance <open-regulatory-compliance@xxxxxxxxxxx> wrote:

Dear all,

I have a bit of an odd “hypothetical” to discuss.

The Product is dual-licensed FOSS OR EULA – the customer may chose between the
two licenses for the exact same software, the paid subscription benefits apply
regardless. In this context, I have no doubt that CompanyA is Manufacturer for
the Product, regardless whether a customer decided to have the FOSS license
apply.

Now, if, in addition to that, CompanyA offers a FOSS “communty edition” that
is an identical or an open-core version of the Product, before the EC
Guidelines, I was certain CompanyA was a Steward for this FOSS version. After
the final version of the EC Guidelines, I have my doubts, which confuses me.
(See examples 29-31 in § 3.5 Illustrative scenarios / ¶ 89):

> Example 30: Company A publishes a FOSS under its own name or trademark and
> offers it as a paid version, which includes certain benefits such as
> technical assistance or performance optimisation. Developers from companies
> B, C and D contribute to the FOSS’s maintenance, but it remains under the
> control of company A.
> Company A is considered a manufacturer to that FOSS.
> Companies B, C and D are not subject to obligations under the CRA for that
> specific FOSS. If they integrate that FOSS into their own products with
> digital elements, they are required to exercise due diligence in accordance
> with Article 13(5)

Now, what if, instead, CompanyA were to offer a free-of-charge, proprietary
Trial Version of the Product, which it does not monetise (it collects only a
contact to promote its Product), and it explicitly states it is not intended
for production use.

Does it still qualify as the Trial Version’s Manufacturer?

If so, are the rules for what constitutes a timely security update for such a
trial version any different than for the actual Product? If so, is it enough
to have security patches for the trial version only on a quarterly basis?

I think the answer would be pretty straight-forward for a clearly testing/
beta/RC version, that is made available only for a limited (testing) time.
(see EC Guidelines, § 2.3 Computer code / ¶ 22).

But if this is instead more of an “use this Trial Version to test (almost all
of) the features of the Product, and it’s very much not intended for
production use, but if you want to run it internally or are stupid enough to
run your private website on it and something breaks, don’t come crying unless
you want to pay for the Product” affair, I do wonder …


cheers,
Matija
--
Liferay International
Director, Legal and Associate General Counsel
(FOSS Licensing & Community Legal Affairs)
matija.suklje@xxxxxxxxxxx



_______________________________________________
open-regulatory-compliance mailing list
open-regulatory-compliance@xxxxxxxxxxx
To unsubscribe from this list, visit https://accounts.eclipse.org