[open-regulatory-compliance] Minutes from the CRA Attestation, stewards

[Juan Rico <juan.rico@xxxxxxxxxxxxxxxxxxxxxx>]

Dear ORC Community,

find here the PR with the minutes of our call today.

The key questions addressed today are below:

• ENISA Playbook Alignment: The group reviewed a PR mapping attestations to the ENISA Secure by Design playbook and CRA articles, agreeing to use the playbook as a transitional guide for manufacturers while encouraging community feedback on ENISA's GitHub space.
• Cyber Manual Movement: A public launch for the Cyber Manual drafts is planned for late November/early December, with an upcoming presentation at the "CRA Monday" event on November 23rd.
• Task Force Next Steps: Proposed future activities include manufacturer engagement via a survey, developing an attestation specification, and integrating efforts into due diligence workflows, with feedback currently being gathered on the mailing list.
• Open Source Project Abandonment: Discussions focused on whether stewards or manufacturers should ensure long-term project viability, noting a current lack of risk measurement by companies and considering time-limited attestations as a potential middle ground.
• Steward Documentation and Liability: The group explored how stewards' technical documentation translates into manufacturer-facing compliance materials and clarified that stewards remain accountable for misleading documentation under current frameworks.

Cheers,

Juan

--

Juan Rico

Director of Program Management | Eclipse Foundation Europe GmbH | X | LinkedIn | YouTube | Instagram | Bluesky | Mastodon

Eclipse Foundation: The Community for Open Collaboration and Innovation

Berliner Allee 47, 64295 Darmstadt

Handelsregister: Darmstadt HRB 92821

Managing Directors: Gaël Blondelle, Mike Milinkovich, Michael Plagge