[open-regulatory-compliance] Minutes from the last Due diligence meeting

[Juan Rico <juan.rico@xxxxxxxxxxxxxxxxxxxxxx>]

Dear ORC Community,

please find here the minutes of the last due diligence meeting held on the 22nd of October.

The key aspects discussed during the meeting are:

• Recordation Requirement Schema: Recommended removing "source revision" and "product release" requirements.
• Open Source Evidence Vectors: Supported PR elements providing test data for integration testing, but flagged the complex "evidence vectors" and hash-outputting GitHub Actions for clarification or removal.
• Scope and Context: Decided to add an introductory section to the document explicitly framing its scope around the European Union's Cyber Resilience Act (CRA) and citing relevant articles.
• Transitional Period: Agreed to focus the initial version strictly on products placed on the market after the CRA enforcement date (December 11, 2027).
• Manufacturer Responsibility: Emphasised that strict mandates ("shall" / "must") are impractical for volunteer-run open source projects; ultimate CRA compliance responsibility rests with the integrating manufacturer, not upstream maintainers.

Have a great weekend!

Juan

--

Juan Rico

Director of Program Management | Eclipse Foundation Europe GmbH | X | LinkedIn | YouTube | Instagram | Bluesky | Mastodon

Eclipse Foundation: The Community for Open Collaboration and Innovation

Berliner Allee 47, 64295 Darmstadt

Handelsregister: Darmstadt HRB 92821

Managing Directors: Gaël Blondelle, Mike Milinkovich, Michael Plagge