[open-regulatory-compliance] Minutes from the Due diligence meeting toda

[Juan Rico <juan.rico@xxxxxxxxxxxxxxxxxxxxxx>]

Dear ORC Community,

please find here the link to the minutes of the last due diligence meeting held today.

I'd like to thank the energy and contributions from everyone participating in the meeting, as well as the coordination provided by our Nokia colleagues. Find below the main points discussed today, and I strongly recommend to take a look to the minutes and to the repository activity

• Due Diligence Scope: The group agreed to strictly define "due diligence" as Article 13(5) due diligence throughout the white paper to maintain focus on the CRA's component integration mandate.
• Strategic Distinctions: Discussions emphasised the need to distinguish between mandatory CRA legal obligations and proactive security best practices, while ensuring due diligence remains proportional to risk (per Recital 34).
• Governance Integration: Participants highlighted that component due diligence must evaluate critical governance signals, such as maintainer succession plans and responsiveness to security pull requests.
• Check the current pull requests and feel free to leave our comments to the existing materials.

Cheers,

Juan

--

Juan Rico

Senior Manager ORC, Oniro and Cloud Programs | Eclipse Foundation Europe GmbH | X | LinkedIn | YouTube | Instagram | Bluesky | Mastodon

Eclipse Foundation: The Community for Open Collaboration and Innovation

Berliner Allee 47, 64295 Darmstadt

Handelsregister: Darmstadt HRB 92821

Managing Directors: Gaël Blondelle, Mike Milinkovich, Michael Plagge