How EU regulations affect OSPOs work and why you should care
summary
European law now creates a distinct role called an open source software steward and the Cyber Resilience Act forces manufacturers to ship security fixes free for 5 years of security updates, or face compliance duties; maintainers remain legally uncompelled to fix things. Implementation runs over three years, there is no EU-run central vulnerability database, and rough estimates show ~30% of devices still unpatched after major incidents. Expect companies to fund or hire maintainers, work upstream, rely on foundations for governance guidance, and treat forks (e.g. OpenSearch-style) as feasible escapes.
AI-written summary · about
chapters (17)
- 0:00Introduction and panel setup
- 3:21Cyber Resilience Act overview
- 7:42Responsibility in OSPOs and security teams
- 10:13Foundations' evolving role
- 15:28Q&A on CRA and maintainers
- 21:37AI Act challenges for open source
- 25:07Supporting volunteer projects
- 32:08SaaS companies and regulations
- 35:41Maintainer pressure and timelines
- 38:56Project impact and compliance
- 41:27Forking vs contributing
- 46:03Small companies and foundations
- 48:50Ignoring regulations consequences
- 50:12Freelancers and manufacturer status
- 52:44Understanding responsibilities
- 54:51License changes and contributors
- 57:21Final remarks and wrap-up
related talks
33mEU cybersecurity regulation and Open Source governance
45mWhy EU Policy Making matters to everyone in the Open Source Ecosystem
37mEUs Efforts to Secure Open Source Software
02mMirko Boehm on Project Maintenance Obligations
54mSpeaking Up For FOSS Now Everyone Uses It
59mMerging Security and Compliance: Perspectives on Emerging Regulations and Best Practices
39mFrom Policy Enthusiast to Legislators' Contact Point
34mHow Community Collaboration is Fixing the Future of Tech Regulation