How Community Collaboration is Fixing the Future of Tech Regulation
summary
By 2026 the EU Cyber Resilience Act (CRA) explicitly excludes most free and open source software, after community intervention that adds the new role of open source stewards and keeps volunteer maintainers generally out of scope; the process produces 41 technical standards, a free CRA class taken by >6,000 people, and ongoing working groups (OpenSSF GCP, Eclipse ORC). Practical outputs include open source checklists, CI/CD guidance, security.md templates and machine-readable VEX files plus tools for continuous risk and vulnerability management.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 1:27EU Cyber Resilience Act risks
- 7:02Engineers in regulation
- 10:12Educating policy makers
- 13:00CRA changes for open source
- 16:35CRA impact on maintainers
- 20:07Clarifying CRA requirements
- 23:41Technical standards and consultations
- 27:11Open source in standards
- 29:38Digital sovereignty values
- 31:44Call to action
- 33:06Summary
related talks
42mMaking EU CRA (Cyber Resilience Act) Simplified and Non-scary for OSS Contributors
42mPanel Discussion: The Impact of the CRA on the Open Source Ecosystem
14mThe CRA: an Open Source Sustainability law?
33mImplementing the EU Cyber Resilience Act (CRA)
42mMaking EU CRA (Cyber Resilience Act) simplified and non-scary for OSS contributors
45mWhy EU Policy Making matters to everyone in the Open Source Ecosystem
39mAll your code belongs to Policy Makers, Politicians and the Law
01mConcerned about the CRA and how it impacts open source?