EU cybersecurity regulation and Open Source governance
summary
EU law excludes individual volunteers and non-commercial FOSS but treats any entity selling or bundling software as a manufacturer with full obligations: implement maintenance and vulnerability reporting, provide security fixes separate from feature updates, and guarantee support for 5 years or longer if product life expects it (car example up to 15 years). Upstream components require manufacturer due diligence; critical software and OSes need third‑party assessment and harmonized standards are still to be written over the next three years. The law creates a lighter regime for open source steward roles and gives manufacturers three years to comply.
AI-written summary · about
chapters (6)
- 0:00Introduction and EU interest
- 5:24Cyber Resilience Act overview
- 11:50Open Source impacts and obligations
- 17:07Open Source project lifecycle
- 25:35Support periods and penalties
- 26:43Q&A session
related talks
01h 03mHow EU regulations affect OSPOs work and why you should care
45mWhy EU Policy Making matters to everyone in the Open Source Ecosystem
39mAll your code belongs to Policy Makers, Politicians and the Law
53mThe EU CRA Readiness for Contributors and Maintainers : A Survival Toolkit
42mCopyleft and the EU CRA
59mMerging Security and Compliance: Perspectives on Emerging Regulations and Best Practices
44mThey're coming to regulate you!
31mCopyleft and the EU CRA