Copyleft and the EU CRA
Talkat Open Source Summit Japan + AI_dev: Open Source GenAI & ML Summit + Automotive Linux Summit 2025 · 2025-12-08..12-10·
summary
EU Cyber Resilience Act requires manufacturers to share code or documentation for fixes upstream, with full enforcement by 2027 and penalties up to 2.5% of global turnover. Example: a company reports managing 72,000 open‑source components (up from 32,000). Copyleft fixes become derivative works that must be relicensed upstream under the same terms, CLAs and abandoned projects create legal chokepoints, and remote processing pulls SaaS into scope — practical compliance workstreams and supplier contracts are mandatory.
AI-written summary · about
chapters (11)
- 0:00EU CRA introduction
- 4:18EU CRA requirements
- 11:17Ericsson’s open source and CRA
- 15:12Mandatory upstream fixes
- 22:37CRA impact on project selection
- 24:42CRA and SaaS reach
- 26:52Documentation vs code fixes
- 31:02Legal conflicts with exclusivity
- 33:54CRA compliance solutions
- 36:04Global CRA vulnerability fixes
- 37:30Q&A
related talks
31mCopyleft and the EU CRA
42mThe Impact of Copyleft on the EU CRA
44mThey're coming to regulate you!
53mThe EU CRA Readiness for Contributors and Maintainers : A Survival Toolkit
53mHow To Stay Compliant With and Take Benefits From the EU CRA (Cyber Resilience Act)
32mHow to stay compliant with and take benefits from the EU CRA (Cyber Resilience Act)
27mEU Cyber Resilience Act: What Every Manufacturer Needs to Know
33mEU cybersecurity regulation and Open Source governance