November 5 2026
Thank you to everyone who joined us at Code & Compliance on 27 October at Maison de la Poste in Brussels. Speakers from the European Commission, ENISA, industry and open source communities took us from CRA implementation and SBOMs to open AI security and shared responsibility for open source. Missed …
October 14 2026
On Tuesday 27 October 2026, Code & Compliance returns to Maison de la Poste in Brussels for a full day of discussions on what regulations like the Cyber Resilience Act (CRA) and AI Act mean for open source software and the products built on it. This edition is built around four topics, each …
October 1 2026
11 September marked the first Cyber Resilience Act (CRA) deadline and an important milestone for the ORC community’s work. Months of work went into preparing for it, from testing the Single Reporting Platform to building the CRA FAQ and the ORC Learning Hub. But there’s still a lot to do before the …
September 23 2026
EU regulatory frameworks have not always accounted for the unique ways open source software is developed and maintained. The EU AI Act represents progress in recognising open source, but adapting the EU’s regulatory framework to open source in practice remains an ongoing process. Large parts of EU …
September 2 2026
The first compliance deadline under the European Union’s Cyber Resilience Act (CRA) is approaching. Starting 11 September 2026, manufacturers and stewards will be required to report actively exploited vulnerabilities and severe incidents affecting the security of products with digital elements. …
August 20 2026
The first half of 2026 has been pivotal for the Open Regulatory Compliance (ORC) Working Group. Over the past six months, we have solidified our role as the premier community for navigating the intersection of open source software and emerging European regulations. By prioritising direct …
July 31 2026
On July 27th the European Commission published the Implementation guidance on the application of Regulation (EU) 2024/2847 (the Cyber Resilience Act — CRA). It provides practical clarification of key CRA concepts that directly impact the open source ecosystem, including the criteria for placing …
April 30 2026
With the Cyber Resilience Act (CRA) introducing new expectations for digital products, the open source community is exploring how to navigate these requirements thoughtfully, while improving long term sustainability of the ecosystem. One potential path is the use of Voluntary Security Attestations …
March 31 2026
With OCX 2026 just weeks away, we’re looking forward to bringing the ORC community together in Brussels for an important milestone, the first-ever Open Community for Compliance track at OCX. This dedicated track reflects the growing importance of our work, offering a space for developers, …
March 10 2026
When we first outlined the thinking behind voluntary security attestations in October 2025, we framed them as a potential lever for two hard problems: helping manufacturers meet their Cyber Resilience Act (CRA) obligations, and improving the long-term sustainability of open source projects. Since …
March 9 2026
The European Commission has published its draft guidance for the implementation of the Cyber Resilience Act (CRA) and opened it for public feedback until March 31st. This consultation represents an important opportunity for the open source ecosystem to help refine how the CRA will be interpreted and …
February 26 2026
Following a strong presence at FOSDEM and our second Code & Compliance event, conversations around the Cyber Resilience Act (CRA) continue to mature — shifting from awareness to practical implementation. The sessions and workshops helped advance key ORC deliverables, including the voluntary security …
February 11 2026
The adoption of the EU Cyber Resilience Act (CRA) represents a major shift in how cybersecurity responsibilities are defined across the software ecosystem. For the first time, the regulation explicitly recognises Open Source Software Stewards as a distinct category of legal actors, separate from …
February 10 2026
The EU Cyber Resilience Act (CRA) and other regulations stress the importance of understanding your software supply chain. The CRA makes manufacturers responsible not only for their own code and hardware, but for all the components they integrate to their products. This often includes a large amount …
February 6 2026
Over the FOSDEM week, one message became unmistakably clear: attestations and due diligence are no longer optional side topics; they are becoming foundational to the sustainability of open source in a regulated world. At Code & Compliance, this reality was already evident in the level of engagement. …
January 29 2026
As we publish this month’s ORC update, the community is right in the middle of Open Source Week in Brussels. With FOSDEM and a packed schedule of policy, compliance, and community discussions underway, the energy and relevance of our work has never been clearer. That momentum is echoed by the strong …
January 12 2026
Late January in Brussels has become an important moment for anyone working at the intersection of open source and European regulation. In 2026, FOSDEM and EU Open Source Week again bring together developers, maintainers, policymakers, and organisations that are actively shaping how open source is …
December 19 2025
As we look back on 2025, it’s clear that this has been a year of remarkable growth and maturation for the ORC community. Our membership has expanded to 63 organisations, reflecting both the rising importance of open, collaborative security practices and the trust our stakeholders place in the work …
December 9 2025
As we wrap up 2025, it’s remarkable to look back at how far the ORC community has come since January. What started as a year shaped by uncertainty transformed into one defined by collaboration, expertise-sharing, and a rapidly growing ecosystem (we now have more than 60 members!). From engaging …
December 3 2025
The European Commission has just published the Implementing Regulation defining the technical description of “important” and “critical” products with digital elements under the Cyber Resilience Act (CRA). You can find the full text here: Regulation (EU) 2025/2392 – Technical Description of Important …
November 27 2025
In this week’s CRA Monday session, we welcomed security consultant Piet De Vaere for a thought-provoking talk on the realities of coordinated vulnerability disclosure (CVD) in Europe. Pete opened with a real incident from earlier this year, when he discovered a flaw in his bank’s online-banking …
November 12 2025
The “Open Source Stewards and the Cyber Resilience Act” white paper explores a new role introduced by the EU Cyber Resilience Act (CRA): the open source steward. This is a newly introduced actor that doesn’t fit neatly into the existing categories of manufacturers or distributors but still carries …
November 4 2025
The idea of regulating open source software is likely to spark anxiety, especially when it touches on security. But in this case, much of that worry is misplaced. The Cyber Resilience Act (CRA) was carefully drafted so that the weight of compliance falls primarily on manufacturers – those of us …
November 4 2025
As the Cyber Resilience Act (CRA) moves closer to implementation, much of the attention has focused on the regulation itself. But what’s equally important, and often overlooked, is the process that will define how these rules are applied in practice: the development of harmonised standards. These …
November 3 2025
Our first Code & Compliance event was a success! Thank you to everyone who joined, asked tough questions, and shared insights across talks and panels. A particular highlight was the Attestations workshop, which sparked constructive debates and set us up for continued conversations in the coming …
October 30 2025
As the Cyber Resilience Act moves from legislation to implementation, the conversation is shifting from drafting rules to defining vertical standards — the technical requirements that will shape how software projects demonstrate compliance. This CRA Mondays session looks at how open source …
October 28 2025
The latest CRA Monday featured Roger Riera, a technical manager at Applus+ Laboratories and Type A member of the European Commission’s Cyber Resilience Act (CRA) Expert Group. Roger introduced his work on a new methodology called the Simplified Common Criteria for CRA, or sCC4CRA**,** a practical …
October 14 2025
What Are Voluntary Security Attestations? In the context of the EU’s Cyber Resilience Act, Article 25, these could be documents that describe the security practices, processes, attributes, or assurances associated with an open source project. They could be publicly shared, perhaps in a code …
October 9 2025
The Cyber Resilience Act (CRA) is reshaping how manufacturers approach software security and compliance. With key deadlines fast approaching, it’s crucial to understand what’s required and how to get there efficiently and collaboratively. That’s exactly what Code & Compliance Community Day is …
October 6 2025
As we move into autumn, the momentum in our community continues to build. A particular highlight is the upcoming Code & Compliance Community Day 2025, taking place 22–23 October. The program is shaping up beautifully, with speakers being announced daily. This is your opportunity to connect with …
October 3 2025
In this edition of CRA Mondays, we welcomed John Ellis, President and Head of Product at CodeThink, to discuss the trustworthiness of software in the context of the Cyber Resilience Act (CRA). With extensive experience leading high-performance software projects across industries like automotive, …
September 12 2025
Contributing to the Open Regulatory Compliance (ORC) Working Group is one of the most effective ways to help shape how the Cyber Resilience Act (CRA) impacts the open source ecosystem. If you’re new to the group or simply wondering where to begin, the best starting point is our deliverables plan. …
September 10 2025
The Open Regulatory Compliance (ORC) Working Group is built on the power of collaboration, and today, we celebrate an exciting milestone—surpassing 20 foundation members! This achievement is a testament to the strength of our community, uniting industry leaders, open source foundations and …
September 10 2025
This post is part of our CRA Mondays series. It captures a recent session featuring Samina Husain (Ecma International), Steve Spring (Chair of Ecma TC54), and Philippe Ombredanne (AboutCode), exploring the ongoing work in Ecma’s TC54 committee and its alignment with the EU’s Cyber Resilience Act …
August 27 2025
As summer winds down, ORC is gearing up for a busy event season. From global security summits to community-driven gatherings, this fall will be packed with opportunities to connect, share knowledge, and advance the conversation around the Cyber Resilience Act and upcoming regulations. One event you …
August 25 2025
This post is part of our CRA Mondays series. It captures a session originally hosted earlier this year with Sébastien Heurtematte, coordinator of the OCCTET project. While the discussion took place several months ago, the insights remain highly relevant as CRA implementation continues to evolve. …
August 14 2025
This post is part of our CRA Mondays series. It captures a session originally hosted earlier this year with Fukami, EU Policy Advisor at the OpenSSF. While the discussion took place several months ago, the insights remain highly relevant as CRA implementation continues to evolve. CRA Mondays are a …
August 13 2025
Here’s a preview of the topics and sessions shaping Code & Compliance Community Day 2025, taking place October 22–23, 2025 in Brussels. This event brings together open source maintainers, compliance leads, manufacturers, and institutional stakeholders to reflect on the Cyber Resilience Act’s (CRA) …
July 30 2025
As we dive into the summer months, we’re combining our June and July updates into a single post, because June was packed. In June alone, we contributed to the EU’s draft guidance on open source hardware, submitted detailed comments on the CEN/CENELEC PT 1 Standard, and provided feedback on the …
July 15 2025
We’re excited to announce Code and Compliance Community Day 2025, a two-part event taking place October 22–23, 2025, in Brussels, Belgium. This new event builds on the momentum of recent community gatherings and ongoing collaboration around open source and regulatory compliance. Designed to support …
June 20 2025
Last month we teamed up with GitHub to host “The Cyber Resilience Act and Open Source: What Maintainers Really Need to Know.” The one-hour panel zeroed in on the top worries we hear from open source project maintainers and contributors. Below is a recap—and, more importantly, where you’ll find the …
June 4 2025
We’re pleased to share that we’ve moved from planning to execution. The Cyber Resilience SIG’s deliverables plan has been expanded with clear, actionable projects, which will each be supported by a dedicated task force. This marks a significant milestone in our collective efforts to operationalise …
May 26 2025
As part of Maintainer Month—a time to recognize and support the open source maintainers who keep our digital infrastructure running—Open Regulatory Compliance (ORC) is hosting a special panel on 27 May. Among the featured speakers is Felix Reda, who will share insights in the session titled, “The …
May 22 2025
In honour of Maintainer Month, Open Regulatory Compliance (ORC) will host a panel with GitHub on 27 May focused on one of the most pressing topics facing open source maintainers today. Maarten Aertsen is among the expert speakers featured in the discussion, “The Cyber Resilience Act and Open Source: …
May 20 2025
On 27 May, Open Regulatory Compliance (ORC) is hosting a panel in support of GitHub’s Maintainer Month, a month dedicated for open source maintainers to gather, share, and be celebrated. Daniel Stenberg is one of the speakers in the ORC’s panel, “The Cyber Resilience Act and Open Source: What …
May 12 2025
On 27 May, Open Regulatory Compliance is hosting a panel, “The Cyber Resilience Act and Open Source: What Maintainers Really Need to Know,” which will be live-streamed by GitHub as part of Maintainer Month. Maintainer Month is a month dedicated for open source maintainers to gather and share helpful …
April 30 2025
We’re pleased to share that, following active community discussions and collaboration, we have submitted feedback to the European Commission on the Definition of Important and Critical Product Categories. This contribution reflects our collective understanding of how the CRA definitions intersect …
March 25 2025
The Cyber Resilience SIG reached a critical milestone by defining a scope of work for 2025. The Cyber Resilience Practices Spec project has also launched, with project proposal and feedback open for review and contribution. The Open Regulatory Compliance WG attended several recent industry events …
March 6 2025
Embedded systems are at the heart of modern industry, powering everything from automotive applications to industrial automation. But as software continues to define embedded technologies, new regulations like the Cyber Resilience Act (CRA) are set to reshape how manufacturers and developers approach …
February 26 2025
The Open Regulatory Compliance WG has created new resources on GitHub for those who are just getting started or who want to learn how to contribute. We hosted our first workshop in Brussels, joined the EU Open Source Policy Summit and attended the first CRA Expert Group meeting, had multiple …
December 19 2024
The European Commission revealed on December 11 the members of its Cyber Resilience Act (CRA) Expert Group, following a public call for applications that ran in October of this year. This diverse group brings together individual experts, industry leaders, Member State agencies, and non-governmental …