☁️ Are cloud-based products within the scope of the #CyberResilienceAct? In short, yes. The CRA explicitly covers Remote Data Processing Solutions (#RDPS) that are integrated into a product with digital elements or support its direct operation. Learn more: cra.orcwg.org/faq/remote-p...

The new ORC Learning Hub helps turn Cyber Resilience Act (CRA) requirements into practical action. Learn about: • Security by design • Vulnerability management • SBOMs • Software supply chain responsibilities Start preparing now: orcwg.org/training/

Not all #OpenSource projects are built the same way, and the #CRA knows it. Understand your classification to implement smart governance: 🔹 Independent Community Projects 🔹 Steward-Supported Projects 🔹 Commercial open source products (COSS) Evaluate your project: cra.orcwg.org/faq/projects/

This #CRAMondays session features key findings from an analysis of #OpenSource projects across technology ecosystems and compares ORT Server results with GitHub advisory data, showcasing differences in coverage and vulnerability detection. 📺 Watch the full clip on YouTube: youtu.be/KN3dKD38S9U?...

How can an "intent to monetise" drag #OpenSource projects into CRA compliance? ✅ Intent: Providing a software product for a fee or paid support. ❌ No intent: Charging for educational material, or accepting non-binding philanthropic donations. Learn more: cra.orcwg.org/faq/cra-itse...

Our latest white paper breaks down the new “Stewards” legal tier introduced in the #CyberResilienceAct and the expectations that accompany it. If you are at all involved with #OpenSource projects, this knowledge will be crucial. 📝 Learn more in our white paper: hubs.la/Q040T4mT0

New free CRA training is now available from the Open Regulatory Compliance (ORC) Working Group. Start learning:  orcwg.org/training/ Learn more about the Foundation's CRA Readiness Project:  buff.ly/bfp8xkQ #FreeBSD #OpenSource #CyberResilienceAct #CRA #SoftwareSecurity

Will individual open source maintainers be penalised under the #CRA? ➡️ Those who simply contribute code to #OpenSource or maintain a project without monetisation are not in scope. ➡️ However, the indirect impact involves a rising industry standard. Learn more: cra.orcwg.org/faq/maintain...

Not everyone experiences the CRA the same way. That's why we built the new ORC Learning Hub to start with your role, not the regulation. Start with our free courses providing an introduction to the Cyber Resilience Act (CRA) for open source communities and manufacturers: orcwg.org/training/

The EU Cyber Resilience Act (CRA) is changing software development and distribution. 📅 Mandatory reporting starts 11 September 2026, now is the time to prepare. Get up to speed with free, practical training from the new ORC Learning Hub: orcwg.org/training/ #CyberResilienceAct #OpenSource

🔍 Did you know the #CyberResilienceAct created a dedicated legal tier for #OpenSource Software Stewards? If your foundation or organisation acts as a digital hub, check out the tailored open source Steward FAQs to learn more: cra.orcwg.org/faq/stewards/

If you build software outside of Europe but sell to European clients, you are a "Manufacturer" under the #CyberResilienceAct. 🚩 Read the specific breakdown of manufacturer obligations: cra.orcwg.org/faq/manufact... #SoftwareDevelopment

Key dates for the EU #CyberResilienceAct are fast approaching. - 11 September 2026: Mandatory actively exploited vulnerability and incident reporting rules take effect. - 11 December 2027: Remaining CRA obligations become fully applicable. ⏰ Don't miss vital deadlines: cra.orcwg.org/faq/official/

📦 Up to 76% of modern commercial software applications contain #OpenSource dependencies. What does this mean for commercial organisations? Check out the specialised breakdown on open source supply chains: cra.orcwg.org/faq/projects/

The #CyberResilienceAct affects all organisations who develop, distribute, and/or sell software in the European market. It addresses #cybersecurity across products and a lack of information available to users regarding security postures. Visit the #ORC FAQs for community guidance: cra.orcwg.org

Know you need to be CRA compliant but don’t know where to start? The ORC Working Group is on a mission to raise awareness around the #CyberResilienceAct (CRA) and showcase how these regulations will affect both closed and #OpenSource organisations. 🧰 Explore resources: orcwg.org/cra/resources/

🚦 We’re in the final stretch: 3 months until #CyberResilienceAct reporting requirements hit. According to ONEKEY, 37% of companies see the 24-hour reporting rule as their number 1 challenge. Are you ready? 👉 Learn more: orcwg.org/cra #CRA #ORCWG

Mike Milinkovich explores why AI-enabled open source security matters for Europe’s digital resilience and autonomy. The #EclipseFdn has been part of Anthropic’s Project Glasswing since its inception & is the only EU foundation participating in the initiative: blogs.eclipse.org/post/mike-mi...

🔍 This recap covers the OC for Compliance track at #OCX26, with sessions focused on the Cyber Resilience Act (CRA), SBOMs, open source governance, and what compliance actually requires from engineering teams. Check out this blog and watch the recordings 👉 blogs.eclipse.org/post/daniela...

The ORC panel at #OCX26 explored how the #CRA is being implemented across different ecosystems. The discussion highlighted the complexity of aligning regulatory requirements with diverse technical environments. 🎥 Watch the recording: hubs.la/Q04fXP250 ⭐ Read the highlights: hubs.la/Q04fXLkX0 #ORCWG

The recordings from OC for Compliance at #OCX26 are available on YouTube. Catch up on sessions covering the #CRA, compliance as code, SBOMs, open source governance, and regulatory collaboration. 🎥 Watch the recordings: www.youtube.com/playlist?lis...

Want to find out more about the Cyber Resilience Act or the Open Regulatory Compliance Working Group? We will be at #EmbeddedWorld2026, ready to answer all your questions and talk about getting involved with the working group! Find us at booth 4-554 in hall 4. See you there! #embeddedworld #ew26

The Open Regulatory Compliance Working Group will be at Embedded World 2026! 🌐 Visit the #EclipseFdn booth 4-554 in hall 4 to dive deeper into how #ORCWG is driving meaningful change in the world of open source compliance. #embeddedworld #ew26 #CRA

Did you know? According to ONEKEY: 🏙️ 37% of companies see the 24-hour reporting rule as their number 1 challenge. 🌐 29% say creating a Software Bill of Materials (SBOM) is the hardest requirement. Get started with the #CyberResilienceAct today: orcwg.org/cra/

🎊 Happy New Year from the Open Regulatory Compliance! 2025 was a year of learning, sharing, and steady progress for the Open Regulatory Compliance community. 👏 Thank you to everyone who participated, shared insights, and helped make these conversations clearer and more constructive.

📣 “The weight of compliance falls primarily on manufacturers, not on the open source community.” Adrian O’Sullivan explains what this means in practice and how the ORC Working Group supports shared understanding across the ecosystem. Read the article to learn more: orcwg.org/blog/manufac...

9 months left to get ahead! 📉 The #CyberResilience demands security by design across all digital products. But 27% of companies haven’t even started engaging with CRA requirements (ONEKEY). 🔗 Start today! orcwg.org/cra

In this ORC article, Adrian O’Sullivan, Huawei, shares why the Cyber Resilience Act’s (CRA) impact is global for manufacturers and how early community engagement helped strengthen the regulation. Learn more: orcwg.org/blog/manufac...

📣 Registration is now open for Code & Compliance 2026! Join us on 29 January in Brussels, ahead of FOSDEM, for the next edition of Code & Compliance. Be part of the conversations advancing open source governance, policy, and practical security solutions. Register now: hubs.la/Q03WGtF40

📣 The FOSDEM 2026 Freedom, Sovereignty & Regulation Devroom is accepting proposals! Share your perspective on how regulation shapes digital freedom and open ecosystems. CfP details ➜ softwarefreedom.net/fosdem-2026-... ⏰ Deadline: 1 December #FOSDEM #FOSDEM2026

🔐 OC for Compliance at #OCX26 will bring together developers, maintainers, and legal experts to share approaches bridging the gap between legislation and implementation. 👉 If you want to stay ahead of evolving regulations, #OCX26 is the place for you. 📆 Register! www.ocxconf.org/event/2026/r...

Help shape how the #CRA impacts open source. Not sure where to start? Begin with our Deliverables Plan. In a new blog and video, we explain what’s included, how to read the status indicators, and how to contribute. 🎥 www.youtube.com/watch?v=QamK... 📝 orcwg.org/blog/how-to-...

⏰ Final call! Our ORC has received some amazing name suggestions, but there’s still time to share yours! We’re collecting ideas until 28 November, so if you haven’t joined in yet, now’s your chance. 💚 Help us give our ORC the perfect name to represent the Open Regulatory Compliance community.

⏰ The call for proposals at Code & Compliance 2026 closes tomorrow! Share your expertise and experiences with a highly engaged audience in Brussels. 🔗 Submit your talk now: www-eur.cvent.com/c/abstracts/... #CodeCompliance #CFP #CRA #opensource

👋 Join our speaker lineup for Code & Compliance 2026! Following the success of our Code & Compliance Community Day, we’re building the next event to go even deeper into #CRA implementation and open source compliance. 📍 Brussels 🔗 Submit your talk by 25 November: www-eur.cvent.com/c/abstracts/...

🔐 OC for Compliance at #OCX26 will bring together developers, maintainers, and legal experts to share practical approaches bridging the gap between legislation and implementation. 📆 Lock in your #OCX26 ticket before prices go up! www.ocxconf.org/event/403bff...

📢 Present at Code & Compliance 2026! We’re looking for panels, presentations, roundtables, or workshops on topics such as tooling, attestations, stewardship, standardisation, or policy. 👉 Submit your talk before 25 November: www-eur.cvent.com/c/abstracts/...

New project! 🔐 The objective of the Cyber Resilience Attestations project is to propose a means to support the due diligence responsibilities of manufacturers who rely on F/OSS components. Learn more: projects.eclipse.org/projects/tec...

The countdown is on! Manufacturers have less than a year to comply with the #CyberResilienceAct’s vulnerability reporting requirements. 📘 Explore our resources to help your team prepare: orcwg.org/cra/ #CRA #CyberResilience #ORCWG

What is an #opensource software steward? 🌐 Open source software steward is a term defined in Article 3(14) of the CRA. However, the discussion on this topic is ongoing. Check our ongoing #CRAFAQ discussion on GitHub and share your thoughts and contributions! github.com/orcwg/cra-hu...

💻 Open source AI in automotive: legal & compliance implications Join us on 6 November 2025 at 3 PM CET for a practical briefing with Dr. Lina Böcker. 👉 Register now: www.crowdcast.io/c/ocx-day4-c...

🤔 Can a solo maintainer be considered to be an #opensource software steward? What do you think? Share your feedback on our CRA FAQ document: github.com/orcwg/cra-hu...

✅ Compliance isn’t about ticking boxes; it’s about building trust in open source. At #OCX26, the Open Community for Compliance invites proposals on regulatory requirements, the CRA, certification, and standardisation. Send your proposal before 13 November! www.ocxconf.org/event/403bff...

I am NOT subject to the CRA, and want to make this clear to downstream users. What should I say? Help answer this question in our CRA FAQ document. Contribute to the discussion 👇 github.com/orcwg/cra-hu...

Francisco Carneiro will introduce the @eclipse.org Open Regulatory Compliance WG at #SFSCON in Bolzano. Join his session on 7 November to explore how the working group brings together key stakeholders to co-develop reusable tools. Don’t miss it 👉 pretix.eu/noi-digital/...

📢 Contribute to the FAQ on the Cyber Resilience Act (#CRA) and have an impact! Some questions around open source projects, maintainers, stewards, or CRA standards are still being discussed. We need your input. 👉 Check out the CRA FAQ and share your feedback with us! github.com/orcwg/cra-hu...

Discover the ORC’s Cyber Resilience SIG deliverables plan: ✅ Navigate the deliverables plan and see CRA-related projects ✅ Understand the scope of each deliverable ✅ Find ways to get involved and contribute 🎥 Watch video: www.youtube.com/watch?v=QamK... 📝 Read the blog: orcwg.org/blog/how-to-...

🎤 It’s #CRA time at The Things Conference! @j-rico.bsky.social, Senior Program Manager @orcwg.org at @eclipse.org is on stage in Amsterdam delivering the keynote “Will the CRA Break Open Source in #IoT, or Make It Stronger?” #EclipseFdn #opensource #CyberResilienceAct

Why attend the Code & Compliance Community Day? 1️⃣ Deepen your understanding of the #CRA 2️⃣ Be part of the discussions shaping CRA compliance 3️⃣ Attend the OpenForum Europe's roundtable “Solving the Standardisation Dilemma” orcwg.org/blog/code-co... www.eclipse-foundation.events/event/Code-a...

🔐 Are you interested in the #CRA? September is packed with events! 1️⃣ Comply.Land – Malta, 11-12 September 2️⃣ Bitkom Open Source Forum – Erfurt, 18 September 3️⃣ The Things Conference – Amsterdam, 23–24 September 👋 Connect with Juan Rico, from the ORC, at Bitkom & The Things Conference.