EU Cyber Resilience Act (CRA)

[hertg]

Has there been any discussion or considerations around the new Cyber Resilience Act (CRA) that is about to be passed in the EU?

Apparently, the CRA has been softened quite a bit compared to its initial draft (which is a good thing). According to the updated regulation, Open-Source Projects that rely on sponsorships, but do not run as a for-profit, should be excluded from the legislation. I think this also excludes Play, but I don't know enough about it, so don't consider this legal advice.

Maybe Open Collective will also address this by themselves in the near future, might not hurt to ask about it for clarification though.

Links

• https://netzpolitik.org/2024/cyber-resilience-act-aufatmen-fuer-die-open-source-community/ (German)
• https://berthub.eu/articles/posts/eu-cra-what-does-it-mean-for-open-source/ (English)

[mkurz]

Thanks for the links, I will talk to Open Collective folks in their slack channel.

[mkurz]

So this was approved by the European Parliament on Tuesday, here is the text: https://www.europarl.europa.eu/doceo/document/TA-9-2024-0130_EN.pdf