40 new ways the CRA can accidentally harm open source

40 new ways the CRA can accidentally harm open source Tobie Langel, UnlockOpen “Open Source In The European Legislative Landscape” devroom Tobie Langel (@tobie) FOSDEM 2024 Principal, UnlockOpen

😅 The CRA has landed. It could have been catastrophic. It isn’t. 🧑💻 Open source community rose to the occasion 🗳 Policymakers paid attention & considered community input ❌ Avoided harming open source 🇪🇺 Avoided harming EU’s ability to leverage open source

👓 We now have (a lot more) clarity* ✅ Responsibility falls where it rightfully belongs: with the entities monetizing the software (manufacturers) 👉 Interesting new role: open source stewards (smart alignment with EU ambitions to leverage open source to regain tech sovereignty)

🌊 Industry & ecosystem-wide impact 🏭 Companies will be more cautious projects move to foundations (the stewards) ⛓ Conformance requirements move up dependency trees ecosystem-wide impact 💰 Who’s going to bare the cost of this overhead?

🔌 40+ harmonized standards 2 options to meet the requirements of the CRA: 🕵 Demonstrate conformity (burden of proof is on you) ☑ Follow a set of standards (provides presumption of conformity) 👉 Standards become de facto way the CRA impacts open source

🤕 40+ way things can go wrong 😱 40+ standards = 40+ ways things can go wrong 📋 Notoriously opaque standardization processes 💰 Open source adoption requires open & royalty free standards 🎭 Huge diversity of open source stakeholders (stewards, hobbyist, COSS, EU SME ecosystem, etc.) 🤝 Interop with other jurisdictions

🙏 Thank you! Tobie Langel, UnlockOpen “Open Source In The European Legislative Landscape” devroom Tobie Langel (@tobie) FOSDEM 2024 Principal, UnlockOpen