40 new ways the CRA can accidentally harm open source
A presentation at FOSDEM 2024 in in Brussels, Belgium by Tobie Langel
40 new ways the CRA can accidentally harm open source Tobie Langel, UnlockOpen “Open Source In The European Legislative Landscape” devroom Tobie Langel (@tobie) FOSDEM 2024 Principal, UnlockOpen
😅 The CRA has landed. It could have been catastrophic. It isn’t. 🧑💻 Open source community rose to the occasion 🗳 Policymakers paid attention & considered community input ❌ Avoided harming open source 🇪🇺 Avoided harming EU’s ability to leverage open source
👓 We now have (a lot more) clarity* ✅ Responsibility falls where it rightfully belongs: with the entities monetizing the software (manufacturers) 👉 Interesting new role: open source stewards (smart alignment with EU ambitions to leverage open source to regain tech sovereignty)
🌊 Industry & ecosystem-wide impact 🏭 Companies will be more cautious projects move to foundations (the stewards) ⛓ Conformance requirements move up dependency trees ecosystem-wide impact 💰 Who’s going to bare the cost of this overhead?
🔌 40+ harmonized standards 2 options to meet the requirements of the CRA: 🕵 Demonstrate conformity (burden of proof is on you) ☑ Follow a set of standards (provides presumption of conformity) 👉 Standards become de facto way the CRA impacts open source
🤕 40+ way things can go wrong 😱 40+ standards = 40+ ways things can go wrong 📋 Notoriously opaque standardization processes 💰 Open source adoption requires open & royalty free standards 🎭 Huge diversity of open source stakeholders (stewards, hobbyist, COSS, EU SME ecosystem, etc.) 🤝 Interop with other jurisdictions
🙏 Thank you! Tobie Langel, UnlockOpen “Open Source In The European Legislative Landscape” devroom Tobie Langel (@tobie) FOSDEM 2024 Principal, UnlockOpen
Following the agreement reached in early December 2023, and pending formal approval by both the European Parliament and the Council, the CRA will be adopted shortly.
What’s going to happen next?
The EU Commission will issue a standardization request to European standardization organizations to develop multiple technical standards (about 40!) defining how to apply the requirements of the CRA. As usual, the devil is in the details, and these standards will substantially shape the future of software in Europe, and as a result, of open source.
The problem?
The EU standardization organizations which will be tasked with developing those standards (CEN-CENELEC and ETSI) are very formal structures that are as arcane and antithetical to open source communities as the EU legislative process itself was only a few months ago.
There’s a very serious risk that this upcoming standardization process might happen again with little or no consultation of the impacted open source communities and lead to additional harm as a result, further damaging Europe’s standing in the open source community and its ability to host, foster, contribute to, and leverage open source projects essential to its sovereignty.
The goal of this session is to preempt this scenario by proactively engaging with policy makers and carving out a path forward that leads to better outcomes for both Europe and open source.
