Attestation Framework & Objectives
summary
Argues that policy is the new licensing and shows concrete wins: specific clauses landed in the Cyber Resilience Act forcing standards bodies to consult free and open source projects, and EU negotiators reused CRA ideas in the Product Liability Directive. Maps five practical risks — supply chain confusion, smaller projects bearing disproportionate CRA costs, the need for one coherent position across foundations, international fragmentation of roughly “10 obligations per region” risk, and the possible use of Article 34 mutual recognition to reduce duplication.
AI-written summary · about
chapters (11)
- 0:00Policy replaced licensing in FOSS
- 1:02Regulation shaping open source
- 2:50EU standardization challenges
- 4:35Public procurement funding
- 5:58Open source as policy black box
- 7:20Unified FOSS policy positions
- 8:46CRA compliance hurdles
- 10:13Smaller foundations in policy
- 11:39Avoiding regulatory fragmentation
- 14:29Mutual recognition under CRA
- 15:57FOSS policy in Europe
related talks
14mThe CRA: an Open Source Sustainability law?
53mHow To Stay Compliant With and Take Benefits From the EU CRA (Cyber Resilience Act)
42mMaking EU CRA (Cyber Resilience Act) Simplified and Non-scary for OSS Contributors
42mMaking EU CRA (Cyber Resilience Act) simplified and non-scary for OSS contributors
44mPanel Discussion: Prepare for the CRA: Open Source Governance in the Age of Cyber Resilience
42mPanel Discussion: The Impact of the CRA on the Open Source Ecosystem
34mHow Community Collaboration is Fixing the Future of Tech Regulation
33mImplementing the EU Cyber Resilience Act (CRA)