The Impact of Copyleft on the EU CRA
summary
EU CRA requires that when a manufacturer develops a fix for a vulnerable component it must share the relevant code or documentation, which forces copyleft patches to travel under the original license and pushes many SaaS links into scope like an AGPL effect. Companies report handling 32,000 new open-source components a year, worry about CLA gatekeeping, abandoned projects and forking, and face fines up to 2.5% of global turnover if compliance and supplier readiness fail.
AI-written summary · about
chapters (20)
- 0:00EU CRA and copyleft intro
- 3:34CRA awareness curve
- 6:26CRA obligations for open source fixes
- 12:05Copyleft impact on contributions
- 16:01Remote data processing compliance
- 20:14Code vs documentation under CRA
- 23:44Satisfying CRA contribution requirements
- 24:24CLAs and CRA compliance
- 26:57Maintainer responsibilities
- 28:02Project responses to CRA fixes
- 30:08Exclusivity agreements and CRA
- 31:51Joint ownership challenges
- 32:57Supplier readiness for CRA
- 34:21Co-ownership solutions
- 36:25NDAs in upstream contributions
- 37:28Q&A: Fixes without CLAs
- 38:31Q&A: Unacceptable contributions
- 39:13Q&A: Non-functional fixes
- 40:35Q&A: Abandoned project responsibility
- 41:20Q&A: CRA text nuances
related talks
42mCopyleft and the EU CRA
31mCopyleft and the EU CRA
14mWill the CRA Break Open Source in IoT — or Make It Stronger?
53mHow To Stay Compliant With and Take Benefits From the EU CRA (Cyber Resilience Act)
27mBeyond Open Source Risks With the CRA and NIS2
39mCherry Blossom and Compliance - An Intro To the EU CRA
24mThe CRA Challenge: Can Open Source and IoT Stay Agile Under Regulation?
42mMaking EU CRA (Cyber Resilience Act) Simplified and Non-scary for OSS Contributors