The European Union has revised the Cyber Resilience Act (CRA), reducing the concerns of the open-source community.

Concerns were raised by the Python Software Foundation (PSF) when the act was being reviewed after its initial definition last year. PSF was specifically worried about the provisions of the related Product Liability Act, which provides consumers with the ability to seek damages for defective products. Under the CRA, producers of digital products will be required to improve the security of their products; set up a cybersecurity framework; mitigate security vulnerabilities; and disclose security problems to customers.

Organizations breaching the terms could be fined up to €15 million or 2.5 percent of annual turnover, whichever is the greater. PSF was particularly worried about libraries such as CPython and PyPI, as the phrasing of the act could mean the PSF and the Python community could be liable for security issues in products built using the code components they provide for free.

The final text of the CRA has now been released, and it includes the concept of an open source steward, by which the CRA means a legal entity that provides free and open-source software that is then used by other developers. The act now says explicitly that the provision of free and open-source software products without monetisation is not considered a commercial activity.

This is in addition to the clarification that:

"The mere circumstances under which the product has been developed, or how the development has been financed should therefore not be taken into account when determining the commercial or non-commercial nature of [making free and open-source software available on the market]."

Open Forum Europe (OFE) said in a statement that:

"This wording will give clarity to a lot of contributors, both commercial and non-commercial, and will prevent the obligations from extending to certain areas where they could be counterproductive."

More Information

Open Forum Europe

Python Software Foundation

European Cyber Resilience Act

Related Articles

Python Software Foundation Raises EU Open Source Concerns

To be informed about new articles on I Programmer, sign up for our weekly newsletter, subscribe to the RSS feed and follow us on Twitter, Facebook or Linkedin.

Comments

Make a Comment or View Existing Comments Using Disqus

or email your comment to: comments@i-programmer.info