FAQ

Last Updated: 05 June 2024

This FAQ provides initial information about the formation and launch of the Open Regulatory Compliance (ORC) Working Group, hosted by the Eclipse Foundation. It covers how to participate in the working group, the roles of other foundations involved, and outlines the next steps. Note that this FAQ does not include details on the specifications being developed. A separate FAQ will address this as we progress. We will update this FAQ periodically based on feedback, which can be sent to the working group mailing list.

Table of Contents

What is the purpose of the Open Regulatory Compliance Working Group? What will it develop?

The Open Regulatory Compliance Working Group (WG) is primarily being created to develop open specifications that will facilitate compliance with regulatory requirements, such as the European Cyber Resilience Act, that can be easily transformed into standards by the relevant standardisation organisations.

By building specifications under an open source governance enabling the transparent participation of the overall open source community, the WG aims to facilitate the participation of the open source community, industry, SMEs, and researchers to standards-making processes and reduced compliance costs.

What is the Eclipse Foundation Working Group Process?

You can read the Process here. You can browse our existing Industry Collaborations here.

Does Eclipse have a Working Group Operations Guide?

Yes, we hope it’s a useful reference guide. You can find it here.

What is the creation timeline for this Working Group? Is the Working Group operating already?

We are ready to begin the operation of the working group and expect to begin doing so in July 2024. Specifically, we are expecting members, including other foundations, manufacturers, SMEs, etc. to complete the process for joining. This leaves the month of June for members to join. A key element to enabling us to begin operating is to actually have members formally involved as the governance aspects of the working group’s efforts must be driven by members.

There will be a number of initial steps to be completed to make this happen (see the 30/60/90 day plan question below); we will share more details going forward as they are developed. We will publish an explicit timeline separately as we get closer to July.

I saw a reference to a “Proposal to Create a New Working Group Announcement Phase” - What does that mean?

This is a formality in the Eclipse Foundation Working Group Proposal Process, whereby existing members of the Eclipse Foundation can review and comment on new working group charters. The proposal phase lasts no less than fourteen (14) days, which means it ended on 29 May. As this period is completed, we can now move forward with onboarding the Working Group members.

How and until when can feedback on the working group charter be provided?

Feedback from all parties is appreciated as we formalise the Charter. Feedback may be sent to the public mailing list.

Feedback is welcome up until the time the Steering Committee approves the charter, typically in the first or second meeting of the Steering Committee. All feedback will be collected and made available to the Steering Committee for their consideration.

As with any initiative with such a diversity of stakeholders and interested parties, we want to use this as a chance to highlight that the Eclipse Foundation governance does not require unanimity. Rather, as will be the case with all decisions to be taken by the working group committees, the Steering Committee will approve the Draft Charter in its first or second meeting. In the case of approval of a charter, a supermajority vote of ⅔ of members is required. It’s also worth pointing out that our governance model permits the Steering Committee to decide at a future date to modify or update the charter if it feels it is appropriate using the same process.

During the interested parties’ call there was a reference to a 30/60/90 day plan.

As a matter of process, an Eclipse Working Group may be launched/created when we have a minimum of three members participating. At that time, a launch meeting is scheduled as is the inaugural steering committee meeting where the steering committee members approve the Draft Charter as Version 1.0.

With respect to our governance process, the Eclipse Foundation outlines milestones to be achieved within the first 30, 60 and 90 days to ensure the Working Group can deliver on its Program Plan objectives. Within 30 days, the charter is approved, elections held, the chair selected, Program Plan process is presented. Before the end of 60 days, the Steering Committee has created a draft of its program plan for approval. By the end of 90 days, the Steering Committee is able to outline to its community the objectives it plans to deliver against its own timeline. There is no requirement that this needs to take 90 days; it can be much faster if that is the will of the steering committee members. The Steering Committee decides through its program plan on the associated timeline of deliverables.

But what about the actual specifications and the work to address the CRA?

Separate from this is, of course, the work to be done on the open specifications, and to begin addressing the specific objectives of the working group. As we all recognise that time is of the essence, we will be working to form the open source specification projects and begin working on these specifications as quickly as possible. We know this is where you are all interested in understanding how to participate, and more details on this will follow over the next few weeks.

How can my organisation join to participate and contribute?

This working group initiative is using the formal Eclipse Foundation Working Group Process. Participation as a member organisation in any Eclipse Foundation working group requires two things:

a) membership in the Foundation overall, and b) membership in the working group.

While there are many reasons for this structure, a quick explanation is that membership in the Foundation establishes the baseline for all members across all of our initiatives, including our IP Policy, Antitrust Policy, Community Code of Conduct, etc.

We will deal with both requirements separately below in detail as we recognise that if you are new to Eclipse, this can be confusing. We have broken this up into describing how membership works, and a separate description about fees.

But, for those who want to skip all the details and just understand “what do I need to do and what does it cost”, here are the very basics of the typical classes of membership (note that there are always exceptions):

* SMEs may join the Working Group at the Strategic membership level for a fee.

Eclipse Foundation Membership

Eclipse Foundation (not the Working Group) has four (4) membership classes: Strategic, Contributing, Associate, and Committer. Details about these classes of membership are available here.

As a general rule ¹ ,

• all for-profit companies (e.g., manufacturers, SMEs, etc.) participating in this working group will be Contributing members of Eclipse Foundation, and
• all not-for-profit entities (e.g., foundations, research institutes, academics, etc.) will be zero-cost Associate members of Eclipse Foundation.

With respect to Eclipse Foundation membership fees (not working group fees, which are explained below), whether/what fees an entity has to pay depends on whether they are for-profit or not-for-profit. See the following page for the specific fees, but in general

• for-profit companies pay annual Eclipse Foundation Contributing membership fees based on their annual revenues (i.e., annual turnover), and
• not-for-profit entities do not pay Eclipse Foundation any annual membership fees as Associate Members. In certain cases, NPOs may choose to become Contributing Members of the Eclipse Foundation, in which case the usual dues structure, based on annual revenues, applies

As so many participants in this initiative are other foundations, our recommendation is these foundations join Eclipse Foundation as Associate members.

Working Group Participation

The Working Group also has four (4) categories of membership: Strategic, Participant, Foundation, and Guest. Note that the original draft version of the working group charter listed Steward as a class of membership. To avoid confusion with the definition (or lack thereof) of steward in the context of the CRA, we are proactively changing the name of the class to Foundation member. We provide more detail regarding this class of membership below in a separate section.

The details of each of these categories of membership are described in the draft charter. It’s worth noting that all members, regardless of class of participation, are welcome and encouraged to participate in the workstreams and open specification projects associated with the working group, to participate in discussions on mailing lists and Matrix channels, and generally to support the success of the initiative.

So, which class should you join? With respect to the working group classes, as a general rule,

Can you summarise the fees I will pay and when I must pay them?

Eclipse Foundation membership fees can be viewed here. All entities participating must be Eclipse Foundation members. See above for which class of membership is appropriate for you. As mentioned above, as a general rule, for-profit companies need to pay membership fees and not-for-profit entities do not.

The specific working group participation fees can be viewed in the Draft Charter. Again, as summarised above, for-profit companies other than SMEs pay working group fees while SMEs and not-for-profit entities do not.

As for timing, Eclipse Foundation membership fees (if any) must be paid at the time of joining; the working group fees (if any) will become effective on 1 January 2025, and invoices will be sent in late November 2024. Further details are in the charter.

Why can’t I participate without joining Eclipse Foundation and having to pay fees?

In short, you can! That is, the work being done under the auspices of this working group, as with all work done at Eclipse Foundation, will follow the mantra of open and transparent. This means you can join the mailing lists and Matrix channels (once created), contribute directly to the open specification projects and associated discussions, etc. under neutral governance. The processes of developing these specifications will always be open and transparent. While membership guarantees participation in both the specifications and in the governance of the working group, it is not required to participate in the technical work of the initiative.

So why should my organisation join the working group as a member?

Each organisation will have its own specific reasons for joining, and enumerating these are outside the context of this FAQ. However, on a more global scale, demonstrating that a large and diverse group of organisations is driving this initiative will be key in ensuring our representation during the standards-making process. This is powerful for many reasons and demonstrating your support is critical. Related, this initiative requires significant professional support to ensure its success, and that can only be sustainable with adequate funding.

Beyond this, ensuring there is active governance of the initiative is important, and in particular, ensuring that all formal participants in our working groups are members of Eclipse Foundation protects all participants. Membership is the mechanism by which each participating organisation agrees to the intellectual property, antitrust, working group, and specification processes and policies. It is membership that creates the level playing field for all participants. Indeed, in the case of this initiative, we believe government is looking for industry and open source foundations to come together in such a governance structure, as noted in the original blog post by Mike Milinkovich, Eclipse Foundation’s Executive Director, “… to respond to the challenge of establishing common specifications for secure software development”. Doing this under the commitments made through formal membership, and with well-defined contribution and decision-making rules, will help drive our mutual success.

Finally, while contributions to the workstreams and ultimately to the open specifications being developed are open to all to make, the IP flows with specification projects as defined in Eclipse’s processes ensure each member may participate directly in the specifications, including Foundation and Guest members. We are certain that by leveraging the Eclipse Foundation’s well-tested specification process, we will better ensure the open specifications that are developed will ultimately be adopted as the de facto standards for industry. We will provide more details on this topic as we move forward. But in summary and to reiterate, contributions to these specifications are welcome from everyone, and the resulting specifications will be made available royalty-free to all downstream users and adopters.

Can you explain what the Eclipse Foundation Membership Fees and the Working Group Participation Fees support?

Eclipse Foundation Membership Fees are used to support the general activities of the Eclipse Foundation. This includes the services we provide to all our open source projects, including IT, CI/CD support, project marketing, etc. and funds our leadership and overall operations.

The Working Group fees collected by the Eclipse Foundation are used to manage the operation of the Working Group. As a general statement, the fees collected by any working group must cover the full direct and indirect costs associated with the operation and execution of the Working Group by the Eclipse Foundation. The fees may be applied across various initiatives and activities, complementary to the initiatives and activities performed by the Eclipse Foundation generally. These initiatives and activities are established by the Steering Committee through a program plan, and the Eclipse Foundation develops a budget that best utilises the fees collected to deliver on these initiatives and activities.

For this working group, first and foremost the fees will be used to enable Eclipse to deploy a team of professionals to support the successful execution of this initiative, including hiring experts in the relevant fields. More generally, the fees will be used to support the development and delivery of the open specifications, communications and outreach, liaison with external stakeholders (standards organisations, public institutions, etc.), facilitation of meetings and other events, etc. In the interest of full disclosure, Eclipse Foundation allocates a small percentage (based on a sliding scale that maxes at 12%) of each working group budget to cover our G&A (General & Administrative) costs.

Also in the interest of full disclosure, we note that the formal governance and fiduciary obligations associated with Working Groups lie with the Eclipse Board of Directors, the Eclipse Foundation’s Executive Director, and Eclipse Foundation staff as defined within the Bylaws. Authority and responsibility for establishing and managing Working Group budgets lies with the Executive Director as defined in the Bylaws. Each Working Group’s budget rolls up into the Eclipse Foundation’s overall budget, which is approved on an annual basis by the Board of Directors. The benefit to members of the working group is that while they provide the oversight of the working group, they do not bear any fiduciary responsibilities. More details can be found in the Eclipse Foundation Working Group Process.

The charter defines Foundation as a class of members. What is this? Is this the same as stewards in the CRA?

There are several aspects worth explaining to our approach.

First and foremost, this working group stems from an initial commitment of a number of open source software foundations. It is also the expectation that these foundations will drive much of the technical work to be done, and should also be represented in the governance structure associated with the working group. As such, it makes sense to introduce a separate class of membership in the initiative to capture this commitment.

Second, and related, we want to make sure that these foundations get to participate in this way without paying any fees. As mentioned above, Eclipse Foundation’s structure is largely split where for-profit organisations pay fees and receive a vote in governance structures while not-for-profit organisations pay no fees, but also have no voting rights. By taking this approach (as captured in the charter), we explicitly address this constraint.

Third, we are mindful that while the CRA introduces the notion of an open source steward, it does not yet adequately define the term nor is there clarity on what that definition ultimately will be. We highlight this as there have been a few questions on the mailing list already about the fact there are inevitably other (possibly many) organisations that will be considered stewards under the CRA once the EU Commission clarifies further this term. We have no desire or intention to influence which organisations end up being deemed open source stewards by the CRA. Indeed, this topic is well outside the scope of this working group initiative, and our goal is to not interfere with the politics associated with that determination process. Regardless, all organisations, including all stewards, however, that term gets resolved, are welcome to participate in the working group, and notably to participate in the development of the specifications.

What is the Eclipse Foundation’s role in the working group?

The Eclipse Foundation has volunteered to host the initiative and its activity. We are doing this as we believe the success of this initiative is critical to the open source community and the software industry as a whole. We also have a well-established process for developing open specifications and having those specifications be adopted by standardisation bodies.

Eclipse is also providing the initial funding to get this initiative launched. Specifically, our leadership team is fully engaged, we are having our professional staff engage fully in the process, and are engaging experts to assist us. We are doing all of this while deferring all fees until 2025 to make the process of joining and participating simple for everyone, including for-profit organisations.

Please note that hosting this initiative means that the Eclipse Foundation will not have a vote in any of the governance processes, including in the specification projects. That is, we do not get a vote in any governance committee or project, and we are not considered a Foundation member.

What is the stakeholder of the Public Sector Forum? Does it close the gap between conventional standards and open source software (jigsaw puzzle)?

This working group focuses on compliance with regulations and the development of specifications to be transformed into standards recognised by public authorities. Additionally, public authorities will also enforce the requirements of the CRA. Therefore, it is important to ensure that our specifications are in line with the reality of enforcement and the targets of the law.

To achieve that, the Public Sector Forum (PSF) will gather representatives from public entities (e.g. public administrations, and government agencies) to facilitate exchange with this working group and gather feedback on the development of the specifications.

Consequently, the WG will have all the necessary information to develop specifications facilitating compliance with the CRA at a low cost. More details regarding this aspect of the working group will be fleshed out over the coming weeks.

How do we continue the discussion?

Discussions can and should continue on the mailing list. We will also set up a Matrix channel for the initiative to assist in lighter-weight discussions.

How can we help now?

Please join the Eclipse Foundation and the working group if you are not a member. If you are already a member, please execute the Working Group Participation Agreement. The working group is open to all interested parties. We need to gather as many members as possible, including stewards, SMEs, and large organisations from the industry. There are no geographical restraints on joining.

Can I begin work on the specifications? And how do I find out more about the specification process?

We will address this topic in a separate FAQ which we will publish at a later time.

[1] We do not restrict membership in either Contributing or Associate classes based on a for-profit vs. not-for-profit basis, though we strongly encourage it. Feel free to contact us if you have questions.