Code & Compliance 2026: Four Panels That Take Open Source Compliance From Policy to Practice

On Tuesday 27 October 2026, Code & Compliance returns to Maison de la Poste in Brussels for a full day of discussions on what regulations like the Cyber Resilience Act (CRA) and AI Act mean for open source software and the products built on it.

This edition is built around four topics, each featuring presentations and ending with a panel discussion. We start with policy objectives, move into the engineering reality of the CRA, turn to the specific challenges of AI, and finish with the question underneath all of it: who is responsible for open source security?

The day is hosted by the Open Regulatory Compliance Working Group (ORC). As with our previous editions, the room is small enough to talk in, and what we learn feeds directly back into ORC’s resources and guidance for the open source community. Register now to save your place.

Panel 1: Navigating the regulatory landscape: From policy objectives to practical implementation

Joining me are Carlos Lopez Rodriguez of the European Commission, Dirk-Willem van Gulik of the Apache Software Foundation, Jaroslav Reznik of Red Hat, and Arnaud Martin of AGORIA. At a strategic level we’ll discuss:

• The vision for digital sovereignty in Europe, and where the CRA and the AI Act fit into it
• The biggest disconnects between the intent of these regulations and the daily reality of open source development
• Earlier engagement between industry associations, open source communities, and regulators, before policy is finalised

This panel sets the baseline for the rest of the day, as we move from policy objectives into the practical and technical realities of implementation.

Panel 2: SBOMs and its real impact on the industry

Once we’ve covered the why, the second panel moves to the how. Under the CRA, manufacturers are facing new due diligence and vulnerability management obligations, putting greater focus on tools and practices such as SBOMs and Vulnerability Exploitability eXchange (VEX).

Panellists such as Ioanna Georgiadou of ENISA, Bartłomiej Głuch of Bartłomiej Głuch, Kombud Group S.A. and Olle E. Johanson of Edvina.net will focus on what compliance looks like inside the product lifecycle:

• Supply chain relationships and how producing and consuming SBOMs is changing them
• Vulnerability mapping at scale with VEX, without drowning in false positives
• Secure-by-design in practice for legacy industrial systems

If your team is working out how to generate, ingest, and act on SBOMs, this is the session for you.

Panel 3: Code, Weights, and Regulation: The New Blueprint for Open AI Security

AI adds a new layer of complexity to everything we discuss in the morning. When the code is actually a large model with published weights, the familiar rules of open source governance need a fresh look. The challenge is not only to define what open source means in AI systems, but also how to address the opportunities and risks derived from the use of AI for vulnerability management.

This panel then brings together Jordan Maris of the Open Source Initiative, James Lovegrove of Red Hat, and Philippe Ombredanne of AboutCode to discuss:

• Open weights and the AI Act, including where the compliance burden lies when a manufacturer integrates an open-weight model into a commercial product
• AI-driven vulnerability discovery, including how faster discovery affects coordinated remediation, disclosure timelines, and maintainers
• Federated AI, and questions around how regulatory responsibilities apply across open source contributors, stewards, and manufacturers deploying decentralised systems

Panel 4: Shared responsibility: Who owns open source security?

By the end of the day, one question remains: who is actually responsible? Our final panel looks at shared responsibility.

Joining the panel are Carlos Serratos of Arm, Amelia Alder of Knorr-Bremse, and Gregor Bransky of Layer 9 Solutions. The discussion will focus on:

• Funding and operational models that support the maintainers whose projects industry relies on
• Where liability sits, and where a maintainer’s responsibility ends and a manufacturer’s begins
• Pooling resources so that competitors in the same sector can secure the open source components they all share

Join us in Brussels on 27 October

Through these four panels we have combined the different views every actor participating in the definition and development of a more cyber ready future has. And they are only part of the programme. Throughout the day, speakers from industry, open source communities, regulatory bodies, and foundations will bring different perspectives on what effective compliance looks like in practice.

If you work in a manufacturing or product team, an open source programme office, an industry association, or a policy, security, or legal role, join us in Brussels on 27 October.

Register now

Can’t make it to Brussels? Our next edition takes place alongside FOSDEM in January 2027.