ORC’s Impact in the first half of 2026
By Juan Rico
The first half of 2026 has been pivotal for the Open Regulatory Compliance (ORC) Working Group. Over the past six months, we have solidified our role as the premier community for navigating the intersection of open source software and emerging European regulations.
By prioritising direct collaboration with regulators and building practical, open source resources, we are shaping how the Cyber Resilience Act (CRA) will be implemented across our ecosystem.
Here are some of the ORC community’s highlights from the first half of the year regarding our impact on CRA implementation and beyond:
1. Directly Influencing Official CRA Guidance
Our technical contributions are moving beyond advocacy and into implementation. During Q1, we submitted extensive feedback on the CRA Guidance Package. Our “Stewards’ Obligations under the CRA” White Paper is fully aligned with what the European Commission released in the Draft guidance package later in March. We maintained robust engagement with the CRA Expert Group, participating in key sessions in Brussels to ensure open source perspectives are embedded in the regulatory baseline.
2. Operationalising Due Diligence
As the CRA deadline approaches, the ORC is shifting focus to practical compliance tooling. We are developing a Due Diligence Framework to support manufacturers in the execution of their obligations when open source components are integrated in their products.
3. Advancing Voluntary Security Attestations
Voluntary attestations are emerging as a vital mechanism to ease the due diligence burden on manufacturers consuming open source components. Following our proposal for a multi-tier attestation process, we launched a comprehensive survey to validate this approach with the ecosystem. The resulting findings have already been presented to the CRA Expert Group, revealing significant interest from both manufacturers and Market Surveillance Authorities in the topic, which is now discussed together with due diligence.
4. Launching the ORC Learning Hub
To close the knowledge gap across the ecosystem, we successfully launched the first phase of the ORC Learning Hub. The platform currently features two foundational modules, one tailored for open source communities and another for manufacturing entities, comprising 28 video presentations and gamified exercises to build widespread CRA readiness.
5. Expanding Community and Cross-Regulatory Focus
Our membership grew to 68 members by the end of the first half of the year, backed by expanded synergies, including a formal MoU with OWASP and ECSO. Looking beyond the CRA, we have formally launched the AI Policy and Compliance Special Interest Group (SIG) to begin addressing the impending requirements of the AI Act, starting with early contributions to the European Commission’s AI transparency call for feedback.
6. Connecting the Community through Events
We significantly expanded our outreach to critical sectors facing immediate CRA pressures, notably automotive and embedded systems. In addition to hosting 121 participants at our second Code & Compliance Community Day in Brussels, ORC brought visibility to the upcoming regulations that will impact open source to the greater OSS community at the Open Community for Compliance as part of OCX. In addition, the ORC spread the word at major industry gatherings including Embedded World, the OASDL community day, the Nordic Software Security Summit, the CRA for Automotive event in San Sebastian, and the Automotive Open Source Summit, to name a few.
These engagements, alongside our collaborative “Unpacking the CRA for the Automotive Industry” webinar with the SDV Working Group, have allowed us to connect directly with manufacturers to address the practical challenges of managing open source dependencies.
Looking Ahead: The Roadmap for H2 2026
As we transition into the second half of the year, our roadmap is focused on turning these regulatory frameworks into practical, operational realities. To close out 2026, we will be prioritising the following key milestones:
- Closing the Due Diligence Framework: We are finalising our due diligence guidelines, with plans to explore converting them into a formal process specification to clarify continuous lifecycle compliance for manufacturers.
- Implementing Attestations in Practice: We are establishing shared community forums to test and validate how voluntary security attestations can practically streamline due diligence in real-world supply chains.
- Extending Our Role in the AI Act Space through our newly formed AI Policy and Compliance SIG: we will be defining clear compliance pathways for open-source AI while deepening our direct engagement with the European Commission’s AI working group.
- The Next Code & Compliance on 27 October: We will gather the community at the next edition of our flagship event in Brussels to showcase these milestones, share security best practices, and co-design the future of open-source tech-regulatory resilience. If your organisation is interested in supporting this event and increasing its visibility within the community, sponsorship opportunities are also available.
Stay tuned, because many more activities are coming!