ORC Monthly: Code & Compliance Recap, ENISA Consultations, and FOSDEM Week CFPs

Thank you to everyone who joined us at Code & Compliance on 27 October at Maison de la Poste in Brussels. Speakers from the European Commission, ENISA, industry and open source communities took us from CRA implementation and SBOMs to open AI security and shared responsibility for open source. Missed a session or want to watch one again? The recordings are on YouTube, and the slides are being added to the Code & Compliance repository on GitHub. You can also browse the event photos on Flickr.

What’s new

• ENISA consultation on vulnerability disclosure: ENISA has opened a public consultation on its technical advisory on security.txt, coordinated vulnerability disclosure policies, and security advisories. Feedback is due 15 November. Add your input to help shape the ORC response.
• ENISA SBOM advisory: ENISA published its technical advisory for software bills of materials on 22 October. The Cyber Resilience SIG is reviewing it as part of its ongoing SBOM work.
• Mapping the CRA and the AI Act: A community contribution maps where CRA and AI Act requirements overlap. Because the topic spans both SIGs, we want to hear from both communities. Join the discussion on GitHub.
• CRA FAQ: Nearly 40 new and updated entries have been added to the CRA FAQ since 1 October. The open source FAQs now also reflect the European Commission’s published CRA guidance. Browse the latest additions or open an issue with your own question.
• AI Policy and Compliance SIG: The SIG submitted its first deliverable, feedback to ENISA on secure-by-design AI-assisted software development. It is also working on a draft deliverables plan, with an AI Act FAQ, an inventory, and a white paper on AI and the CRA under discussion.

Open Source Week in Brussels

Open Source Week brings the community to Brussels in the days leading up to FOSDEM, and many events across the week will be relevant to the ORC community. Calls for proposals are open now, so submit your ideas before the deadlines below.

Thursday 28 January: Code & Compliance | FOSDEM Edition 2027

A developer-focused programme on how the CRA and the AI Act affect open source projects and the products built with them. Our most popular event of the year is expected to sell out, so register early. ORC members save 50 percent with the code ORCMEMBER50.

CFP deadline: 7 December 2026

Submit a proposal or register to attend

Friday 29 January: FOSSapalooza

A new event connecting open source organisations and communities, run jointly with AboutCode, OWASP, and OpenChain. ORC is organising a dedicated track that complements Code & Compliance. Submit to either event, and we may suggest moving talks between them for the best fit.

CFP deadline: 30 November 2026

Learn more about FOSSapalooza and submit a proposal

Sunday 31 January: Open Source & EU Policy devroom at FOSDEM

The fourth edition of this FOSDEM devroom brings open source communities and EU lawmakers together to discuss how current and upcoming EU laws affect the ecosystem. The Open Source Initiative organises it with APELL, the Eclipse Foundation, GitHub, Linux Foundation Europe, Mozilla, NLnet Labs, Open Forum Europe, OpenSSF, and Red Hat.

CFP deadline: 1 December 2026, 12.00 CET

Submit a proposal or read the full call for papers

FOSDEM will also host the Beyond the CRA: Building Secure and Resilient Open Source devroom. We’ll share details as soon as they’re available.

Upcoming events

• Apply AI Summit | 17 November
• From Policy to Pipeline: CRA Open-Source Stewardship, Automated SBOMs, and the OCCTET Toolchain | 18 November
• OSXP 2026 | 9-10 December
• Code & Compliance | FOSDEM Edition 2027 | 28 January 2027
• FOSSapalooza | 29 January 2027
• FOSDEM 2027 | 30-31 January 2027
• The EU Cyber Acts Conference | 23-25 March 2027
• OCX 2027 | 13-15 April 2027

See all events on the ORC events page.

How to participate

• Join our calls on the community calendar.
• Subscribe to the mailing list or join us on Slack.
• Contribute on GitHub.
• Share news and events with us at news@eclipse.org.
• Become a member.