ORC Monthly: CRA Reporting Begins, AI SIG Takes Shape, and Learning Hub Grows
By Shanda Giacomoni
11 September marked the first Cyber Resilience Act (CRA) deadline and an important milestone for the ORC community’s work. Months of work went into preparing for it, from testing the Single Reporting Platform to building the CRA FAQ and the ORC Learning Hub. But there’s still a lot to do before the remaining CRA obligations apply in 2027.
That’s why we hope to see you at Code & Compliance on 27 October at Maison de la Poste in Brussels. Across four blocks, the day moves from policy objectives to the practical work of complying with the CRA and the AI Act. ORC members save 50 percent with the code ORCMEMBER50. Register now.
What’s new
- ORC Learning Hub: Hundreds of learners are now taking Modules 1 and 2 of the ORC Learning Hub. Module 3, Introduction to SBOMs and Vulnerability Management, is under development. Join the CRA Monday on 19 October to help review the module before publication.
- AI Policy and Compliance SIG: The SIG approved its scope on 21 September, starting with the EU AI Act. Rachel Foucard of TYPO3 has joined Dave Russo of Red Hat as co-lead. The SIG is also drafting a joint response to the ENISA consultation on AI-assisted software development, due 15 October.
- OCX 2027 call for proposals: OCX 2027 comes to Brussels 13-15 April 2027. Submit a talk to the Cybersecurity and Regulatory Compliance track.
- Save the date: Code & Compliance returns for its FOSDEM Edition on 28 January 2027 in Brussels. This edition is aimed at maintainers and engineers. The call for proposals and registration both open on 27 October.
- Share your SRP story: Now that CRA reporting obligations apply, we want to hear how organisations are adapting their vulnerability and incident reporting processes to the Single Reporting Platform. Share your experience with us to help inform the community’s ongoing work.
CRA Mondays
CRA Mondays are back after our summer hiatus. Catch up on September’s recordings:
- Solving Copyright and Licensing Information in Client-Side JavaScript and CSS with Matija Šuklje
- CRA Meets Machinery Regulation: Decentralised Digital Product Documentation with Merzough Münker
We’re looking for CRA Mondays speakers for November and December. Get in touch if you have a topic.
Blogs you might have missed
- Preparing for the First CRA Deadline: Resources for the Open Source Community
- ORC’s Impact in the First Half of 2026
- The European Commission publishes CRA implementation guidelines. Key takeaways for open source
Upcoming events
- Tech Week 2026: EU Cyber Resilience Act, Automating CI/CD Compliance with AI | 13 October
- CRA Monday: CRA Training Community Review | 19 October
- TechEx Europe 2026 | 19-20 October
- ETSI Security Conference 2026 | 19-22 October
- Code and Compliance | 27 October
- Nordic Software Security Summit | 4-6 November | Stockholm
See all events on the ORC events page.
How to participate
- Join our calls on the community calendar.
- Subscribe to the mailing list or join us on Slack.
- Contribute on GitHub.
- Share news and events with us at news@eclipse.org.
- Become a member.