What’s new: ENISA consultation on vulnerability disclosure, ENISA SBOM advisory, Mapping the CRA and the AI Act, OCX 2027 call for proposals and the AI Policy and Compliance SIG.
Open Community Experience (OCX) returns to Brussels from 13 to 15 April 2027.
Registration for Open Community Experience (OCX) 2027 is now open. OCX is the Eclipse Foundation's flagship annual open source developer conference, bringing together developers, maintainers and open source communities from across Europe and beyond.
On Tuesday 27 October 2026, Code & Compliance returns to Maison de la Poste in Brussels for a full day of discussions on what regulations like the Cyber Resilience Act (CRA) and AI Act mean for open source software and the products built on it.
More than 300 definitions, 13 chapters, two languages and an open licence. Led by the Embedded France association, the French embedded‑systems community is releasing a structured reference vocabulary, contributing to a shared European language for embedded AI.
Engineering teams focus on what the regulation requires, and legal teams focus on when the deadlines land, but the question that actually matters for the business rarely gets asked: who gets how impacted in the market once the CRA is enforced, and who gets to set the new terms of trust with customers and partners?
11 September marked the first Cyber Resilience Act (CRA) deadline and an important milestone for the ORC community’s work. Months of work went into preparing for it, from testing the Single Reporting Platform to building the CRA FAQ and the ORC Learning Hub.
Taking place 27 October in Brussels, Code & Compliance will examine practical approaches to developing compliant products, navigating evolving European regulatory frameworks including the Cyber Resilience Act (CRA) and AI Act, and strengthening collaboration between manufacturers and the open source ecosystem.
EU regulatory frameworks have not always accounted for the unique ways open source software is developed and maintained. The EU AI Act represents progress in recognising open source, but adapting the EU’s regulatory framework to open source in practice remains an ongoing process.
The EU-funded OCCTET project delivers open source tools to help organisations identify software components, address vulnerabilities, and prepare compliance documentation ahead of the first CRA reporting deadline.
Registration for Open Community Experience (OCX) 2027 is now open. OCX is the Eclipse Foundation's flagship annual open source developer conference, bringing together developers, maintainers and open source communities from across Europe and beyond.
More than 300 definitions, 13 chapters, two languages and an open licence. Led by the Embedded France association, the French embedded‑systems community is releasing a structured reference vocabulary, contributing to a shared European language for embedded AI.
The EU-funded OCCTET project delivers open source tools to help organisations identify software components, address vulnerabilities, and prepare compliance documentation ahead of the first CRA reporting deadline.
BRUSSELS and Wilmington, DE – 30 July 2026 – The Eclipse Foundation, one of the world’s largest open source software foundations, and the Open Worldwide Application Security Project (OWASP), a global nonprofit foundation dedicated to improving software security, today announced a Memorandum of Understanding (MoU) to strengthen open source security and support industry readiness for the European Union’s Cyber Resilience Act (CRA).
BRUSSELS – 30 JUNE 2026 – The Eclipse Foundation, one of the world’s largest open source software foundations, in collaboration with the Open Regulatory Compliance (ORC) Working Group, today announced the launch of the ORC Learning Hub, a free global education initiative designed to help the people responsible for building, maintaining, securing, and governing open source software prepare for the European Union’s
As we approach Open Community Experience (OCX) 2026, taking place 21–23 April in Brussels, I’ve been reflecting on this year’s program and what it says about where our community is heading.
Members Eurotech and Codethink join the Eclipse Foundation in Hall 4, booth 4-554
The European Cyber Security Organisation (ECSO) and the Eclipse Foundation have formalised a Memorandum of Understanding (MoU), establishing a framework for close cooperation between the two organisations.
Uncover the growing challenges facing open source today, from rising regulatory demands to the complexities of operating as a global, mature ecosystem.
What’s new: ENISA consultation on vulnerability disclosure, ENISA SBOM advisory, Mapping the CRA and the AI Act, OCX 2027 call for proposals and the AI Policy and Compliance SIG.
Open Community Experience (OCX) returns to Brussels from 13 to 15 April 2027.
On Tuesday 27 October 2026, Code & Compliance returns to Maison de la Poste in Brussels for a full day of discussions on what regulations like the Cyber Resilience Act (CRA) and AI Act mean for open source software and the products built on it.
Engineering teams focus on what the regulation requires, and legal teams focus on when the deadlines land, but the question that actually matters for the business rarely gets asked: who gets how impacted in the market once the CRA is enforced, and who gets to set the new terms of trust with customers and partners?
11 September marked the first Cyber Resilience Act (CRA) deadline and an important milestone for the ORC community’s work. Months of work went into preparing for it, from testing the Single Reporting Platform to building the CRA FAQ and the ORC Learning Hub.
Taking place 27 October in Brussels, Code & Compliance will examine practical approaches to developing compliant products, navigating evolving European regulatory frameworks including the Cyber Resilience Act (CRA) and AI Act, and strengthening collaboration between manufacturers and the open source ecosystem.
EU regulatory frameworks have not always accounted for the unique ways open source software is developed and maintained. The EU AI Act represents progress in recognising open source, but adapting the EU’s regulatory framework to open source in practice remains an ongoing process.
A number of resources have been published or updated in recent weeks by the European Commission, ENISA, standards organisations, national cybersecurity authorities, and open source organisations. With so much to wade through, we have collected some of the most relevant resources to get you started.
If you want to put your organisation in front of developers, architects, and the people who actually decide what gets adopted, here's where to do it and why.
The Eclipse Foundation and OWASP partnership arrives at exactly the right moment, not as a proactive initiative but as a reactive necessity. The open source ecosystem has spent years operating on a distributed trust model where security responsibility is diffuse by design. The CRA upends that model by imposing legal accountability on manufacturers, including those whose products incorporate open source dependencies. That changes the calculus for every enterprise shipping into Europe.