Time for the Cyber Resilience Act, so I'm introducing myself, so I'm all excited
and I'm working for the Professor of the Foundation in Europe, as a policy program manager,
and today I'm talking with Michael Schlossner, from the Federal Office for Information Security
and the DSI, so the Bundesamt für Sicherheit in the Information Station Act, about our
recent work on the Cyber Resilience Act, and then we will be joined by the tomato-body-uping
commission for a round of Q&A, so we start as a short introduction on the Cyber Resilience
Act, and our current questions we have, and then we open up the floor for a Q&A part
where you can pretty much ask us everything.
And as this, I'm heading over to Mr. Phil Slight.
Thank you, so what we start with is giving a short introduction into the CIA, like what
the goals are, and then what goals, especially for open source, are there, and then last year
we did a project where we handed out a questionnaire to try to get as much information
from developers, manufacturers, and possible stewards, I will say two or three words about
the stewards in a minute, and where they see themselves and what problems they might have
with the CIA, they might see that we can address that in possible guidance and in talks
like this.
What are the goals of this CIA? First, we all know that there are more and more vulnerabilities
in software products, in hardware products, and in the products on the European market, in
general, so the idea was to create something that secure software development becomes a normal
part of creating new products. It wants to ensure that products software and hardware products
with less vulnerabilities come to the market, and that manufacturers have to think about
the vulnerabilities and the security of their products for the whole life cycle. So it's not just
I develop something, then I'm happy being it on the market, and then I don't care anymore,
they have to fix vulnerabilities when they arise in certain timeframes, and they have also to
think about what happens with the product. Another very important goal is that the CIA also wants
to give users the chance to get informed about the products they want to buy, so that they
can make good decisions on buying secure products, so that's overall we raised the bar on
security with all the products on the European market. So where are we now? The CIA answered
into force in December 2024, so it's more than one year now where we are in a kind of transition
phase, so the CIA has a three year transition phase, there are some obligations which start
in September this year, so manufacturers have to report actively known, actively exploited
vulnerabilities and severe incidents when they know them or when they could become aware of them,
and for that the Anisa, the European cybersecurity agency, is working on a single reporting platform
where then manufacturers can report their vulnerabilities, and from there they once go to
Anisa, so that then gets an overview of the active exploited vulnerabilities and to the national
service, so that they can do the coordinated vulnerability disclosure process.
Doing the transition phase, right now there's a lot happening at standardization, so the European
standardization organizations, they are in the process of developing certain product standards,
and also some horizontal standards on risk assessments and how to do it, on vulnerability
handling and what you have to do there, so there's a lot of work going on,
then something we will talk about is that the CIA leaves the opportunity for open source
adaptations, so that's something where we look if that can be used to attest, that's open source
of where does comply to certain things to certain requirements, and that's something which is
where we heavily discuss right now how that could work and what that could be, and there's also
a lot about guidance going on, so there's guidance published by the European Commission on the
EU website about open source, there's frequently asked questions document on there, so where
you can get even more information on how to implement the CIA, how certain things should be
interpreted in the CIA, and the guidance part is also still ongoing, so we are still in the process
where people can give information give us their source, and then we can show a look how we can
integrate it into guidance and what we can get out of that, and as it's pointed out here,
in order to clarify a lot of things, we need information what are the main topics and the main
questions out there, we need to address in the guidance, so the CIA has
different roles, it's a product regulation, and one of the stakeholders bringing products
onto the European market is the manufacturer, another one which is kind of new in the context of
the CIA is distraught, so the steward is supposed to manage open source software, free and open source
software, which is intended to be integrated into products, so that they also have some
obligations about reporting vulnerabilities, but they don't have all the applications
like a manufacturer, and one point which is very different between them, they can't be
fine if they don't apply it to the obligations, and one exception, free and open source
doesn't have to do anything in regards to the CIA, what we are talking about later is
maybe there's an incentive to do something if they want, but all in all they don't have to do
anything about the CIA if they don't want to, so what are the obligations and manufacturer
has in regards to open source, the manufacturer is fully responsible for all the open source
or the components he integrates into his product, and that includes all the free open source
software, so it's his responsibility if there are vulnerabilities and there he has to do something
to fix it, and he also has to do it again for the whole lifetime, he can't just take open source
and then leave it at it is, he has to do something, two more things which are written down in the CIA,
if a manufacturer becomes aware of a vulnerability, he must inform the developer or the maintainer
of the open source project, and if he provides the fix, he also has to provide the fix to the
project, they still can decide if they want to include it and want to do something with it,
but manufacturers have to provide the fix, so are now over to all.
Yeah, also since when the cyber resilience act was introduced, people already started to
kind of work on this, and this is an interesting example from the kill project where I like
a manufacturer just approached Daniel and said like, look, I looked in the CIA and you have no
obligations, I have obligations, please help me, and they gave them a list of what they wanted to have,
and also didn't offer any kind of money or resources in order to get this information,
so we're just approaching Daniel to say like, look, we need this and this and this and this.
And this is precisely what we do not want to see and what should not happen with the cyber resilience
act, it's rather something where we do believe that if you do free software and like put it out to the
world and it's then used by manufacturer, the manufacturer should have some like obligations
and help you in order to get what he needs and not like that the project is then just like
presenting everything for free and helps the manufacturer to get out a good product.
So, and in this regard, we can go to the next slide, so we might get a leave you started a
project like roughly a year ago, I think it was, and we tried to bring in some like first of all
clarity to better understand the roles, but also more importantly to understand where people outside
are, so what do they see and what do they think about the CIA and how it should like be
lived in reality, what do they need and how should process this look for them. So that's why
since we are both Germans in the Project Captain and Germany, this is also some volunteers from Germany
that are also here in the room, so thanks for helping us during that year on this. We came up with
a question in a survey where we basically wanted to have feedback from manufacturers, we also
wanted to have feedback from foundations or the free software ecosystem, but also from stewards or
potential stewards or people that might think that they want to be a steward or that they might want
to do or that they think that they are a steward or people that have some other concerns about
the cyber resilience act, so we also try to many address people that are kind of like familiar
with the cyber resilience act, so they should have some at least some sort of experience around it
and should know what they talk about, when they feel the service or was not about like quantity,
but rather quality, and also we said nobody has to answer all the questions, so it's just like
answer where you are like kind of familiar with or they see problems, and this resulted in like
nearly 350 responses we got around 80 have been like filled completely, and this helped us really a
lot in order to better understand how people look at the CIA and also helped us to spot projects
and communities we weren't even aware of that they exist and how they do believe that they are
affected by the cyber resilience act, so the survey helped us to bring in some clarity, but also
to identify some their questions, maybe problems, and this was then also used to incorporate this
in the implementation process, Michael just referred to what we've been talking about guidance,
also there are some consultations where we pointed people on, and also since this questionnaire was
mainly on the question like on roles and and steward and project, we also had some free fields
and by that we figured out that there's even more that we should ask and this is what we are
basically now going to talk about, and this is also one of these actual problems or like processes
we try to address and it's on attestation, so and also what Michael already mentioned in the
beginning, however so from what was also interesting to see from the questionnaire is that like
only 50% of the people who answer to the questionnaire were like sure about their role,
so 50% didn't knew what they are or how they will be regulated under the cyber resilience act,
so that was a pretty interesting question and also a lot of questions were like being around
like what is the threshold in order to like when is something commercial when are you considered
to be maybe a manufacturer or what's the limit to be a steward, so what is with donations is
there is certain level to donations you can receive maybe other forms of income rights or remember
again the question from from the curl project, so what would happen if Daniel signs a contract and
say look I'm helping you as a steward to fulfill your roles as a manufacturer and then you have some
sort of income that's this then makes you maybe a manufacturer, so it's baller it's not but
so these are the question people had and I do believe that this is something we have to address
and should that should also then for example end up in guidance also many many projects,
many containers develop us out there felt that they might be pressured in in future and that like
manufacturers put some pressure on them to like be around and to do things that they do not want to
do, so basically one of the most interesting feedback we got about that's why we also quoted it
I like to do software engineering not management and I think this is also something which we should
always keep in mind right so this is your resilience act should not like hinder people from doing
software development because we are pushing them into management or other obligations that
should not be the case and so and this is also why some people were fear that the quality of the
project will be not that good in future since they have to spend time on other processes
in order to like I don't know make that software better and also what we have seen and this is also
super interesting also in light of the discussion on a dissertation but also on the on the
Stewart concept and at all is that we see that many of that some projects get also financial
support even from manufacturer these days but the financial support they get until now it's like
far being lower than the costs they have right so and there's like it's not really balanced so
to say and if you talk about this our resilience act and want the stewards to help the manufacturers
or want them to come up with a dissertation we have to talk about the money so we have to make sure
that there is like a proportionate amount of resources around for them so in order that they can
help the manufacturers to get their products on the market so and all of this means that we
are like basically talking about three like court topics at the moment they are also some
some other debate but it's like on guidance this is also what we address in the very beginning
then it's on standards or the ongoing standard decision process there's also some very nice
much from the commission on the standard decision process so I grabbed this after the talk
and then the attestation debate which we are just recently addressed here and where there's also
like pretty much a clean paper at the moment and where we need to fill this with content and for
this we have thought it's a good idea to do another survey so we are not the only ones that have
this idea so they are also some more surveys out there but this is then what we are going to talk
about in the next minutes yes so question what is the attestation there's article 25 describing
the possibility for the commission to put something out how attestation for open source
could work and the question is can that be used to finance open source a little balance the
playing field that manufacturers are totally responsible for the stuff they put into their products
can they support the ones who develop the stuff they put into their products so
that's the one thing how can developers be or how we can help them and the other thing is
what we want that manufacturers use open source as freely as they can and we know that open source
is helping the security everywhere so we want manufacturers to use open source so it should be
very easy for them to use it so we need to kind of balance we want to have the developers
and we want to make it easy for the manufacturers to do it and the easy part for the manufacturer
should be that they not bother the project but they just like can more or less like kind of like
credit so and this is the question how to organize this yeah and maybe just pay for development time
so what is going on the eclipse foundation has a project where they think about attestation
and work out how the attestation can be can be used what the attestation can be that's also a
question what is there to be attested and they've put a survey themselves I think this week
and there are a lot of discussions and people can join those discussions and we encourage
everybody to do so what we did with our survey was we want to see how small maintainers and developers
which might not work with the foundation which might not work together with potential stewards
or stewards how it could work for them and what ideas they might have in this process so that
we don't only get something which works for foundations like Linux foundation or eclipse foundation
we want something which also works for the small maintainers which just want to do software
development instead of the management and we also again that's learning from our other survey
we have a lot of free text in there so people can't just put a lot of stuff in their
source in there and we even have a one catch all the last question is tell us everything you want to
know so you can just leave your ideas in there so that's that the survey itself
write us your ideas what you want in there and how you think this could work we have 27
around 27 questions and again we are looking for your feedback and we'll use that to take it into
the discussions on how we could make the attestation work so on this we have also some some
sort of categories right so we already have some ideas how it could look like so we we already
like give you something where you can give us some answers for example on the pricing or like
who should issue the attestation how you can get attestations or they're also like in these
questions already some idea in but if there's anything else like any ideas you might have that
be do not address in this questionnaire please put this in so and every idea helps in order to
get a better understanding how this process could look like and also I think it doesn't mean
that there will be like just one way how to get attestation maybe there might be more and for this
it's a good idea to like see and bring some clarity into this like how it maybe could look like
so that doesn't mean that it will look like this afterwards but every idea helps us to better
understand how this all could be made yeah so we have the link to the survey which has
released today so from now on everybody can just answer and put the ideas in and also we put the
link to the guidance on open source from the European Commission in there so that's also a good
point to start on what interpretations towards open source is already in the CRA and how certain things
are defined and from there you can also go to the FAQ section for the CRA which is a very large
document I know that not everything is in there yet we're still working on some more guidance
but it also helps to see what the CRA is meant for and how certain things look like in the CRA
to give some more clarity so it's a good idea to first with the commission source and then go
to the questionnaire and also it's I guess important to know the questionnaire will be open for
one month so until the 28th of February you can as for everything what you have into this survey
and then we close it to from the first of March on and then evaluate and also like share the
results publicly but also then obviously the commission and market surveillance also here so
this is also making something that people should know that Michael is working for such a market
surveillance authority so we then also try to bring it into the process and not just like
publish it but also try to make sure that these ideas then also like are reflected in the
upcoming processes all right so with that we go over to the questions you might have
yeah so this means first of all we want to message the join us here from the European Commission
so this is a thing we have like a very good so to say panel here where you can ask as everything
this means you can ask as general questions on the cyber resilience act but also on the topics
which has recently addressed and I do believe we should be able to answer at least most of them
I just so that I don't forget about that we have one question in the in the metrics channel
when does inertia provide the APP definition for the single reporting platform is there any timeline
waitable okay so we're going deep into serial implementation not really open source related so
you I think Michael mentioned that there is an obligation to report actively exploited vulnerabilities
and incidents that affect the security of your product and you report only once through a
single reporting platform that is being established by Anisa now of course this is going to be quite
a complex procurement procedure and it's to be operational by September of this year to to start
the reporting obligations and it needs to be very secure because some of these information will
be quite sensitive and through the single reporting platform the information gets sent to the
national C-Series the API for the manufacturers in the first phase will not be available
because we are focusing more on the security aspects and on making sure that the C-Series
so that need to do the incident response have everything that they need and then in a second phase
we might look into an API for automatizing reporting obligations from the development factor
before I hand over to the next question maybe you can do a short introduction for yourself
of course maybe should have started with that my name is Thomas Bernabuy and I'm one of the
policy officers that is working in the European Commission on the implementation of the CRA
writing the guidance documents and indeed following all these developments.
Thank you. So I'm teaching a little bit by not asking a question but I'll give
you mention the projects earlier what I really want to stress here for the open source people
present here is that you can participate there it's entirely free it's entirely sort of like open
to anyone there so just to dispel that the rumors there.
Can I just add that obviously so the commission has procured services from the Clips Foundation
and Nullpoint Studio to help with this development but we want this to work not just for the
Clips Foundation we wanted to work for the individual developers that Michael was talking about
for the small players so of course we also need your perspective and also Alex is I think
that's a lot to it that.
Hi there thanks for that I work in the embedded systems industry making connected devices
I'm trying to follow and educate myself on this for quite some time I feel really confused
I hear a lot about policy in the future and questions this is brilliant this is great we need
involvement but I have timelines of commitments and I have to comply to those we have UKCE
ready in force now I talked to my customers they've never heard of this I talk about
security and they say I will do that later on I said we'll find but you are now legally obliged
to do this have you heard about the CRA that they haven't I'm really concerned that we're in an
industry where there's such little understanding of what we need to be doing and we're putting
products out into the field for 10, 15 years and we've got to support those and I'm not sure
as the person at the front end what I have to be doing and what I have to be saying to our
customers I don't really know for a manufacturer or a manufacturer or am I a steward when I'm
doing this because it might be used or I do stuff of fun what I'm not wearing and I'm quite worried
about that and if there's if you could sort of direct to me to where I need to go and what I need to
listen to to try to educate myself would be really pleased.
um just one question was it medical devices because if they fall under the medical regulation
okay yeah so I wanted to try to catch all and you're not
under the CRA but if you have dual purpose products which might end up in a medical device but
which might also end up in some other devices then you are you have to fulfill the CRA there are some
guidance documents out there and we published as BSI also some guidance documents and we are
still heavily developing those guidance documents on how you can do the risk assessment so
the vulnerability handling requirements you have to do and you have to look what vulnerabilities
can come to your product you have to um surveil them kind of and you have to fix them
the main requirement or the other requirements on the products they are mainly risk based so
it all starts with the risk assessment and then with the risk assessment you need to decide
what do I need to implement how much I need to implement to have a secure product
and that also depends on where it is used so for you probably might end up doing a bit more
than a normal toothbrush but it all starts on the risk assessment and there is some guidance
out there and we are still developing it on what you have to do there and that's also an opportunity
to keep feedback if that works for you and where you still have questions and what will help you
even more so we are also looking into that maybe just just to compliment because indeed obviously
so as Michael was saying so medical devices are excluded from this CRA but indeed you might
be caught in the scope I didn't quite understand what exactly you do but it is possible and of
course we understand and we are aware that software has not been traditionally regulated so it's a new
industry there needs to be a lot of awareness that's why we've started the website the FAQs
which are a little bit chunky but you know it can they give you a bit of an overview of what you need
to do realistically and I think the inside of my call was providing on the risk assessment this
is really key start from what are your risks are you already following good secure by design
practices are you already doing the things that you're supposed to be doing for a good software
in most cases when we talk about people in the open source area they are already doing
almost everything that they need to be doing so the compliance effort is also relatively limited
so this is also very very important what we want is state-of-the-art secure coding
secure design sorry secure by design practices and vulnerability handling and most cases you're
already doing it you just need to show it in the most rate it and also I would like to add
so try to identify your local or national active surveillance authority and go to them and
chat now so I guess they happy to to get this questions so so that really I think it's a good idea
to identify your national market surveillance authority yeah and to show how happy I am
the first thing should be if you have an industry representative then go to them because they're
looking into the stuff for three years now so they should I know that they do know a lot
and I know that if you come to the right people they will help you they have lawyers who might
address certain questions you might have which we can't we are not allowed to give legal advice
on the CIA so sometimes if people ask us they're not where we satisfied with the answer we have
to give them but you can approach us we can talk and also again your industry representatives
they should know that you want something and that you need something and then they will help
and they should help so we have another question here just quickly before so when you race your
hand please keep it up else I will assume when you take it down that it was answered in the other
question and beside that I will try to do the best to make sure that I have a sane order
thank you what is your advice for a small business owner that is also leading an open source project
and so it's both a manufacturer and possibly a steward and faces another company that is
kind of free riding on your software and puts you in a responsible position to fix
all the way downster if you're not or if you're not in the world of a manufacturer
if you're just this you have for the manufacturer stuff if you bring a product on the European
market with the CE label then you have to fill the CRA so you have kind of some obligations and
manufacturers who integrate your products into their own and they know that you
fulfill the CE and that you have to do vulnerability handling and that you have to comply to the
essential requirements it's another thing if you have the role of a steward or just a maintainer
then you don't have to do that much as a steward you have to you have to have as coordinated
vulnerability or a vulnerability policy you have to work together with market surveillance if they come and
ask you to do something then they can't they can't tell you what to do but you have to work with them
together to find this solution and you have to report vulnerabilities in the open source components
under your or your responsible for as a steward you don't have to do fix anything you don't have
to do the vulnerability handling for the manufacturer the manufacturer has to support you into doing
that because he's responsible for everything he puts in this product and he can't just say
I integrated it now do something because I have the responsibility that there's not a vulnerable
product out there he has to work with you and to get what he wants and to get a compliant product
yeah if you're if you're as a manufacturer providing free and open source software then you're not a
manufacturer for that free and open source software it the world is depending on the product that
support a regulation for every product you put out there you have to assess what world you take
so manufacturers don't just become manufacturers because they sell one product and then there are
manufacturers for all the other products they have so let's let's go with the order because else it's
difficult with the with the stream to people will not understand it so let's go with the order there
and then we can also have the other back and forth later outside or when we have the time again
hi my question is kind of related I have a company that supports with regulatory affair
with our manufacturers but in my case most of my customers are importers so they are actually
considered manufacturer but they didn't develop any of the software any of the hardware but they are
the manufacturer and I have doubt about the economic sustainability for those people because
they have to pay us so we are investing three years we're investing money in
learning CRA and everything and they just don't have the budget to support to pay us for being
compliant so most of what they are doing is decide to not comply okay and that's very common
in many European countries that is you know not Germany and France or the big players okay
just just be sincere we have customers all around the union and in particular I would say that
it is already happened with some other projects from European Union we already made it clear that
it was an issue there is already a phenomenon of non-complying producers and I fear it is going to
happen again if the economic part is not addressed so what sort of opinion about that and
which action you want to take since and no it is an own problem yeah I mean so of course it is
an own problem in a lot of these regulated areas from sort of the NLF new legislative framework
which is how market access basically legislation there are a lot of initiatives of you this
is a little decommission to get away the market surveillance authorities put in place
to address yeah importing goods from third countries that are not compliant
there is no silver bullet of course it requires market surveillance authorities to work together
and to do use a risk-based approach to make sure that they go and check where they know that
there are likely to be non-compliances to avoid unfair competition from from companies
maybe just to say that the importer doesn't assume the responsibilities of the manufacturer
the responsibilities remain of the manufacturer but the importer should not and cannot place on the
market products that are non-compliant and I see your face I could reply yeah would be buying
but so I mean I don't have a well-perfect answer but I'm just saying that we obviously are aware
and obviously CRA is not yet in in application so there's not actions that we're doing now
but we're working with the market surveillance authorities to have a strategy on how to address all of that
so I have a small consultants company my one person and I literally the same thing yeah
but still it's slightly different so I make a software that I don't host myself don't even use
myself but it's fun project that I have now some other company comes along in uses it thankfully
it's an American company why shouldn't I put up a sign that says never use this software in the
European Union you're not allowed to use it go away and is to get out of all the legal
hassle what's the what's the good thing that comes with this why would you need to put that sign
you if you're not really but if you're no monetizing it you're not I mean it's just something
so the downstream integration by a manufacturer does not say anything about whether you
are replacing a product on the market it is the responsibility of whoever takes your project
and puts it in their product to ensure compliance now we've seen on the screen Daniel from
Carol that is already getting annoying emails from manufacturers that have taken his project
and put it into theirs you don't have a responsibility it is their problem what we want to do
with the attestation project that that we were talking about earlier is to make sure that the
company that takes your product pays you or comes back to you and says okay what do you need to
ensure that this is sustainable and you could if you want give them an attestation that says I've
done these these these these and that and therefore you can be sure that when you integrate it into
your whatever downstream product you have certain assurances and you can fulfill your due
diligence obligation but the fact that somebody who is a manufacturer takes your project
puts it into their product has zero implications for you from a legal point of view
just because you made something great doesn't mean it's a product in the sense of you put
a product onto the European market so you've done something great and that's fine but somebody has
to monetize it and put it onto the European market so there's also some guidance on what that
means and just because somebody uses it you don't have to do anything even the attestation if you
don't want to do any attestation then don't maybe put a sign somewhere that's like with sign
use it on your own risk and you're responsible and I don't care what you do if you put it
into a product which then comes to you when markets I think you I'm learning about the
rate today so I'm a bit conflated I'm passionate about security but I can also hear the concerns
about manufacturers around a possible virus to enter in the market right and maybe let's
compare it to this right and although like it's not as well as if it's an episode's product
is in the manufacturer at some point in the chain there is this barrier right but also based on
there I also wanted to ask in terms of I heard about you know security design and secure product
but it also depends on the purpose right which for software is very hard to determine ahead of time right
and there's nothing they secure 100% so it's what's the right level of effort and how do we
determine that again depends so if you are developer for free and open source software then you just
I can say do what you want but I mean open source community tends to look on security
bit more than other manufacturers might do and there are also a lot of manufacturers who do
all this stuff they're not our problem the CIA is there to get this stuff out which doesn't
comply and the manufacturer has due diligence obligations when he puts a component into his
product so he needs to look at the component and he has to decide does it fit is it fit for the
purpose I want to use it into my product and if it doesn't have certain security features he might
need then he can't use it because then he might have to look for another component he can use
which fulfills everything he wants okay and for the last months we're struggling with a
question regarding who is manufacturer because the definition is who designs or let design
product for himself but what if you're with a someone who's a supply chain have its own product
with digital elements but he's only manufacturing for another bigger manufacturer and
we are as a border when you fall under this I only design for another person who is then the
manufacturer and when I'm the true manufacturer has to solve the obligations of under this
CIA because this definition for design it on your own or let it design creates a lot of
interpretation who is the manufacturer and this supply chain theory with you have two
three or four different parties and supplying stuff for one product with digital elements even if
there are many products which are itself products with digital elements in before in the supply chain
if I'm just to correct the question the manufacturer is the person as in legal or natural
the market is something under their own name or trademark right so if they hire you to
develop a certain feature which then they integrate into their product and that's what they market
they are the manufacturer then of course they might ask you to do certain things as part of hiring
you so that ultimately their product is secure but you are not the manufacturer if you've just
developed a feature for for a company let's say because you know marketing it under your name
or trademark no it depends I mean it no this is not really corrected depends on what is
that's basically the contract for relationship between you and this manufacturer are you actually
supplying something as in are you are you supplying something to one two three four manufacturers
are you just being hired by somebody that's a little bit the line that you need to walk on
say that again sorry I couldn't hear
maybe it helps there is the blue guide which can be downloaded also from the European website
so I'm just Google Blue Guide and there's a definition and some guidance on what it means to
put a product on the European market and because if you're not putting a product on the European
market then you're not a manufacturer sorry can and based on the earlier questions I'm wondering
whether there has been a shift in the definition of the manufacturer because I always understood
in previous discussions from months years back that even as an open source software developed
you would be a manufacturer as long as your solution is being just published but is that has
that been shift and then when you develop the open source software you're not automatically
a manufacturer where is that border between being an open source developer and being a manufacturer
it was always said if you have make money based on the open source then you automatically
become the manufacturer but here in your answers that seems to have shifted and I'm a bit confused
if I just develop open source software put it on make it public I'm not a manufacturer but when I
do consult this you're not how does that work has that to mean the cases you describe neither
is a manufacturer right if you're just putting something in GitHub that you've developed
and everyone can access it and download it then that's it you're not a manufacturer that's
you're not monetizing directly the project you might have a separate consultancy service where
you help manufacturers use it and install that product but that's separate it's not monetizing the
product itself the the GitHub project it's a consultancy service so I don't I don't know if that's what
you are getting at it yeah so the generally speaking so it's not generally speaking if even though
the two things might be related because you might be you know you have the expertise because you
are the person that developed if the product is placed on the market for free and
freely accessible so it's free and open source yeah that would not be that's the way we're thinking
about is that it wouldn't be a monetization yeah the thing is that if you put something out there
and the customer can do everything himself might not have the knowledge but he if he acquired
the knowledge to do it then he could do everything himself then you're providing something totally
for free so everybody can use it just because you might have some more knowledge and you have a
service to support someone to integrate it then that's your service you're doing you're not
putting a product out there yes another question just I know it can be a bit disappointing
when the speakers the people on the panel then can't answer the question completely but it's
very difficult and this set up here to have a back and forth and between the first person asking
the questions so let's try to then also have follow up questions with the people after the talk
or then when it's the next time it turns and if I may as well just to say that of course
you know we might not have all the answers but we also take the input and we reflect on it and
I personally cannot commit to anything but you know internally we can work on the guidance that
when once it's published it kind of commits the commission so all right so thanks for all the answers
so far so if you have a large product as a manufacturer maybe have 10,000 open source components in there
you need to hunt down all these adaptations but you need to under know your components first so you're
dependency graph now I wonder in open source license compliance the components are legally defined
so that's the discrete binary components but it's also separately the copy and paste in those components
so for the CRA what's the component it's the discrete binary components you build into your product
or is it also within those binary components copy and paste it's a legal question maybe it's
a theoretical question but I would like to know the answer I'm not sure if I understood the
question correctly but the manufacturer is responsible for everything in his product
so if he puts in a component which also has other components he's still responsible for the whole
product he puts on the market a question a little bit on financing open source developers because
there's been some talk about yeah but we can't expect open source developers to start solving
our problems for free and I think that's a completely legitimate question I think the word free
and free and open source by the people who use it they tend to think I don't have to pay for it
but free for us as open source developers mean that we still have sovereignty over our own time
and we want to put our time into a hobby project that we might not even want to be paid to do something
because if I make my hobby my work I have to find a new hobby so have you kind of thought about
people who might I completely understand there are people they don't want to fix other people
stuff for free and they should have a way to be remunerated that I completely understand but there's
also a side of us who are like no I don't want your money I want sovereignty over my own project
yeah then how do you how do you see that balance being given then when manufacturers then have to
say okay then I'm not going to use that component anymore or can they still do it or how do you
force someone to do work for you if they already have so much on their plate in their daily job
the thing is again they're responsible for everything and if you don't want to do anything with
the manufacturer you just want to do your own project then they can't force you there's no obligation
for you to do something they can still use your component if then even if there's a vulnerability in
they have to do something and see how they can fix that vulnerability or mitigate that vulnerability
so it's their responsibility and through their due diligence they then have to decide
can I use the project for what I want to do or maybe I need to look somewhere else and use another
component so maybe also like you don't even have to answer these questions why so the
current example again from Daniel so what we want or what's out there is you don't even have to
react on this so if you do not want to do anything you do not have to do anything so but the manufacturer
might go there and just fork your project so that might be the easiest solution for a manufacturer
or just like to make sure that there's some like that you can fulfill the obligations point
so but also another idea might be so if you do not want to be the steward and you do not
want to have this in the action Mr. Manufacturer maybe the attestation could be some may out so
that you do this once in like a specific way and then you say towards a manufacturer and you don't
need to have to contact to the manufacturer that there is some sort of attestation and this is
then how you can make sure that your project is still not fork but can be integrated so what we
want to see is that there are many ways for in particular individual developers to decide if you
want to interact to which extent you want to interact or if you do not want to interact at all
okay my question is pretty basic what are the different roles which is recognized in CRA and
the CRA and what are their duties and responsibilities because what is happening is that we are
doing our own interpretation so it would be amazing to hear from the hostess mouth okay so
it's a easy question not sure but no okay so indeed we did not really present the CRA but the main
role is the manufacturer that's the entity that markets the product under the name of trademark
and has the bark of the obligations so I cannot name names but in the context of open source you
could imagine that there is a very famous company that does an operating system and that
I am not naming names and that company would likely qualify for the definition of a manufacturer
then there is a very famous foundation that has a lot of projects that also the commission is working with
and they might qualify for Stuart role and then there is a lot of you in the room that just have fun
I mean they also do it for a living but you are not like the very famous company that we mentioned earlier
so the very famous company is the manufacturer the manufacturer is responsible for ensuring the
product is designed according to the essential requirements of the CRA so before they place it on the market
and after the placement on the market they're responsible for fixing the vulnerabilities that might
emerge in the product as part of all of this they need to run what is called a conformity assessment procedure
so they need to check and say okay how is this essential requirement related to cryptography
how is it implemented in my product and they need to demonstrate that it's implemented and so on and so forth
and they need to exercise crucially due diligence on the components that they take from elsewhere
the stewards have a much lower regime they need to put in place a policy to make sure that the projects
that they host and that they support follow secure by design practices and they need to the
extent that they are involved directly in the development so that they have developers on call etc
they need to report vulnerabilities that might emerge maybe you should then say these out loud
there are no fines for failure to meet these obligations for the stewards so we rely on the good
cooperation from them to do that then there are a bunch of other roles I mean there's the market
surveillance authorities which are the national authorities at national level that are responsible
to enforce the regulation and there are the computer security incident response teams of
the member states that are also responsible for helping with addressing vulnerabilities when there
is an emergency so that's a little bit the market the main architecture then you have importers you
have other roles but these are the main the main legal figures yes I have another question
as a manufacturer I am now responsible for the entire product but also everything that I am using
so now I'm a little bit torn here because either I can go with open source and use that one
but then I'm responsible for making sure that it's actually fixed so if I can convince the
open source product to actually fix the bug if they don't then I have to fix it and that costs more
man hours instead of money money is easier to get than man hours often but I'm also responsible for
ensuring that if there are so I need to monitor all these open source products myself
while on the other side I can go to a company and I can buy a license and then they are more
responsible for giving me all the information so quite often we go and we buy things and then
need to contract to say well you have to do all these parts and you have to monitor and make sure
that the product is secure so now I would actually go more towards the commercial licenses because
start it's easy for me yeah they take money definitely so it's the question or could be the question
who wants more money and you're still responsible so the question is how much does that cost you
instead of finding a way to support open source so if that's cheaper for you then
business case maybe it's better to support them still get everything you want and the other question
is looking at how much open source is used in all the products around the European market
does that scale and is that even feasible are there enough manufacturers who can go and just
replace all the open source we are using how can you believe in quality wise right I will
be so sure that what you get on the license is better quality better security than a lot of
the open source projects be baitable so he told me I should be quick so I'm working for a
company we are producing semiconductors and with that devices controllers we also provide
code examples like two three examples to showcase different functionalities so this is not like a
finalized product someone could use but still he could use this code and implement it into his
final and product what is your recommendation towards those code examples so what should we do
so generally speaking I mean obviously I cannot offer legal advice to the specific case
but it is unlikely that something like that would be considered as a product with digital
elements placed on the market it's just simple code so it's most likely not going to be considered
as a product therefore not subject to this year so we we will have some guidance on this topic
coming out soon I'm sorry that we have to cut it now please join me in the big round of applause especially