Eclipse Foundation Tackles Regulatory Challenges with New Open-source Compliance Initiative

• By John K. Waters
• September 26, 2024

The Eclipse Foundation announced the launch of the Open Regulatory Compliance Working Group (ORC WG), aimed at helping the global open-source community navigate increasingly complex regulatory landscapes. As governments worldwide impose new regulations on software technology, including cybersecurity and privacy laws, the ORC WG seeks to offer guidance and best practices to open-source participants, including developers, enterprises, and organizations.

The working group will focus on ensuring compliance with evolving legal frameworks while collaborating with regulatory bodies to inform them about the unique nature of open-source development. Backed by leading global technology companies and open-source foundations, the initiative is designed to safeguard the use of open-source software while maintaining compliance with standards.

Mike Milinkovich, executive director of the Eclipse Foundation, highlighted the importance of aligning open-source practices with regulatory requirements, particularly as governments impose new legislation such as the European Cyber Resilience Act (CRA).

"Given the impact of software technology on the global economy, it is unsurprising that governments worldwide are enacting new regulations to safeguard privacy, security, and accessibility," Milinkovich said in a statement. "The Open Regulatory Compliance Working Group was created to bridge the gap between regulatory authorities and the open-source ecosystem, ensuring organizations and developers can leverage open-source technologies while remaining compliant with evolving global regulations."

The group will focus initially on the CRA, aiming to help open-source projects comply with its provisions by developing cybersecurity process specifications and collaborating with European authorities to provide timely guidance. The working group has also secured formal liaison status with European standards organizations, signaling its commitment to influencing regulatory standards.

The initiative has already attracted significant support from prominent players, including the Apache Software Foundation, Nokia, Siemens, and Mercedes-Benz Tech Innovation, among others. These organizations emphasize the importance of ensuring that regulations like the CRA are implemented in ways that protect open-source innovation while meeting the highest standards of security and compliance.

"The CRA will impact open-source users and producers alike," said David Nalley, President of the Apache Software Foundation, in a statement. "Legislators will benefit from the brain trust of open-source organizations that Eclipse has brought together to ensure that the legislation is crafted in a way that protects all parties."

"Open-source communities and the software they produce are ever more important for the whole industry," said Jonne Soininen, Head of Open-Source Initiatives at Nokia. "This is exactly why, for Nokia, the wellbeing and sustainability of the open-source communities is paramount. The CRA brings potential new requirements to the open-source communities. Nokia strongly believes that the targets of the EU CRA and the best outcome can only be achieved by the open-source community having a strong voice in this process."

In addition to its focus on the CRA, the ORC WG aims to formalize industry best practices for regulatory compliance across jurisdictions and provide essential resources, such as webinars and compliance materials, to educate the broader open-source community.

The Eclipse Foundation’s move underscores the growing intersection between regulatory frameworks and the open-source software supply chain, highlighting the need for collaborative solutions to ensure security and compliance without stifling innovation.