Why we should care about the CRA

and how it can affect open-source

Grab this slide deck:

https://slides.com/cheukting_ho/cra-lt

Hello I am Cheuk

• Open-Source contributor
  
  
   
• Organisers of community events
  
  
   
• ex EPS board member, PSF fellow
   
• Looking for my next role

What is CRA?

Remember GDPR?

Now we come CRA

TL;DR - putting 

On your software

It's a good thing... right?

However...
in open-source

We may not be able to demonstrat compliance

Or it's very expensive...

Non-commercial activities are exempted, right?

But... what is a commercial activity?

• Can I accept donations?
• Should I open-source my project in my company?
• Should I let my employee to work on open-source in office hour?
• Can I provide a paid cloud service based on ao OSS?

What should I do?

Get more information and voice out concerns

• The PSF says: https://pyfound.blogspot.com/2023/04/the-eus-proposed-cra-law-may-have.html
   
• The Internet Society says: https://www.internetsociety.org/blog/2022/10/the-eus-proposed-cyber-resilience-act-will-damage-the-open-source-ecosystem/
   
• The CRA: https://digital-strategy.ec.europa.eu/en/library/cyber-resilience-act
   
• Read this blog post: https://blog.nlnetlabs.nl/open-source-software-vs-the-cyber-resilience-act/#the-effects-on-developers-of-open-source-software
   
• And more...