<html><body><div dir="ltr">
Thanks for the context and setting expectations.</div><div dir="ltr">--<br></div><div dir="ltr"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div dir="ltr"><div>Jody Garnett</div></div></div></div></div><br>
</div>
<br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Dec 8, 2023 at 12:57:53 AM, Luís Moreira de Sousa <<a href="mailto:luis.de.sousa@protonmail.ch">luis.de.sousa@protonmail.ch</a>> wrote:<br></div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex" type="cite">
<div style="font-family:Menlo,Consolas,Courier New,Monospace;font-size:14px">Dear Jody,</div><div style="font-family:Menlo,Consolas,Courier New,Monospace;font-size:14px"><br></div><div style="font-family:Menlo,Consolas,Courier New,Monospace;font-size:14px">thank you for the update. The last "trilogue" took place on the 30th of November and OSS was finally considered. A final document is now closed and will proceed through the successive steps towards approval. The CRA will come into two force stepwise as discussed before, but now on different dates: first tier in January of 2026 and fully in January of 2027.<br></div><div style="font-family:Menlo,Consolas,Courier New,Monospace;font-size:14px"><br></div><div style="font-family:Menlo,Consolas,Courier New,Monospace;font-size:14px">Various rumours have emmanated out of the last "trilogue", sometimes conflicting. In truth the final document is not public, a clear understanding of its implications will not emerge before then. There are claims that Microsoft's concerns regarding distribution via code forges were addressed, but in parallel software stewards such as OSGeo will still be required to some form of compliance. <br></div><div style="font-family:Menlo,Consolas,Courier New,Monospace;font-size:14px"><br></div><div style="font-family:Menlo,Consolas,Courier New,Monospace;font-size:14px">This situation is certainly frustrating, but there is no point in speculating before the complete Act is made fully public.</div><div style="font-family:Menlo,Consolas,Courier New,Monospace;font-size:14px"><br></div><div style="font-family:Menlo,Consolas,Courier New,Monospace;font-size:14px">Best regards.<br></div>
<div class="protonmail_signature_block" style="font-family:Menlo,Consolas,Courier New,Monospace;font-size:14px">
<div class="protonmail_signature_block-user">
<div><br></div><div>-- <br></div><div>Luís</div></div></div><div class="protonmail_quote">
On Wednesday, December 6th, 2023 at 4:09 PM, Jody Garnett via Discuss <<a href="mailto:discuss@lists.osgeo.org">discuss@lists.osgeo.org</a>> wrote:<br><br>
<blockquote class="protonmail_quote" type="cite">
<div dir="auto"><div dir="auto">Follow up to November discussion and <a href="https://www.osgeo.org/foundation-news/eu-cyber-resilience-act/" rel="noreferrer nofollow noopener" target="_blank">blog post</a> asking OSGeo community to be informed.</div><div dir="auto"><br></div><div dir="auto"><ol style="margin:0px" start="1"><li>At the end November Europe lawmakers agreed on something: <a href="https://www.consilium.europa.eu/en/press/press-releases/2023/11/30/cyber-resilience-act-council-and-parliament-strike-a-deal-on-security-requirements-for-digital-products/" rel="noreferrer nofollow noopener" target="_blank">https://www.consilium.europa.eu/en/press/press-releases/2023/11/30/cyber-resilience-act-council-and-parliament-strike-a-deal-on-security-requirements-for-digital-products/</a> <br><br>Free and open source was so far down the priority list that the press release does not even mention it.</li></ol></div><div dir="auto"><br></div><div dir="auto"><ol style="margin:0px" start="2"><li>Next there were assurances that free and open-source community concerns were addressed: <a href="https://www.europarl.europa.eu/news/en/press-room/20231106IPR09007/cyber-resilience-act-agreement-with-council-to-boost-digital-products-security" rel="noreferrer nofollow noopener" target="_blank">https://www.europarl.europa.eu/news/en/press-room/20231106IPR09007/cyber-resilience-act-agreement-with-council-to-boost-digital-products-security</a> <br><br>The quote did indicate how our concerns were addressed:<br><br>> We have ensured support for micro and small enterprises and better involvement of stakeholders, and addressed the concerns of the open-source community, while keeping an ambitious European dimension.</li></ol></div><div dir="auto"><br></div><div dir="auto"><ol style="margin:0px" start="3"><li>This week I can find a articles providing clarifications that have been added: <a href="https://openforumeurope.org/eu-cyber-resilience-act-takes-a-leap-forward/" rel="noreferrer nofollow noopener" target="_blank">https://openforumeurope.org/eu-cyber-resilience-act-takes-a-leap-forward/</a> <br><br>Two clarifications:<br><br>> the provision of free and open-source software products with digital elements that are not monetised by their manufacturers is not considered a commercial activity<br><br>> The mere circumstances under which the product has been developed, or how the development has been financed should therefore not be taken into account when determining the commercial or non-commercial nature of [making free and open-source software available on the market].</li></ol></div><div dir="auto"><br></div><div dir="ltr">—</div><div dir="auto">Jody</div></div><div dir="auto" style="background-color:rgba(0,0,0,0)!important;border-color:rgb(255,255,255)!important;color:rgb(255,255,255)!important">
</div>
</blockquote><br>
</div>
</blockquote>
</div></body></html>