Summary

  • Barry O'Donovan told RIPE 93 that the EU Cyber Resilience Act distinguishes a volunteer contributor from an organisation sustaining open-source software and from a manufacturer selling a digital product. The role determines who must document vulnerability handling.
  • The Commission says manufacturers began reporting actively exploited flaws in September 2026; the corresponding steward reporting duty starts in December 2027. The difference matters to operators trying to find a real recipient for a security report now.

A law meets an inbox

O'Donovan opened his RIPE 93 talk with a room full of network people already carrying regulatory acronyms. Then he turned to the software they install. A volunteer can publish code and accept a pull request; a foundation can keep a project viable; a company can sell the finished product. The same repository may touch all three. The EU Commission's explanation assigns different duties to the roles, not to the GitHub page.

The distinction becomes less academic when someone reports a flaw. Under Article 24, a steward must document a cybersecurity policy that covers finding, addressing and remediating vulnerabilities. A manufacturer carries the product obligations. O'Donovan said his organisation had hired a developer eight months earlier and that the developer's work now included intake of AI-assisted vulnerability reports. One more inbox can consume a person's working day before any patch exists.

The calendar has teeth. The Commission's reporting timetable puts manufacturer reporting from 11 September 2026 and steward reporting from 11 December 2027. The single platform sends reports to a national CSIRT and ENISA. O'Donovan described a light regime for stewards, without the administrative fines attached to manufacturers. The obligation to handle a vulnerability and the capacity to fix it remain different things.

The line nobody in the room could draw

In the session transcript, Maria Matejka asked who would decide whether an organisation was a steward or a manufacturer. O'Donovan expected a grey middle and future court cases. No court made that classification in the meeting. For an operator, the urgent question is more prosaic: which named team accepts the report, maintains the release, and tells users when a fix is ready? A legal label cannot answer an email by itself.

Sources: RIPE 93 talk; official transcript; EU CRA text; Commission open-source guidance; Commission reporting dates.