On Saturday, 19 September 2026 at 18:19:41 UTC, Gregor Mückl wrote:
>
On Saturday, 19 September 2026 at 18:01:44 UTC, Adam Wilson wrote:
>All of this is a very complex way of saying that DLF will have to hire EU counsel to write these policies and provide ongoing oversight of code changes and responses to security incidents to ensure continuing compliance.
No, it's actually not. Just make sure to follow proper best practices regarding secure software development, CRA or not. As long as you do that, you're in the clear and you reduce your users' compliance workload implicitly.
I would point out that this is entirely your personal opinion. No lawyer I've talked would ever say "Yea man, just wing it bro", which is effectively what you're saying we should do. If a policy is required by statute than the policy must be written, enforced, and on-going compliance oversight maintained either by counsel or independent audit.
The DLF has neither the money nor the human-time capacity to "reduce users' compliance workload implicitly." Compliance with local statutes has always been the sole responsibility of the end-user of any software.
The DLF is not and cannot be responsible for ensuring compliance with local security statutes for exactly the same reason as the DLF is not and cannot be responsible for ensuring compliance with local copyright statutes. The logic is no different, even if the text of the law is.
The community will continue to fix bugs, including security vulnerabilities, as fixes are offered and such fixes meet our engineering standards. But we cannot compel any human to do such work without compensation as that would be slavery and is highly illegal.
If you want to help the DLF comply with your local statutes then you or your employer will have to pay the bill for your time. The DLF simply does not have the capability to make any compliance guarantees of any kind for any reason, be it Copyright or Security laws.