Re:Funding Open Source like public infrastructure
by pabs3 on Friday August 15, 2025 @12:17AM
(#44908564)
Found a FAQ about it:
"Failure to comply with vulnerability reporting, cyber incident reporting, or essential cybersecurity requirements could trigger administrative fines of up to €15 million or 2.5% of global turnover. Other obligations include €10 million or 2% of global turnover."
Apart from fines, "Beyond financial penalties, non-compliant products may also be prohibited or restricted from being made available on the EU market, or authorities may order their withdrawal or recall. This can lead to significant reputational damage and loss of market access."
Re:Funding Open Source like public infrastructure
by pabs3 on Monday August 18, 2025 @10:12PM
(#44947548)
There is more to it than just reporting, "essential cybersecurity requirements" presumably would include fixing issues, hardening to reduce impact of issues etc.
"Failure to comply with vulnerability reporting, cyber incident reporting, or essential cybersecurity requirements could trigger administrative fines of up to €15 million or 2.5% of global turnover. Other obligations include €10 million or 2% of global turnover."
https://www.windriver.com/resource/eu-cyber-resilience-act-f...
Also more details in this one:
https://codific.com/cra-fines/
Apart from fines, "Beyond financial penalties, non-compliant products may also be prohibited or restricted from being made available on the EU market, or authorities may order their withdrawal or recall. This can lead to significant reputational damage and loss of market access."