About the Open Regulatory Compliance Working Group | Open Regulatory Compliance Working Group

The Open Regulatory Compliance (ORC) Working Group is a global, industry-led collaboration helping organisations understand and implement open source compliance strategies under evolving regulations like the Cyber Resilience Act (CRA) without compromising open source innovation. We unite manufacturers, open source stewards, and maintainers to create practical, community-driven best practices for secure and resilient software.
ORC helps organisations understand regulatory requirements for their open source software, prepare for key milestones, and implement risk-based security practices without slowing innovation. Our members collaborate to define clear, practical guidance tailored to the realities of open source development.
While the CRA is our current focus, the ORC Working Group is structured to take on emerging compliance topics. Through Special Interest Groups (SIGs), members can explore new regulatory domains as they arise, ensuring the community remains agile and responsive as global requirements evolve.
Examples of future SIG topics include:
This structure ensures that ORC remains a long-term, future-proof collaboration.
Whether they build physical devices, integrate software into products, or deliver digital services, manufacturers bring critical real-world perspectives on how open source is used across products, platforms, and supply chains. Their perspectives ensure ORC’s work remains grounded in real-world production needs.
Open source stewards and foundations provide essential insight into the governance, sustainability, and community dynamics of OSS projects. Their leadership ensures that regulatory approaches remain compatible with open source principles and support the long-term health of the ecosystem.
Developers and maintainers contribute deep technical knowledge of how open source is created, reviewed, and improved. Their experience ensures that best practices are realistic for contributors, respectful of community workflows, and supportive of secure, high-quality software development.
The Open Regulatory Compliance working group supports all open source actors in understanding and meeting regulatory requirements. Our purpose is to strengthen the security, resilience, and long-term sustainability of the open source ecosystem through open, community-driven collaboration.
To achieve this, ORC:
Provides an open forum for members of the open source community to organise, share, document, and develop best practices, and support each other.
Collects and shares input and feedback in relevant legislative and standardisation processes.
Develops specifications that can be transformed into standards recognised by legislators through relevant standardisation organisations.
Creates additional materials to help with compliance, such as guidelines, educational content, and specifications not designed for further standardisation.
ORC strives to develop artefacts and best practices that help open source actors comply with regulatory requirements across jurisdictions. For detailed information about our mission and governance, please refer to our Working Group Charter.
The ORC community is open to anyone committed to strengthening open source security and compliance.
The Open Regulatory Compliance (ORC) Working Group is a neutral forum for the open source community — including foundations, maintainers, vendors, users, package managers, among others — and the broader software industry to facilitate CRA compliance.
Copyright © Eclipse Foundation AISBL. All Rights Reserved.