Update 02.md by August-Bournique · Pull Request #17 · orcwg/cra-due-diligence

August-Bournique · 2026-07-17T11:49:24Z

Outline of Section 2 and inclusion of intro for ongoing 13(6) requirement (upstreaming) work.

Outline of Section 2 and inclusion of intro for ongoing 13(6) requirement (upstreaming) work. Signed-off-by: August-Bournique <august@bourniquelaw.com>

Signed-off-by: Juan <137221298+jrico-eclipse@users.noreply.github.com>

CsatariGergely · 2026-07-28T12:49:18Z

@@ -1,7 +1,58 @@
-# To what do we apply due diligence
+# 2.1 To what do we apply due diligence


In the other pr-s we do not have chapter numbering, but we can add it to there also if we think it is useful.

Let's remove the chapter numbers.

We can add them in a final editorial step.

CsatariGergely · 2026-07-28T12:53:19Z

+2.2.2 Placement on the Market
+
+## 2.3 Which components of the product
+Due diligence cannot be limited to top-level dependencies. Regulatory compliance requires complete transparency across the entire software supply chain, encompassing all open source code compiled, linked, or executed within the final product.<br>


Suggested change

Due diligence cannot be limited to top-level dependencies. Regulatory compliance requires complete transparency across the entire software supply chain, encompassing all open source code compiled, linked, or executed within the final product.<br>

Due diligence cannot be limited to top-level dependencies. Regulatory compliance requires complete transparency across the entire software supply chain, encompassing all open source code compiled, linked, or executed within the final product.

CsatariGergely · 2026-07-28T12:56:11Z

+Due diligence cannot be limited to top-level dependencies. Regulatory compliance requires complete transparency across the entire software supply chain, encompassing all open source code compiled, linked, or executed within the final product.<br>
+Target Component Hierarchy:
+  - **Direct & Transitive Dependencies**: Primary open source libraries and frameworks imported directly by developers, as well as all indirect (nested/transitive) sub-dependencies down the dependency graph.
+  - **System & Runtime Infrastructure**: Embedded operating systems (e.g., Yocto, Linux), container base images, hypervisors, and execution runtimes packaged alongside the product.


Suggested change

- **System & Runtime Infrastructure**: Embedded operating systems (e.g., Yocto, Linux), container base images, hypervisors, and execution runtimes packaged alongside the product.

- **System & Runtime Infrastructure**: Embedded operating systems (e.g., Linux), container base images, hypervisors, and execution runtimes packaged alongside the product.

Yocto is not an operating system it is a tool to build operating systems.

CsatariGergely · 2026-07-28T12:56:18Z

+Due diligence cannot be limited to top-level dependencies. Regulatory compliance requires complete transparency across the entire software supply chain, encompassing all open source code compiled, linked, or executed within the final product.<br>
+Target Component Hierarchy:
+  - **Direct & Transitive Dependencies**: Primary open source libraries and frameworks imported directly by developers, as well as all indirect (nested/transitive) sub-dependencies down the dependency graph.
+  - **System & Runtime Infrastructure**: Embedded operating systems (e.g., Yocto, Linux), container base images, hypervisors, and execution runtimes packaged alongside the product.


Should we add a note, that in a typical case a hypervisor or container runtime is not part of a product?

CsatariGergely · 2026-07-28T12:58:52Z

+  - **Direct & Transitive Dependencies**: Primary open source libraries and frameworks imported directly by developers, as well as all indirect (nested/transitive) sub-dependencies down the dependency graph.
+  - **System & Runtime Infrastructure**: Embedded operating systems (e.g., Yocto, Linux), container base images, hypervisors, and execution runtimes packaged alongside the product.
+  - **Firmware & Hardware Abstraction Layers**: Open source bootloaders, drivers, and microcode integrated into hardware platforms.
+  - **Bundled Build & Runtime Utilities**: External scripts, third-party binary blobs, or open source utility engines embedded to deliver core product functionality 


Suggested change

- **Bundled Build & Runtime Utilities**: External scripts, third-party binary blobs, or open source utility engines embedded to deliver core product functionality

- **Bundled Runtime Utilities**: External scripts, third-party binary blobs, or open source utility engines embedded to deliver core product functionality

Build time dependencies are not part of the product, therefore out of CRA scope.

CsatariGergely · 2026-07-28T12:59:08Z

+├── Application Layer        └─ Direct Dependencies (Frameworks, Libraries)
+├── Middleware Layer         └─ Transitive Sub-Dependencies (Nested Packages)
+├── Runtime / Execution      └─ Containers, Virtual Machines, Language Runtimes
+└── System Layer             └─ Embedded OS (e.g., Yocto, Linux), Firmware, Microcode


Suggested change

└── System Layer └─ Embedded OS (e.g., Yocto, Linux), Firmware, Microcode

└── System Layer └─ Embedded OS (e.g., Linux), Firmware, Microcode

CsatariGergely · 2026-07-28T13:00:47Z

+## 2.4 When to apply due diligence?
+### 2.4.1 Assessment and Article 13(5)
+### 2.4.2 Related Requirements
+####  2.4.2.1 Upstreaming Requirments Article 13(6) 


This is not related to due diligence therefore I would live it out from this whitepaper.

CsatariGergely · 2026-08-24T09:00:26Z

+2.2.2 Placement on the Market
+
+## 2.3 Which components of the product
+Due diligence cannot be limited to top-level dependencies. Regulatory compliance requires complete transparency across the entire software supply chain, encompassing all open source code compiled, linked, or executed within the final product.<br>


CRA requires to do the due diligence only to those components which are integrated by the manufacturer. Transient dependencies are implicitly integrated, therefore should not be subject of due diligence.

CsatariGergely · 2026-08-24T09:01:21Z

+Due diligence cannot be limited to top-level dependencies. Regulatory compliance requires complete transparency across the entire software supply chain, encompassing all open source code compiled, linked, or executed within the final product.<br>
+Target Component Hierarchy:
+  - **Direct & Transitive Dependencies**: Primary open source libraries and frameworks imported directly by developers, as well as all indirect (nested/transitive) sub-dependencies down the dependency graph.
+  - **System & Runtime Infrastructure**: Embedded operating systems (e.g., Yocto, Linux), container base images, hypervisors, and execution runtimes packaged alongside the product.


Suggested change

- **System & Runtime Infrastructure**: Embedded operating systems (e.g., Yocto, Linux), container base images, hypervisors, and execution runtimes packaged alongside the product.

- **System & Runtime Infrastructure**: Embedded operating systems (e.g., Yocto, Linux), container base images, hypervisors, and execution runtimes when they are included in the product.

CsatariGergely · 2026-08-24T09:01:50Z

+Target Component Hierarchy:
+  - **Direct & Transitive Dependencies**: Primary open source libraries and frameworks imported directly by developers, as well as all indirect (nested/transitive) sub-dependencies down the dependency graph.
+  - **System & Runtime Infrastructure**: Embedded operating systems (e.g., Yocto, Linux), container base images, hypervisors, and execution runtimes packaged alongside the product.
+  - **Firmware & Hardware Abstraction Layers**: Open source bootloaders, drivers, and microcode integrated into hardware platforms.


Suggested change

- **Firmware & Hardware Abstraction Layers**: Open source bootloaders, drivers, and microcode integrated into hardware platforms.

- **Firmware & Hardware Abstraction Layers**: Open source bootloaders, drivers, and microcode integrated into hardware platforms when they are included in the product.

timop62 · 2026-08-26T10:17:10Z


-## Which products
+2.1.1 3rd Party Component Integration
+2.1.2 Special Considerations for FOSS Components


For this and the for the previous line I would suggest to either delete them and create an issue for both, or make them both subsections by prefixing with ###

@CsatariGergely to add to the foreword, that this is a work in progress document add a link to the issues. Create the issues for the empty chapters.

@August-Bournique to remove the empty chapters.

Issues for relevant empty chapters created:

Add 3rd Party Component Integration to content/02.md #22

Add Special Considerations for FOSS Components subchapter to content/02.md #23

Add Defining Products With Digital Elements to content/02.md #24

Add Placement on the Market subchapter to content/02.md #25

Add details to Which components of the product subchapter of content/02.md #26

timop62 · 2026-08-26T10:23:46Z

-## Which components of the product
+## 2.2 Which products
+The CRA distinguishes between purely non-commercial upstream open source development and commercial product distribution. Due diligence obligations apply strictly to commercial entities placing Products with Digital Elements (PDEs) on the EU market.
+Primary Target Categories


Is "Primary Target Categories" a defined term? Writing the words with capital letters makes me assume it is, but I'm not familiar with such term. It would be helpful to shortly explain what is meant by it and if the list that follows is complete or if it is a list of examples.

@August-Bournique please comment.

timop62 · 2026-08-26T10:30:13Z

+Regulatory Boundary: Recital 27 of Regulation (EU) 2024/2847 clarifies that non-commercial open source developers and foundations are exempt from direct manufacturing obligations. However, the moment a commercial manufacturer integrates a non-commercial open source component into its product, that component falls fully within the manufacturer's regulatory compliance scope.
+
+2.2.1 Defining Products With Digital Elements
+2.2.2 Placement on the Market


For this and the for the previous line I would suggest to either delete them and create an issue for both, or make them both subsections by prefixing with ###

timop62 · 2026-08-26T10:30:40Z

+
+## 2.3 Which components of the product
+Due diligence cannot be limited to top-level dependencies. Regulatory compliance requires complete transparency across the entire software supply chain, encompassing all open source code compiled, linked, or executed within the final product.<br>
+Target Component Hierarchy:


In a same spirit as the comment above on "Primary Target Category", is "Target Component Hierarchy" a defined term? Writing the words with capital letters makes me assume it is, but I'm not familiar with such term. It would be helpful to shortly explain what is meant by it and if the list that follows is complete or if it is a list of examples.

timop62 · 2026-08-26T10:32:30Z

+2.3.1 Hardware Components
+2.3.2 Software Components
+2.3.3 Remote Data Processing Service Components
+2.3.4 Non Component Remote Services


For this and the for the previous line three lines I would suggest to either delete them and create an issue for each of them, or make each of them a subsection by prefixing with ###

timop62 · 2026-08-26T10:36:28Z

+├── Runtime / Execution      └─ Containers, Virtual Machines, Language Runtimes
+└── System Layer             └─ Embedded OS (e.g., Yocto, Linux), Firmware, Microcode
+```
+


I assume the list above and the picture following the list are related, however it was not immediately clear how. Some text to describe the connection would help the reader to connect the dots.

CsatariGergely · 2026-09-10T13:30:17Z

@@ -1,7 +1,58 @@
-# To what do we apply due diligence
+# 2.1 To what do we apply due diligence


Let's remove the chapter numbers.

We can add them in a final editorial step.

CsatariGergely · 2026-09-10T13:36:35Z


-## Which products
+2.1.1 3rd Party Component Integration
+2.1.2 Special Considerations for FOSS Components


@CsatariGergely to add to the foreword, that this is a work in progress document add a link to the issues. Create the issues for the empty chapters.

@August-Bournique to remove the empty chapters.

CsatariGergely · 2026-09-10T13:38:16Z

-## Which components of the product
+## 2.2 Which products
+The CRA distinguishes between purely non-commercial upstream open source development and commercial product distribution. Due diligence obligations apply strictly to commercial entities placing Products with Digital Elements (PDEs) on the EU market.
+Primary Target Categories


@August-Bournique please comment.

August-Bournique and others added 2 commits July 17, 2026 13:49

Update 02.md

c4f2e72

Outline of Section 2 and inclusion of intro for ongoing 13(6) requirement (upstreaming) work. Signed-off-by: August-Bournique <august@bourniquelaw.com>

adding intro text to different sections

460d2f2

Signed-off-by: Juan <137221298+jrico-eclipse@users.noreply.github.com>

CsatariGergely reviewed Jul 28, 2026

View reviewed changes

Comment thread content/02.md

CsatariGergely requested changes Jul 28, 2026

View reviewed changes

CsatariGergely requested changes Aug 24, 2026

View reviewed changes

timop62 requested changes Aug 26, 2026

View reviewed changes

CsatariGergely requested a review from a team September 1, 2026 12:33

CsatariGergely requested changes Sep 10, 2026

View reviewed changes

		@@ -1,7 +1,58 @@
		# To what do we apply due diligence
		# 2.1 To what do we apply due diligence

	Due diligence cannot be limited to top-level dependencies. Regulatory compliance requires complete transparency across the entire software supply chain, encompassing all open source code compiled, linked, or executed within the final product.<br>
	Due diligence cannot be limited to top-level dependencies. Regulatory compliance requires complete transparency across the entire software supply chain, encompassing all open source code compiled, linked, or executed within the final product.

	- System & Runtime Infrastructure: Embedded operating systems (e.g., Yocto, Linux), container base images, hypervisors, and execution runtimes packaged alongside the product.
	- System & Runtime Infrastructure: Embedded operating systems (e.g., Linux), container base images, hypervisors, and execution runtimes packaged alongside the product.

	- Bundled Build & Runtime Utilities: External scripts, third-party binary blobs, or open source utility engines embedded to deliver core product functionality
	- Bundled Runtime Utilities: External scripts, third-party binary blobs, or open source utility engines embedded to deliver core product functionality

	└── System Layer └─ Embedded OS (e.g., Yocto, Linux), Firmware, Microcode
	└── System Layer └─ Embedded OS (e.g., Linux), Firmware, Microcode

	- Firmware & Hardware Abstraction Layers: Open source bootloaders, drivers, and microcode integrated into hardware platforms.
	- Firmware & Hardware Abstraction Layers: Open source bootloaders, drivers, and microcode integrated into hardware platforms when they are included in the product.

Uh oh!

Conversation

August-Bournique commented Jul 17, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants