EU AI Act and CRA: Timelines and Resources
The EU has made significant progress in implementing the Cyber Resilience Act (CRA) and the AI Act over the past month. These developments are critical for Open Source developers, maintainers, and organizations, as they shape the regulatory landscape for software and AI systems. The Open Source Init
Overview of EU AI Act and CRA Implementation
The European Union has taken two major steps in the implementation of the Cyber Resilience Act (CRA) and the AI Act. These developments are particularly significant for the Open Source community, as they define new regulatory expectations for software and AI systems. The Open Source Initiative (OSI) has been actively involved in shaping these frameworks to ensure they are compatible with the principles and practices of Open Source development.
Key Milestones in CRA Implementation
The CRA establishes cybersecurity requirements for products with digital elements, including vulnerability handling, security updates, and lifecycle responsibilities. The European Commission has released practical implementation guidance, which includes sections on Open Source software and Open Source stewards. This guidance provides clarity on how the CRA applies to Open Source projects and developers.
In addition, the European Telecommunications Standards Institute (ETSI) has made available 17 vertical final draft standards under public review. These standards are part of the CRA framework and are essential for ensuring compliance with the CRA’s requirements. The OSI has worked closely with ETSI to ensure that Open Source voices are included in the standardization process.
Progress on the AI Act
The AI Act introduces a risk-based regulatory framework for artificial intelligence, with obligations being introduced progressively. The Act includes provisions related to general-purpose AI models, transparency, documentation, and governance. The OSI has been involved in shaping the AI Transparency Code of Practices, which provides guidance on how AI developers can meet the Act’s transparency requirements.
The AI Act has entered into force, with key provisions coming into effect in stages. For example, the transparency rules under Article 50 became applicable in August 2026. Additional provisions, including prohibitions and transition requirements, will apply in subsequent years. The AI Act also includes provisions for AI regulatory sandboxes, which are expected to be operational by August 2027.
Timelines and Key Dates
Implementation of the AI Act and CRA follows a structured timeline. For the AI Act, key dates include the entry into force in August 2024, the application of general-purpose AI obligations in August 2025, and the full application of the Act in December 2027. For the CRA, key dates include the entry into force in December 2024, the publication of implementation guidance in July 2026, and the full application of the CRA in December 2027.
These timelines are essential for developers, maintainers, and organizations to understand their obligations and prepare for compliance. The OSI and other organizations have been collecting resources, facilitating discussions, and developing practical guidance to help the Open Source community navigate these regulatory changes.
As implementation progresses, the OSI will continue to work with European policymakers and the broader Open Source community to provide education, share expertise, and advocate for approaches that recognize the importance of Open Source AI for innovation, transparency, and collaboration.
Source: Open Source Initiative. Analysis based on publicly available information; no hands-on testing is claimed.
