Eclipse Announcements

+49 (89) 211 871 -43/ -52

514 Media Ltd (France, Italy, Spain)

Benoit Simoneau

M: +44 (0) 7891 920 370

Nichols Communications (Global Press Contact)

Jay Nichols

+1 408-772-1551

Eclipse Foundation Launches the Sovereign AI Foundation

Elspeth Tory — Wed, 30 Sep 2026 10:00:00 +0000

Eclipse Foundation Launches the Sovereign AI Foundation Elspeth Tory Wed, 2026-09-30 06:00

New vendor-neutral initiative brings together an initial community of 17 organisations to connect industry needs with open source AI projects and turn shared expertise into practical guidance for greater choice and control

BRUSSELS – 30 September 2026 – The Eclipse Foundation, one of the world’s largest open source software foundations, today announced the formation of the Sovereign AI Foundation, a vendor-neutral initiative that will help member organisations understand their AI dependencies, evaluate open source alternatives, and make more informed decisions about the technologies on which they rely.

As AI moves from experimentation into critical operations and decision-making, control over the underlying technology is becoming a strategic business concern. Many organisations rely on models, platforms, and services they cannot fully inspect, adapt, or govern. That dependence can limit their ability to control where data is processed, choose which technologies to use, or change direction as costs, requirements, and provider terms evolve.

“AI sovereignty is about preserving meaningful choice and control over the systems on which organisations depend,” said Mike Milinkovich, executive director of the Eclipse Foundation. “The Eclipse Foundation already hosts open source technologies that give organisations practical alternatives across the AI stack. The Sovereign AI Foundation will connect those projects with real industry requirements while giving members a neutral forum to compare experience, identify shared priorities, and accelerate adoption.”

AI sovereignty does not mean isolation, complete self-sufficiency, or rejecting proprietary technology. It means retaining the ability to understand, choose, adapt, and govern critical AI systems while preserving viable alternatives and the freedom to change direction.

Open source is central to achieving that goal. It can provide greater visibility into technology dependencies, more flexibility to adapt systems, and more choice in how AI is deployed. Combined with portability, operational expertise, and vendor-neutral governance, open technologies can help organisations reduce unnecessary dependency and retain greater control over their AI systems.

The Eclipse Foundation advances these goals in two complementary ways. Independently governed open source projects develop and maintain the technologies. The Sovereign AI Foundation brings member organisations together to identify shared requirements, evaluate relevant projects, contribute experience and expertise, and support adoption and community growth.

The initiative launches with 17 participating organisations spanning technology, industry, research, and the open source community: CEA LIST, EclipseSource, Engineering Ingegneria Informatica, Ericsson, Eurotech, Infosys, Kentyou, KU Leuven, Open Elements, Red Hat, Renesas Electronics, Robert Bosch, Thales, The IO Foundation, TypeFox, the University of York, and Vector Informatik. Additional organisations are in the process of joining, and all Eclipse Foundation member organisations are invited to participate.

Connecting industry needs with open source AI projects

The Sovereign AI Foundation will connect member priorities and real-world use cases with relevant projects across the Eclipse Foundation ecosystem. Members will be able to identify and evaluate technologies that address their needs, bring operational requirements and feedback to project communities, contribute expertise, and help drive adoption.

Relevant projects include Eclipse Theia and Theia AI for AI-enabled developer tools; Eclipse Enclave for running AI coding agents in isolated, policy-controlled environments; Eclipse PanEval for evaluating model capability, safety, and cybersecurity; and Eclipse LMOS for developing and managing multi-agent systems. The Open VSX Registry provides vendor-neutral extension infrastructure for open source and AI-enabled development tools, with downloads approaching one billion per month. The Eclipse Foundation is also exploring a broader AI Registry for emerging components such as Model Context Protocol (MCP) servers, agent skills, and plugins.

Each project retains independent governance and control over its technical roadmap. By connecting organisations deploying AI with the communities building these technologies, the Sovereign AI Foundation will support a modular ecosystem in which projects can address different requirements, evolve independently, and work together where appropriate.

From shared experience to practical guidance

The Sovereign AI Foundation focuses on six areas:

Mapping real-world needs and use cases: Building a shared view of how members are deploying, evaluating, and piloting open source AI.
Assessing technologies and dependencies: Examining developments across models, evaluation frameworks, infrastructure, and agentic systems, as well as the dependencies they can create.
Evaluating relevant open source projects: Assessing how projects align with member requirements and identifying opportunities for adoption, contribution, and collaboration.
Sharing experience and identifying common requirements: Comparing lessons from real-world deployments and identifying needs that members and project communities can address together.
Developing practical resources: Producing whitepapers, blueprints, landscape analyses, and reference materials that support better-informed AI decisions.
Translating research into action: Turning findings from Eclipse Foundation research initiatives, including EU-funded projects, into insights that members can apply.

The Sovereign AI Foundation will focus on knowledge sharing, technology assessment, project evaluation, ecosystem coordination, and practical guidance. It will not develop software or specifications. Technical development will continue within Eclipse Foundation-governed projects, creating a feedback loop between the organisations deploying AI and the communities building the technologies they need.

Supporting a broader open AI ecosystem

The Sovereign AI Foundation is the member forum within the Eclipse Foundation’s broader AI ecosystem. Beyond the projects named above, the Eclipse Foundation’s AI project portfolio spans deep learning, data and numerical computing, simulation, observability, cloud infrastructure, edge applications, and other areas. These projects benefit from established governance and shared legal, operational, security, and community support.

The Eclipse Foundation also supports practical skills development through its AI Coding Workshop series, which helps developers and engineering teams apply disciplined, cross-tool approaches to AI-assisted software development. Visit the workshop website for the latest schedule and registration information.

Together, these activities connect open technologies with the knowledge, experience, and practical skills organisations need to adopt and develop AI while preserving choice and control.

Eclipse Foundation member organisations are invited to join the Sovereign AI Foundation, share their requirements and experience, identify common priorities, and help build its first practical resources. Other organisations can explore Eclipse Foundation membership and participation at sovereign-ai-foundation.org.

Member perspectives

CEA-List

“Sovereign AI is essential to securing Europe’s technological independence and fostering collaborative innovation. Building on the success of our Aidge open-source ecosystem in enabling next-generation AI projects, CEA-List is committed to contributing to European initiatives that strengthen sovereign AI communities, such as SAIF.”

GOUY-PAILLER Cédric, Head of AI Program at CEA-List

EclipseSource

“AI is changing how engineering tools are built and how engineers work with them. From our practical work building custom AI-native IDEs and engineering tools with our industry customers, as well as our contributions to open-source platforms such as Eclipse Theia, Theia AI, and Eclipse Enclave, we see a strong need for solutions that combine powerful AI capabilities with control, flexibility, and vendor neutrality. The Sovereign AI Foundation provides an important forum to bring real-world engineering requirements into the open-source ecosystem, align across organizations, and jointly shape technologies that can provide a reliable foundation for future AI-native engineering workflows.”

Jonas Helming, CEO of EclipseSource.

Eurotech

“At Eurotech, we enable AI to the edge, where it connects directly with physical systems and where security, reliability, and the ability to adapt over long lifecycles are essential. The Sovereign AI Foundation gives us a valuable forum to work with industry peers on practical strategies and measures that safeguard transparency and control over mission-critical technology relationships.”

Robert Andres, Chief Marketing Officer at Eurotech.

InfoSys

“As AI diffusion scales across the organisation, strategic Enterprise AI Autonomy will be key to ensure that the organisations are able to control and have autonomy in model usage, data & learning, and operational execution. We are excited to work with the Sovereign AI foundation in promoting open sourcing and autonomy across the AI ecosystem.”

Rafee Tarafdar, Executive Vice President, CTO, Infosys

Research Centre for Information Systems Engineering (LIRIS)

“The dependency of economic, academic, and societal organisations on external services like AI keeps growing and is increasingly being considered a strategic problem related to sovereignty. This awareness goes beyond functional requirements and includes concerns such as trustworthiness and reliability, as well as the need for assurances on key issues like data confidentiality, availability, portability, compatibility, retaining control over economic cost, and avoiding vendor lock-in. In a simple equation, Trust equals Transparency times Control. In the work of the Sovereign AI Foundation, which aligns with the principles of open source development, both factors are actively being improved, ultimately leading to higher trustworthiness of key technology.”

Dr. Dimitri Van Landuyt, Research Centre for Information Systems Engineering (LIRIS), Faculty of Business and Economics (FEB), KU Leuven, Belgium

TypeFox

“Already, we’ve been impressed by the community that’s been put together, and the quality of the ideas and projects put forth. We’re more than excited to be involved as members of the Sovereign AI Foundation, and are looking forward to being a key part of this trailblazing effort.”

Benjamin Wilson, Language Engineer, TypeFox

About the Sovereign AI Foundation

The Sovereign AI Foundation is an Eclipse Foundation initiative that provides a vendor-neutral forum for member organisations to navigate the open source AI landscape. Participants share knowledge and use cases, assess technologies and trends, and develop practical resources that support more informed AI decisions and greater transparency, interoperability, choice, and control. Learn more at sovereign-ai-foundation.org.

About the Eclipse Foundation

Media contacts:

Schwartz Public Relations

Julia Rauch/Luca Myska

Sendlinger Straße 42A

80331 München

+49 (89) 211 871 -43/ -52

514 Media Ltd (France, Italy, Spain)

Benoit Simoneau

M: +44 (0) 7891 920 370

Nichols Communications (Global Press Contact)

Jay Nichols

+1 408-772-1551

Tags

Eclipse Foundation Releases Free Toolkit to Help SMEs Prepare for the EU Cyber Resilience Act

Natalia Loungou — Thu, 10 Sep 2026 11:00:00 +0000

Eclipse Foundation Releases Free Toolkit to Help SMEs Prepare for the EU Cyber Resilience Act Natalia Loungou Thu, 2026-09-10 07:00

BRUSSELS – 10 September 2026 – The Eclipse Foundation, one of the world’s largest open source software foundations, today announced the availability of a free, open source toolkit developed through the EU-funded OCCTET project to help small and medium-sized enterprises (SMEs) and open source projects prepare for the European Union’s Cyber Resilience Act (CRA).

The toolkit translates complex regulatory requirements into practical steps that organisations can incorporate into their software development and security processes. It helps them assess their readiness, identify which open source components are used in their products, manage vulnerabilities, and document how security risks are being addressed.

The release comes as the CRA’s first obligations take effect. Beginning 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents affecting the security of products with digital elements made available in the European Union. The CRA’s broader requirements will apply from 11 December 2027.

Early use of the OCCTET self-assessment platform has identified a common challenge: many SMEs have security measures in place but lack the visibility, documentation, and consistent processes needed to demonstrate how software risks are being managed.

“For organisations with limited compliance resources, preparing for the CRA is a major undertaking,” said Mike Milinkovich, executive director of the Eclipse Foundation. “OCCTET makes that work more manageable by bringing together tools that help them understand their obligations, identify and address vulnerabilities, and maintain the records needed to support compliance.”

A practical path from assessment to action

The OCCTET toolkit combines multiple services that support organisations from initial assessment through vulnerability management and documentation.

SMEs and open source projects can now access and test the following services:

Assess readiness: The CRA Self-Assessment Portal helps SMEs understand how the CRA applies to them, evaluate their current readiness, and identify areas requiring attention. The free, guided assessment translates CRA provisions into structured questions, scoring, and practical recommendations.
Identify software components: Eclipse Apoapsis (OCCTET instance) identifies open source components, dependencies, and licenses, based on the OSS Review Toolkit and known vulnerabilities. It can also generate a range of CRA-ready reports and compliance artefacts, including Software Bills of Materials (SBOMs), which provide a standardised inventory of the software components contained in a product.
Review findings and take action: Bitsea Curator (OCCTET instance) combines automated analysis with human review to help users verify software information, assess whether vulnerabilities affect their products, prioritise issues, and document their decisions. It also supports the creation of Vulnerability Exploitability eXchange (VEX) reports, which record whether a product is affected by a known vulnerability.
Reuse shared software information: The Federated OSS Assessment Database, vulnerablecode.io, provides information about open source packages, including their origins, licenses, security advisories, vulnerabilities, and reference SBOMs. Its public PurlDB demonstrator supports reference SBOM generation for more than 20 million packages, while its VulnerableCode integration connects vulnerability information with the software packages it affects.

The toolkit has been validated against complex, real-world software dependency scenarios across ten different technology ecosystems. Testing has included widely used open source projects, large-scale analysis of the Eclipse Foundation’s entire project portfolio, as well as a growing number of real-world SME use cases. This extensive validation demonstrates the toolkit’s ability to operate across diverse technologies, project sizes, and software supply chains.

This testing has demonstrated its ability to analyse complex dependency structures, identify vulnerabilities, support human review, and monitor security issues over time.

Get started with OCCTET

The Open Source Compliance: Comprehensive Techniques and Essential Tools (OCCTET) project brings together industry leaders, cybersecurity experts, SME representatives, and open source organisations to make software security and CRA preparation more accessible, transparent, and cost-effective.

SMEs and open source projects can explore the toolkit and available resources at occtet.eu. Organisations interested in testing the services using real products and development workflows, and providing feedback to support their continued improvement, can visit the OCCTET Get Engaged page.

OCCTET complements the Eclipse Foundation’s broader work to help organisations and open source communities prepare for the CRA. Through the Open Regulatory Compliance (ORC) Working Group, participants are developing community-driven specifications, guidance, training, and other resources to support CRA implementation across the open source ecosystem.

These resources include the free ORC Learning Hub, which provides practical, role-specific training to help open source developers, maintainers, project stewards, product teams, and security and compliance professionals understand how the CRA applies to their work and put its requirements into practice.

The community also comes together through Code & Compliance, the flagship ORC event for open source developers, project stewards, legal and compliance professionals, policymakers, and industry leaders. The next event takes place on 27 October 2026 in Brussels, providing a forum to exchange experiences, share practical guidance, and explore how the CRA and other emerging digital regulations are affecting the open source ecosystem. Register now to join the discussion.

About the OCCTET Project

Open Source Compliance: Comprehensive Techniques and Essential Tools (OCCTET) is an EU-funded initiative focused on helping SMEs and open source projects navigate cybersecurity and compliance requirements under the Cyber Resilience Act. Coordinated by the Eclipse Foundation, the project is developing an integrated suite of free, open source tools for readiness assessment, software dependency analysis, vulnerability management, SBOM generation, and compliance documentation.

The OCCTET project has received funding from the Digital Europe Programme under grant agreement No. 101190474. The content does not necessarily reflect the views of the European Commission. The European Commission is not liable for any use that may be made of the information contained herein.

Learn more at occtet.eu.

About the Eclipse Foundation

Media contacts:

Schwartz Public Relations

Julia Rauch/Luca Myska

Sendlinger Straße 42A

80331 München

+49 (89) 211 871 -43/ -52

514 Media Ltd (France, Italy, Spain)

Benoit Simoneau

M: +44 (0) 7891 920 370

Nichols Communications (Global Press Contact)

Jay Nichols

https://eclipsesource.com/blogs/2026/09/10/eclipse-theia-1-75-release-news-and-…

+1 408-772-1551

Tags

cyber resilience act

Eclipse Theia 1.75 Released

Jonas Helming — Thu, 10 Sep 2026 07:05:36 +0000

Eclipse Theia 1.75 Released Jonas Helming Thu, 2026-09-10 03:05

Eclipse Theia 1.75 adds major new AI capabilities including Agent Plugins, agent Memory, and MCP Apps with interactive UI directly in chat. The release also brings a unified AI configuration experience, SCM improvements, faster startup, updated platform technologies, and dozens of additional enhancements - well worth a look at the full release notes.

Image

URL

Tags

Jakarta Faces, Java Web Framework, Stateless Edition: Marketplace AliFaces

Angelo Rubini — Wed, 09 Sep 2026 15:21:45 +0000

Jakarta Faces, Java Web Framework, Stateless Edition: Marketplace AliFaces Angelo Rubini Wed, 2026-09-09 11:21

Jakarta Faces gets a fresh perspective in this article by Angelo Rubini, who introduces AliFaces - a marketplace concept for stateless Jakarta Faces components.

The piece covers how moving to a stateless architecture can benefit Jakarta Faces applications, addressing common challenges in modern web development. Rubini presents practical insights on building scalable web applications while maintaining the familiar component-based approach that Jakarta Faces developers appreciate.

If you're working with Jakarta Faces or considering it for your next project, this article offers valuable food for thought on architectural patterns and component reusability.

https://foojay.io/today/jakarta-faces-java-web-framework-stateless-edit…

URL

https://foojay.io/today/jakarta-faces-java-web-framework-stateless-edition-mark…

Eclipse Foundation and OWASP Join Forces to Strengthen Open Source Security and CRA Readiness

Anonymous — Wed, 29 Jul 2026 15:30:47 +0000

Eclipse Foundation and OWASP Join Forces to Strengthen Open Source Security and CRA Readiness Anonymous (not verified) Wed, 2026-07-29 11:30

BRUSSELS and Wilmington, DE – 30 July 2026 – The Eclipse Foundation, one of the world’s largest open source software foundations, and the Open Worldwide Application Security Project (OWASP), a global nonprofit foundation dedicated to improving software security, today announced a Memorandum of Understanding (MoU) to strengthen open source security and support industry readiness for the European Union’s Cyber Resilience Act (CRA).

The agreement combines the Eclipse Foundation’s expertise in open source governance, industry collaboration, and regulatory readiness with OWASP’s globally recognised security projects, standards, education, and community. The organisations will develop resources to help open source maintainers, stewards, manufacturers, and software teams strengthen security practices and respond to evolving regulatory requirements.

Open source is critical digital infrastructure, but responsibility for securing it is distributed across a complex global ecosystem, said Mike Milinkovich, executive director of the Eclipse Foundation. With AI accelerating both software development and vulnerability discovery, and the first CRA obligations taking effect in a matter of weeks, the need for practical, coordinated action is increasingly urgent. By bringing together the expertise and communities of the Eclipse Foundation and OWASP, we can reduce fragmentation and help organisations put stronger security and regulatory readiness practices into action.

The CRA introduces mandatory cybersecurity requirements for products with digital elements made available in the EU, including products built with or dependent on open source software. Its vulnerability and incident reporting obligations for manufacturers take effect on 11 September 2026, requiring organisations to establish the processes and technical capabilities needed to identify, manage, and report serious security issues.

The regulation also formally recognises open source software stewards as important participants in the software supply chain. Although their responsibilities differ from those of commercial manufacturers, stewards will play an important role in supporting secure development, vulnerability management, transparency, and cooperation across the open source ecosystem.

Security guidance only makes a difference when developers, maintainers, and organisations can put it into practice, said Andrew van der Stock, executive director of the OWASP Foundation. By working with the Eclipse Foundation, we can extend the reach and impact of OWASP’s security expertise while giving open source communities clearer, more actionable ways to strengthen the software supply chain and prepare for the CRA.

Although the CRA is a European regulation, its implications extend globally. Any organisation that makes software-enabled products available in the EU must understand its responsibilities, including how it develops, integrates, documents, maintains, and secures the open source components on which those products depend. With more than 96% of commercial codebases containing open source software, according to the OpenLogic 2026 State of Open Source Report, CRA readiness is an urgent consideration across the global software industry.

Under the MoU, the Eclipse Foundation and OWASP intend to collaborate across five principal areas:

CRA readiness for the open source ecosystem
Alignment and interoperability among security practices and frameworks
Joint education and community engagement
Open source stewardship and maintainer support
Policy and regulatory education

Initial priorities are expected to include practical guidance for open source stewards, joint CRA readiness webinars, resources supporting software bill of materials (SBOM) adoption and software supply chain security, and community events, workshops, and maintainer roundtables.

The two organisations also participate jointly in the Eclipse Foundation’s Open Regulatory Compliance Working Group (ORC WG), which brings together open source foundations, global enterprises, and industry stakeholders to develop practical resources for navigating the growing impact of software regulation on open source.

The organisations do not intend to create competing security frameworks. Instead, they will work to align and amplify existing initiatives, improve adoption, and help organisations embed sustainable security and regulatory readiness practices across the software lifecycle.

For more information about the Eclipse Foundation’s work on open source regulatory compliance, visit orcwg.org. To learn more about OWASP’s community-led software security projects, standards, and educational resources, visit owasp.org.

About OWASP

The OWASP Foundation is a nonprofit organisation that works to improve software security. Through community-led open source software projects, over 260 local chapters worldwide, tens of thousands of members, and leading educational and training conferences, the OWASP Foundation is the source for developers and technologists to secure the web. For nearly two decades, corporations, foundations, developers, and volunteers have supported the OWASP Foundation and its work. To learn more or to become a member, visit owasp.org.

About the Eclipse Foundation

Media contacts:

Schwartz Public Relations

Julia Rauch/Luca Myska

Sendlinger Straße 42A

80331 München

+49 (89) 211 871 -43/ -52

514 Media Ltd (France, Italy, Spain)

Benoit Simoneau

M: +44 (0) 7891 920 370

Nichols Communications (Global Press Contact)

Jay Nichols

https://jakarta.ee/learn/?utm_source=ef-blog&utm_medium=organic-social&utm_camp…

+1 408-772-1551

The Jakarta EE learning hub has been refreshed

Natalia Loungou — Thu, 23 Jul 2026 10:11:58 +0000

The Jakarta EE learning hub has been refreshed Natalia Loungou Thu, 2026-07-23 06:11

The learning hub helps you get productive faster with guides, tutorials, and learning resources designed for modern enterprise Java.

URL

We all depend on open source. One country should not hold the keys to defending it

Natalia Loungou — Wed, 15 Jul 2026 09:06:11 +0000

We all depend on open source. One country should not hold the keys to defending it Natalia Loungou Wed, 2026-07-15 05:06

A coordinated effort to secure open source is overdue. But routing the world’s most sensitive security data through a single jurisdiction recreates the very weakness it sets out to fix. In an immediate response, a new initiative has been announced to coordinate the full vulnerability remediation lifecycle.

URL

https://blogs.eclipse.org/post/catharina-maracke/we-all-depend-open-source-one-…

Tags

open source

The Eclipse Foundation and the ORC Working Group launch ORC Learning Hub to help open source developers, maintainers, and software teams prepare for the Cyber Resilience Act

Natalia Loungou — Tue, 30 Jun 2026 10:03:00 +0000

The Eclipse Foundation and the ORC Working Group launch ORC Learning Hub to help open source developers, maintainers, and software teams prepare for the Cyber Resilience Act Natalia Loungou Tue, 2026-06-30 06:03

BRUSSELS – 30 JUNE 2026 – The Eclipse Foundation, one of the world’s largest open source software foundations, in collaboration with the Open Regulatory Compliance (ORC) Working Group, today announced the launch of the ORC Learning Hub, a free global education initiative designed to help the people responsible for building, maintaining, securing, and governing open source software prepare for the European Union’s Cyber Resilience Act (CRA). The program provides practical, role-specific training for open source developers, maintainers, contributors, project stewards, product teams, security and compliance professionals, OSPO leaders, and legal teams.

While the CRA is a European regulation, its impact is global. Any organisation that distributes or commercialises software-enabled products in the EU market, including those built on open source, must comply with its requirements. Open source is now nearly universal in modern software, with more than 96% of commercial codebases containing open source (OpenLogic 2026 State of Open Source Report). As a result, the need for clear, actionable guidance is urgent across the global software industry.

The CRA changes the rules for how software is developed and delivered globally,” said Mike Milinkovich, executive director of the Eclipse Foundation. “Because open source is part of almost every modern application and system, CRA readiness has to happen where software is actually built. The ORC Learning Hub helps developers, maintainers, project stewards, and software teams understand what the CRA requires and put that knowledge into practice.

Developed by the ORC Working Group and hosted by the Eclipse Foundation, the ORC Learning Hub brings together expertise from across the open source ecosystem, industry, and regulatory domains. It delivers open source–focused training to help organisations understand how the CRA applies in real-world scenarios and what actions they need to take.

With the first CRA obligations set to take effect in September 2026, organisations face a narrowing window to prepare. Until now, guidance has been fragmented and largely high-level, particularly when it comes to open source software. The ORC Learning Hub addresses this gap by delivering clear, actionable, and role-specific education aligned with modern, open source–driven software development practices.

The Cyber Resilience Act introduces mandatory cybersecurity requirements for products with digital elements sold in the EU, including those built with or dependent on open source software. It places new responsibilities on manufacturers and distributors of such products in the European market. The CRA also introduces a new actor, the open source software stewards, which must adopt secure development practices, ensure transparency, and manage vulnerabilities across the entire software supply chain.

At the core of the ORC Learning Hub is a modular training program designed to guide organisations through CRA readiness step by step. The full program includes:

Module 1: Introduction to the CRA for Open Source Software
Module 2: Introduction to the CRA for Manufacturers
Module 3: SBOMs and Vulnerability Management in Open Source
Module 4: CRA Due Diligence and Open Source Usage
Module 5: Vulnerability Management in Practice

The Learning Hub launches with Modules 1 and 2 available today, providing tailored entry points for:

Open source developers, maintainers, contributors, and project stewards
Product teams, security and compliance professionals, OSPO leaders, and legal teams

Additional modules covering SBOMs, due diligence, and vulnerability management will soon be released.

The ORC Learning Hub is designed to:

Help developers, maintainers, project stewards, and software teams understand what the CRA means for their work
Clarify how CRA obligations apply to open source software, communities, and downstream product development
Provide role-specific guidance for manufacturers, developers, maintainers, OSPOs, security teams, and legal/compliance professionals
Help organisations operationalise CRA readiness across modern, open source-based software supply chains
Support global collaboration on emerging regulatory best practices

The ORC Learning Hub is free and available globally. Organisations and open source stakeholders are encouraged to begin preparing now, ahead of the September 2026 deadline, and to stay engaged as new modules and guidance are released. The program is available at https://orcwg.org/training/

About the ORC Working Group

The Open Regulatory Compliance Working Group (ORC WG) brings together open source foundations, global enterprises, and industry stakeholders to address the growing impact of software regulations on open source. With more than 60 members, ORC develops best practices, specifications, and practical resources to help organisations navigate evolving regulatory requirements. Its initial focus is the European Cyber Resilience Act (CRA), while supporting the long-term security, sustainability, and adoption of open source innovation worldwide.

About the Eclipse Foundation

The Eclipse Foundation provides a global community of individuals and organisations with a vendor-neutral, business-friendly environment for open source collaboration and innovation. We host Adoptium, the Eclipse IDE, Jakarta EE, Open VSX, Software Defined Vehicle, and more than 400 high-impact open source projects. Headquartered in Brussels, Belgium, we are an international non-profit association supported by over 300 members. Our events, including Open Community Experience (OCX), bring together developers, industry leaders, and researchers from around the world. To learn more, follow us on X and LinkedIn, or visit eclipse.org.

Media contacts:

Schwartz Public Relations

Julia Rauch/Luca Myska

Sendlinger Straße 42A

80331 München

+49 (89) 211 871 -43/ -52

514 Media Ltd (France, Italy, Spain)

Benoit Simoneau

M: +44 (0) 7891 920 370

Nichols Communications (Global Press Contact)

Jay Nichols