The agreement brings together Eclipse Foundation’s expertise in open software governance, industry collaboration, and regulatory readiness with OWASP’s globally recognized security projects, standards, education, and community. The organizations will develop resources to help maintainers, project managers, manufacturers, and open software teams enhance their security practices and respond to evolving regulatory requirements.
“Open software is a critical digital infrastructure, but the responsibility for ensuring its security is distributed across a complex global ecosystem,” said Mike Milinkovich, executive director of Eclipse Foundation. “AI is accelerating software development and vulnerability discovery, and with the first mandatory CRA requirements coming into effect in a few weeks, it is even more urgent to take practical and coordinated action. By combining the expertise and communities of Eclipse Foundation and OWASP, we can reduce fragmentation and help organizations strengthen their security and implement measures to prepare for the new regulations.”
The CRA introduces mandatory compliance requirements for the cybersecurity of products with digital elements offered in the EU, such as products built with or dependent on open source software. The obligation for manufacturers to report vulnerabilities and incidents comes into effect on September 11, 2026, and requires organizations to establish the necessary processes and technical capabilities to identify, manage, and report serious security issues.
The new law also formally recognizes the relevance of open source project managers as participants in the software supply chain. While their responsibilities differ from those assigned to manufacturers, project managers play a vital supporting role in secure development, vulnerability management, transparency, and cooperation across the open source ecosystem.
“Security guidelines only make a difference when developers, maintainers, and businesses can put them into practice,” said Andrew van der Stock, CEO of the OWASP Foundation. “Working with the Eclipse Foundation, we can expand the reach and impact of OWASP’s security expertise, while providing clearer and more actionable guidance to open-source communities on improving the software supply chain and preparing for the implementation of the CRA.”
Although the CRA is a European law, its implications extend worldwide. Any organization distributing products that incorporate software in the EU must understand its responsibilities, including how to develop, integrate, document, maintain, and secure the open-source software components upon which those products depend. Given that more than 96% of commercial codebases contain open-source software, according to the OpenLogic 2026 State of Open Source Report, preparing for the CRA is a pressing issue for the software industry globally.
According to the MoU, Eclipse Foundation and OWASP intend to collaborate on five main areas:
• CRA readiness of the open software ecosystem
• Coordination and interoperability across security practices and environments
• Joint training and community engagement
• Support for open software maintainers and project managers
• Policy and regulatory education.
Initial priorities are expected to include practical guidance for open software project managers, joint CRA readiness webinars, support resources for adopting the Software Bill of Materials (SBOM) and software supply chain security, as well as community events, seminars, and roundtables for maintainers.
Both organizations also jointly participate in Open Regulatory Compliance Working Group (ORC WG) , which brings together open software foundations, global companies, and industry stakeholders to develop practical resources that facilitate adaptation to the growing impact of open software regulation.
These organizations do not seek to create competing security environments, but will instead work to coordinate and amplify existing initiatives, improve adoption rates, and help organizations implement sustainable security and regulatory readiness practices throughout the software lifecycle.
