Olle E. Johanson is an experienced and appreciated speaker, teacher, Open Source developer, and consultant. He is currently developing courses for the ORC Learning Hub, covering topics relevant to the open source community as it prepares for the CRA.

Olle is project lead for OWASP Project Koala, developing the Transparency Exchange API (TEA), a member of the CycloneDX Industry Working Group and the OWASP SBOM Forum, co-founder of SBOMEurope.eu, and a leader of the DNS TAPIR Open Source project. While not trying to save the world with SBOMs, he helps clients on their journey towards CRA compliance as a consultant with his company, Edvina AB.

This presentation outlines a practical, technology-driven approach for bridging technical documentation and CRA compliance obligations. We demonstrate how structured metadata in RDF formats, REST APIs, and the iiRDS standard can be combined to publish standardized product archives directly from product websites. Additionally, we explore the role of decentralized infrastructure like IPFS in maintaining long-term data ownership, resilience, and accessibility across complex industrial supply chains and open-source ecosystems. This aims to convert technical product assets, such as maintenance guides, component manuals, and operational specifications into verifiable compliance evidence, employing the required common standards and allowing for seamless inter-departmental communication.

Speaker: Merzough Münker

Merzough Münker is a software engineer whose work centres on data ownership and long-term availability. His background is in web and cloud application development, and his interest is in what happens to data after it is published, who controls it, and whether it is still there, and still verifiable, years later.

In 2025 he co-founded EnduraDocs in Aachen, Germany. EnduraDocs aims to provide solutions for the digital-delivery provision in the first drafts of the EU Machinery Regulation. EnduraDocs is a member of the iiRDS Consortium, thus his work includes working on the intelligent information Request and Delivery Standard (iiRDS) , an open standard for machine-readable user information. For him, good technology is a question of empowerment: giving people and organisations real control over their own data, and keeping them independent of any single vendor.

Key Points

• Bridging Legal & Technical Workflows: Strategies for translating technical product documentation into verifiable CRA compliance evidence and creating a shared language between technical and regulatory teams.
• Standardized Metadata & iiRDS Integration: Leveraging RDF metadata formats and the iiRDS standard to unify component documentation across manufacturing components and open-source software.
• Automated API-Based Distribution: Enabling seamless integration into enterprise workflows and toolchains by exposing structured product documentation archives via REST APIs.
• Decentralized Data Ownership with IPFS: Utilizing decentralized storage infrastructure to guarantee data resilience, availability, and customer ownership over critical product manuals and compliance artifacts.
• MCP as a Unified Bridge for AI & Automation: Connecting iiRDS metadata, Request APIs, and decentralized IPFS storage to provide AI agents and automated workflows with seamless access to structured technical product assets.

Matija Šuklje is lawyer by trade and hacker at heart. He is a co-author of SPDX, OpenChain, the Fiduciary License Agreement (FLA) 2.0 and 2.1, REUSE.software and the HackerTrain.

He is currently serving Liferay in the role of their Legal Director and Associate General Counsel (FOSS Licensing & Community Legal Affairs). Apart from license compliance and governance in an IT company, he has FOSS legal and governance experience with both the NGO (FSFE, Commons Conservancy, …) and public sector.

This session will cover:

• web front-end source code is typically missing licensing / copyright info – both when written and when distributed – we need to fix the input to fix the output
• fixing the input: add SPDX/REUSE tags to source code
• fixing the output: generate and serve SBOM and attribution notices to visitors/users
• how to do all of the above in a standardized manner that has little to no impact on web performance
• “bonus side-effect”: improve legal predictability and reuse of code

Sébastien Heurtematte is a Security Software Engineer at the Eclipse Foundation and coordinator of the OCCTET project. His work focuses on open source infrastructure, software supply-chain security, automation, and CRA-related tooling.

Martin is co-founder and CEO of Double Open. After 25 years as an attorney-at-law, he now builds compliance automation at Double Open with an offering based on open source ORT Server. Double Open engineers develop and maintain the ORT ecosystem, and provides SaaS and on-premise solutions.

Paula Mesa Macías is a telecommunications engineer with over 10 years of experience across software development, infrastructure, cybersecurity and digital systems, working across public, private and civic-tech contexts. Paula is the founder of Pau&Company, an ethical technology consultancy focused on cybersecurity, privacy, environmental impact of IT and use of AI. Pau&Company offers technical audits, system analysis and implementation, helping organisations understand their infrastructure and make more secure, resilient and responsible technology decisions.

Speaker: Gregor Bransky

Gregor "Little Detritus" Bransky has been involved in public digital infrastructure policies for nearly a decade. He started in 2017 as a member of Freifunk Aachen, Aachens open wireless mesh community, and contributed to the discussion around WiFi4EU.

In March 2020, he became co-team lead of "wir-bleiben-liquid.de", one of the 20 winning teams of the #WirVsVirus Hackathon organized by the German government. The team also won the #EUvsVirus Hackathon.

Since March 2021, Gregor has been a founding member and acting board member for policy and press at Innovationverbund Öffentliche Gesundheit e.V., a civic-tech project dedicated to building public digital infrastructures that empower society.

In the years since Log4Shell, the Log4j project has worked to remain at the forefront of emerging security practices in the open source ecosystem. Despite being maintained by a relatively small team, the project has experimented with new approaches to improve transparency, vulnerability handling, and downstream assurance.

In this talk we will revisit the changes introduced in Log4j after Log4Shell and examine how they align with the emerging expectations of the CRA, including attestation and due-diligence requirements. The presentation will highlight practical lessons from running a widely used open source project and explore what it takes to make open source components more trustworthy for downstream adopters in a regulated world.

Speaker: Piotr P. Karwasz, Apache Software Foundation

Piotr is an independent Java developer focusing on open-source supply-chain security and sustainability. He is a member of the Apache Software Foundation Security Team and contributes to several industry initiatives, including ECMA TC54 and OpenSSF working groups.

He joined the Apache Logging Services project shortly after the Log4Shell incident and has since helped drive multiple security and transparency improvements aimed at rebuilding trust in the project and strengthening its security posture. Today, he is the most active maintainer of the Log4j project.

Speaker: Agustin Benito Bethencourt, Consultant, Software Transparency Foundation

Agustín discovered Free Software during his university years, but it was in 2003 when he redirected his entrepreneurial career toward open source software and open data. Since then, he has led teams and organizations in designing, developing, and maintaining open-source-based products and services. With experience spanning management, executive, and consulting roles, Agustín has worked across diverse sectors including automotive, IoT, edge, industrial, embedded, enterprise, and desktop. Today, he works as an independent consultant.

As a volunteer, Agustín is a proud KDE e.V. and KDE España, as well as a Software Heritage Ambassador. Over the past two decades, he has actively contributed to multiple open source software and open data initiatives.

In addition, Agustín has a solid background as a speaker, community steward, business developer, and trainer. Having lived in several countries, he now divides his time between Málaga and La Palma (Canary Islands, Spain). A strong advocate of remote work, he continues to travel frequently and collaborate globally.

Agustín is contracted by Software Transparency Foundation (part-time) as Ecosystem Lead

LinkedIn: https://www.linkedin.com/in/toscalix/

But the session is not only about challenges. It also showcases emerging strengths and opportunities, including community-driven governance models, lightweight compliance workflows adapted for low-resource environments, and successful examples of African projects contributing to secure and compliant open-source ecosystems.

Attendees will learn:

1. How compliance expectations (e.g., CRA, SBOM requirements, supply-chain attestations) impact open-source maintainers and contributors in the Global South.

2. Practical ways organizations can support global contributors to reduce compliance friction in distributed open-source development.

3. Governance strategies that help maintainers improve transparency, code quality, licensing clarity, and long-term sustainability.

4. Why strengthening compliance awareness in Africa enhances the trustworthiness and resilience of the entire global open-source supply chain.

This talk offers a perspective rarely highlighted in open-source governance discussions, bridging geographic, cultural, and infrastructural gaps. Participants will leave with actionable insights, potential collaboration pathways, and a deeper understanding of how to build more equitable and compliant global open-source ecosystems.

Speaker: Julius Boakye, Software Engineer, Talent CoOp I’m a proud Individual Member of the Django Software Foundation and a full-stack software engineer with a strong focus on Django and mobile development. Beyond code, I’m deeply involved in the global Python, Django, Google, and FlutterFlow communities, actively contributing to the organization of several major conferences around the world.

I’ve served as the Opportunity Grant Co-Chair for DjangoCon US in both 2024 and 2025, and I was the Design Lead for PyCon Africa 2024 in Ghana, where I crafted the visual identity and led the creative direction for the entire conference. I'm also part of the organizing teams for DjangoCon Africa 2025 in Arusha, Tanzania, DjangoCon Europe, PyCon Ghana, and PyCon Portugal.

I’m the Founder of Django Campus, an initiative dedicated to empowering students and young developers to kick-start their tech careers through mentorship, practical training, and community engagement. Through Django Campus, we’ve helped many aspiring technologists across Ghana and other parts of Africa build skills, find confidence, and grow into impactful contributors in the tech ecosystem.

In addition to my community work, I’ve spoken at several local, international, and online conferences, including DjangoCon Africa, PyCon Africa, PyCon Namibia, and CHAOSS Africa, where I share insights on open source, community building, and software development.

Beyond the Python ecosystem, I also serve in ambassadorial and leadership roles with FlutterFlow and Google Developer Communities, fostering inclusive, empowering, and sustainable tech spaces wherever I can. My passion lies in leadership and impact, I find true joy in seeing others succeed and knowing I played a part in their journey.

LinkedIn: https://linkedin.com/in/juliusboakye

We present current developments, figures on the frequency of plagiarism, and other prominent cases, shed light on the legal situation, and explain why companies urgently need to protect themselves. We provide clear answers to burning questions:

1. Why does AI code become a liability risk?
2. How can software manufacturers and purchasers still protect themselves?
3. What technical and legal measures can prevent a ticking time bomb in your own product? Anyone who uses AI code carelessly in the future will be left to deal with the damage. We show you how to save yourself—before it's too late.

Speakers: Dr. Andreas Kotulla and Florian Hackel

Dr. Andreas Kotulla is the founder and managing director of Bitsea GmbH, a company specializing in the technical analysis of software systems. Bitsea supports companies in the introduction and implementation of holistic open source strategies – from governance, processes, and tool chains to the provision of an Open Source Program Office (OSPO) and scanning as a managed service.

As a computer scientist with over 30 years of experience in IT, Dr. Kotulla is a proven expert in software engineering, software quality, and open-source management. He spent twelve years in management positions at international telecommunications providers and now shares his knowledge in workshops and lectures. Dr. Kotulla is an active member of the Linux Foundation's OpenChain project and the Open Source Working Group of Bitkom e.V. He is also the author of several specialist books and publications on IT and software topics.

LinkedIn: https://www.linkedin.com/in/dr-andreas-kotulla-621b25102/

Florian Hackel is an attorney at JUN Legal GmbH and specializes in IT, data protection, and commercial law, particularly software licensing law. He reviews and evaluates open source licensing of software products and supports companies in introducing and implementing compliance processes for free and open source software. He also advises clients on regulatory issues in the field of artificial intelligence, particularly the EU AI Act. He develops tailor-made solutions for complex legal issues and communicates them in a clear and understandable manner. He is also co-author of the “Praxishandbuch Open Source” (Practical Handbook on Open Source).

LinkedIn: https://www.linkedin.com/in/florian-hackel-a6a236371/

Knowledge attendees should have before joining the session

The session is designed for a mixed audience of legal, compliance and technical stakeholders. To get the most value, attendees should ideally have: A basic understanding of software development workflows, including the use of third-party code, libraries and tools in the SDLC. A general awareness of copyright and IP in software (e.g. that source code is protected as a copyrighted work, and that reuse without permission can be problematic). For legal/compliance professionals: familiarity with general liability concepts (e.g. negligence vs. intent, organisational duties, due diligence) is helpful. For technical participants: some experience with or curiosity about AI coding assistants (e.g. Copilot, CodeWhisperer, ChatGPT-based coding) and how they are used in day-to-day development.

What attendees will learn from the session

Attendees will leave the session with a clear picture of the liability landscape around AI-generated code and a practical checklist of measures to avoid turning their own software products into a legal “ticking time bomb"

In this talk, I’ll show how these problems aren’t just Belgian, but systemic. Across the EU, policymakers treat CVD as a means to impose requirements on reporters instead of a commitment by organisations to receive and fix vulnerabilities. They confuse disclosure with bug bounties, enforce pointless formalities, and discourage the very people trying to help. I’ll explain what went wrong, why it matters for NIS2 and the CRA, and how we can fix CVD before it collapses under its own red tape.

Speaker: Piet De Vaere, Product Cybersecurity Consultant

Piet is an electrical engineer, computer scientist, and consultant specializing in product cybersecurity compliance. His focus areas include the EU Cyber Resilience Act (CRA), the EU Radio Equipment Directive (RED DA), and the UK Product Security and Telecommunications Infrastructure (PSTI) Act. He regularly applies standards such as EN 303 645 and IEC 62443 to support compliance projects.

SignPath Foundation provides free and secure code signing for 250 OSS projects. To achieve this, we had to go beyond key security: how can we guarantee that releases are safe to use?

Key points:

• Introduction of SignPath foundation
• OSS project vetting and approval process
• Automatic provenance verification of releases
• Code signing challenges
• CA certificate provisioning
• Goals and limits of security and process vouching

Speaker: Stefan Wenig, Founder of SignPath GmbH, director of SignPath Foundation

This session will cover:

• CRA vertical standards development under ETSI
• Open participation in a traditional closed process
• Tooling for participating

Speaker: Jordan Maris

Jordan is the OSI's EU Policy Analyst. He spent the last three years as an assistant to a Member of the European Parliament, campaigning for Open Source Software in negotiations on laws such as the AI Act, Cyber Resilience Act and Product Liability Directive among others. Jordan is a long-time user of Open Source software and a strong advocate for the Public Money–Public Code principle.

This session will cover:

• What is sCC4CRA and why it matters
• EUCC vs sCC4CRA: key differences
• sCC4CRA alignment with standardisation work
• how to use sCC4CRA
• Future and next steps

Speaker: Roger Riera

Roger Riera is a member of the European Commission’s Cyber Resilience Act (CRA) Expert Group as a Type A member, contributing to the effective implementation of the CRA regulation. Technical Manager at Applus+ Laboratories, specialising in hardware security, with 10 years of experience in the field

Speaker: John Ellis

John Ellis is the President and Head of Product for Codethink, a world-class provider of critical, high-performance software projects for international-scale companies in a range of industries including Automotive, Finance, Medical, and IoT. Headquartered in Manchester, UK, Codethink has pioneered software industry thinking around concepts of trustable software, with a view to improving the quality of software engineering for societal good. Example customers include Arm, Bloomberg, BMW, Bosch, JLR, John Deere, Mercedes-Benz, Panasonic, Volkswagen, and Tesla.

As a former executive at Motorola, Global Technologist at Ford Motor Company, and a consulting and startup veteran, John led or participated in teams that built many of the innovations we see today in connected vehicles on the ground and in the air.

John is the best-selling author of The Zero Dollar Car, a former adjunct professor at University of Notre Dame, as well as a former translator in the 1992 Summer Olympics.

John can be found online @ www.johntellis.com.

Key Points:

• Exploring CRA in Practice: Learn how the Eclipse Trustable Software Framework (TSF) could help translate CRA’s broad legal requirements into practical engineering steps.

• Trust Made Measurable: Consider how a FICO-style “Trustable Score” might offer a way to make software assurance auditable and comparable across organizations.

• An Open Conversation: Join engineers, executives, regulators, and lawyers in the Eclipse community to discuss how TSF may evolve as part of CRA’s future.

The session will also provide an overview of Ecma International’s role as a global standards organisation. A Q&A segment will give you the chance to engage directly with experts on these critical CRA-related standards.

Speakers

• Olle E Johansson
• Steve Springett
• Philippe Ombredanne

Key-points

• The CRA as a category of legislation
• The importance of the CRA for businesses
• The role of components, including open source, under the CRA
• Due diligence obligations for manufacturers
• Conformity assessments and security attestations

Bio: Pedro Demolder is an IP/IT and data protection lawyer at Timelex. He assists both SMEs and multinationals with GDPR and Data Act compliance, performing audits and helping implement legal requirements into daily operations, systems, and processes. He regularly advises on complex matters at the intersection of technology law and other domains, such as online platforms, product manufacturing, and HR. Pedro is well-versed in drafting information notices for a wide range of target audiences and negotiating data processing, data exchange, and data sharing agreements. Pedro also advises clients on all aspects of cybersecurity, including the legal, technical, operational, and organisational dimensions of information security. He supports the setup of compliance frameworks, breach notification procedures, and contingency planning. In addition, he provides trainings on data protection and cybersecurity obligations, ensuring that legal requirements are understood and embedded in practice.

Bio: Arnaud Le Hors is Senior Technical Staff Member of Open Technologies at IBM, working on a range of technologies with a primary focus on Open Source supply chain security and AI. He has been working on standards and open source for over 30 years. Arnaud was editor of several key web specifications including HTML and DOM and was a pioneer of open source with the release of libXpm in 1990. Arnaud is the main representative for IBM at W3C and INCITS, Co-Chair of the LF AI & Data Generative AI Commons, a member of the OpenSSF Technical Advisory Committee.

Bio: Fukami lives in Brussels and works for the OpenSSF as EU Policy Advisor. He is member of ETSI, the CRA EG on behalf of OpenSSF and in JTC13/WG9.

Maxim Baele is an experienced cybersecurity consultant specializing in product and application security​, with a background in Linux system engineering, security architecture, and automation​. He spends his days coaching organizations in building secure products and implementing cybersecurity strategies​, while spending many of his evenings contributing to OWASP as a liaison, as a board member for OWASP BE and a core team member of the OWASP SAMM project.

This talk will cover a proposal for a globally coordinated platform for vulnerability reporting that ensures transparency, strengthens manufacturer accountability, and enables trusted third-party data enrichment. As cybersecurity regulations for connected products advance worldwide, the current model—primarily funded by a single state and dependent on unaffiliated third parties for critical data—faces limitations in scalability and neutrality. A new approach is needed: one that gives manufacturers control over submitted data, integrates independent data providers, and is governed and funded by a diverse coalition of global stakeholders. The session will explore how such a system can enhance trust, regulatory alignment, and security for both users and industry.

Olle E.Johanson is an experienced and appreciated speaker, teacher as well as an Open Source developer and consultant. He is currently project lead for OWASP Project Koala- developing the Transparency Exchange API (TEA), member of the CycloneDX industry working group, the OWASP SBOM Forum, co-founder of SBOMEurope.eu and a leader for the DNS TAPIR Open Source project. While not trying to save the world with SBOMs, he is helping clients with the journey towards CRA compliance as a consultant in his company Edvina AB.

• A call for action: The path towards a global platform for vulnerability reporting. This document is the base for the discussion

Sébastien Heurtematte, member of the Eclipse Foundation, is the coordinator of the OCCTET project, leading a consortium of 7 partners across Europe working to make Cyber Resilience Act (CRA) compliance simpler and more accessible for SMEs. With a strong technical background in open source, release engineering, and supply chain, he brings years of experience simplifying complex processes and addressing security challenges. Passionate about collaboration and accessibility, he focuses on making CRA compliance practical and approachable for both open source projects and SMEs.

• OCCTET Website
• European Cybersecurity Competence Centre and Network