If you sell a product or distribute a project that contains open-source software, you are required to comply with both the licenses and relevant regulations like the European Union’s cyber resilience act (CRA). Customers and regulation require that you provide a correct software bill of materials (SBOM), avoid copyleft-licensed code, create correct legal notices, generate proper technical documentation for the CE mark, and monitor all your deliveries for vulnerabilities, even if support contracts have long expired. Ignore these compliance requirements, and you risk being sued by copyright trolls, irate customers, or the authorities. This talk shows you how to handle these requirements, including the European Union’s cyber resilience act.

Short Bio:

Dirk Riehle is a professor of software engineering and for open-source software at FAU Erlangen-Nürnberg. Before becoming a professor, he led the open source research group at SAP in the Silicon Valley.

Licensed under the CC BY 4.0 International license © Copyright 2025 Dirk Riehle, some rights reserved