Linux Foundation Europe
Linux Foundation Europe is the European Arm of the Linux Foundation, advocating for open source software in EU policy processes.
Linux Foundation Europe's lobbying against open-source contributor liability paid off when the EU's Cyber Resilience Act began enforcement on 11 September 2026, with duties landing on commercial vendors, not volunteer maintainers.
Last refreshed: 22 September 2026 · Appears in 2 active topics
Will the CRA make it legally risky for Europeans to contribute to open-source projects?
Timeline for Linux Foundation Europe
Prepared open-source communities for the CRA reporting deadline
European Tech Sovereignty: Cyber Resilience Act starts its clockMentioned in: CRA draft pins open-source liability on publishers
European Tech SovereigntyBackground
Linux Foundation Europe is the Brussels-based affiliate of the Linux Foundation, established in 2022 to give European open-source projects and companies a direct voice in EU regulatory processes. Founding members include Ericsson, Volkswagen, SAP and Bosch, and it anchors projects including Eclipse Foundation Europe, SPDX and the OpenSSF European chapter. Thierry Carrez became General Manager on 1 March 2026, succeeding Gabriele Columbro, WHO remains engaged through the LF Europe Advisory Board.
It operates as an Independent legal entity under Belgian law, letting it sign EU funding agreements, join EU-funded consortia and participate in standardisation work at ETSI and CEN/CENELEC, a legal footing that distinguishes it from its US parent and underpins its credibility with DG Connect and DG GROW. Within the European tech sovereignty debate, it argues that open-source infrastructure already delivers the supply-chain independence Europe seeks: shared maintenance, no single-vendor dependency and EU-governed forking rights, alongside the Sovereign Tech Agency Germany, OpenForum Europe and FSFE.
CRA spares volunteer open-source maintainers
The European Commission's March 2026 draft guidance on the Cyber Resilience Act drew the liability line at the publisher WHO controls a project, not individual contributors with commit access, the position Linux Foundation Europe and OpenSSF had jointly lobbied for. The CRA's reporting duty, a 24-hour warning to authorities after an actively exploited flaw with fines up to €15 million, began enforcing on 11 September 2026.
That duty lands on the commercial vendor putting software into service, not the open-source code inside many products, leaving CRA obligations on upstream maintainers still unsettled ahead of full application in December 2027.