On 4 Jul 2024, at 13:30, Dirk-Willem van Gulik via open-regulatory-compliance <open-regulatory-compliance@xxxxxxxxxxx> wrote:
2) BigCo sells support for Tomcat. Their customers obtain Tomcat direct from the ASF and then BigCo helps then install, configure.
Q1. Is BigCo subject to the CRA?
What is the product? Services and support are not within the scope of the CRA. It’s a product regulation.
3) After installing it - BigCo operates Tomcat for Customer.
They provide a service when I understand correctly, I don’t see the product aspect, but they maybe subject to NIS2.
4) If BigCo opens bug reports against Tomcat on behalf of their customers does that change the answers to Q1 & Q2?
If they fall under NIS2, yes. Then they likely have duties in the process. If their customers are manufacturers using these containers for their products, same thing: They remain in NIS2 scope, a possible manufacturer using that service for their remote data processing as part of their product maybe in scope of the CRA.
5) If BigCo provides patches with some of those bug reports does that change the answers to Q1 & Q2?
Why should that matter?
6) If BigCo employs one or more committers of the Tomcat project and allows them to work on Tomcat tasks as part of their employment does that change the answers to Q1 & Q2?
No.
7) If BigCo employs a lot of the of committers of the Tomcat project and allows them to work on Tomcat tasks as part of their employment does that change the answers to Q1 & Q2?
No.
