[
Date Prev][
Date Next][
Thread Prev][
Thread Next][
Date Index][
Thread Index]
[
List Home]
Re: [open-regulatory-compliance] More edge cases
|
On 8 Jul 2024, at 09:59, Federico Leva <federico.leva@xxxxxxxxxxxxxxxxxx> wrote:
> Dirk-Willem van Gulik via open-regulatory-compliance kirjoitti 4.7.2024 klo 14.30:
>> 7) If BigCo produces "BigCo Web Server for Java that is based on Apache
>> Tomcat" then clearly they will be subject to the CRA for that product.
> Are all your questions assuming the customer is never on the hook?
For the CRA - no. As it is essentially, on the party that _places_ the product in the market. The ‘customer’ is, by definition, the party after that.
So as such it is never on the hook.
However - it may buy bits; combine them and place the result on the market for its customers. Then the CRA starts to apply from that point onward again.
> Is that because BigCo only sells their product to consumers for personal purposes or what? Say the customer is an ISP or domain hoster which sells web hosting on the side, aren't they supposed to be responsible for their webserver software? And if they ask BigCo to configure it for them, does it really matter whether BigCo delivers the binaries or just uses a public distribution?
Yes - but that ISP places a product in the (European) market as well.
> At $dayjob-1 we had a vendor which sold us a giant monolith web service shipped for RHEL only, with tomcat and a bunch of dependencies vendored in. They required specific OS versions, configured all the dependencies, delivered everything in giant tarballs. Surely they're responsible for the tomcat upgrades as part of the overall product. I sure hope that doesn't change if they decide to stop vendoring the dependencies and, say, install a pinned version from the RHEL repos.
So if, in your example, BigCo has placed a product on the European market, e.g a webserver (even if it BigCo HTTP sever powered by Apache) and that ISP has bought that product and supplies something to its customer (e.g. a web-farm with low cost webpages for small companies) and puts that on the European market. Then IMHO both are under the CRA.
If BigCo is BigConsulting - and they rent people out by the hour that ISP hires & where the ISP directs them to download & tweak the apache httpsd server and set it up — then BigConsulting is IMHO not under the CRA. ISP still is.
Now an ISP is a bad example as the arguably has some sort of exertise/knowldge.
So let’s say your ISP is not an ISP but a Marketing/digital-brand agency that sells websites to small companies ‘all in’ (ie. Nice looking web page and 5 years of ‘free’ hosting).
The case law will probably begin if BigCo sort of has a BigConsulting contract with the Marketing company where BigCo staff follow some BigCo developed process/script that fetches apache-https, installs it and configures it. So essentially it is a `product’ in all but the name. I would expect the courts to push back on this - and place it under the CRA — or see a CRA-II after the evaluation period that ‘fixes’ this. For the simple reason that the Marketing company gets it as a `product’.
Dw