LF Member European Forum 2026

Every Linux Foundation member relies on community-maintained open source, but regulations like the EU CRA now mandate upstream contributions. This "enforced collaboration" has led some companies to shove pull requests and demand immediate response from the community, often lacking awareness of the diverse open source governance and contributing norms.

Co-presented by open source leaders from Red Hat and Ericsson, this session outlines how member organizations can responsibly contribute back to open source while preserving upstream health. It highlights two OpenSSF initiatives. First, a Concise Guide for Upstream Collaboration, developed by the Best Practices WG and aiming to help OSPOs guide employees through security upstream contributions. Second, the deliverables of the Global Cyber Policy WG, including CRA Maintainer Guidance, demonstrating how community developers can establish clear consumption expectations, shielding them from unreasonable compliance pressure.

Attendees will leave with a clear sense for how to shift their open-source strategies from a corporate risk function to a collaborative model that secures their products and helps the broader open-source ecosystem.