How I Learned To Stop Worrying And Love The NLF

The speaker, an EU policy advisor at the OpenSSF in Brussels, opens by describing a problem common to security professionals entering EU policy work. Unlike audits, where an application can be checked against a known model, the Cyber Resilience Act lacked a mental model for how to approach it, even though the speaker had prior experience with data protection and civil rights policy.

The middle of the talk walks through a slide of European rules. The Cyber Resilience Act, the Product Liability Directive and the AI Act are grouped as product rules under the New Legislative Framework, which brings market surveillance rules along with them. The speaker then surveys how open source is referenced across related laws, including NIS2, the Cybersecurity Act and the Interoperable Europe Act. A key lesson is that the Cyber Resilience Act leaves many questions of who engages with whom to market surveillance authorities, so how the law is designated and how it is actually implemented over the next few years may differ.

The closing takeaway is cautiously optimistic. The speaker argues the regulation has a good chance of making software considerably more secure, and reports that the stakeholders they have spoken with broadly support the goal. The talk ends with an invitation for attendees to bring questions about the process to the speaker, who mentioned planned follow-up discussions in the coming weeks and months.