OpenSSF's CRA guide arrives with EU manufacturers already on a 24-hour reporting clock

The manufacturer duty covers actively exploited vulnerabilities and severe incidents affecting the security of products with digital elements, according to the European Commission ^[3]. A plan keyed to the stewards' 2027 start is keyed to someone else's deadline ^[2]. Until then, when an exploited flaw sits in an open-source component, the company that shipped the product is the party with a CRA report to file ^[1][2].

The clock starts at awareness ^[4]. The early warning and the full notification are 48 hours apart ^[16]. In my view the 24-hour step is an inventory problem first. Inside a day, someone has to establish whether the exploited code is in what shipped, and in which version.

OpenSSF's role-based journey is an index of other material ^[7]. It shipped alongside a practitioner's guide at the foundation's Community Day Europe in Prague ^[6]. I'd use the journey as the reading list for a reporting runbook. The runbook itself, with an owner for each step and an hour budget against the 24-hour warning, is still the manufacturer's to write.

The Ericsson case holds the package's one quantified result. The order of events in it is the useful part: the private forks went first, and the upstream contributions followed ^[8]. The announcement does not provide an independent measure of the resources' adoption or of any effect on incident rates ^[9]. A team tracking upstream takes a fix by moving a version. A team on a private fork has to backport the fix, test it and ship it inside the same day. For the 1,400 figure to transfer, another codebase would need comparable forks to retire and upstream maintainers willing to accept the changes ^[8].

The membership additions came 25 days after the manufacturer clock started ^[17]. Of the four, Emphere is built around the problem the clock exposes. Its founders started it in 2025 to address the handoff between identifying vulnerabilities and getting fixes shipped ^[10]. CEO Ankit Kumar was the one filing vulnerability tickets during his six years on cloud infrastructure security at Uber. CTO Pallav Gupta built systems at CarGurus and Twitter, where engineers had to fix them ^[10]. "Emphere is glad to join OpenSSF to help the community outpatch attackers, human and AI alike," Kumar said ^[11]. Emphere raised $2.1 million in pre-seed funding in June from AI2 Incubator and Outsiders Fund, GeekWire reported ^[12].

OpenSSF is a Linux Foundation initiative ^[14]. Its general manager, Steve Fernandez, framed the work as coordination across the industry instead of isolated vulnerability fixes, according to the announcement ^[13]. In the material published so far, Ericsson's upstream count is the one place that coordination shows up as a number ^[8].