Insights

Securing the AI software supply chain: from asset inventories to agent permissions

Securing the AI software supply chain involves first putting code dependencies, models, data, frameworks, tools, and intelligent agent interfaces into a single asset view. Subsequently, these assets are connected to access control, permission management, testing, change management, and incident response processes. While having a list without operational controls still does not answer what agents can call, where data will go, or whether changes require revalidation.

When do CRA vulnerability reporting obligations apply?

CRA vulnerability reporting obligations apply as of September 11, 2026 for reporting obligations and December 11, 2027 for the subject obligation. Enterprises should first determine if their products fall under the regulatory scope and then establish a reporting mechanism; they cannot simply apply the same compliance checklist to all software within a product. For automotive and medical devices, among other products, specific regulations and exclusion criteria must also be verified. [European Commission Official Introduction](https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act).

Why AI code review needs the real build configuration

Real build configurations help AI code review determine which actual code is included in this build, providing context for type checking, function calls, and data flow. For projects that heavily use macros, cross-compilation, and vendor extensions, these details are crucial to validate alerts.

CRA vulnerability management: from component inventories to traceable remediation evidence

For CRA readiness, development teams need an evidence chain that stays current with each product release: what was used, what was found, who assessed it, how it was remediated and whether the fix worked. Applicability and the conformity-assessment route still depend on the product. This article focuses on organising the engineering evidence; reporting dates and triggers are covered in [CRA vulnerability reporting obligations](/en/resources/articles/cra-vulnerability-reporting-readiness).

Can public-domain code be used commercially? Four checks using the SAX notice

A GPLv2 component in an Apache 2.0 project: check the version before assessing distribution

When adopting an Apache 2.0-licensed project, it was discovered that there were GPLv2 components within the project. The first step should be to revert to the specific license and project relationships by changing the top-level LICENSE file from Apache 2.0 to something else. Simply renaming the top-level LICENSE file to use Apache 2.0 does not alter the existing licensing conditions of third-party code.

Using MySQL in commercial software: when should you review open-source obligations?

Commercial software does not have to disclose all proprietary code simply because it is 'commercial'. Reviews should be conducted separately for database servers, client libraries or connectors, and how they integrate into the final deliverable. Internal deployment versus external bundling distribution are also different usage behaviors.

An LGPL component is flagged in an audit: how to review linking, source and dependency obligations

An LGPL component is flagged in an audit: how to review linking, source and dependency obligations For audits flagging LGPL components, it's crucial to first examine the specific version, usage method, and delivery materials. Taking LGPL 2.1 as an example, dynamic linking does not automatically relieve licensing obligations, nor can static linking be directly inferred to require public disclosure of all proprietary source code.

GPLv3 compliance through the Luohe v Wanyou case: version, combination and evidence

Open source software can be commercially used, but it requires compliance with applicable licenses. The value of the Luohe v Wanyou case lies in showing how courts review a project's version, licensing text, and actual dissemination behavior together, rather than providing a simple conclusion that applies to all GPL projects.