# Important new law that may impact many on this forum

**URL:** <https://discourse.nodered.org/t/important-new-law-that-may-impact-many-on-this-forum/99530>\
**Category:** General\
**Tags:** security\
**Created:** [29 October 2025 12:38 UTC](https://discourse.nodered.org/t/important-new-law-that-may-impact-many-on-this-forum/99530 "2025-10-29T12:38:51Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [29 October 2025 12:38 UTC](https://discourse.nodered.org/t/important-new-law-that-may-impact-many-on-this-forum/99530/1 "2025-10-29T12:38:51Z")

</div>

Hi all, my newsfeed recently popped this up and I thought I should share it. Even though it is not directly Node-RED related, it may impact Node-RED, FlowFuse, the JavaScript Foundation and anyone using Node-RED or other open source in commercial products.

> **[Kroah-Hartman explains Cyber Resilience Act for open source](https://www.theregister.com/2025/09/30/cyber_reiliance_act_opinion_column/)**
>
> Opinion: Impact? Nope, don't worry, be happy, says Linux veteran

Not the best article explaining the law but useful because it relates to open source specifically.

The new EU act has passed into law and will become active next September. It impacts all developers and vendors producing "digitally enabled" products whether commercially or via any form of funding. It places a number of key requirements on such producers

From what I can tell, it appears to be a generally good thing and should generally improve quality.

Thankfully, UIBUILDER for Node-RED already meets most of the requirements of the law and, while I probably don't actually need to do it, I will be looking to further improve UIBUILDER with things like a Software Bill of Materials to help any producer wanting to use UIBUILDER in commercial/funded projects.

---

<div class="post-metadata">

**Author:** ![marcus-j-davies](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/marcus-j-davies/32/103435_2.png) [@marcus-j-davies](https://discourse.nodered.org/u/marcus-j-davies)\
**Post date:** [29 October 2025 15:16 UTC](https://discourse.nodered.org/t/important-new-law-that-may-impact-many-on-this-forum/99530/2 "2025-10-29T15:16:19Z")

</div>

The question, now comes...

When will a rulling be passed, that states

- _If you do XYZ, or have XYZ you are deemed a commercial producer?_

open source/unfunded or otherwise

My ZWave Node is used by A smart building supplier (no I wont give out the name 😃 ), does that make me commercial - or will it soon (I don't benefit - other than the ego boost)?

But Thanks for the info Julian - Much appreciated

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [29 October 2025 15:43 UTC](https://discourse.nodered.org/t/important-new-law-that-may-impact-many-on-this-forum/99530/3 "2025-10-29T15:43:45Z")

</div>

> [@marcus-j-davies](#):
>
> My ZWave Node is used by A smart building supplier (no I wont give out the name 😃 ), does that make me commercial - or will it soon (I don't benefit - other than the ego boost)?

As I (marginally) understand it, you would be commercial (or at least funded) if you get paid for their use of your node.

But of course, you are correct in that where is the line drawn? I occasionally get a bit of funding for UIBUILDER but it is tiny - so in theory, it could be said to be partially funded - personally I think that the amount is so tiny I can't believe that anyone would treat it that way. But what would happen if my YouTube UIBUILDER videos reached 100k subscribers and I could get advertising revenue - would that count?

But if you are clearly not funded for the nodes, you are good. The main aim of the law appears to target embedded systems driven by software - think healthcare and critical national infrastructure. As such, I think that it will have an overall positive impact on the industry. And, as a side-benefit, it should help open source developers like us also improve the security of our products. by giving us standards to adopt.

Anyway, the requirements of the law seem pretty sensible and I don't think that they are far from good practice anyway.

---

<div class="post-metadata">

**Author:** ![marcus-j-davies](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/marcus-j-davies/32/103435_2.png) [@marcus-j-davies](https://discourse.nodered.org/u/marcus-j-davies)\
**Post date:** [29 October 2025 15:50 UTC](https://discourse.nodered.org/t/important-new-law-that-may-impact-many-on-this-forum/99530/4 "2025-10-29T15:50:39Z")

</div>

> [@TotallyInformation](#):
>
> I occasionally get a bit of funding for UIBUILDER

Is that why you haven't been persistent for a small while?

How was vegas?

😉

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [29 October 2025 16:00 UTC](https://discourse.nodered.org/t/important-new-law-that-may-impact-many-on-this-forum/99530/5 "2025-10-29T16:00:18Z")

</div>

Haha! It wouldn't even cover the cost of taking the family to see a _film_ about Vegas!

Still, every little helps fund my work on UIBUILDER, the web components and other open source. 😃

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [27 January 2026 16:00 UTC](https://discourse.nodered.org/t/important-new-law-that-may-impact-many-on-this-forum/99530/6 "2026-01-27T16:00:53Z")

</div>

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.