An analysis of the revised SBOM minimum elements published on July 29, 2026 by CISA and 17 other agencies. The data fields grew from 7 to 17, and licensing entered the minimum baseline for the first time. Covers what an OSPO must decide before selecting a tool, how SBOM formats differ in their support, and how far the open source tool BomLens gets today.
An analysis of the US AI executive order signed on June 2, 2026, based on primary sources. Covers what the AI Cybersecurity Clearinghouse and the voluntary frontier model framework mean for enterprise open source managers, how they contrast with the EU CRA’s mandatory reporting, and what to do now versus what to watch.
An analysis of the EU Open Source Strategy (COM(2026) 503), published by the European Commission on June 3, 2026, based on primary sources. Covers the four objectives, the seven-year EUR 2 billion mobilization, the governance structure, civil-society criticism, and implications for Korean public-sector and enterprise practice.
Whether AI-generated code needs snippet-level open-source license scanning — the decision factors, grounded in public sources, and how this differs from security-vulnerability scanning.
The EU Cyber Resilience Act (CRA) brings its Article 14 reporting obligations into force on September 11, 2026. This article draws primarily on primary sources to lay out how Korean companies should prepare for the 24-hour, 72-hour, and 14-day notification deadlines, along with SBOM and conformity assessment requirements.
To use Anaconda for commercial purposes, you must purchase a paid version. A developer at a company with 200 or more employees using Anaconda counts as commercial use.
Akka’s license, which was Apache-2.0, changed from version 2.7 to the Business Source License, which companies can no longer use for free.
Let’s look at the background and issues of the SFC and Vizio GPL lawsuit.
Can I use this publicly available dataset to build commercial AI software?
Open Source Compliance for SaaS Vendors
A summary of the open source security issue known as Log4Shell.
The National IT Industry Promotion Agency (NIPA) has published four ‘NIPA Open Source Software Guides’ to help enterprises, institutions, and organizations use open source software safely.
Defendant ordered to pay the plaintiff RMB 500,000 in damages for violating the GPL
Explains the author’s analysis of whether GPLv2 also requires installation information.
Distribution of Dockerfiles: Who is responsible for FOSS Licence Compliance?
The definition and guide for the OSPOOpen Source Program Office
Explains the background behind the drafting of Elastic License 2.0
The International Standard For Open Source Compliance
Kakao has released open source educational materials for in-house developers so that anyone can read it.
NCSOFT has released lecture slides and scripts, which are open source educational materials in-house, on GitHub based on the spirit of sharing open source so that anyone can use them.
NCSOFT summarized the Open Source Compliance in the Enterprise book and released it on GitHub for anyone to read.