At the final OFE Lounge event yesterday, I opened a conversation about whether the European Union’s Regulation 1025 needs revising or redoing. It is the regulation that defines how the mechanism for creating harmonized standards in response to legislation works.
When it was written, open source was considered a “business model” and ICT standards were a distinct and identifiable subset. Even then, ICT aspects were mostly about voltages in wires; if there was some societal aspect (e.g. a safety vs security tradeoff) it was fairly objective and engineering-like.ICT standards then were functional requirements not having much bearing on the data communicated, and aspects that did were generally not part of the ICT standard itself.
Conceptually 1025 strongly reflects this and embodies the conservatism both the public sector and market-dominant actors felt at the time, when any mention of open source was treated as controversial and primarily about commercial disruption. In effect the current 1025 is a 10 year old crystalisation of a 20 year old outlook.
Today, open source is between 80% and 99% of all software and “digital elements” comprise some part of every modern product. Even hardware solutions are dominated by “digital elements”. As such the approach taken by 1025 is out of date and most likely needs a root-and-branch rethink to properly apply to the world today and the world we anticipate tomorrow. However, 1025 applies to the whole standards concept and not just to digital matters, so a full rewrite is unlikely (and probably undesirable). All the same, a review is very much necessary to address specific issues that have arisen since the start of the millennium.
Specific Issues
- Article 4 addresses “transparency of standards” but makes no accommodation for individuals to be alerted to, gain access to or contribute feedback on standards. This means the “fourth sector” - citizens playing economic roles previously reserved for corporations, financial institutions or unions - is not accommodated. This is an issue throughout 1025. Article 5 omits fourth sector actors from the stakeholders which must be accommodated for example, as does article 8(4).
- Article 6 addresses SMEs but their assumed role is peripheral to standardisation rather than central, so entities of SME scale that facilitate open source projects face high friction in gaining access even to standards deliverables, let alone to the processes.
- Article 10 needs modernisation so that normatively referenced standards are in the public domain. An easy fix would be to modify Article 10(6) to read “…the Commission shall publish a reference of such harmonised standard without delay in the Official Journal of the European Union…”
- Article 14 needs to add a requirement that any standards which can be implemented with software must be implementable as open source according to OSI’s Open Standards Requirement for Software.
- Article 16 should be expanded to cover financing of related open source implementations. This might be achived by fixing Annex III.
- The Committee in article 22 and 23 needs to consider open source stakeholders too.
- In Annex II(4)(c), the IPR norm is set as FRAND but that was clearly done in the worldview of an earlier era (see the mention of “without compensation” at the end). Today’s norm needs to be FRAND for hardware and RF for software.
- Annex III omits any indication of inclusion of fourth sector actors. They cannot be adequately represented in the four categories indicated, and even if they plausibly can, the organisations that have captured the use of this Annex do not do so and would not truly consider doing so.
This list is not comprehensive; maybe some of the items on it are wrong. There is a public comment period coming, and OSI will be submitting input. What should we write? What would you change in the statement above?