if that is the case then it should be brought to the respective overseen regulatory body, weather it is for them to clarify that this is not a valid interpretation of the law (it's at least clearly in conflict with the spirit of the law) and intentionally delaying public releases this way is a no-go or weather it is to amend the law to make it more explicitly illegal

either way if that is true it looks like a very intentional abuse/misinterpretation of existing regulations

▲

eddythompson80 3 hours ago | parent [-]

What makes you think it’s misinterpretation?

▲

pas 2 hours ago | parent [-]

FAQ https://ec.europa.eu/newsroom/dae/redirection/document/12233... [PDF]

https://digital-strategy.ec.europa.eu/en/policies/cra-manufa...

	▲	dns_snek 2 hours ago \| parent [-]
		It's not a CRA obligation, but a rule from ecodesign requirements for smartphones (Reg. 2023/1670) > security updates or corrective updates mentioned under point (a) need to be available to the user at the latest 4 months after the public release of the source code of an update of the underlying operating system or, if the source code is not publicly released, after an update of the same operating system is released by the operating system provider or on any other product of the same brand; https://eur-lex.europa.eu/eli/reg/2023/1670/oj/eng#anx_II So by delaying AOSP releases by 4 months, Google is allowing OEMs to leave their users exposed to known vulnerabilities for up to 8 months.