For all the people not reading the actual law, this is the actual language of the proposal:

In order not to hamper innovation or research, free and open-source software developed or supplied outside the course of a commercial activity should not be covered by this Regulation. This is in particular the case for software, including its source code and modified versions, that is openly shared and freely accessible, usable, modifiable and redistributable. In the context of software, a commercial activity might be characterized not only by charging a price for a product, but also by charging a price for technical support services, by providing a software platform through which the manufacturer monetises other services, or by the use of personal data for reasons other than exclusively for improving the security, compatibility or interoperability of the software.

IMO the problem OP mentions does not really exist. You can work for a corp while working on the product, your FOSS project can take donations even from corps, the only thing you can't do is monetize your FOSS product without caring for security.

Companies need to conduct cyber risk assessments before a product is put on the market and throughout its lifecycle effectively manage its vulnerabilities, regularly test it, and so on. Products assessed as 'critical' will need to undergo external audits.

I have not read the proposal. Legal language makes me want to rip my own eyes off.

The only winners I see are those security auditors and similar providers.

Privative corpos from USA and China will arrive with all "security assesments" and "auditions" in place, and still have backdoors lol

I wonder if I am developing an app for lemmy and I am based in EU , am I obligated to get an external vulnerability audit done , or pay a 15.million euro fine , since I am working for a corporate with a full time job?

Its been a while since i last read about it, but i thought they made some exempts so FOSS wouldnt suffer too much. One can only hope they did!

How to contact your MEP https://www.europarl.europa.eu/meps/en/home

While I see how a law like that would create insecurities in the FOSS world I trust that it will not be abused to shut down FOSS projects as some of the largest EU members like France and Germany are relying heavily on Open Source software. I believe this do be the reason why this cumbersome exception was formulated in the first place.

However it could mean that the blurry line between commercial software and FOSS software could become a clear cut and FOSS projects that provide paid versions of their software could be forced to comply or go back to relying on donations.

tldr: I dont think it will kill FOSS per se. Potentially it will become more difficult to mometize FOSS apart from donations.

https://youtu.be/iUgAS1luxEQ a video here !