openssl@3.2 Apache-2.0 ✓ cleared · ffmpeg-core GPL-2.0-only ⚑ obligations · react@18.3 MIT ✓ cleared · libcurl curl ✓ cleared · busybox GPL-2.0-only ⚑ obligations · zlib@1.3 Zlib ✓ cleared · sqlite Public Domain ✓ cleared · linux-kernel GPL-2.0-only ⚑ obligations

Relax. You’ve found Orcro

What we do to help you

Orcro is a software supply chain compliance consultancy with deep open source expertise — built for the era of the Cyber Resilience Act, SBOM mandates, and AI-assisted code.

All the right people in the room together

We mirror the way you work. We put our lawyers, engineers and consultants in the same room so all our expertise is dedicated to your project we deliver a seamless outcome.

Every licence in your stack, `SPDX-ID: accounted-for` and defensible.

Tell us where your software supply chain stands today, and we’ll tell you — plainly — what it would take to make it defensible.

`SPDX-ID: accounted-for`

talk_to_us

services ↓

Standard

ISO/IEC 5230

SBOM formats

SPDX + CycloneDX

Regulation

CRA ready

Tooling

Black Duck, FOSSA, Scancode, Flexera

Programmes that hold up to audit, M&A and regulators.

// services, numbered like we’d draft them

§1

Counsel to counsel

Software supply chain expertise for law firms and professional services firms advising on transactions, disputes and compliance. Orcro’s legal professional talking to your legal team.

→

§1

AI – embedded and controlled

Coding agents change the development and compliance landscape beyond recognition. We can wrangle agents to do your bidding, maximise productivity, but still keep code consistent, documented and compliant.

→

§5

Capability, training & virtual OSPO

Capability assessment, department-by-department training, and OSPOs established, operated — or provided as a service.

→

§2

Code clearance & tooling

SBOM generation, composition analysis and clearance — with SCA tooling recommended, implemented and tuned so it earns its keep.

→

§4

Regulatory readiness

Cyber Resilience Act, AI Act and SBOM mandates — turned into practical, defensible processes rather than shelf-ware policies.

→

§3

M&A & transactions

Due diligence on both sides of the table, open source warranties in the deal documents, and insurance-grade risk profiling.

→

§1

OpenChain ISO/IEC 5230

Implement an internationally recognised open source compliance programme — and certify it. Orcro is the UK’s first accredited certification provider.

→

Successful outcomes

// real-world client engagements

Nine-figure deal. Proven FOSS IP hygiene

Process-level diligence under ISO 5230 — not a static scan report — protected valuation and expedited closure.

What the automated scanners missed

An entire embedded Linux stack shipping with zero compliance documentation — found by process audit, fixed without halting production.

A market-first insurance product

ISO 5230 built into underwriting parameters, unlocking an insurer’s ability to quantify open source risk for a new innovative W&I product.

all twelve case studies →

What people say.

// peers & directories

peer endorsement

“Andrew is one of the best lawyers I know in the field of IT, FOSS, Open Source Hardware and Open Data. With his commendable technical skills, he is able to deduce the real issue even from the more complex issues, and keeps up-to-date on the state of the art… my go-to person for all the latest and complex legal issues pertaining to OSHW.”
Shane Coughlan · former Legal Team Lead, Free Software Foundation Europe

directory · 2026

“One of the world’s leading legal experts on open source and open hardware licensing.”
Chambers and Partners · UK 2026

directory · 2026

“Particularly noted for his breadth of knowledge relating to open-source licensing, and software more widely.”
Chambers and Partners · UK 2026

Compliance is a journey. We can’t flatten the hills — we make the climb manageable.

// the Orcro approach

What

needs to be done. We start with your business culture, risk appetite and budget — then define scope.

How

it gets achieved. Processes, governance, technology and training that fit how your teams actually work.

Who

does it. Clear ownership, with detailed costings up front — no surprises, no scope drift.

We’re self-proclaimed passionate tech enthusiasts — lawyers and engineers in the same room. We want compliance to be a competitive advantage — something that grows your business, not a brake on it.