§ services numbered like we’d draft them
You develop. We handle everything else.
Orcro is the lawyer-driven open source compliance consultancy: deep technical expertise, specialist legal skills and capability-focused change management, delivered as one service. Over 60% of our work is for multinational clients; all of it is right-sized to your needs and budget.
§1
OpenChain ISO/IEC 5230
Implement an internationally recognised open source compliance programme — and certify it. Orcro was the second organisation in the world, and the first in the UK, accredited to certify against the ISO OpenChain standard.
§1.1
Programme implementation
Policies, processes, governance and training that satisfy ISO/IEC 5230 — built to fit how your teams actually work, not bolted on.
§1.2
Certification & readiness assessment
Formal certification, or a readiness assessment that shows you exactly how far from conformance you stand and the shortest path to it.
§1.3
Security Assurance Specification
The SBOMs you generate for licence compliance double as vulnerability-management instruments. We’re actively involved in the OpenChain Security Assurance specification’s development and can prepare you for its adoption as it follows ISO 5230 toward standardisation.
§2
Code clearance & tooling
Know your code and your obligations — from a single product clearance to an entire portfolio, wired into the pipeline you already run.
§2.1
Composition analysis & SBOMs
Scanning, clearance and SBOM generation in SPDX and CycloneDX — the evidence base for licensing, regulation and security alike.
§2.2
Product-launch clearance
Pre-launch verification that your software complies with every relevant licence — peace of mind before a product meets the market.
§2.3
SCA tooling, end to end
Recommendation, implementation and management of Black Duck, Flexera, Mend.io, SW360, FOSSology and Quartermaster — configured and tuned so the expensive tools you own earn their keep.
§2.4
Crisis management
When code isn’t compliant and the clock is running, we rescue complex situations — triage, remediation and the communications around both.
§3
M&A & transactions
A seamless bridge between your development team and your lawyers. Everyone at Orcro is a lawyer or a technologist, used to working inside corporate law-firm deal teams — and to the timescales and responsiveness a live deal demands.
§3.1
Due diligence, both sides
Preparing software assets for diligence, or interrogating a target’s — at process level, where the truth lives, not just a scan snapshot.
§3.2
Deal documentation
Working with your lawyers to draft and negotiate open source warranties in the SPA and disclosure letter — and equally comfortable discussing Maven, npm, dependency trees and Docker containers with your developers.
§3.3
Insurance & risk management
We partnered with one of the world’s leading insurers to build a framework for underwriting open source risk in transactions — and we apply the same risk-profiling methodology directly for clients.
§4
Regulatory readiness
The Cyber Resilience Act, the AI Act, SBOM mandates and data protection — turned into practical, defensible processes rather than shelf-ware policies.
§4.1
CRA & AI Act readiness
Scoping and materiality assessment: what’s actually in scope for you, what the obligations are, and a costed route to meeting them before the deadlines do.
§4.2
Regulatory horizon & board reporting
Decisions made today land three to five years out. We help you make the timescales, risks and commercial stakes legible to non-technical management and keep them current as the rules evolve.
§5
Capability, training & virtual OSPO
Compliance sticks when it becomes culture. We assess capability, train every department in its own language, and run — or help you run — your open source programme office.
§5.1
Capability assessment & change management
Our OpenChain Capability Maturity Model maps internal knowledge and skills and produces a roadmap — then focused change management safeguards your software investment as practice shifts. Try the self-assessment →
§5.2
Training, by audience
From experienced industry leaders, targeted by department — software development, DevOps, C-suite, sales and marketing, train-the-trainer — delivered in person, remote or recorded, and integrated with your existing learning platform.
§5.3
OSPO establishment & virtual OSPO
We establish open source programme offices and help you operate them — or provide the OSPO as a flexible ongoing service: ad hoc queries, policy implementation, tooling management, foundation liaison and continuing training.
§5.4
Community engagement
Advocacy, outreach and constructive relationships with the open source projects and foundations your products depend on.
§6
Counsel to counsel
Software supply chain expertise for law firms and professional services firms. Our forensic technical knowledge means we’re regularly asked to co-counsel on open source transactions — translating between the technical and the legal so nothing is lost in either direction.
§7 the legal api
An interface to legal expertise that engineers can build against.
Think of Orcro as a Legal API: a predictable, powerful, scalable way for technologists to interface with legal-technical expertise. Ask in your own language — dependencies, containers, CI gates — and get answers structured for action, with defined turnaround and no translation loss.
The same interface works in the other direction. Your lawyers ask in theirs, and we bridge the technologist–lawyer communication gap that exists inside almost every organisation — which is, frankly, the core of what we do.
// no actual endpoint — yet. responses generated by humans.
POST /legal/query
{
"from": "devops",
"question": "can we ship ffmpeg in the container image?",
"context": ["GPL-2.0", "commercial", "embedded"]
}
200 OK
{
"answer": "yes — with obligations",
"obligations": ["source offer", "notices"],
"plain_english": true,
"humans_involved": true // always
}
Full-service support, end to end.
// the project cycle
01 · analyse
Requirements
Your compliance challenges, project drivers, regulatory impact, capability baseline and key commercial risks — established with your legal, DevOps and OSPO teams.
02 · scope
Definition
Technical requirements, communications and training needs, and regulatory issues including CRA and AI Act materiality assessment.
03 · review
Technical analysis
Where you actually stand: licence compliance, tooling implementation, OSPO maturity and the quality of your existing legal support.
04 · implement
Change management
Internal processes built and embedded — from bidder selection and terms through technical schedules to the end-to-end contract package.
05 · deliver
Delivery
Policy and procedure drafting, DevOps configuration and procurement, and training — including train-the-trainer.
06 · sustain
Virtual OSPO
Ongoing support: compliance queries, capability reviews, tooling management, foundation liaison and continuing training — so the programme keeps maturing after we step back.
// partnership
Orcro + Bristows: consultancy and counsel, joined up.
Orcro keeps its global recognition by staying tightly focused on open source compliance consultancy. Our partnership with Bristows LLP — the London-based, internationally focused law firm where our founder heads the Open Source team — means clients’ needs beyond that focus are met with legal advice of the highest quality, without losing the joined-up picture.
Bristows is ranked in the top band for technology, IP and software by the leading legal directories, with over 200 lawyers across sectors from technology and electronics to banking, energy and the public sector — large enough for full coverage, agile enough to stay responsive.
Orcro Limited is not regulated as a law firm and does not provide legal advice; legal services are provided by Bristows LLP under separate engagement.
One-off project or full outsourcing — your call.
Our approach is to upskill your people over time so most situations resolve in-house, with Orcro on call for the genuinely hard ones. Tell us where you stand and we’ll scope it plainly, with detailed costings up front.