The Cyber Resilience Act and Open-Source Software - A Fine Balancing Act

Sep 3, 2026

Upload by Mason

This document delves into the complex relationship between the Cyber Resilience Act (CRA) and open-source software (OSS), exploring the delicate balance required to foster innovation while ensuring security. It clarifies what constitutes commercial activity when supplying OSS, providing specific indicators such as an intention to monetize beyond cost recovery, charging for the product or technical support, processing personal data as a condition of use, or accepting donations that exceed development and maintenance costs without profit intent. Conversely, it outlines activities considered outside the scope of commercial activity, including monetization solely for cost recuperation, supplying software for integration by other manufacturers without monetizing the original software, receiving financial or developmental support from manufacturers, regular releases, or contributions by non-profit organizations for non-profit objectives. The document also addresses the special regulatory regime for open-source software stewards, defined as legal entities providing sustained support for OSS development and playing a key role in its viability. This nuanced approach aims to prevent unintended burdens on the open-source community while upholding the cybersecurity objectives of the CRA.

LanguageEnglish

CategoryGeneral

FormatPDF

Pages15

Reading Time5 min

AccessFree to download

Indicative of a supplying the software in the course of a commercial activity

Indicative of a supplying the software outside the course of a commercial activity

Special regulatory regime

FAQs

What factors indicate that supplying open-source software is considered a commercial activity under the Cyber Resilience Act?

Supplying open-source software is considered a commercial activity if there's an intention to monetize beyond cost recovery, a price is charged for the product or technical support, personal data processing is a condition for use (with exceptions), or donations exceed costs without profit intent.

What are examples of supplying open-source software that are *not* considered commercial activities?

Activities not considered commercial include monetizing only to recuperate maintenance costs, supplying software for integration by others without monetizing the original, receiving financial or developmental support, regular releases, development by non-profits for non-profit goals, contributing to OSS without project leadership, or mere distribution on repositories.

Who are considered open-source software stewards under the special regulatory regime?

Open-source software stewards are legal persons who provide sustained support for the development of open-source software and play a main role in ensuring its viability.

Sep 3, 2026

Upload by Mason