CRA and open source

Free and open-source software is in CRA scope only when supplied in the course of a commercial activity

Direct answer. Under the Cyber Resilience Act, Regulation (EU) 2024/2847, free and open-source software is in scope only when made available on the market in the course of a commercial activity. Recital 18 of the English Official Journal says non-monetised provision by the manufacturers is not a commercial activity. Open-source software stewards get a lighter regime in Article 24. Manufacturers that integrate open-source components must exercise due diligence under Article 13(5) and, under the first sentence of Article 13(6), report a vulnerability they find in a component to whoever maintains it. The articles below are the consolidated English text, reference line 02024R2847 — EN — 20.11.2024 — 000.003 (CELEX 02024R2847-20241120). A consolidation is a documentation tool and has no legal effect. The recitals are not in that consolidated articles file. They are quoted from the English Official Journal of the base act, Regulation (EU) 2024/2847. This page is not legal advice. It does not quote fine amounts.

CRALedger Duty Records (Shopify App Store · Write a review): “Track CRA product duties, Article 14 incident deadlines, encrypted ENISA SRP draft packs, vulnerability forwarding, and audit records.”

Related: EUDR Records Manager — DDS reference numbers on supplier lots.

Free check first: CRA role and scope self-check runs in your browser and sends nothing. Answer the role questions and see which articles the checklist names.

Checklist before you treat a repository as out of scope

Definitions: Article 3(14) and Article 3(48)

Article 3(14) of the consolidated text says: “‘open-source software steward’ means a legal person, other than a manufacturer, that has the purpose or objective of systematically providing support on a sustained basis for the development of specific products with digital elements, qualifying as free and open-source software and intended for commercial activities, and that ensures the viability of those products;”

Article 3(48) says: “‘free and open-source software’ means software the source code of which is openly shared and which is made available under a free and open-source licence which provides for all rights to make it freely accessible, usable, modifiable and redistributable;”

Recital 18 of the base act

Recital 18 is in the English Official Journal of Regulation (EU) 2024/2847. It is not in the consolidated articles file used for the articles on this page. The recital says:

“Free and open-source software is understood as software the source code of which is openly shared and the licensing of which provides for all rights to make it freely accessible, usable, modifiable and redistributable. Free and open-source software is developed, maintained and distributed openly, including via online platforms. In relation to economic operators that fall within the scope of this Regulation, only free and open-source software made available on the market, and therefore supplied for distribution or use in the course of a commercial activity, should fall within the scope of this Regulation. The mere circumstances under which the product with digital elements has been developed, or how the development has been financed, should therefore not be taken into account when determining the commercial or non-commercial nature of that activity. More specifically, for the purposes of this Regulation and in relation to the economic operators that fall within its scope, to ensure that there is a clear distinction between the development and supply phases, the provision of products with digital elements qualifying as free and open-source software that are not monetised by their manufacturers should not be considered to be a commercial activity. Furthermore, the supply of products with digital elements qualifying as free and open-source software components intended for integration by other manufacturers into their own products with digital elements should be considered to be making available on the market only if the component is monetised by its original manufacturer. For instance, the mere fact that an open-source software product with digital elements receives financial support from manufacturers or that manufacturers contribute to the development of such a product should not in itself determine that the activity is of commercial nature. In addition, the mere presence of regular releases should not in itself lead to the conclusion that a product with digital elements is supplied in the course of a commercial activity. Finally, for the purposes of this Regulation, the development of products with digital elements qualifying as free and open-source software by not-for-profit organisations should not be considered to be a commercial activity provided that the organisation is set up in such a way that ensures that all earnings after costs are used to achieve not-for-profit objectives. This Regulation does not apply to natural or legal persons who contribute with source code to products with digital elements qualifying as free and open-source software that are not under their responsibility.”

Manufacturers that integrate components: Article 13(5) and Article 13(6)

Article 13(5) says: “For the purpose of complying with paragraph 1, manufacturers shall exercise due diligence when integrating components sourced from third parties so that those components do not compromise the cybersecurity of the product with digital elements, including when integrating components of free and open-source software that have not been made available on the market in the course of a commercial activity.”

The first sentence of Article 13(6) says: “Manufacturers shall, upon identifying a vulnerability in a component, including in an open source-component, which is integrated in the product with digital elements report the vulnerability to the person or entity manufacturing or maintaining the component, and address and remediate the vulnerability in accordance with the vulnerability handling requirements set out in Part II of Annex I.” The hyphen in “open source-component” and the missing comma before “report” are in that sentence. This page does not quote the second sentence of Article 13(6). Vulnerability handling itself is CRA vulnerability handling. An SBOM is CRA software bill of materials. Manufacturer duties beyond this open-source angle are CRA manufacturer obligations.

Open-source software stewards: Article 24

Article 24(1) says: “Open-source software stewards shall put in place and document in a verifiable manner a cybersecurity policy to foster the development of a secure product with digital elements as well as an effective handling of vulnerabilities by the developers of that product. That policy shall also foster the voluntary reporting of vulnerabilities as laid down in Article 15 by the developers of that product and take into account the specific nature of the open-source software steward and the legal and organisational arrangements to which it is subject. That policy shall, in particular, include aspects related to documenting, addressing and remediating vulnerabilities and promote the sharing of information concerning discovered vulnerabilities within the open-source community.”

Article 24(2) has two paragraphs. The first says: “Open-source software stewards shall cooperate with the market surveillance authorities, at their request, with a view to mitigating the cybersecurity risks posed by a product with digital elements qualifying as free and open-source software.” The second says: “Further to a reasoned request from a market surveillance authority, open-source software stewards shall provide that authority, in a language which can be easily understood by that authority, with the documentation referred to in paragraph 1, in paper or electronic form.”

Article 24(3) says: “The obligations laid down in Article 14(1) shall apply to open-source software stewards to the extent that they are involved in the development of the products with digital elements. The obligations laid down in Article 14(3) and (8) shall apply to open-source software stewards to the extent that severe incidents having an impact on the security of products with digital elements affect network and information systems provided by the open-source software stewards for the development of such products.” Article 14 deadlines are CRA Article 14 incident deadlines.

The last sentence of recital 19, from the same Official Journal text, says: “Given that the light-touch and tailor-made regulatory regime does not subject those acting as open-source software stewards to the same obligations as those acting as manufacturers under this Regulation, they should not be permitted to affix the CE marking to the products with digital elements whose development they support.” CE marking for manufacturers is CRA CE marking and the EU declaration of conformity.

Article 25, in one sentence

Article 25 says: “In order to facilitate the due diligence obligation set out in Article 13(5), in particular as regards manufacturers that integrate free and open-source software components in their products with digital elements, the Commission is empowered to adopt delegated acts in accordance with Article 61 to supplement this Regulation by establishing voluntary security attestation programmes allowing the developers or users of products with digital elements qualifying as free and open-source software as well as other third parties to assess the conformity of such products with all or certain essential cybersecurity requirements or other obligations laid down in this Regulation.”

Article 64(10): stewards and the fines in paragraphs 2 to 9

Article 64(10) of the consolidation, marked ►C2, says: “By way of derogation from paragraphs 2 to 9, the administrative fines referred to in those paragraphs shall not apply to the following:” Point (b) then says: “any infringement of this Regulation by open-source software stewards.” This page does not quote the amounts in the paragraphs that sentence refers to.

Hosting: recital 20

Recital 20 of the base act says: “The sole act of hosting products with digital elements on open repositories, including through package managers or on collaboration platforms, does not in itself constitute the making available on the market of a product with digital elements. Providers of such services should be considered to be distributors only if they make such software available on the market and hence supply it for distribution or use on the Union market in the course of a commercial activity.”

Which quoted provision covers which role

Role, and the provision quoted on this page
Role What the quoted text says
Individual contributor Recital 18, last sentence: the regulation does not apply to natural or legal persons who contribute with source code to free and open-source software that is not under their responsibility.
Open-source software steward Article 3(14) defines the steward. Article 24 sets the policy, cooperation, documentation, and limited Article 14 duties. Article 64(10)(b) says the administrative fines in paragraphs 2 to 9 shall not apply to any infringement by open-source software stewards. Recital 19, last sentence, says stewards should not be permitted to affix the CE marking.
Manufacturer integrating free and open-source software Article 13(5) requires due diligence when integrating third-party components, including free and open-source software that has not been made available on the market in the course of a commercial activity. The first sentence of Article 13(6) requires the manufacturer to report a vulnerability found in an integrated component, including an “open source-component,” to the person or entity manufacturing or maintaining it.
Repository or package-manager host Recital 20: the sole act of hosting on open repositories, including through package managers or on collaboration platforms, does not in itself constitute making available on the market. The provider is a distributor only if it makes the software available on the market in the course of a commercial activity.

Application dates, in Article 71(2)

Article 71(2) says: “This Regulation shall apply from 11 December 2027.” The next sentence says: “However, Article 14 shall apply from 11 September 2026 and Chapter IV (Articles 35 to 51) shall apply from 11 June 2026.” The rest of the timeline is Cyber Resilience Act timeline. Important and critical product lists are Annex III and Annex IV.

A theme or app sold to merchants

Whether a theme or an app sold to merchants is in scope is a role question: manufacturer, steward, contributor, or host. This page does not claim that any specific Shopify app or theme is in or out of scope. The manufacturer articles are CRA manufacturer obligations. The browser checklist is CRA role and scope self-check.

What this page is not

Related pages

Not legal advice. Confirm the live regulation, including the recitals in the Official Journal and the articles in any consolidation EUR-Lex shows, before you treat a project as in or out of scope. The app tracks records you enter. It does not decide whether a product is in scope.