Luca BertonThe CRA's treatment of open-source software was one of the most debated aspects of the legislation. The final text creates a framework that distinguishes between commercial and non-commercial open-source development.
Non-Commercial Open Source — Excluded
Free and open-source software developed and distributed outside a commercial activity is not subject to CRA obligations. Volunteer maintainers of community projects are explicitly protected from manufacturer obligations.
Commercial Open Source — In Scope
If open-source software is developed as part of a commercial activity — meaning there's a revenue model connected to the software (support contracts, dual licensing, paid features) — it falls under the CRA like any other commercial product.
Kubernetes Recipes
A practical guide for container orchestration and deployment by Grzegorz Stencel & Luca Berton (Apress).
Watch on Skillshare →Open Source Stewards — New Category
The CRA introduces "open source software stewards" — legal persons (typically foundations like Apache, Eclipse, Linux Foundation) that systematically support the development of FOSS used in commercial products. Stewards have lighter obligations:
- Cybersecurity policy documentation
- Cooperation with market surveillance authorities
- Vulnerability reporting facilitation
But they do NOT have manufacturer obligations like conformity assessment or CE marking.
The Supply Chain Impact
Companies using open-source components in commercial products remain fully responsible for those components' security. You can't pass CRA liability to upstream maintainers. This means robust dependency management, vulnerability scanning, and patching processes for all open-source components in your products.
Evaluating RAG Solutions
Choose the right RAG model, configure, test, and optimise.
Start on Pluralsight →