The European Cyber Resilience Act and software governance

The EU Cyber Resilience Act (CRA) fundamentally extends cybersecurity responsibility across the digital product supply chain, including Products with Digital Elements (PDEs) placed on the EU market. While the CRA’s obligations attach primarily to manufacturers and other economic operators, open-source software (OSS) introduces a distinctive challenge: critical software dependencies may be developed, maintained, and distributed across decentralized communities with no single accountable entity.

To address this accountability gap, the CRA introduces a purpose-built legal construct: the Open-Source Software Steward. This role is intended to bridge decentralized open-source communities and the commercial manufacturers that depend on their software, without imposing the full obligations of a manufacturer on volunteer maintainers or foundations. Instead, the CRA establishes a distinct role with calibrated responsibilities and meaningful protection. At its core, an Open-Source Software Steward is a legal entity, other than a manufacturer, that provides sustained and systematic support for the development of specific free and open-source products intended for commercial activities. However, a clear boundary is drawn regarding commercial activity.

Although Free and Open-Source Software (FOSS) is generally exempt when distributed outside the course of a commercial activity, this exemption is lost (and manufacturer obliga-tions apply) if the software is supplied in return for direct payment, or if it is monetized through behavioral advertis-ing, user data exploitation, or paid proprietary extensions.

Conversely, purely altruistic donations for cost recovery, or development training by non-profits, generally do not trig-ger manufacturer status. Meanwhile, proprietary Freeware falls within the scope of the CRA even when provided free of charge (such as device drivers). Under Article 24 of the CRA, Stewards must establish and document a verifiable cybersecurity policy to foster secure development and vulnerability handling. While this represents a "light-touch" framework without administrative fines, Stewards are still subject to mandatory reporting obligations under Article 24(3) to notify authorities of actively exploited vulnerabilities and severe infrastructure incidents.

Article 13 sharpens liability. Manufacturers must maintain accurate SBOMs across all dependencies, guarantee security updates for the product's declared support period, and prove via Annex VII documentation that no known exploitable vulnerabilities exist at market release.

CRA already mandates that manufacturers share vulnerability fixes with the upstream maintainer. The legislation doesn't merely incentivize upstreaming, it practicality eliminates any alternative. The Open Source Program Office (OSPO) within an enterprise is an organizational catalyst. Under CRA pressure, it evolves from a licensing compliance function into the strategic hub that connects internal product governance directly to upstream communities. The approach proposed here goes beyond the CRA’s minimum compliance requirements.

When the upstream repository is natively CRA-compliant, shaped by active manufacturer contributions and automated verification infrastructure, the manufacturer pulls pre-audited, fully documented components directly into production. Conformity assessment workload drops by orders of magnitude.

The CRA legally defines "secure by design" through harmonized European standards; manufacturers that engage in their development shape compliance pathways for the entire market.
While still under review, ETSI, CEN, and CENELEC are mandated to deliver horizontal baseline requirements across all products and also vertical standards for higher-risk categories in Annex III and Annex IV.

The Linux Foundation provides collaborative infrastructure that manufacturers can leverage instead of building compliance capabilities independently. As AI adoption expands across these ecosystems, the Linux Foundation has extended its standardization efforts to verifiable AI trust through the Appia Foundation, a vendor-neutral initiative developing open-source conformity specifications for the global AI value chain. Its founding members include Microsoft, Google, OpenAI, and Nemko, bringing together international standards and practical regulatory conformity assessment. In this position, Nemko can translate its deep regulatory expertise into assessable, open-source conformity framework to secure the future of trustworthy AI.

The CRA marks an irreversible end to value extraction from open-source ecosystems without security contribution. Organizations that embrace entangled governance, code-control-by-design, and upstream investment don't just survive the regulation, they convert it into a scalable, mathematically secure supply chain that competitors cannot easily replicate.

The above is a synopsis of an article which is available in full at this link.

(This article is based on information provided by Alicja Halbryt; edited by T.Sollie)