How does the CRA affect open-source software?
An open-source licence does not settle CRA scope. The important questions are who is responsible for the software, whether its supply is commercial, and whether an organisation acts as a manufacturer or an open-source software steward.
Start with how the software is supplied
The CRA’s market-supply framework, explained in recitals 15 and 18, leaves free and open-source software supplied outside a commercial activity outside the product requirements. Software supplied commercially can still fall within the CRA even when its source is public and its licence allows modification and redistribution.
Look at the actual arrangement: who publishes and controls the software, what users receive, and whether access to a version, functionality or maintenance depends on payment. A zero download price or a public repository is not enough to answer all of those questions.
Paid services and donations need a closer look
The Commission distinguishes optional services around freely available software from a paid supply of the software itself. Separately selling training or installation help does not, by itself, make that software a commercial product. A paid edition supplied under a commercial agreement can be different, even if similar software is also available for free.
Likewise, a voluntary donation is different from a payment that is effectively required to obtain the current release or security fixes. Read the actual access conditions rather than relying on the word “donation”. The guidance also discusses cost recovery by individuals and not-for-profit objectives; these are fact-specific considerations, not a universal revenue threshold.
A contributor and a steward have different roles
Contributing code to a project that is not under your responsibility does not by itself make you the manufacturer of that project. A downstream company’s commercial use also does not automatically make every upstream contributor a manufacturer.
An open-source software steward is a separate category for a legal person, other than a manufacturer, that systematically supports the sustained development and viability of specific open-source products intended for commercial activities. A foundation may need to examine this role even where it does not place the software on the market itself.
Article 24 gives stewards a tailored set of obligations, including a cybersecurity policy and cooperation with market-surveillance authorities. It also applies particular reporting duties in the circumstances set out there. Those duties should not be replaced with the full manufacturer checklist or treated as no duties at all.
Using an open-source component does not remove your product duties
A manufacturer may integrate an open-source component that is itself outside CRA scope. The manufacturer still needs to exercise due diligence when integrating it and handle relevant vulnerabilities in the resulting product. The upstream project’s exclusion is not an exclusion for the manufacturer’s finished product.
Record the component and version, its source and maintenance arrangements, how your product uses it, and how you will handle a relevant vulnerability if upstream maintenance ends. Keep the software inventory and the decisions about your own product together.
A fictional example: an upstream library and a paid device
A volunteer publishes a freely accessible parsing library. A device manufacturer includes it in a network gateway sold to business customers.
The gateway’s commercial sale does not, by itself, make the volunteer the manufacturer of the gateway or make the library’s publication commercial. The publisher’s own activities and responsibility must be assessed on their facts.
The gateway manufacturer still needs to assess its product and the library it integrates. If a relevant vulnerability is found, an absence of a paid upstream support contract does not make the downstream product’s vulnerability-handling duties disappear.
Facts to keep with the assessment
- Keep the licence, release and access conditions, responsibility for the project, paid offerings and the purpose of any supporting legal entity.
- Manufacturer, contributor, steward and integrator are not interchangeable labels; one organisation can have different roles for different products.
- This overview is not a determination of an individual project’s status. Commission guidance is non-binding.
Sources and further reading
Related reading
Record your product’s starting point
Use the free assessment to record the product you supply and the facts behind its indicative result.
Start the assessment