The Cyber Resilience Act for Open Source
Practical guidance on EU Regulation 2024/2847 for maintainers, contributors, and stewards navigating the intersection of open source and commercial activity.
The Cyber Resilience Act (CRA) clarifies that non-profit open source development remains exempt from manufacturer obligations. However, software supplied in a commercial context—such as through paid support or proprietary extensions—falls under EU Regulation 2024/2847. Maintainers of commercialized projects must now manage SBOMs, address vulnerabilities, and maintain technical documentation. CRAcheck assists maintainers in assessing their repositories and automating the generation of required compliance artifacts.
When Does the Cyber Resilience Act Apply to Open Source?
Regulation (EU) 2024/2847, effective since 10 December 2024, distinguishes between independent community development and commercial supply. Software developed or distributed strictly outside of commercial activity is exempt from the regulation's manufacturer mandates.
However, maintainers and organizations face regulatory obligations under these specific conditions:
- Direct monetization, including paid proprietary extensions, mandatory commercial support contracts, or tiered paid software editions.
- Acting as a formal steward that systematically provides sustained software components for commercial products, triggering specific stewardship requirements.
- Downstream enterprise users embedding your library into commercial products, who require upstream SBOMs and rapid vulnerability coordination.
Key Responsibilities and Practical Impacts for Maintainers
Even when independent maintainers are exempt, downstream commercial distributors will demand standard CRA artifacts to satisfy their own regulatory audits.
Automated SBOM Generation
Export machine-readable Software Bills of Materials in CycloneDX format across 9 major ecosystems, including npm, PyPI, Go, Rust, .NET, PHP, Ruby, and Java.
SECURITY.md Standardization
Generate and publish standardized security policies detailing coordinated vulnerability disclosure channels and contact points mandated by the CRA.
Incident & Vulnerability Alerts
Track actively exploited vulnerabilities with automated notifications, supporting ENISA reporting workflows (24h early warning, 72h incident notification, 14d final report).
Annex VII Technical Documentation
Generate structured technical dossiers and draft EU declarations of conformity for projects supplied commercially or through dual-licensing models.
Meeting Enterprise Expectations Without Losing Focus on Code
Corporate users increasingly demand CycloneDX SBOMs, signed releases, and formal vulnerability disclosures. Navigating the legal complexities of Regulation 2024/2847 should not distract you from your core development work.
- Automated repository scanning to identify compliance factors in minutes
- Standardized security policies tailored to coordinated disclosure workflows
- Full visibility into transitive dependencies across major package managers
- Objective readiness scoring out of 100 to prioritize security hygiene
Critical CRA Deadlines Maintainers Must Track
The Cyber Resilience Act follows two primary regulatory milestones following its 10 December 2024 entry into force:
- 11 September 2026: Mandatory vulnerability reporting begins. Manufacturers must notify ENISA and relevant CSIRTs within 24 hours of identifying actively exploited vulnerabilities.
- 11 December 2027: Full enforcement of essential cybersecurity requirements, CE marking, Annex VII technical documentation, and conformity assessments.
Commercial Activity vs. Non-Commercial Open Source
Occasional donations or corporate sponsorships without operational control do not constitute commercial activity. However, open-core models, commercial licensing, or bundled cloud hosting require full product compliance. Penalties for non-compliance can reach up to 15 million euros or 2.5% of global annual turnover.
Why Downstream Users Demand Compliance Upstream
Commercial vendors face stringent audit requirements for their products. Because they bear legal liability for the third-party components they ship, maintainers who provide clear SBOMs and documented security policies become the preferred, reliable foundation for commercial software stacks.
See Where Your Repository Stands Under CRA Rules
Connect your GitHub repository to generate an automated SBOM, evaluate security baselines, and calculate your current CRA readiness score.
Four Steps to Prepare Your Open Source Project
- 1
1. Connect Your GitHub Repository
Authorize CRAcheck to inspect your package manifests across npm, PyPI, Go, Rust, .NET, PHP, Ruby, or Java.
- 2
2. Generate Your CycloneDX SBOM
Instantly export a machine-readable Software Bill of Materials documenting all direct and transitive dependencies.
- 3
3. Evaluate Your Compliance Score
Review your readiness score out of 100 based on vulnerability hygiene, disclosure channels, and documentation completeness.
- 4
4. Publish Policy and Disclosure Files
Export pre-filled SECURITY.md templates and draft technical files to reassure commercial users and contributors.
How CRAcheck Supports Open Source Self-Assessment
CRAcheck is a self-assessment support tool designed to help maintainers and vendors evaluate codebases against the regulatory expectations of EU Regulation 2024/2847.
By connecting your repository, you receive ongoing alerts for vulnerabilities in your dependency tree, alongside structured templates for Annex VII documentation and essential ENISA reporting workflows.
Frequently Asked Questions
Are solo open source maintainers subject to CRA fines?+
Maintainers developing open source outside of commercial activity are exempt. However, if software is monetized via commercial licensing, paid add-ons, or professional support contracts, standard manufacturer obligations and potential penalties up to 15M EUR or 2.5% of turnover may apply.
What is an open source software steward under the CRA?+
A steward is a legal entity, such as a foundation, that provides sustained support for open source products intended for commercial use. Stewards must establish cybersecurity policies and coordinate vulnerability handling, rather than fulfilling full manufacturer duties.
Do maintainers have to produce an SBOM for community users?+
Non-commercial projects are not legally required to produce an SBOM under the CRA. However, commercial vendors integrating your code must maintain one, making your project significantly more attractive to enterprise users if you provide a standardized CycloneDX SBOM.
Does using CRAcheck grant official CRA certification?+
No. CRAcheck is a self-assessment tool. It automates inventory generation, evaluates readiness scores, monitors dependency vulnerabilities, and prepares documentation templates; it does not replace a notified body or provide an official regulatory guarantee.
Equip Your Repository for the Cyber Resilience Act
Join developers and maintainers using CRAcheck to audit dependencies, generate SBOMs, and stay ahead of EU cybersecurity deadlines.
Same topic — Par type de produit
New to the Cyber Resilience Act? Start with the complete guide.
The CRA guideFrom the blog
Check your CRA compliance in 1 minute
Free, no sign-up. Scan your repo and get your compliance score + pre-filled documents.