.png&w=3840&q=75&dpl=dpl_4WWtFHEr9P8wkcdWCGky2WYKjEiM)
How does the Cyber Resilience Act treat open source (FOSS)?
Direct answer
Non-commercial open-source software developed outside a commercial activity is largely outside the Cyber Resilience Act. Monetisation can change that: gating features behind payment, or donations exceeding development costs, can make it commercial. A commercial manufacturer that integrates open source remains fully liable for the final product.
Key takeaways
- Non-commercial FOSS is largely out of scope (Recital 18 -- //CONFIRM recital number).
- Accepting basic donations does not, by itself, trigger commercial status.
- Commercial status can arise from gated features, dual-license paid tiers, or donations exceeding costs.
- Open-source software stewards have a lighter regime and are exempt from fines (Art. 24, 64).
- A commercial manufacturer is fully liable for integrated open-source components; liability does not pass to volunteer maintainers.
The full answer
The CRA carves out open-source software that is not supplied in the course of a commercial activity, so genuinely non-commercial projects are largely outside its scope. The nuance is monetisation: merely accepting donations does not make a project commercial, but gating essential features or updates behind payment, running a paid enterprise tier alongside a free community version, or taking donations that exceed development costs can tip it into commercial territory (Art. 24). //CONFIRM thresholds against the March 2026 guidance
A dedicated "open-source software steward" role applies to entities that provide sustained support for commercial-intent open source; stewards must keep a cybersecurity policy and cooperate with authorities, but are exempt from administrative fines (Art. 64). Crucially, when a commercial manufacturer integrates open-source components into a product it places on the market, that manufacturer carries full legal responsibility for the security of the final product. Liability cannot be pushed upstream to volunteer maintainers.
How Acuna GRC handles it
- Solution
CRA
Track every vulnerability to a verified fix, keep CRA technical documentation, record exploited vulnerabilities, check component suppliers and reuse NIS2.
- Module
Vulnerability management
Vulnerable items from your scanners rolled up into one issue per vulnerability, with an owner and a due date.
- Core workspace
Comply
The frameworks you select, the scopes and tags that segment your organization, the common measures library and the mapping of measures across frameworks.
Sources
This page explains the rules in general terms and is not legal advice.
See how Acuna GRC runs this.
Tell us your frameworks and your team. We show you how Acuna GRC runs the program.
Hosted in Switzerland, the EU or the US