Most individual open source maintainers are not regulated manufacturers under the EU Cyber Resilience Act. Organizations that steward open source for commercial use have light duties, and companies that ship your code in products carry the heavy ones. Prepare a security policy, a vulnerability contact and a clear component list.
Who is in scope for the Cyber Resilience Act?
The regulation applies to products with digital elements made available on the EU market in the course of a commercial activity. Recital 18 says free and open-source software that is not monetised by its manufacturers is not a commercial activity. Receiving donations does not, by itself, change that. Recital 18 also explains that supplying open-source components for others to integrate counts as placing on the market only if the original manufacturer monetises it.
So a solo maintainer publishing a library for free is generally outside the manufacturer duties. Check the actual text of the recitals and articles for your own case, since the line depends on facts such as whether you charge for support or the software itself.
What is an open-source software steward?
The regulation creates a separate category. Recital 19 describes legal persons who provide sustained support for the development of open-source products intended for commercial activities, and who play a main role in their viability, including certain foundations and entities that develop and publish open source in a business context. The regime is called light-touch and tailor-made. Stewards cannot affix the CE marking.
What does Article 24 require of stewards?
Two things, in plain terms:
- Put in place and document in a verifiable manner a cybersecurity policy that fosters secure development and effective vulnerability handling by the product's developers. The policy should foster voluntary vulnerability reporting, cover documenting, addressing and remediating vulnerabilities, and promote sharing of vulnerability information in the open-source community.
- Cooperate with market surveillance authorities on request, and provide documentation they ask for.
Nothing in Article 24 asks a steward to produce a CE-marked conformity assessment for a project.
What pressure will you feel from downstream companies?
Manufacturers that ship your code must meet the full requirements, including vulnerability handling, and they must draw up a software bill of materials covering at least top-level dependencies (Annex I, Part II). Article 14 reporting of actively exploited vulnerabilities, with a 24-hour early warning, applies from 11 September 2026. The regulation as a whole applies from 11 December 2027.
Expect manufacturers to ask maintainers for: a security contact, a disclosure policy, a list of supported versions, signed releases and a bill of materials. Those requests are not legal duties on you if you are outside scope, but they are reasonable to prepare for.
What does a small, realistic program look like?
Constructed example. A three-person project keeps a SECURITY.md with an email address, a coordinated disclosure window, and the supported versions. It publishes a CycloneDX or SPDX bill of materials with each release, signs tags, and keeps a short log of vulnerabilities fixed. When a vendor asks questions, the maintainers point at those four artifacts.
What to do
- Decide whether your project or its sponsor looks like a steward under the recitals, and ask the foundation or counsel if unsure.
- Write a security policy file with a reporting channel and response expectations.
- Document how you triage, fix and announce vulnerabilities.
- Generate a bill of materials at release time and publish it with the artifact.
- Sign releases and protect publishing accounts with strong authentication.
- Keep a list of supported versions and an end-of-life date for old ones.
- Tell downstream users how to report issues, and thank reporters in advisories.
Safeguard's Gold open-source Chrome extension and the free scan at gold.safeguard.sh/scan can help you look at your own dependency tree. They are checks you run, not a compliance status.
Quick check
Does accepting donations make my project commercial?
Recital 18 says receiving financial support does not by itself make an activity commercial. The facts of monetisation still matter, so read the recital for your situation.
When do the main obligations apply?
The regulation applies from 11 December 2027. Article 14 reporting applies from 11 September 2026, and Chapter IV from 11 June 2026.
Sources
Last reviewed: 18 October 2026.
