Commercial activity
The Regulation applies only to products made available in the course of a commercial activity. Whether money changes hands is only one of several indications.
Commercial activity is the condition for making a product available to fall under the Cyber Resilience Act. It separates commercial products from hobby projects and open-source software that is not monetised.
Definition in the Regulation
Article 3, point (22), of Regulation (EU) 2024/2847 requires a commercial activity for making available on the market. Recital 15 lists the indications: a price for the product, charging for technical support beyond the recovery of costs, and an intention to monetise the product, for example as a platform for other services. They also include requiring personal data as a condition of use, unless this is solely for security or compatibility, and accepting donations that exceed the costs. Donations without the intention of making a profit are not a commercial activity. Recital 18 adds that funding, regular releases or development by not-for-profit organisations do not in themselves make open-source software commercial. The Commission guidance C(2026) 5252 counts paid versions, where access to the software or its maintenance is conditional on payment, as commercial activity (paragraphs 51 to 57); separately offered services such as consultancy or training are not (paragraph 55, example 18). Anyone providing support for someone else's open-source software does not place it on the market, as long as they do not substantially modify it in the process (paragraph 59).
What it means for manufacturers
For a company that sells products, the question is quickly answered: it acts commercially. The term becomes interesting for side products. In our reading of recital 15 (intention to monetise), a free tool on the company website that leads customers to the paid product points to a commercial activity. According to the guidance, a free community edition alongside a paid edition is a separate product that is not placed on the market, whereas the paid edition is (paragraph 52). If you merely build open-source components into your product, you do not have to answer the question for the component; the due diligence obligation under Article 13(5) applies to you, expressly including non-commercial software.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kitRelated terms
- Making available on the market
- Placing on the market
- Free and open-source software
- Open-source software steward