Free and open-source software
"Open source is exempt" is only half true. If you make money from it, you are a manufacturer like any other. And if you build open-source components into your product, you are responsible for due diligence on them.
Free and open-source software (FOSS) is software whose source code is openly shared and whose licence allows anyone to use, modify and redistribute it free of charge. It falls under the CRA only if it is made available in the course of a commercial activity.
Definition in the Regulation
Article 3, point (48) defines the term as "software the source code of which is openly shared and which is made available under a free and open-source licence which provides for all rights to make it freely accessible, usable, modifiable and redistributable". Under Article 3, point (22) and recital 15, making available on the market requires a commercial activity; indications are a price for the product, charging for support beyond the recovery of costs, an intention to make a profit, or the processing of personal data as a condition of use. Recital 18 makes clear that software that is not monetised is not a commercial activity, and that financial support from manufacturers, regular releases or development by not-for-profit organisations do not in themselves make it commercial. Under recital 20, merely providing software through package managers or development platforms is not, in itself, making it available on the market and therefore not placing it on the market.
For legal persons that support such software on a sustained basis for commercial purposes, Article 24 creates the role of open-source software steward with reduced obligations; under Article 64(10), stewards cannot be fined.
What it means for manufacturers
Three cases: a project with no business behind it stays outside the Regulation, even with a donation link. A foundation or association that maintains a framework which manufacturers build in and fund is a steward. A limited company that offers an enterprise edition for a licence fee is the manufacturer of that edition, with all the obligations that entails. More important for SMEs: every manufacturer uses open-source components. Article 13(5) requires due diligence for them, expressly including non-commercial software; Article 13(6) requires manufacturers to report vulnerabilities they find to the project and to share their own fixes.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kitRelated terms
- Open-source software steward
- Commercial activity
- Due diligence for third-party components
- Making available on the market