Open-source software steward
Foundations and associations that support an open-source project on a sustained basis are not manufacturers. The Regulation gives them a role of their own with few obligations, no CE marking and no fines.
An open-source software steward is a legal person that supports the development of free and open-source software on a sustained basis without being a manufacturer itself. Typical examples are foundations and associations that support a project.
Definition in the Regulation
Article 3, point (14), of Regulation (EU) 2024/2847 defines the steward as "a legal person, other than a manufacturer, that has the purpose or objective of systematically providing support on a sustained basis for the development of specific products with digital elements, qualifying as free and open-source software and intended for commercial activities". The obligations are set out in Article 24: a cybersecurity policy documented in a verifiable manner (Article 24(1)), cooperation with market surveillance authorities (Article 24(2)) and reporting actively exploited vulnerabilities under Article 14(1), to the extent that the steward is involved in development (Article 24(3)). Under recital 19, stewards may not affix the CE marking. Article 64(10)(b) excludes fines against stewards. For them, the reporting obligation only applies from 11 December 2027 (Article 71(2)); the Commission services' FAQ says so explicitly (version 1.4 of 4 September 2026, question 5.5).
What it means for manufacturers
For small and medium-sized manufacturers, the role usually matters from the other side: they build in open-source components that are supported by a steward. The steward is then not responsible for the conformity of the end product; that lies with the integrating manufacturer and its due diligence obligation under Article 13(5). If you support a project yourself as an association, for example a protocol framework that controller manufacturers build in and fund, you may be a steward. If, on the other hand, you sell open-source software or offer a paid edition, you are a manufacturer like any other. Individual developers cannot be stewards; the role requires a legal person.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kitRelated terms
- Free and open-source software
- Commercial activity
- Manufacturer
- Due diligence for third-party components