Obligations of Open-Source Software Stewards Under the CRA

An open-source software steward is defined as a legal person (not an individual) that:

1. Provides a platform or environment for the development or distribution of open-source software intended for integration into products with digital elements
2. Does so on a non-commercial basis — or where commercial activities do not constitute the primary purpose
3. Does not place products on the market itself in a way that makes it a manufacturer under Article 13

• Linux foundations and similar non-profit organisations managing major open-source projects
• Public benefit entities maintaining security libraries, cryptographic toolkits, or operating system components
• Academic institutions managing software repositories used in commercial products

Individual developers who contribute to open-source projects — but do not manage the overall platform — are explicitly excluded from the steward definition.

Article 24 requires open-source software stewards to put in place and document a cybersecurity policy covering:

• How security vulnerabilities in the managed software are identified, assessed, and addressed
• The processes by which security patches and updates are developed and released
• How external vulnerability reports are received and handled
• How the steward communicates security information to downstream users (manufacturers integrating the software)

This policy need not be as comprehensive as a manufacturer's full security development lifecycle documentation, but it must be documented and publicly accessible. The policy demonstrates that the steward takes a structured approach to security rather than an ad hoc one.

Article 24 requires open-source software stewards to operate a process for receiving and handling vulnerability reports — essentially a CVD policy equivalent. This process must:

• Provide a publicly accessible mechanism for reporting vulnerabilities (typically a security.txt file, a SECURITY.md in the repository, or a dedicated reporting form)
• Acknowledge receipt of vulnerability reports
• Provide reporters with a process timeline and coordinate disclosure
• Publish security advisories when vulnerabilities are fixed

Note that open-source stewards are not subject to the Article 14 mandatory notification deadlines (24h/72h/14d to ENISA). Their CVD obligations are process-level requirements, not time-triggered regulatory notifications. They may voluntarily notify under Article 15.

Article 24 requires open-source software stewards to cooperate with national market surveillance authorities (MSAs) when requested. This may involve:

• Providing information about the software's security properties, architecture, or known vulnerabilities
• Assisting MSAs in understanding the supply chain implications of a vulnerability in the managed software
• Providing technical documentation about the software's development processes and security controls

The cooperation obligation is less extensive than a manufacturer's obligations — MSAs cannot order product recall or CE marking withdrawal from an open-source steward. However, the cooperation obligation ensures that MSAs can get the information they need to assess the risk posed by vulnerable open-source components integrated into regulated products.

To avoid chilling open-source development, Article 24 explicitly carves out several obligations that manufacturers face but stewards do not:

• No CE marking — open-source stewards do not need to affix CE markings to software
• No EU Declaration of Conformity — no formal conformity declaration is required
• No conformity assessment — no notified body involvement is required
• No Article 14 mandatory notifications — no 24h/72h deadlines to ENISA
• No SBOM requirements — no formal software bill of materials obligation under Article 13(6)

Manufacturers who commercialise open-source software (sell it, monetise it, bundle it in commercial products) become manufacturers under Article 13 and lose the steward carve-out. The line between steward and manufacturer is primarily drawn by commercialisation.