Open Source Steward

The EU Cyber Resilience Act introduces the category of 'Open Source Steward' to address the reality that much of the software infrastructure underlying commercial digital products is developed and maintained by non-commercial foundations, projects, and individuals. An Open Source Steward is a legal entity (such as a foundation or non-profit) that provides systematic support for the development of open source software intended for commercial use — but does not itself place products on the market for commercial purposes. The CRA explicitly excludes Open Source Stewards from the full range of manufacturer obligations. They are not required to perform conformity assessments, issue declarations of conformity, or affix CE marks. This was a significant concession made after open source community pushback during the CRA legislative process.

While Open Source Stewards are exempt from most CRA manufacturer obligations, they are not entirely unregulated. The CRA requires Open Source Stewards to:

1. Establish and maintain a CVD policy — making it possible for security researchers and users to report vulnerabilities in the software they steward.
2. Cooperate with market surveillance authorities — providing information relevant to the security of their software when requested.
3. Notify ENISA of actively exploited vulnerabilities in their software components when they become aware of them.

These lightweight obligations reflect the CRA's recognition that open source stewards play a critical role in the software supply chain and need to participate in the EU's vulnerability management ecosystem, even if they are not commercial manufacturers.

Major Linux distributions, package repositories like Apache Software Foundation, and foundations like the Eclipse Foundation and OpenSSF are the primary intended beneficiaries of the Open Source Steward category. These organisations maintain critical infrastructure software used in millions of commercial products but are not themselves placing products on the EU market. The category ensures they have a defined, proportionate regulatory status rather than being inadvertently classified as manufacturers. For commercial companies that both contribute to open source projects and manufacture products (a common pattern), the CRA requires careful organisational separation: the commercial product manufacturing activities are subject to full CRA obligations, while any separate non-commercial open source project support activities may qualify for the Open Source Steward classification.

The existence of the Open Source Steward category does not reduce commercial manufacturers' obligations with respect to the open source components they incorporate in their products. Manufacturers remain fully responsible for ensuring that all components in their products — including open source ones — meet the CRA's essential requirements when integrated into the finished product. The CRA explicitly states that integrating an open source component into a commercial product does not transfer liability to the component's steward. This makes SBOM maintenance, continuous vulnerability monitoring of dependencies, and rapid response to upstream vulnerability disclosures essential practices for any manufacturer using open source components.