CRA open-source software and stewards
A free and open-source licence is not a complete scope decision. Commercial availability, manufacturer responsibility and the distinct steward role matter.
Contribution, manufacturer and steward
Distinguish contributing code outside your responsibility from supplying a product commercially and from sustained support by an open-source software steward. Funding and distribution facts need to be recorded, not guessed from the repository licence.
Using open source in a commercial product
A manufacturer incorporating open-source components still needs product-level vulnerability handling, dependency records and evidence. Upstream activity does not replace responsibility for the delivered product.
Role-specific duties and dates
Review Article 24 for the steward regime. Manufacturers' Article 14 reporting applies from 11 September 2026; steward reporting under Article 24(3) applies from 11 December 2027. Do not apply one role's date indiscriminately to another.
Next steps
Official sources and review context
Regulation (EU) 2024/2847 · European Commission · ENISA SRP
CRA-I18N-2026-10-14-DRAFT-4
Operational tools and retained records. No legal opinion, conformity assessment, certification or confirmation of CRA compliance is generated.