Does the EU Cyber Resilience Act apply to my open-source library?

Short answer (it depends): Free and open-source software developed or supplied outside commercial activity is largely outside the CRA. Open-source stewards (foundations, companies systematically supporting FOSS for commercial use) have a light-touch regime; if you monetise the library itself, you may be a manufacturer.

What it means for an open-source library

• Accepting donations without profit intent is generally not commercial activity.
• Selling support, paid licences or a paid hosted version can change that.
• Stewards: cybersecurity policy, cooperation with authorities, vulnerability reporting duties (lighter).
• Downstream manufacturers will ask you for security contacts and SBOM data either way.

Key dates

• 11 Sep 2026: reporting of actively exploited vulnerabilities and severe incidents (ENISA Single Reporting Platform) — applies to products already on the market.
• 11 Dec 2027: main obligations (security requirements, vulnerability handling, support period, CE marking).

FAQ

• I’m based outside the EU? Making your open-source library available to EU users can still bring you in scope.
• What docs would I need? Typically a CVD policy, security.txt, intake page, reporting runbook, support-period statement, risk assessment.

Related: 24h reporting for open-source libraries · CVD policy

Not legal advice. Templates + software. Verify against the CRA text (Regulation (EU) 2024/2847), Commission guidance C(2026)5252 or a qualified advisor.

Last reviewed: 2026-10-30