The EU Cyber Resilience Act (Regulation 2024/2847) creates unfunded compliance mandates for open source foundations acting as 'stewards' by December 2027
technologytechnology0 views
The EU Cyber Resilience Act, published December 10, 2024, introduces the novel legal category of 'open source software steward' -- foundations and organizations that systematically support open source projects used in commercial products. These stewards must implement documented cybersecurity policies, report actively exploited vulnerabilities to EU authorities (ENISA), and facilitate information sharing, with some requirements taking effect September 11, 2026 and full applicability by December 11, 2027. Why it matters: open source foundations like the Apache Software Foundation, Eclipse Foundation, and Linux Foundation must build compliance infrastructure for hundreds of projects, so foundations already operating on thin margins must hire legal and security staff or risk non-compliance, so smaller open source organizations without EU legal expertise may simply stop distributing software in Europe, so commercial manufacturers using open source must treat every open source component like first-party code for vulnerability handling, so the compliance burden falls disproportionately on the least-resourced participants in the software supply chain. The structural root cause is that the CRA was designed primarily for commercial software vendors and IoT manufacturers, and while the final text exempts non-commercial open source development from the heaviest requirements, the 'steward' category creates a gray zone where nonprofit foundations face regulatory obligations without corresponding revenue streams or government funding to meet them.
Evidence
The Cyber Resilience Act was published as Regulation (EU) 2024/2847 in the Official Journal of the EU on December 10, 2024. GitHub's policy team published analysis noting that 'steward' obligations include vulnerability reporting to ENISA within 24 hours of becoming aware of active exploitation. The OpenSSF and Eclipse Foundation have published guidance documents for their communities. The Act applies to all 'products with digital elements' placed on the EU market. Open source stewards are exempt from administrative fines but not from the compliance obligations themselves. Red Hat's analysis notes that manufacturers using open source in commercial products must handle vulnerability management, updates, and documentation for open source components identically to proprietary code.