The CRA is not about open source
The Cyber Resilience Act introduces an open-source steward role but fails to provide funding for ongoing maintenance, leaving critical security work unfunded despite new regulatory obligations.
Background
- The **CRA** (Cyber Resilience Act) is a European Union regulation that imposes cybersecurity requirements on products with digital elements — including software — sold in the EU. It was adopted in late 2024, with provisions rolling out through 2025–2027.
- The Act includes a specific role for "open-source stewards" — organizations that manage or distribute open-source software (e.g., the Eclipse Foundation, the Apache Software Foundation, or Linux Foundation Europe). These stewards can help their projects comply with CRA obligations.
- The criticism, voiced here and elsewhere, is that the CRA creates responsibilities for stewards (documentation, vulnerability reporting, compliance paperwork) but provides **no funding** to do that work. Open-source projects that are developed by unpaid volunteers or understaffed nonprofits now face regulatory pressure without resources to meet it.
- The broader debate: The EU says the CRA protects consumers; critics say it burdens open-source infrastructure that the entire tech industry depends on, potentially driving small projects to shut down or move outside EU jurisdiction.