Who is an open-source software steward under the CRA?
Light regime
A lighter regime. Free and open-source software that is not monetised is not considered placed on the market, and legal persons who systematically provide support for its development, open-source software stewards, fall under a lighter, tailored regime rather than full manufacturer obligations [[F-009]].
The deciding factors
| Factor | If true | If false | Source |
|---|---|---|---|
| A legal person systematically supports non-monetised open-source software | Open-source software steward light regime | Not a steward | F-009 |
| You monetise the software | Manufacturer scope instead | Steward regime holds | F-007 |
| Monetisation starts later | Re-check; verdict changes | No change | F-102 |
| Has a direct or indirect connection to a device or network | It is a product with digital elements | Likely out of scope | F-005 |
Check your own product
Start the short scope check. Every legally material fact — EU availability, commercial activity, exclusions, your role — is asked, never assumed.
Example scenarios
-
Foundation systematically supporting a non-monetised project
Open-source light regime may apply · role: _
A legal person supporting non-monetised open-source software: the steward light regime applies.
Deciding fact: Art. 3(14), Art. 3(48), Art. 24, Art. 64(10)(b), Recitals 18–19
-
Company that stewards a project and sells support contracts for it
Likely in scope · role: _
Charging for support is commercial activity; the company places a product with digital elements on the market as a manufacturer.
Deciding fact: Art. 3(1), Art. 2(1)
-
Not sure whether the sponsorship arrangement is monetisation
It depends on one fact · role: _
Commercial activity is the deciding fact; sponsorship of a non-monetised project is generally not commercial supply.
Deciding facts: Art. 3(1), Art. 2(1); Art. 2(1), Art. 3(22), Recitals
Each scenario is a fixture: the shared CEMarque rules engine evaluates its inputs at build time and the page cannot be served if the outcome shown here differs from the engine's.
Edge cases
- _
- _
- _
- _
Why
The steward role
Free and open-source software that is not monetised is not considered placed on the market. Legal persons, other than manufacturers, that systematically provide support for the development of such software intended for commercial activities are open-source software stewards, and a lighter, tailored regime applies to them rather than the manufacturer's obligations [1]. The regime is a documented cybersecurity policy, cooperation with authorities, and Article 14 reporting only where the steward is involved in development or an incident affects its own development infrastructure; stewards do not affix CE marking and are not subject to fines [1].
Steward or manufacturer
Charging a price, charging for support or monetising the software otherwise is a commercial activity, and a body doing so for the software it supplies is a manufacturer in the ordinary way [2] [3]. A company can steward one project and manufacture another; the check is per product.
When it changes
Monetisation or commercial redistribution by you changes a non-commercial verdict, and the check should be re-run when it happens [4]. An enterprise tier, paid hosting or paid support are the usual triggers.
Individuals
The steward definition speaks of legal persons [1]. An individual maintainer of non-monetised software is outside scope because the software is not placed on the market, not because of the steward regime [1].
What to do next
CRARequired only answers applicability. CEMarque carries your answers forward and adds your role, class, conformity route, dates, obligations, and a permanent cited verdict.
Check my product Run the full cited determination on CEMarque
Related applicability questions
Sources
- F-009 Free and open-source software not monetised is not considered placed on the market. Open-source software stewards (legal persons that systematically support free and open-source software intended for commercial activities) have a light regime: a documented cybersecurity policy, cooperation with authorities, and Article 14 reporting only where they are involved in development or where an incident affects their own development infrastructure; they do not affix CE marking and are not subject to fines. Art. 3(14), Art. 3(48), Art. 24, Art. 64(10)(b), Recitals 18–19 EUR-Lex ↩
- F-007 The Regulation applies to products made available on the market in the course of a commercial activity; charging a price, charging for support, monetising via advertising or data, or otherwise intending to monetise are commercial activity. Art. 2(1), Art. 3(22), Recitals EUR-Lex ↩
- F-011 Manufacturer: a natural or legal person who develops or manufactures products with digital elements or has them designed, developed or manufactured, and markets them under their name or trademark, whether for payment, monetisation or free of charge. Art. 3(13) EUR-Lex ↩
- F-102 Monetisation or commercial redistribution by you changes a non-commercial verdict; re-check when that happens. Recitals EUR-Lex ↩
- F-005 A product with digital elements is a software or hardware product and its remote data processing solutions, including components placed on the market separately, whose intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network. Art. 3(1), Art. 2(1) EUR-Lex ↩
CRARequired answers applicability only, using scope logic and cited regulatory facts maintained by CEMarque, which encodes Regulation (EU) 2024/2847 and published guidance as of Facts v2026.09.4 (10 September 2026). Results are "likely" or "conditional" readings of your answers, not a legal opinion and not a conformity assessment. Run the full cited determination on CEMarque before you act. Methodology.