Does the CRA apply to open-source software?
Light regime
Usually not, with a light regime for stewards. Free and open-source software that is not monetised is not considered placed on the market, and legal persons who systematically support its development fall under a lighter, tailored regime [[F-009]]. Monetising or commercially redistributing it changes that [[F-102]].
The deciding factors
| Factor | If true | If false | Source |
|---|---|---|---|
| Free and open-source, not monetised | Not placed on the market; the steward light regime may apply | Normal manufacturer scope | F-009 |
| You charge for support, hosting or a commercial licence | Commercial: normal manufacturer scope | Not placed on the market | F-007 |
| A legal person systematically supports the project | Open-source software steward light regime | Individual maintainer, outside | F-009 |
| A downstream vendor integrates it commercially | That vendor is the manufacturer of the finished product | No change for you | F-104 |
Check your own product
Start the short scope check with the product type pre-selected. Every legally material fact — EU availability, commercial activity, exclusions, your role — is asked, never assumed.
Example scenarios
-
Foundation-hosted project, no paid tier, systematic support
Open-source light regime may apply · role: _
Not monetised, so not placed on the market; the foundation systematically supports it and is treated as an open-source software steward under the light regime.
Deciding fact: Art. 3(14), Art. 3(48), Art. 24, Art. 64(10)(b), Recitals 18–19
-
Company sells support contracts and a hosted edition of its open-source product
Likely in scope · role: _
Charging for support or a service is a commercial activity; the company places a product with digital elements on the market.
Deciding fact: Art. 3(1), Art. 2(1)
-
Not sure whether the sponsorship programme is monetisation
It depends on one fact · role: _
Commercial activity is the deciding fact. Recurring paid support or a paid tier is commercial; sponsorship of a non-monetised project generally is not.
Deciding facts: Art. 3(1), Art. 2(1); Art. 2(1), Art. 3(22), Recitals
Each scenario is a fixture: the shared CEMarque rules engine evaluates its inputs at build time and the page cannot be served if the outcome shown here differs from the engine's.
Edge cases
- _
- _
- _
- _
Why
Not placed on the market
Free and open-source software that is not monetised is not considered placed on the market [1]. Publishing source code, accepting contributions and distributing binaries at no charge are not commercial activity in the Regulation's sense [2] [1].
The steward regime
Legal persons other than manufacturers who systematically provide support for the development of open-source software intended for commercial activities, an open-source software steward, fall under a lighter, tailored regime rather than full manufacturer obligations [1]. That regime is a documented cybersecurity policy, cooperation with authorities, and Article 14 reporting only where the steward is involved in development or its own infrastructure is affected; stewards do not affix CE marking and are not subject to fines [1]. A foundation that hosts and maintains a project without monetising it is the typical case. An individual maintainer is not a steward; non-monetised software they publish is simply not placed on the market [1].
Commercialisation
Charging a price, charging for support, or monetising the software otherwise is a commercial activity, and the supplied product is a product with digital elements in normal scope [2] [3]. Monetisation or commercial redistribution by you changes a non-commercial verdict and should trigger a re-check [4]. Selling support, hosting or a commercial licence for open-source code is the common route into full scope.
Downstream integration
A developer who integrates an open-source component into their own commercial product is the manufacturer of that product and responsible for its conformity, including the integrated component [5]. The upstream project's status does not change because of it.
What to do next
CRARequired only answers applicability. CEMarque carries your answers forward and adds your role, class, conformity route, dates, obligations, and a permanent cited verdict.
Check my product Run the full cited determination on CEMarque
Related applicability questions
Sources
- F-009 Free and open-source software not monetised is not considered placed on the market. Open-source software stewards (legal persons that systematically support free and open-source software intended for commercial activities) have a light regime: a documented cybersecurity policy, cooperation with authorities, and Article 14 reporting only where they are involved in development or where an incident affects their own development infrastructure; they do not affix CE marking and are not subject to fines. Art. 3(14), Art. 3(48), Art. 24, Art. 64(10)(b), Recitals 18–19 EUR-Lex ↩
- F-007 The Regulation applies to products made available on the market in the course of a commercial activity; charging a price, charging for support, monetising via advertising or data, or otherwise intending to monetise are commercial activity. Art. 2(1), Art. 3(22), Recitals EUR-Lex ↩
- F-005 A product with digital elements is a software or hardware product and its remote data processing solutions, including components placed on the market separately, whose intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network. Art. 3(1), Art. 2(1) EUR-Lex ↩
- F-102 Monetisation or commercial redistribution by you changes a non-commercial verdict; re-check when that happens. Recitals EUR-Lex ↩
- F-104 A developer who integrates a component into their own product is the manufacturer of that product and responsible for its conformity, including the integrated component. Art. 13(5), Art. 3(13) EUR-Lex ↩
CRARequired answers applicability only, using scope logic and cited regulatory facts maintained by CEMarque, which encodes Regulation (EU) 2024/2847 and published guidance as of Facts v2026.09.4 (10 September 2026). Results are "likely" or "conditional" readings of your answers, not a legal opinion and not a conformity assessment. Run the full cited determination on CEMarque before you act. Methodology.