Open-source software steward

The institutional role behind the open-source regime.

LAW Defined in Article 3 (Art. 3(14)). The verbatim definition is in the official text of Article 3; only the Official Journal is authentic.

BINDING Source: Regulation (EU) 2024/2847 (Cyber Resilience Act) · publisher European Union · captured 2026-09-16 · snapshot sha256:27b7c6c64c773001… · CELEX 32024R2847

An open-source software steward is a legal person, other than a manufacturer, whose purpose or objective is to provide systematic support on a sustained basis for the development of specific free and open-source products intended for commercial activities, and that ensures the viability of those products — certain foundations, for example — and the steward regime is lighter than the manufacturer regime F-009. Non-monetised free and open-source software is not considered placed on the market at all F-009.

Verified facts this page relies on

F-009 Free and open-source software not monetised is not considered placed on the market. Open-source software stewards (legal persons that systematically support free and open-source software intended for commercial activities) have a light regime: a documented cybersecurity policy, cooperation with authorities, and Article 14 reporting only where they are involved in development or where an incident affects their own development infrastructure; they do not affix CE marking and are not subject to fines. Art. 3(14), Art. 3(48), Art. 24, Art. 64(10)(b), Recitals 18–19

Facts are maintained and human-verified in the CEMarque Facts Table (v2026.09.4, verified 2026-09-10).

Editorial review: Claude (AI reviewer, delegated by the editor), 2026-10-08. Methodology and correction process: how this site works.

Related in the reference

Not sure whether this applies to your product? Check if the CRA applies to you on CRARequired.