Free and open-source software

The treatment of free software is the most discussed and most misunderstood part of the Regulation. One idea governs the whole reading:

The distinguishing criterion is not the licence, it is the commercial nature of the supply. A free licence does not take you out of scope; a non-commercial activity does.

The four statuses

Status	Who	Regime
Individual developer or contributor	A natural person or entity developing free software outside a commercial activity	Out of scope. No obligations.
Open-source software steward	A legal person, other than a manufacturer, providing systematic and sustained support to the development of free software products intended for commercial activities, and ensuring their viability	Lightened regime: cybersecurity policy, cooperation, reporting. No CE marking, no technical documentation, no fines.
Manufacturer integrating open source	You, in the vast majority of cases	Full regime, with due diligence on third-party components and upstream reporting.
Manufacturer distributing free software commercially	A vendor monetising free software	Full regime, like any manufacturer.

Why the legislator did it this way

The reasoning, worth knowing for internal arguments: subjecting the free software ecosystem to manufacturer obligations would have made volunteer contribution impossible while leaving untouched the responsibility of those who derive commercial value from it. The Regulation therefore puts the burden on whoever places the product on the market, not on whoever writes the code upstream.

Corollary: you cannot shift your responsibility upstream. The maintainer of a library you embed answers for nothing on your behalf.

Points to watch in your organisation

Do your employees contribute upstream on work time? If so, in what framework, and does it make you a steward for some projects? An internal contribution policy must settle the question and be documented.

Do you publish free software projects yourselves? If they are made available outside a commercial activity, they are out of scope. If they accompany a commercial offering, the qualification must be examined product by product.

Do you run or fund a foundation? The open-source software steward status may then be in play, with its own obligations — lightened but real.

Voluntary attestations of conformity

The Regulation provides for a voluntary attestation mechanism: a developer or user of free software may draw up, on a voluntary basis, an attestation regarding the security properties of the component. Such attestations do not bind their author as a declaration of conformity, but they are a useful input to downstream integrators’ due diligence.

For you they have two uses: consuming them — an upstream attestation enriches your diligence file — and possibly producing them for the components you publish, which makes it easier for other CRA-bound manufacturers to adopt your building blocks.