Independent information resource Product security · EU CRA
CRA scope / 17

Does Free Software Fall Within CRA Scope?

Understand when free software falls within the Cyber Resilience Act, including free-of-charge commercial software, free and open-source software, monetisation, commercial activity and open-source software stewards.

IN BRIEF

Price and CRA scope are different questions. Proprietary freeware distributed commercially can still be made available on the market. Free and open-source software has special CRA rules designed to distinguish non-commercial community development from monetised products and sustained stewardship supporting software intended for commercial activities.

01 / 10

Free of Charge Does Not Automatically Mean Outside the CRA

The general CRA definition of making available on the market expressly covers supply whether in return for payment or free of charge. A software company therefore cannot decide that its product is outside CRA scope merely because users download it without paying. A free proprietary application used to support a commercial ecosystem, paid service or other business model can still be supplied in the course of a commercial activity.

02 / 10

Freeware and Free and Open-Source Software Are Different Questions

Software can be free to the user without qualifying as free and open-source software. The CRA understands free and open-source software as software whose source code is openly shared and whose licensing grants rights to access, use, modify and redistribute it. Proprietary freeware therefore needs the ordinary market and commercial-activity analysis, while qualifying FOSS receives additional specific treatment.

03 / 10

The CRA Gives Non-Monetised FOSS Special Treatment

Recital 18 explains that provision of products with digital elements qualifying as free and open-source software that are not monetised by their manufacturers should not be considered a commercial activity for the CRA economic-operator regime. This protects genuine non-commercial open-source development from being treated in the same way as ordinary commercial product manufacturing merely because the source code is publicly available.

04 / 10

How the Software Was Funded Is Not the Sole Test

The CRA expressly separates development financing from the commercial nature of supply. The fact that an open-source project receives financial support from manufacturers, or that manufacturers contribute to its development, does not by itself make the activity commercial. Likewise, regular releases do not by themselves establish that the software is being supplied in the course of a commercial activity.

05 / 10

Open-Source Components Have a Specific Monetisation Rule

Recital 18 specifically addresses free and open-source components intended for integration by other manufacturers. Their supply should be considered making available on the market by the original manufacturer only where the component is monetised by that original manufacturer. Downstream manufacturers integrating non-commercial open-source components still have their own due-diligence and product-security responsibilities for the finished products they market.

06 / 10

Non-Profit Development Can Remain Non-Commercial

The CRA also explains that development of qualifying free and open-source products by not-for-profit organisations should not be treated as a commercial activity where the organisation is structured so that all earnings after costs are used to achieve not-for-profit objectives. The actual organisation and activity need to satisfy that condition rather than relying solely on a project describing itself as community based.

07 / 10

Individual Contributors Are Not Automatically Manufacturers

The Regulation states that it does not apply to natural or legal persons merely because they contribute source code to free and open-source products that are not under their responsibility. This distinction protects ordinary contributors from automatically assuming manufacturer obligations simply because a patch or feature they wrote becomes part of a widely used open-source project.

08 / 10

Open-Source Software Stewards Have a Separate CRA Role

The CRA introduces the open-source software steward for legal persons that systematically provide sustained support for the development of specific qualifying FOSS intended for commercial activities and ensure the viability of those products, without themselves acting as the manufacturer placing them on the market. Stewards are subject to a tailored regime rather than the full manufacturer regime. Cluster 11 of this site addresses that role in detail.

09 / 10

Hosting Code in an Open Repository Is Not Enough by Itself

Recital 20 states that merely hosting products with digital elements in open repositories, package managers or collaboration platforms does not by itself constitute making the product available on the market. The service provider becomes relevant as a distributor only where it actually supplies the software for distribution or use on the Union market in the course of a commercial activity.

10 / 10

Use a Two-Step Free-Software Scope Test

First determine whether the software is merely free of charge or genuinely qualifies as free and open-source software under the CRA. For ordinary freeware, assess commercial activity and market supply using the normal CRA definitions. For FOSS, document who is responsible for the product, whether the manufacturer monetises it, whether a component is monetised, whether a legal person acts as an open-source software steward and whether contributors are merely participating in a project outside their responsibility.

REFERENCE DESK

Official sources

Read the full legal text and Commission material for precise wording, qualifications and updates.

Editorial review: 26 September 2026. Regulatory material can change; follow the official sources for current guidance.