The Cyber Resilience Act’s Open Source Problem
The European Commission’s proposed Cyber Resilience Act (CRA) aims to hold companies accountable for shipping and maintaining secure software, setting clear requirements for secure development across digital products in the EU single market. The proposal also establishes elevated standards for critical categories like web browsers and VPNs, and would require manufacturers to patch vulnerabilities in a timely fashion. While the need for such reform is clear, the draft text’s treatment of open source software has raised significant concerns within the developer community.
The Commission’s current language includes a partial exemption for open source, which sounds workable on paper but breaks down in practice. The text attempts to exempt “non-commercial” open source, yet modern open source development rarely fits a neat commercial/non-commercial binary. Maintainers work in paid and unpaid capacities across corporate, government, nonprofit, and academic settings. Non-profits often sell consulting and technical support for their projects, and individual developers increasingly rely on sponsorships and grants. These realities do not map cleanly onto the proposed exemption, leaving many legitimate projects and their contributors in legal uncertainty.
A Product-Focused Approach
GitHub has submitted feedback to the European Commission arguing that the CRA should shift its focus from the abstract nature of the developer to the concrete nature of the artifact. The central proposal: if open source software is not offered as a paid or monetized product, it should be exempt from the regulation’s obligations. This framing keeps the regulatory burden where it belongs—on finished products sold into the single market—rather than on the distributed process of software creation.
This product-centric lens also matters for the infrastructure that powers modern development. Platforms such as GitHub, self-hosted git servers, container registries, and package managers all facilitate software distribution. These were explicitly exempted as intermediaries under the EU Copyright Directive, but there is a real risk that the CRA’s current language could classify them as distributors of the software they merely host and transport. A clear exemption for non-monetized open source would resolve that ambiguity.
The Stakes for Europe’s Digital Economy
The open source ecosystem is a pillar of Europe’s digital infrastructure. Research sponsored by the European Commission estimates that open source contributed at least €65–95 billion to EU GDP in 2018, and that figure is expected to grow as open source underpins AI development. Poorly scoped regulation not only threatens this economic contribution but also undermines the very security goals the CRA seeks to achieve—many upstream projects lack the legal bandwidth to navigate a complex compliance regime, even if their downstream commercial users are the ones exploiting their code.
Direct public investment in open source is another viable policy lever. Germany’s Sovereign Tech Fund, launched last year, demonstrates how governments can actively finance maintenance and security improvements in projects serving the public interest. Such models complement existing multi-stakeholder security initiatives like the OpenSSF and deserve broader adoption across Europe.
As the legislative process moves forward, the practical question is whether the final text can distinguish between commercial software products and collaborative open source development without unnecessary collateral damage. GitHub is partnering with policymakers to push for amendments that make the CRA work for developers—and to invite direct community feedback on those proposed changes via its public developer policy repository.
