CRA leaves most open source software without CE marks

The CRA leaves most open source software without CE marks, limiting how far DNS operators and other organisations can rely on that label when demonstrating supply chain security. NLnet Labs says the European Union law largely keeps contributions by individuals outside its scope, while imposing different responsibilities on commercial manufacturers and nonprofit open-source stewards.

The Cyber Resilience Act (CRA) is an EU law governing hardware and software placed on the European market. In an article dated 20 October 2026, NLnet Labs said the first group of reporting obligations had taken effect just over a month earlier for Manufacturers, the law's term for commercial producers of hardware and software. From 12 December 2027, all covered products intended for the EU market will be regulated.

The final law was negotiated by EU member states in the Council and the European Parliament from a proposal by the European Commission. NLnet Labs said it worked with all three institutions after the proposal appeared in 2022, focusing on how the legislation would treat open source software, meaning software whose code can be inspected, modified and shared under its licence.

According to the organisation, the negotiated text requires Manufacturers that integrate software into their products to send security fixes upstream, meaning back to the projects and maintainers from which the software originated. It also introduced more detailed boundaries for free and open source software. Manufacturers selling open source software in the CRA's “important” product class may assess their own compliance rather than obtaining an assessment from an independent third party.

For contributors, NLnet Labs' interpretation is straightforward: most open source software is outside the CRA's scope. People contributing code to its projects do not acquire CRA obligations simply by doing so, including when the contribution is made as part of their employment. For anyone who needs the legal detail, the organisation recommends starting with the European Commission's CRA guidance for open source software. In particular, it points readers to the flowchart at the end of Section 3 before working through that section's 14 pages.

The position changes when a company incorporates open source software into a commercial product sold in the EU. The CRA gives that Manufacturer a due diligence obligation, requiring it to examine and manage relevant risks. The work becomes more demanding when an open source component carries a critical operational load or performs a security-sensitive function, rather than being a minor dependency that can be reviewed through automated checks alone.

NLnet Labs says its software is frequently used in these important roles. It offers professional support to help integrating companies conduct their due diligence, with the resulting revenue contributing to long-term maintenance. This is the organisation's description of its own support model, not an exemption from the Manufacturer's legal responsibilities.

Nonprofit organisations that develop and publish open source software fall under another part of the CRA. NLnet Labs identifies itself as an Open-Source Software Steward and has documented which projects it considers to be under its stewardship, along with the corresponding obligations. That status does not cover all of its work. Research projects that were never intended for commercial activity, and projects declared end of life, do not create or no longer carry those obligations for the organisation.

The distinction matters to operators covered by NIS2, the EU cybersecurity framework that places supply chain security duties on organisations including DNS operators, top-level domain (TLD) registries and Internet Exchanges. A TLD registry operates a domain ending such as a country or generic suffix, while an Internet Exchange is infrastructure through which separate networks exchange traffic. The CRA is intended to make these assessments easier by allowing a CE mark to distinguish products that meet EU product-security requirements from those that do not.

However, NLnet Labs notes that, apart from exceptions, most open source software in an operator's supply chain will not have a CE mark. Projects maintained by individuals are outside the CRA's scope, so those maintainers cannot apply the mark. Software supported by a nonprofit steward is within a CRA regime, but the steward also cannot CE-mark it. According to the organisation, the only open source software that can carry the mark is free and open source software (FOSS) sold by a Manufacturer. That Manufacturer may not be the project's upstream maintainer, and such products are likely to represent only a fraction of the FOSS in an operator's supply chain.

Operators will therefore need other evidence that they are managing their dependencies responsibly. NLnet Labs warns that choosing a CE-marked alternative merely because the preferred software is open source would be a poor result, particularly if it means abandoning better software. It argues that the CRA's stewardship model could instead help organisations demonstrate responsible maintenance as the regulatory treatment of NIS2 develops.

That model pools funding through steward organisations that support maintainers, rather than requiring every operator to create a separate relationship. Open source also allows operators to build their own expertise for diagnosing supply chain problems. Organisations that do not make that internal investment can instead obtain specialist support. Guidance from the European Union Agency for Cybersecurity (ENISA) says support contracts should address the full system life cycle, including obsolescence management and the date through which support will continue.

For organisations deciding how to manage this work, AEU-I offers security-first IT, infrastructure and consulting, a relevant option when outside technical assistance is needed.

The practical message is that a missing CE mark does not by itself show that an open source component is insecure or unsupported. DNS operators, website businesses and IT teams still need to identify who maintains each important component, document how fixes arrive, establish how long support will last and retain evidence that their software supply chain is being actively managed.