17MAY

CRA draft pins open-source liability on publishers

3 min read

14:28UTC

The European Commission published draft Cyber Resilience Act open-source guidance on Tuesday 3 March 2026 with consultation closing on Tuesday 31 March, confirming that responsibility for free and open-source software falls on who publishes and controls, not on contributors with commit access.

← Back to Brussels' 27 May package, two days before G7 Jump to analysis ↓

TechnologyDeveloping

Key takeaway

Maintainer liability is settled at the publisher-control test; donation triggers remain unresolved with the September 2026 reporting clock running.

On Tuesday 3 March 2026, the European Commission published draft implementation guidance for the Cyber Resilience Act (CRA, the EU's binding cybersecurity law covering digital products and software with digital elements) governing how the law applies to free and open-source software⁠¹. Consultation closed on Tuesday 31 March. The guidance establishes that responsibility under the CRA falls on the entity that publishes and controls the software, not on individual contributors who hold commit access.

The CRA reporting clock starts on Friday 11 September 2026 regardless of whether the Commission publishes final guidance before then. The draft closes the contributor-versus-publisher ambiguity Felix Reda, the German digital rights advocate and former MEP, had flagged repeatedly through 2024 and 2025. Hogan Lovells' published analysis of the draft confirms full compliance applies from Saturday 11 December 2027. OpenForum Europe and other open-source advocacy bodies welcomed the publisher-control test as resolving the most acute exposure for individual maintainers.

The grey area that remains is whether financial donations to a project trigger "placed on market" obligations under the CRA. The draft text suggests donations can trigger those obligations where access to essential functionality is conditional on payment. That conditional clause is the file's unresolved question for maintainers operating donation-funded projects with no separation between freely available and donor-tier functionality. The seven-CEO deregulation letter arrived in the same fortnight; the CRA open-source file was not in scope, but the legislative environment is the same. the Commission has not published the final guidance, and no publication date has been announced as of mid-May 2026.

Deep Analysis

In plain English

The Cyber Resilience Act (CRA) is an EU law that will require software sold in Europe to meet minimum security standards; much like toy safety labels or car crash tests, but for software. The CRA creates a problem for open-source software: code that anyone can download freely and modify, written by volunteers who are not paid. The guidance published in March clarifies two things. First, if you publish and control an open-source project, you are responsible for its security, not every individual who has ever contributed code. Second, if your project receives regular financial donations (through crowdfunding or sponsorship platforms), you may count as a commercial entity and lose some of the open-source exemptions. For software developers in Europe, this means they need to track who funds their projects and whether that funding crosses a compliance threshold.

Deep Analysis

Root Causes

The CRA's open-source liability ambiguity was an unintended product of the legislation's history: the original 2022 Commission proposal focused on IoT hardware and commercial software, and the open-source carve-out was added by the European Parliament during trilogue in 2023 without a detailed definition of who fell within the carve-out.

The carve-out's wording; 'freely available software, not in the course of a commercial activity'; was drafted by MEPs without input from open-source foundations, who only engaged fully after the text was finalised.

Felix Reda, the former MEP and open-source advocate, had flagged the contributor-vs-publisher ambiguity publicly from the first published draft, but his interventions during the passage of the legislation were unsuccessful in securing a clearer text. The March 2026 guidance is the belated administrative response to that unresolved legislative gap.

What could happen next?

Risk
The donation-triggers-liability ambiguity may cause GitHub Sponsors and Open Collective to implement EU geo-restrictions on donation features before 11 September 2026, drying up funding for European open-source maintainers at the moment CRA compliance investment is highest.
Immediate · 0.55
Precedent
The publisher-not-contributor liability rule will become the reference point for all subsequent EU digital product-safety legislation applied to software, including potential extensions of the AI Act to open-weight AI models.
Long term · 0.7
Consequence
The 11 September 2026 CRA reporting deadline applies regardless of whether the Commission publishes final guidance, meaning open-source publishers must begin compliance preparations under the draft guidance framework with no guarantee that the final rules will match.
Immediate · 0.85

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: The EU's Product Liability Directive (PLD), updated in 2024, resolved a comparable publisher-vs-contributor ambiguity in software by adopting a 'placing on market' test: the entity that makes a product commercially available bears liability, not the original developer.

The CRA guidance is applying the same framework, which suggests consistency of EU product-safety doctrine but also that the Commission expects open-source developers to become aware of and manage European PLD obligations, a compliance literacy most open-source maintainers lack.

Counter-parallel: The US Computer Fraud and Abuse Act's liability framework has never applied to open-source contributors for vulnerabilities in their code, because US law treats CFAA liability as requiring intent. The EU's strict-liability product-safety model, applied to open-source via the CRA, is therefore a genuinely novel legal framework with no US analogue; and no established compliance practice that European developers can borrow from.

Consensus view: Hogan Lovells' Brussels technology practice and the Linux Foundation Europe both assess the publisher-not-contributor rule as the most important clarity the guidance provides: the original CRA text left ambiguous whether any person with write access to a repository incurred product liability, which had created a chilling effect on developer participation in European open-source projects.

Counter-view: Open Source Initiative (OSI) director Stefano Maffulli argued in a March 2026 blog post that the donation-triggers-liability provision remains the most commercially damaging ambiguity, because it would classify GitHub Sponsors, Open Collective, and similar developer-funding platforms as potential compliance vectors, with the effect of drying up small-maintainer funding just as the CRA demands more security investment from those same maintainers.

Key tension: Whether the Commission will clarify the donation threshold (a single €1 donation vs a sustained funding relationship) before the 11 September 2026 reporting deadline, or whether the draft guidance becomes de facto final through inaction.

Sources:Sovereign Tech Agency

Mentions:OpenForum Europe →European Commission →Cyber Resilience Act →Felix Reda →Brussels →Linux Foundation Europe →Hogan Lovells →European Parliament →

First Reported In

Update #5 · Brussels' 27 May package, two days before G7

Sovereign Tech Agency· 17 May 2026

Read original →

Causes and effects

This Event

CRA draft pins open-source liability on publishers

Resolves the contributor-versus-publisher ambiguity Felix Reda flagged, though the financial-donations grey area remains live before reporting obligations begin on 11 September 2026.

Led to

EU backs open source with €2bn plan

CRA open-source guidance (ID:3375) prepared the ground for the EU Open Source Strategy's free-software procurement mandate.

Occurred 3 Jun 2026

Read story →

Different Perspectives

ESMC (TSMC-majority joint venture)

ESMC's president said construction remains on schedule after the Dresden fab's topping-out ceremony on 14 September, reported by Focus Taiwan with first process equipment still targeted for the second half of 2027. No first-party ESMC or TSMC statement independently confirms the claim, and the fab remains 70% TSMC-owned inside a project Europe cites as its semiconductor sovereignty case.

Civo

Civo sold out its Navigate London sovereignty conference on 22 September, drawing about 800 attendees including a sitting MP, a former defence procurement minister and sponsors led by Nokia. Companies House confirms chief executive Mark Boost as Civo's sole person with significant control, British and UK-resident, which answers the ownership question the conference itself is arguing matters.

United States Trade Representative

USTR opened its 2027 National Trade Estimate comment window on 14 September, naming the EU among markets with restrictive technology requirements and inviting submissions on cross-border data rules. The window follows Trump's 24 July Section 301 order into EU digital rules by seven weeks, and unused comments are kept, in USTR's own wording, for future negotiations.

Cohere

Cohere published the deal on 16 September without naming a regulator, running the merged company globally under its own brand from dual Toronto and Berlin headquarters. It pledges the combined company will deliver sovereign AI on STACKIT, the Schwarz Group's German platform, aimed at government buyers weighing that offer against Berlin's own anchor-customer signal.

Germany (Federal Government)

Digital Minister Karsten Wildberger called the Cohere talks "a very strong signal" and signalled Berlin's readiness to become an anchor customer, now its main lever since equity sits with Cohere. The German side secured a co-headquarters and two Cohere C-suite seats, but the protective-rights terms it pressed for in July remain undisclosed.

Poland

Poland leads a self-announced AI Gigafactory consortium with a EUR 100 million phase-one commitment, matched by Czechia and joined by Hungary at EUR 25 million. EuroHPC has confirmed no consortium for the call closing 12 November, so the bloc exists only in national announcements so far.