Why the CRA Complicates Providing IT Products and Services in the EU (And Why It Ultimately Benefits Us All)

What is the CRA?

To summarise the Cyber Resilience Act (CRA) (European Union, 2024¹), which will come into full effect in the European Union from 2027, in a single sentence:

‘If a security issue is discovered within open-source software (OSS) used in digital products and services provided within the EU, the manufacturer bears the obligation to promptly report and fix the vulnerability.’

It is important to clarify upfront that, in the context of the CRA, the term ‘manufacturer’ does not generally include OSS maintainers or stewardship organisations². In this context, a manufacturer refers to an entity that conducts business by manufacturing and selling products with digital elements (as defined by the CRA) that incorporates OSS.

Furthermore, this legislation applies to all manufacturers of products with digital elements sold or provided within the EU, regardless of the country in which the manufacturer is based.

This post will cover the following:

• What the CRA is
• Why the CRA was enacted
• What the CRA will actually improve

You might be thinking, ‘oh great, yet another GDPR-style EU regulation…’ However, I believe that understanding the background and application of the CRA is beneficial for all individuals and organisations that use OSS, whether directly or indirectly. I strongly encourage you to read on and deepen your understanding of the current issues surrounding the OSS ecosystem and how the CRA is designed to improve the situation.

Why was the CRA enacted?

In short, it was enacted to solve fatal structural problems that hinder the safe use and operation of products and services containing OSS, thereby improving both the cyber resilience of the entire EU market and enhancing regional security.

Having been involved in OSS projects for a long time, I consider the first point to be particularly crucial. The details are outlined below.

The surprising and fatal vulnerability of modern societal infrastructure

The hidden fragility of modern societal infrastructure, which is most often built on OSS, is brilliantly illustrated in the well-known comic titled ‘Dependency’ by Randall Munroe. I’m sure you’ve seen it many times, but here it is:

Source: xkcd: Dependency by Randall Munroe ( CC BY-NC 2.5 )

IT is indispensable to the administrative and public infrastructure that supports our daily lives, as well as to various businesses. Therefore, it is safe to say that the IT systems underpinning these, and their constituent elements including OSS, are themselves modern societal infrastructure. This is exactly where the unexpected vulnerability lies.

The software operating behind the scenes to support our daily activities and society frequently utilises various forms of OSS. Furthermore, as software supply chains become increasingly complex, it is no longer rare to discover fatal vulnerabilities (or witness intentional attacks via the supply chain) in the IT systems foundational to modern society³.

In many cases, the maintainers of such critically important OSS receive little to no support, financial or otherwise. The ‘surprising and fatal vulnerability’ mentioned at the beginning of the post does not refer to the vulnerabilities within the OSS code itself, but rather to the structural problem whereby these OSS projects and their maintainers fail to receive adequate human and financial support.

How to solve the ‘free-rider’ problem

At the end of the 20th century, Eric S. Raymond, a leading advocate for the open source movement, noted that because software is a resource whose copies can be made infinitely, an increase in the number of users is a positive development for OSS projects⁴. However, this was merely a comparison between physically finite resources like land and theoretically infinite resources like code; it did not factor in the time, effort, and financial resources demanded of the maintainers.

When companies utilise OSS for their products and businesses without contributing back to it, it is often described as ‘free-riding’. The existence of many ‘free-riders’, regardless of company size, increases the temporal, physical, and financial burden on maintainers to keep the OSS updated and secure.

Unfortunately, the reality is that in most cases, modern IT infrastructure is propped up by the goodwill of maintainers. Of course, it is possible for individuals and companies to sponsor OSS projects and developers. There are many instances where this is actively done, and crowdfunding platforms like Open Collective have emerged to facilitate it. Furthermore, some companies define the maintenance and development of the OSS projects they use as a prerequisite for their business success, actively participating in communities and supporting projects with personnel and donations. While the ecosystem supporting OSS is steadily developing in this way, these efforts do not resolve the fundamental structural issue that allows free-riding on OSS in the first place.

What will the CRA actually improve?

Ultimately, the CRA will improve the cyber resilience (disaster prevention and mitigation) of the entire EU market. However, the point I am personally focusing on is that the law makes it exceedingly difficult to continue free-riding when rolling out products and services in Europe. As a result, the CRA will improve the harsh conditions currently faced by OSS projects and maintainers.

As mentioned earlier, manufacturers have a legal obligation to not only report but also fix any vulnerabilities discovered in the OSS used in their products and services. If a manufacturer violates this law, they face fines of up to €15 million or 2.5% of their total worldwide annual turnover for the preceding financial year, whichever is higher.

The CRA cannot completely eradicate free-riding, nor is that its primary objective. However, the sheer size of the EU market is highly attractive to companies, making it exceedingly difficult for them to ignore the regulations when offering products or services in that region. This phenomenon is known as the ‘Brussels Effect’⁵. Just as EU regulations compelled Apple to change the iPhone charging port to USB-C, EU legislation has the power to influence companies and markets globally⁶.

As touched upon at the beginning, manufacturers are obliged to fix vulnerabilities in the OSS included in the products and services they sell in the EU. Companies with their own development resources can provide patches themselves, while those without such resources will have to hire experts or the actual maintainers of the OSS to fix the vulnerabilities. This makes it possible for maintainers to receive fair compensation and reduces their overall burden. In other words, the CRA can serve as a mechanism to significantly rectify the structural issues pointed out at the start of this post.

Conclusion

This post has outlined the CRA, but I have omitted details regarding how companies and FOSS maintainers who are located outside of the EU will be affected, in order to avoid producing a post so lengthy that even I would be reluctant to review it. I intend to publish a separate post on that topic at a later date.

Furthermore, regarding the issues caused by large corporations using OSS for business without giving back to the community and maintainers, various studies have been conducted by organisations such as the independent Belgian non-profit think tank OpenForum Europe. The European Commission and the European Union view these not only as matters affecting citizens’ interests, safety, and the European economy, but also as national security issues, and are proceeding with various legislative measures accordingly. The CRA is a part of this effort, and I personally expect that many open-source projects will rapidly gain momentum in the EU through public-private cooperation, or so I hope at least. I will touch upon information regarding this in my reports on FOSDEM 2026 and the EC-sponsored Drupal4Gov EU, both held in Brussels in January 2026.