The Open Source Steward — A New CRA Category

The Cyber Resilience Act (CRA) creates an entirely new role in the open source ecosystem: the open source software steward. This role did not exist before the CRA. It is the legislator's answer to a central question: Who takes responsibility for open source software embedded in commercial products — but sold by no one?

What is a steward? #

The definition is in Art. 3 No. 14 CRA: A steward is a legal person that:

Is not a manufacturer
Has the purpose of systematically and sustainably supporting the development of specific open source products
Ensures the viability of these products
The products are intended for commercial activities

A steward does not sell software. It ensures that open source projects remain secure, maintained, and usable.

What obligations does a steward have? #

The obligations are set out in Art. 24 CRA and are deliberately lighter than the manufacturer obligations:

Develop and document a cybersecurity strategy (Art. 24(1))
Promote the voluntary reporting of vulnerabilities (Art. 24(1), Art. 15)
Document, remediate, and eliminate vulnerabilities (Art. 24(1))
Promote information exchange on vulnerabilities within the community (Art. 24(1))
Cooperate with market surveillance authorities upon request (Art. 24(2))
Report actively exploited vulnerabilities, insofar as the steward is involved in development. Report severe security incidents where they affect the development systems the steward provides (Art. 24(3))

Steward vs. manufacturer #

The decisive difference:

Manufacturers bear the full CRA obligations: CE marking, declaration of conformity, full fines of up to EUR 15 million or 2.5% of annual turnover (Art. 64(2))
Stewards are subject to reduced obligations and are expressly exempt from fines (Art. 64(10b)). Other financial sanctions are also excluded (Recital 120). In the event of a breach, market surveillance authorities may only require "appropriate corrective measures" (Art. 52(3)).

A steward expressly may not affix the CE marking (Recital 19).

What does the steward role deliver? #

For open source projects:

Professional vulnerability management without the project itself having to provide the resources
Access to structured security processes
Protection from the consequences that arise when a project without a steward is used commercially

For companies that use open source:

Where a project brings its steward into its confidential security processes, the steward learns of vulnerabilities in advance — a time advantage of weeks to months over public CVE disclosure
Manufacturers who discover vulnerabilities in components they have integrated must inform the manufacturer or maintainer of that component and share any fix they developed (Art. 13(6))
The due diligence obligation for FOSS integration (Art. 13(5)) can be demonstrably fulfilled through collaboration with a steward

What does this mean for you? #

If you use open source components in your products, you benefit from these projects being under steward support. If your company operates or supports open source projects, your obligations follow from your actual role: whoever markets a product under their own name stays a manufacturer — the "steward" label changes nothing about that. So check first which role you are in. For projects that want it, OTTRIA takes on the steward role and the operational obligations that come with it.