Scenario:

A company publishes four different programs, each under a FOSS license, on the Internet, whereby the respective programs are only offered in the manner described below:

The company wonders in which of these cases the CRA applies and what obligations arise for the company as a result.

Answer:

Re. 1:
Article 2 "Scope" of the CRA states that it only applies to "products with digital elements made available on the market [...]" (see Art. 2 (1) CRA). In Art. 3 (22) CRA, "making available on the market" is defined as:

"…the supply of a product with digital elements for distribution or use on the Union market in the course of a commercial activity, whether in return for payment or free of charge;”

The CRA clarifies in its recitals that not every publication of FOSS takes place „in the course of a commercial activity" and is in that case exempt from the application of the CRA:

"In relation to economic operators that fall within the scope of this Regulation, only free and open-source software made available on the market, and therefore supplied for distribution or use in the course of a commercial activity, should fall within the scope of this Regulation.“ (cf. recital 18)

This means that FOSS, as a component of a product with digital elements, only falls within the scope of the CRA if it is made available as part of a commercial activity.

The following applies for the term "commercial activity“:

„Supply in the course of a commercial activity might be characterised not only by charging a price for a product with digital elements, but also by charging a price for technical support services where this does not serve only the recuperation of actual costs, by an intention to monetise, for instance by providing a software platform through which the manufacturer monetises other services, by requiring as a condition for use the processing of personal data for reasons other than exclusively for improving the security, compatibility or interoperability of the software, or by accepting donations exceeding the costs associated with the design, development and provision of a product with digital elements.“ (cf. Recital 15)

The CRA further clarifies that a distinction must be made between the development and supply phases, and that development within the scope of a commercial activity must be distinguished from making available on the market within the scope of a commercial activity (Recital 18):

"The mere circumstances under which the product with digital elements has been developed, or how the development has been financed, should therefore not be taken into account when determining the commercial or non-commercial nature of that activity. More specifically, for the purposes of this Regulation and in relation to the economic operators that fall within its scope, to ensure that there is a clear distinction between the development and supply phases, the provision of products with digital elements qualifying as free and open-source software that are not monetised by their manufacturers should not be considered to be a commercial activity.”

Therefore, commercially driven software development is not covered by the CRA, only commercial distribution is.

This means that, as the offer is not commercial, publication as a FOSS component in constellation 1 does not fall under the CRA. The mere mention of the manufacturer does not prevent this. However, this only applies if the company does not use and charge for the tool internally within a corporation (see also FAQ "Must CRA obligations be fulfilled when products are delivered to companies within the same group?).

Ref. 2:
A mere contribution to a FOSS project does not yet lead to responsibility under the CRA. This also aligns with the CRA's intention to protect innovation through Open Source development, as stated in Recital 18, which explicitly refers to contributions:

"Furthermore, the supply of products with digital elements qualifying as free and open-source software components intended for integration by other manufacturers into their own products with digital elements should be considered to be making available on the market only if the component is monetised by its original manufacturer. For instance, the mere fact that an open-source software product with digital elements receives financial support from manufacturers or that manufacturers contribute to the development of such a product should not in itself determine that the activity is of commercial nature.”

Contributions must be considered independently of the product in which the company uses the FOSS with the added functionality. The product and the FOSS it contains and to which the contribution was made, must meet the requirements of the CRA because, in this respect, the distribution is considered a commercial activity. However, the contribution itself is not considered as “making available on the market” because no commercial activity exists in this respect.

Ref. 3:
Unlike in scenario 2, a contribution is made and a complete component is published in this case. Therefore, the company can be regarded as an Open Source Steward or manufacturer in this respect. The company's product containing the FOSS must be assessed independently. Regarding this product, the company is considered a manufacturer and must comply with the CRA.

Commercial activity regarding the FOSS component is likely to exist only if it is additionally distributed for a fee (outside the public source code repository) and not only as part of a product. Recital 18 again indicates this:

"Furthermore, the supply of products with digital elements qualifying as free and open-source software components intended for integration by other manufacturers into their own products with digital elements should be considered to be making available on the market only if the component is monetised by its original manufacturer.”

Ref. 4:
The assessment for scenario 2 applies to this scenario as well.

Please note:

The European Commission plans to publish additional guidance regarding FOSS, Open-Source Stewards, and the interpretation of "commercial activity". A draft of this guidance is already available.

CRA; Commercial activity; Contribution; EU guidance; FOSS; Individual development; Making available on the market; Open Source Steward; Repository

Most recent content update of this FAQ: April 2026

Next FAQ: "What obligations must be met when FOSS components are integrated into a product that falls within the scope of the CRA? For example, what obligations do machine manufacturers have when using Linux and other FOSS in a device?"