Re: [open-regulatory-compliance] Update on reporting obligations for ope

[Steffen Zimmermann <steffen.zimmermann@xxxxxxx>]

Hi there,

in short some conclusions to this new FAQ entry, drawn by claude and reviewed by a human legal advisor (in parts a German view). Take it or ignore it ;-)

1. FAQ 5.5 is legally correct. The stewards’ reporting obligations rest on Article 24(3) CRA, not on Article 14. Article 71(2), second sentence, brings forward only Article 14 and Chapter IV. Article 24 applies from 11 December 2027. Wording, structure (chapter layout, Article 69(3), Article 52(3)) and purpose (recital 19) support this result.
2. On 11 September 2026 only the manufacturers’ reporting obligations under Article 14 start to apply. Stewards are not subject to reporting obligations for a further 15 months. The clarification was needed because neither the Commission guidance (paragraph 216) nor ENISA’s SRP FAQ mention the later date.
3. The material scope of the stewards’ reporting obligation is graduated. Reporting of actively exploited vulnerabilities only where the steward is involved in development (Article 24(3), first sentence; guidance paragraph 82). Reporting of severe incidents only where the steward’s own development infrastructure is affected (Article 24(3), second sentence; guidance paragraph 81). Purely non-technical support triggers no reporting obligation (guidance paragraph 80).
4. Whether stewards are bound by the deadlines of Article 14(2) and (4) is unregulated. Article 24(3) does not refer to those paragraphs; ENISA’s SRP FAQ nevertheless applies them to stewards. Because of Article 64(10)(b) the question has no consequences in terms of penalties.
5. Administrative fines against stewards are excluded (Article 64(10)(b)); under recital 120, other pecuniary penalties should also be avoided. The German draft implementing act accordingly contains no offence provision for stewards. Enforcement takes place solely through corrective action under Article 52(3).
6. For manufacturers in mechanical engineering, their own notification under Article 14 from 11 September 2026 is the only mandatory channel for actively exploited vulnerabilities in FOSS components. Neither a later steward report nor membership in a foundation replaces it.
7. Manufacturers that publish non-monetised FOSS are stewards of that software and face a split timeline: Article 14 from 11 September 2026 for their marketed products, Article 24(3) from 11 December 2027 for their own FOSS.

 

Sources: Regulation (EU) 2024/2847 (OJ L, 20.11.2024, English language version); FAQs on the Cyber Resilience Act, version 1.4 of 4 September 2026; Commission guidance on the scope of the CRA, C(2026) 5252; ENISA, FAQ on the Single Reporting Platform, v2; Draft act implementing Regulation (EU) 2024/2847, Bundesrat printed paper 260/26. This analysis does not constitute legal advice in an individual case.

Viele Grüße,

Steffen Zimmermann

Industrial Security @ VDMA

Von: open-regulatory-compliance <open-regulatory-compliance-bounces@xxxxxxxxxxx> im Auftrag von Juan Rico via open-regulatory-compliance <open-regulatory-compliance@xxxxxxxxxxx>
Datum: Freitag, 4. September 2026 um 22:01
An: Open Regulatory Compliance Working Group <open-regulatory-compliance@xxxxxxxxxxx>
Cc: Juan Rico <juan.rico@xxxxxxxxxxxxxxxxxxxxxx>
Betreff: [open-regulatory-compliance] Update on reporting obligations for open source software stewards

Dear ORC community, and especially to those planning to act as stewards!

The European Commission has updated the EC CRA FAQ today bringing clarity to a topic that has been largely discussed.

The new FAQ entry published today 5.5 says:

"5.5 Are open-source software stewards subject to reporting obligations under the CRA?
Article 24(3) of the CRA establishes that reporting obligations laid down in Article 14, paragraphs (1), (3) and (8), apply to open-source software stewards under certain
circumstances.
In accordance with Article 71(2) of the CRA, Article 24(3) shall apply from 11 December 2027."

Hope this helps, have a great weekend.

Juan

--

Juan Rico

Senior Manager ORC, Oniro and Cloud Programs | Eclipse Foundation Europe GmbH | X | LinkedIn | YouTube | Instagram | Bluesky | Mastodon

Eclipse Foundation: The Community for Open Collaboration and Innovation

Berliner Allee 47, 64295 Darmstadt

Handelsregister: Darmstadt HRB 92821

Managing Directors: Gaël Blondelle, Mike Milinkovich, Michael Plagge