CRA Article 14 for open-source software stewards: reporting from December 2027

Two calendars, one Regulation

Article 71(2) brings most of the Cyber Resilience Act into application on 11 December 2027, but pulls Article 14 forward to 11 September 2026 for manufacturers. Article 24 — the steward regime — is not in that early list. So the manufacturer reporting chain is live; the steward reporting extension waits for the general application date. The Commission states that plainly on its CRA reporting obligations page: stewards are subject to reporting obligations (Article 24(3)) from 11 December 2027.

Who is a steward (and who is not)

Article 3(14) defines an open-source software steward as a legal person other than a manufacturer that systematically provides sustained support for the development of specific free and open-source products with digital elements intended for commercial activities, and that ensures those products' viability. Recital 19 names foundations and entities that host collaboration platforms or source code, govern a project, or steer its development. Sustained support for FOSS that is ultimately intended for commercial integration or services is the target — not every GitHub organisation and not every volunteer.

Recital 18 also draws a hard line for contributors: the Regulation does not apply to natural or legal persons who contribute source code to FOSS products that are not under their responsibility. If you only send patches, you are not automatically a steward or a manufacturer.

What Article 24(3) actually imports from Article 14

The steward regime does not copy every manufacturer duty. Article 24(3) says:

• The obligations in Article 14(1) (notify actively exploited vulnerabilities via the single reporting platform) apply to stewards to the extent that they are involved in the development of the products with digital elements.
• The obligations in Article 14(3) and (8) (severe-incident notification chain and informing users) apply to the extent that severe incidents having an impact on the security of those products affect network and information systems provided by the steward for the development of such products.

When those duties apply, the staged clocks look like the manufacturer chain — 24-hour early warning, 72-hour notification, then the final-report rules for the relevant path. Use the reporting deadlines guide and becoming-aware guide to understand how those clocks run; just remember the steward start date is December 2027.

Other steward duties (policy and cooperation)

Article 24(1) and (2) sit beside reporting: a documented, verifiable cybersecurity policy for vulnerability handling and community information-sharing (including fostering voluntary reporting under Article 15), plus cooperation with market surveillance authorities and supplying that policy documentation on a reasoned request. Those also track the 11 December 2027 application of Article 24 — they are not a substitute for manufacturer Article 14 work if you are also placing products on the market.

Manufacturer vs steward — pick the role that matches the product

Confusion usually comes from FOSS inside a commercial product. If your organisation places that product on the EU market under its own name or trademark in a commercial activity, Article 14 already applies to you as manufacturer. Stewardship is for legal persons who support FOSS development without being that manufacturer. An organisation can wear different hats for different products — track each case under the role that fits that product. Importers and distributors have a separate path again; see Article 14 for importers and distributors.

Fines and enforcement

Article 64(10) exempts open-source software stewards from the administrative fines in that article. That is a broader carve-out than the micro/small early-warning exemption for manufacturers. It does not mean "no duties" once Article 24 applies, and market surveillance authorities still supervise steward obligations under Article 52. Manufacturer ceilings and what to do if you are already late are covered in CRA Article 14 fines.

Questions people ask

Do open-source software stewards have to file Article 14 reports today?

No. Manufacturer reporting under Article 14 has applied since 11 September 2026. Steward reporting under Article 24(3) applies from 11 December 2027, per Article 71(2) and the Commission’s CRA reporting page / FAQ 5.5. Until that date, the ENISA Single Reporting Platform’s mandatory steward path is not live for those duties.

Who counts as an open-source software steward?

Article 3(14): a legal person, other than a manufacturer, whose purpose is systematically providing sustained support for the development of specific free and open-source products with digital elements intended for commercial activities, and who ensures those products’ viability. Recital 19 points to foundations and entities that host, govern, or steer such projects. Individual contributors of source code who are not responsible for the product are not stewards.

What exactly will stewards have to report?

Article 24(3) pulls in only parts of Article 14: the actively exploited vulnerability duties in Article 14(1) apply to the extent the steward is involved in developing the product; the severe-incident duties in Article 14(3) and the user-information duty in Article 14(8) apply to the extent a severe incident affecting product security hits network and information systems the steward provides for that development. It is not a full copy of every manufacturer obligation.

We ship commercial products that include open-source components — are we a steward?

Usually no. If you place a product with digital elements on the EU market under your own name or trademark in the course of a commercial activity, you are a manufacturer. Manufacturer Article 14 duties already apply to you from 11 September 2026 — including where the actively exploited vulnerability is in an open-source component you integrated (Commission FAQ 5.4). Stewardship is a separate, lighter role for organisations that support FOSS intended for commercial use without being the manufacturer of that product.

Are stewards fined for missing Article 14 clocks?

Article 64(10) exempts open-source software stewards from the administrative fines in that article (as corrected by the July 2025 corrigendum). That does not erase the duty once Article 24(3) applies, and market surveillance still has cooperation and corrective-action tools under Article 24 and Article 52. See our fines guide for the manufacturer-side ceilings.

Where will steward notifications go?

Through the same ENISA Single Reporting Platform manufacturers use today. The Commission and ENISA both describe the SRP as the channel for manufacturer and steward notifications; steward mandatory reporting is timed to the December 2027 application of Article 24(3).