Answer the questions and see the reasoning.
Assess one supply arrangement at a time
The open-source licence matters, but it is not the complete commercial-activity test. The July 2026 guidance focuses on the particular product supply: who publishes it, how access or maintenance is provided and what is monetised.
A freely available community edition and a paid enterprise edition may lead to different roles for the same organisation. Do not assume a donation, corporate contributor or commercial downstream user makes every upstream copy commercially supplied.
Support services and paid editions differ
Optional consulting, training or deployment services around freely available FOSS do not, by themselves, make its supply commercial. Where access to a particular edition or its maintenance is conditioned on payment, the guidance identifies a different supply arrangement.
Payments solely recovering actual development costs need separate analysis; the Commission guidance distinguishes these from monetised supply. Record the actual terms. “Free download” is insufficient if necessary access or a supplied paid version is monetised. Similarly, “paid support” is too broad a label to decide the result without understanding what the customer receives.
Contributor, steward or manufacturer?
An individual contributor does not automatically become a manufacturer or steward. The steward definition requires a legal person, systematic sustained support for specific FOSS intended for commercial activities, and ensuring its viability, other than acting as manufacturer for that supply.
Stewards have a cybersecurity-policy and cooperation framework under Article 24. Reporting applies to the extent specified there, including involvement in development and relevant development infrastructure. Stewardship is not a declaration that all CRA duties disappear.
Manufacturer reporting obligations under Article 14 apply from 11 September 2026. The separate reporting obligations of open-source software stewards under Article 24(3) apply from 11 December 2027, in accordance with Article 71(2). An organisation acting as manufacturer for a separately supplied commercial product must assess that role independently.
Downstream manufacturers keep their own responsibilities
A manufacturer using a FOSS component in a commercial product still has due-diligence and product-security obligations. The non-commercial position of an upstream contributor does not exempt the finished product.
For a commercially supplied Important Class I or II FOSS product, Article 32(5) may allow internal control if technical documentation is public. This is a conformity route condition, separate from determining scope and the supplier’s role.
Dates and next actions
Article 14 reporting for manufacturers applies from 11 September 2026, including to older in-scope products. Most requirements apply from 11 December 2027, subject to the rules for products already placed on the market and subsequent substantial modifications.
If you are the manufacturer of an in-scope product, establish the product risk assessment, support-period decision, vulnerability handling and technical documentation. Select the applicable conformity route before making a compliance claim. A reseller should use the importer and distributor assessment for its distinct duties.
Frequently asked questions
Does accepting donations automatically trigger manufacturer duties?
No. Assess the concrete arrangement, including any obligations attached to funding, commercial supply and the entity’s role.
Can one organisation be both a steward and a manufacturer?
Yes, for different supplies or products. The guidance gives distinct treatment to freely supplied community FOSS and paid editions.