The Timeline
The European Commission's CRA overview gives three distinct milestones. The Act entered into force on 10 December 2024. Reporting obligations apply from 11 September 2026, while the main obligations apply from 11 December 2027. The Commission also published practical guidance on 27 July 2026 to help manufacturers, developers, and businesses understand their obligations.
Keep these milestones separate when reading a project's description. An entry-into-force date and an application date answer different questions; the reporting timetable is another distinction again. For a software directory reader, the useful habit is to identify which part of the timetable a statement refers to before drawing conclusions about a particular program.
When Free and Open-Source Software Is in Scope
The Commission's open-source explanation states that free and open-source software falls within the CRA's scope only when made available on the market. It explains this as supply for distribution or use in the course of a commercial activity. It also states that free and open-source products not monetised by their manufacturers should not be considered a commercial activity.
The same explanation excludes developers who contribute source code to free and open-source software outside their responsibility. These distinctions describe how the Commission treats different development and distribution models. They do not reduce the question to whether a download happens to cost nothing.
When comparing projects, read the license information alongside the description of who supplies and supports the software. For example, ask whether you are looking at a project contribution, a product supplied commercially, or sustained support by a separate organisation. Use the Commission's distinctions to frame the questions, rather than assigning a legal category from a short directory listing.
Open-Source Software Stewards
The Commission describes a category called open-source software stewards. These are legal persons providing sustained support for the development of free and open-source products intended for commercial activities, with a main role in ensuring their viability. The category addresses products that are published but not made available on the market within the meaning of the Act.
Its explanation describes a tailored regime under Article 24: a cybersecurity policy covering secure development and vulnerability handling, cooperation with market surveillance authorities, and reporting of actively exploited vulnerabilities and severe incidents affecting product security. Under Article 64(10), stewards are not subject to administrative fines for infringements of the CRA.
For readers, the practical point is to understand the role being described. A contributor and a steward are not interchangeable labels in the Commission's account. If project documentation names a supporting organisation, read what that organisation says its responsibilities are before treating its presence as an answer to every support question.
Software Bills of Materials
CISA describes a software bill of materials, or SBOM, as an ingredients list for software. On 29 July 2026, CISA, the National Security Agency, the Federal Bureau of Investigation, and international partners released 2026 Minimum Elements for a Software Bill of Materials. The guidance replaces the minimum elements published by NTIA in 2021.
CISA says SBOM data helps organisations understand software components and supply chains and make more informed decisions about risk. It describes the minimum elements as baseline technologies and practices for an SBOM. This gives a reader a useful purpose for component information: understanding what makes up the software being considered.
Keep that purpose distinct from the Commission's timetable and scope explanation. A component record answers questions about software makeup. The CRA guidance describes the regulatory distinctions discussed above. When examining an SBOM, start by identifying which release it describes and what information it gives you, rather than treating the document's title as a complete assessment of the program.
What It Means When You Choose Free Software
A practical comparison starts with clear questions. Who supplies the release? What does its license permit? Where is its support and security information? Does the documentation explain the components included? Read these details together so that a familiar project name or a free price does not carry more weight than the available information.
For ordinary browsing, the Commission's explanations help clarify terminology and the stages of the timetable. CISA's guidance explains why software component records matter. Neither requires a reader to infer a project's full circumstances from a license badge. Keep the distinctions in mind, follow the documentation for the program you are considering, and use the official explanations when a short description leaves its distribution model unclear.