European UnionCyber Resilience Act, Obligations of Open-Source Software Stewards
Regulation (EU) 2024/2847, Art. 24
A product security requirements rule binding public and private bodies.
- Private right of action
- No
- Obligation class
- Security, Governance
As of .
What it requires
- These duties apply from (Article 71(2)). They bind an open-source software steward: a legal person, other than a manufacturer, that has the purpose or objective of systematically providing support on a sustained basis for the development of specific products with digital elements, qualifying as free and open-source software and intended for commercial activities, and that ensures the viability of those products (Article 3(14)).
- Put in place and document, in a verifiable manner, a cybersecurity policy to foster the development of a secure product with digital elements and an effective handling of vulnerabilities by the developers of that product. Make the policy foster the voluntary reporting of vulnerabilities under Article 15 by those developers, take into account your specific nature and the legal and organizational arrangements to which you are subject, and include aspects related to documenting, addressing and remediating vulnerabilities and promote the sharing of information concerning discovered vulnerabilities within the open-source community (Article 24(1)).NIST CSF 2.0GV.PO-01
- Cooperate with the market surveillance authorities, at their request, with a view to mitigating the cybersecurity risks posed by a product with digital elements qualifying as free and open-source software, and, on a reasoned request, give the authority the documentation of your policy in a language it can easily understand, in paper or electronic form (Article 24(2)).NIST CSF 2.0GV.OC-03
- To the extent that you are involved in the development of products with digital elements, notify any actively exploited vulnerability contained in a product, of which you become aware, to the CSIRT designated as coordinator and to ENISA through the single reporting platform, as Article 14(1) requires of a manufacturer (Article 24(3)).NIST CSF 2.0RS.CO-02
- To the extent that severe incidents having an impact on the security of products with digital elements affect the network and information systems you provide for the development of such products, notify the severe incident as Article 14(3) requires of a manufacturer, and inform the impacted users as Article 14(8) requires of a manufacturer (Article 24(3)).NIST CSF 2.0RS.CO-02
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST Privacy Framework
- NIST CSF 2.0
- GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
- GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
- RS.CO-02Internal and external stakeholders are notified of incidents
- CIS Controls
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
Who enforces it
Enforcement body
The market surveillance authority designated by each EU Member State under Article 52 of the Regulation, working with the CSIRT designated as coordinator and ENISA under the single reporting platform established by Article 16.
Settledness
- As of
- Open questions
- When does a legal person that supports an open-source product only through code contributions, funding or hosting have the purpose of systematically providing support on a sustained basis for its development and ensure its viability, so that it is an open-source software steward under Article 3, point (14), rather than a non-obligated contributor?
What this law does
Article 24 binds an open-source software steward, which Article 3(14) defines as a legal person, other than a manufacturer, that has the purpose or objective of systematically providing support on a sustained basis for the development of specific products with digital elements, qualifying as free and open-source software and intended for commercial activities, and that ensures the viability of those products.
Article 24(1) requires a steward to put in place and document in a verifiable manner a cybersecurity policy to foster the development of a secure product with digital elements and an effective handling of vulnerabilities by the developers of that product.
That policy must also foster the voluntary reporting of vulnerabilities under Article 15 by those developers and take into account the steward's specific nature and its legal and organizational arrangements, and it must in particular include aspects related to documenting, addressing and remediating vulnerabilities and promote the sharing of information concerning discovered vulnerabilities within the open-source community.
Article 24(2) requires a steward to cooperate with the market surveillance authorities, at their request, with a view to mitigating the cybersecurity risks posed by a product with digital elements qualifying as free and open-source software, and, on a reasoned request, to give the authority the documentation of its policy in a language that authority can easily understand, in paper or electronic form.
Article 24(3) applies the obligations of Article 14(1) to a steward to the extent that it is involved in the development of the products with digital elements, and applies those of Article 14(3) and (8) to the extent that severe incidents having an impact on the security of those products affect network and information systems that the steward provides for their development. Article 71(2) makes the Regulation, Article 24 included, apply from .
Article 64(10), point (b), exempts any infringement of the Regulation by an open-source software steward from the administrative fines of Article 64(3) to (9).
When LexLint raises it
When your app profile says your app distributes a software product.