An analysis of the EU Cyber Resilience Act, which covers every connected device and almost all software, causing open-source developers to worry about its scope
Context & Ripple Effects
When EU lawmakers proposed the Cyber Resilience Act in September 2022, it was framed as a rulebook for IoT and smart-device makers facing fines for weak security. Bert Hubert's analysis widens that frame dramatically: the Act as drafted covers every connected device and almost all software, which is why open-source developers — not just gadget vendors — are suddenly worried about its scope.
The breadth is consistent with how Brussels has been extending digital regulation: the 2015 rules already forced critical providers to harden infrastructure and report major security incidents, and separate EU plans would require companies to scan for CSAM, alarming privacy experts. The Cyber Resilience Act reads as the next step in that expansion — this time reaching into the code supply chain itself.
First-order effects
- Open-source developers and maintainers fall within the Act's potential scope, since it covers almost all software, not just commercial IoT products — a compliance burden falling on volunteers who never asked to be regulated vendors.
- Connected-device makers selling into the EU now face security requirements backed by fines under the Act's original design, extending obligations well beyond the smart-device categories named at proposal time.
Second-order effects
- Commercial vendors may respond by reducing reliance on open-source components they cannot get warranty or support commitments for, shifting procurement toward commercially maintained code and pressuring foundations to formalize stewardship.
- The open-source community's alarm becomes a lobbying position: developers and foundations have an immediate stake in pushing Brussels to carve out non-commercial or hobbyist software before the rules harden.
Third-order effects
- If the pattern holds, EU regulation evolves from policing finished devices toward governing the entire software supply chain — who maintains code, how vulnerabilities are handled, and who carries liability when volunteer-built components ship inside commercial products.
- The Act joins a broader Brussels arc — CSAM scanning mandates, collective risk assessments on chips and AI, and a tech-sovereignty agenda — suggesting the EU is positioning itself as the de facto global regulator of digital infrastructure, with compliance costs rippling far beyond European borders.
The trend: EU digital regulation is expanding from sector-specific rules toward blanket coverage of connected products and the software supply chain, forcing open-source governance into the compliance conversation.