An analysis of the EU Cyber Resilience Act, which covers every connected device and almost all software, causing open-source developers to worry about its scope
The EU's new Cyber Resilience Act is admirable in its goal. And the EU is not alone in thinking something needs to be done … Tweets: @lukolejnik , @alecmuffett , @kaepora , @rafbuff , @bert_hu_bert , @cartron , and @kaliszad Tweets: Lukasz Olejnik / @lukolejnik : New EU proposal for a regulation may mean the immediate prohibition of shipping and using products or apps if a security vulnerability is found. This is extreme and sounds like censorship. Huge control delegated to untransparent and unelected bodies. https://berthub.eu/... Alec Muffett / @alecmuffett : Buggy or not, code is *speech* and state-imposed obligations tread upon prior restraint & chilled speech. Sure, emplace quality standards on industries like medical or aerospace hardware; but across-the-board this approach is illiberal and misconceived. https://berthub.eu/... https://twitter.com/... Nadim Kobeissi / @kaepora : If you work in security auditing in the EU, this is an extremely important read. Make sure you read this and pass it on: https://berthub.eu/... Rafael Laguna de la Vera / @rafbuff : If you didn't find the time to dig in to the Cyber Resilience Act but are afraid that it might do something not so clever - as always my friend @bert_hu_bert / @bert_hubert has a very readable explainer about what's going on and what's at stake #OpenSource https://twitter.com/... Bert Hubert / @bert_hu_bert : New post: The EU's new Cyber Resilience Act is about to tell us how to code, and fine us hugely if we don't. https://berthub.eu/... @cartron : As usual, Bert does an excellent analysis of the CRA and his thoughts on what's good and what could go wrong/be improved. Worth reading! https://twitter.com/... Adam Kalisz / @kaliszad : Great article by @bert_hu_bert illuminating the recent EU Cyber Resilience Act (CRA) proposal https://berthub.eu/... From what I know about most audits and certifications, it would almost certainly make selling or just writing software with occasional donations complete hell.
Context & Ripple Effects
The Cyber Resilience Act lands in a familiar Brussels sequence: after plans to tighten export controls on dual-use tech including hacking tools (dual-use export controls) and amid the fight over message scanning, the EU is again reaching for horizontal rules that treat software itself as a regulated product. Bert Hubert's analysis credits the goal but argues the scope — every connected device, almost all software — sweeps in maintainers who never asked to be manufacturers.
The reaction Hubert aggregates is telling: Lukasz Olejnik reads the proposal as permitting an immediate halt to shipping or using a product once a vulnerability is found, while Alec Muffett frames buggy code as speech. That puts the CRA alongside other European measures drawing similar objections, from the UK's Investigatory Powers revision threatening end-to-end encryption to Johansson's scanning proposal, where Muffett has also been a public critic.
First-order effects
- Open-source developers — not just device vendors — become potential liable parties for software they give away, since the Act covers almost all software regardless of commercial intent.
- Under Olejnik's reading, discovering a serious vulnerability can force an immediate stop to distribution and use, turning routine disclosure into a legal decision for anyone shipping code into the EU.
Second-order effects
- Vendors who bundle open-source components inherit the compliance burden, so they will pressure upstream projects for warranties, SBOMs, and signed processes — reshaping volunteer-driven projects around enterprise liability rather than contributor goodwill.
- Security researchers and critics like Olejnik and Muffett gain a concrete regulatory target, and the episode hands ammunition to parallel fights over encryption and scanning, where the same actors argue that mandated control points weaken security rather than strengthen it.
Third-order effects
- If the CRA's structure holds, the EU normalizes delegated enforcement bodies with power to block products across the single market — the same enforcement-surface pattern later visible when the Commission issued a voluntary AI Act code of practice with documentation duties for developers.
- For Hubert's broader project of building a coherent European cloud alternative, the CRA cuts both ways: it aims to make European software trustworthy by default, yet if compliance costs push hobbyist and small maintainers out, the continent's software base thins at exactly the layer industrial policy needs most.
The trend: Europe is regulating the entire software supply chain through horizontal product-liability regimes, with unpaid open-source maintenance as the recurring collision point between security mandates and how code actually gets written.