Security · Flashcard
A maintainer publishes an open-source library and does not monetise it. How does the CRA treat that?
- AIt is not a commercial activity, so the regulation's manufacturer obligations do not attach
- BIt is a commercial activity as soon as businesses depend on the library in production
- CIt is a commercial activity once the project accepts donations of any size at all
- DIt is outside the regulation only while the project has no EU-based maintainers
Why this is the answer
Supplying free and open-source software that its manufacturers do not monetise is explicitly not considered a commercial activity, so publishing a library does not turn a maintainer into a CRA manufacturer. Downstream adoption by companies does not change that — the obligations follow whoever places the commercial product on the market — and maintainer location is not part of the test.
Official docs