Recommended Free Tools
Short answer: not yet. Open-source security support is improving, but most projects and many companies have not turned awareness of the EU Cyber Resilience Act (CRA) into repeatable operations. A 2026 survey found that 66% of respondents were not familiar with the CRA or only slightly familiar, 41% had not decided whether it applied to them, and just 32% produced software bills of materials (SBOMs) for all products.
The critical distinction is legal, not merely technical: the CRA regulates products with digital elements placed on the EU market. It does not make every volunteer who publishes code an obligated manufacturer. The main product-level duties usually sit with manufacturers, while some legal persons that sustainably support commercially intended free and open-source software may qualify as open-source software stewards under a lighter, tailored regime.
The two dates that make this an immediate issue
The CRA entered into force on December 10, 2024. Its obligations arrive in stages, so “the CRA deadline” is misleading.
| Date | What happens |
|---|---|
| December 10, 2024 | The regulation entered into force. |
| June 11, 2026 | Provisions on notifying conformity-assessment bodies began applying. |
| July 27, 2026 | The European Commission published its first implementation guidance. |
| September 11, 2026 | CRA vulnerability and severe-incident reporting obligations begin applying; the Single Reporting Platform is scheduled to be operational. |
| December 11, 2026 | Sufficient conformity-assessment bodies are expected to have been notified. |
| October 30, 2027 | Additional standardisation deliverables are scheduled. |
| December 11, 2027 | The CRA becomes fully applicable. |
The September 11, 2026 date is therefore an operational cliff, not the date on which every requirement suddenly becomes fully applicable. Manufacturers need reporting escalation and evidence processes before that date, while the wider product-compliance regime reaches full application on December 11, 2027. See the Commission’s implementation timeline and reporting guidance.
#1 Best Overall
What the CRA actually regulates
The CRA is a horizontal EU product-security regulation for “products with digital elements”: hardware and software capable of connecting, directly or indirectly, to a device or network, subject to the regulation’s exclusions and classifications. It addresses security throughout a product’s life cycle, including design, vulnerability handling, documentation, conformity assessment and post-market responsibilities. The Commission’s summary and overview explain the product scope.
This is not an “open-source law.” Open-source code becomes relevant when it is embedded in, bundled with or used to build a regulated commercial product. The company placing that finished product on the EU market remains accountable for the product-level result, even when much of the code originated in a public repository.
Who carries which responsibility?
| Actor | Typical CRA position | Main practical concern |
|---|---|---|
| Individual volunteer maintainer | Usually not a commercial manufacturer merely because code is published. | Whether activity is genuinely non-commercial and whether a legal person is involved. |
| Non-commercial open-source project | Receives important protection compared with commercial product activity. | Avoiding accidental commercialisation while maintaining sensible security practices. |
| Open-source software steward | A legal person that systematically and sustainably supports commercially intended FOSS and plays a main role in its viability may fall into a lighter, tailored regime. | Vulnerability handling, documentation, cooperation and clear boundaries around the projects it stewards. |
| Commercial manufacturer | Primary product-level duty holder. | Security by design, vulnerability handling, technical documentation, conformity assessment, CE marking, reporting and support. |
| Importer or distributor | Must perform checks before making relevant products available in the EU. | Due diligence on the manufacturer, documentation and conformity obligations. |
The licence alone does not answer the question. Relevant facts include commercial intent, sustained and systematic support, organisational structure, monetisation, and who ensures a project’s viability. The Commission’s open-source explanation and the regulation itself should be read together.
What an open-source software steward should put in place
The steward regime is not the same as manufacturer compliance. The legal text describes it as light-touch and tailor-made, while detailed expectations will continue to depend on guidance, standards and regulatory interpretation. A foundation or company that may qualify should nevertheless establish:
Free tools Windows power users keep installed
One-click scans. No signup required.
- A documented vulnerability-intake, triage and remediation process.
- A coordinated vulnerability-disclosure policy and a monitored security contact.
- Defined channels for cooperation with downstream manufacturers and, where relevant, authorities or CSIRTs.
- Basic security documentation and project information that can be kept current.
- Evidence of security-relevant decisions, releases, advisories and upstream coordination.
- A written boundary between stewardship, paid support, hosting, consulting and manufacturing.
- A register identifying which projects the organisation actually stewards, rather than assuming that every hosted repository is covered.
A foundation funded by corporate members is not automatically exempt or automatically liable. Likewise, a company that publishes a free library while selling support may be acting as a steward, service provider, manufacturer or several of these at once. The facts of the activity matter more than the label.
What manufacturers must do with open-source dependencies
Manufacturers cannot transfer CRA responsibility to an upstream community. Their process should connect each shipped product, build and support period to the software and decisions behind it.
- Inventory the product. Record products supplied or planned for the EU, intended use, category, exclusions and market route.
- Assign legal roles. Identify manufacturer, importer, distributor, steward, component supplier and service-provider relationships.
- Freeze product identity. Define product name, version, build, release date and support period, then tie every test and SBOM to a reproducible release.
- Generate a product SBOM. Capture direct and transitive components actually shipped, versions, suppliers, licences, hashes and build provenance where technically possible.
- Monitor and triage vulnerabilities. Determine whether a reported issue reaches the product, is exploitable in its configuration and requires a fix, workaround, communication or documented risk acceptance.
- Coordinate upstream. Work with maintainers when a fix is needed, while retaining product-specific evidence and ownership of the downstream decision.
- Operate coordinated disclosure. Publish a security contact, define acknowledgement and escalation routes, and coordinate timing with maintainers and relevant authorities.
- Prepare reporting. Decide who determines whether a vulnerability is actively exploited or an incident is severe, and maintain an escalation path capable of meeting applicable deadlines.
- Build the technical file. Retain the risk assessment, security requirements, testing, SBOM, vulnerability decisions, support commitments and conformity material.
- Fund upstream resilience. Sponsor critical projects or provide security and incident-response help instead of demanding unpaid compliance paperwork from volunteers.
A vulnerable library listed in an advisory is not automatically an exploitable vulnerability in every downstream product. A manufacturer should retain technical evidence about reachability, configuration, attack surface and mitigations supporting its conclusion. Conversely, a raw “not affected” assertion without evidence is weak protection in an audit or incident.
Why SBOMs matter—and why they are not compliance
An SBOM is a traceable inventory of components in a particular product build. It helps teams identify direct and transitive dependencies, map vulnerabilities to releases, track remediation and communicate with upstream projects. It also creates evidence for customers, auditors and authorities.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Only 32% of respondents in the 2026 CRA Awareness and Readiness Report said they produced SBOMs for all products, illustrating the operational gap. The report is available at OpenSSF.
SBOM limitations are material:
- A source manifest may not describe the final binary, firmware image or container.
- Generated code, vendored libraries and build-time components can be missed.
- Formats and metadata quality vary.
- A vulnerability match does not prove reachability or exploitability.
- An SBOM becomes stale unless linked to a specific build and release.
- A project SBOM does not automatically describe a manufacturer’s complete product, including proprietary code and hardware interfaces.
An SBOM therefore enables vulnerability management; it does not prove secure design, safe defaults, effective disclosure, patch availability, conformity or product-level risk control.
What the 2026 readiness evidence says
The 2026 CRA Awareness and Readiness Report surveyed 843 respondents and analysed more than 12,000 open-source projects. It is useful evidence of awareness and practice, not a probability sample of the global open-source population. Respondents came from Linux Foundation subscribers, partner communities and social media, and the steward-specific module had only 28 respondents.
- 66% were not familiar with the CRA or only slightly familiar.
- 41% had not determined whether it applied to them.
- 46% were uncertain about the deadlines.
- Only 34% correctly identified 2027 as the full-compliance year.
- 51% relied passively on upstream projects for security fixes, up from 46%.
- 61% of non-commercial developers were unsure of their status.
- 62% of surveyed SMEs relied on open source for more than three-quarters of their products.
- 47% of manufacturers in the SME segment expected to raise prices to cover compliance costs.
The report also recorded a 394% year-over-year increase in published CVEs in the analysed LFX-indexed projects in the first quarter of 2026, with high-severity findings up 811%. Those are publication counts in that dataset, not proof that open-source software became 394% less secure. The report points to possible explanations including improved automated scanning, AI-assisted analysis and CRA-prompted auditing.
Rank #4
September 11, 2026: the reporting cliff
The CRA Single Reporting Platform is scheduled to become operational on September 11, 2026. It is intended to support reporting of actively exploited vulnerabilities and severe incidents affecting products with digital elements. ENISA describes the platform at its SRP page.
Reporting duties belong to the relevant regulated actors and product context. This does not mean every individual maintainer must personally file a 24-hour report. A manufacturer should have a named decision-maker, severity and exploitation criteria, escalation contacts, prepared product identifiers and a process for preserving the facts supplied to the platform.
Reporting is also distinct from full product compliance and from the lighter steward regime. Treating all three as one obligation creates both unnecessary fear among volunteers and dangerous complacency among manufacturers.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.The weakest link may be capacity, not code
Critical projects can be maintained by a handful of volunteers while their code supports products worth millions of euros. When a maintainer cannot patch quickly, manufacturers may face unsupported dependencies, private forks, incomplete SBOMs and uncertain disclosure channels. The CRA could improve this incentive structure if manufacturers fund upstream security work, share vulnerability intelligence and contribute engineering capacity. It could also create harm if organisations push manufacturer-style paperwork onto unpaid contributors or abandon useful projects rather than support them.
Best Value
Manufacturers should not simply say “the open-source project is responsible.” Their duty is to monitor, evaluate, document and communicate dependency risk in the product they sell. A downstream company that stops selling an old product also needs legal advice on continuing support, reporting and post-market duties; “discontinued” is not a universal escape from obligations for products already placed on the market.
Support infrastructure is growing, but reach remains uneven
OpenSSF maintains a CRA policy hub. The Linux Foundation has published maintainer and steward guidance, including its 2026 assessment of readiness at its CRA analysis. In June 2026, the Eclipse Foundation and Open Regulatory Compliance Working Group announced a CRA Learning Hub.
These resources improve the ecosystem’s support infrastructure, but availability is not adoption. The survey evidence shows that the smallest projects and organisations still have the least capacity to convert guidance into named owners, repeatable workflows and retained evidence.
A practical readiness test
For an individual maintainer or volunteer project
- Identify whether a legal person commercially supports or controls the project.
- Publish a security contact and a realistic disclosure process.
- Keep release and dependency information accurate where capacity allows.
- Do not assume that heavy commercial use turns you into a manufacturer.
- Ask downstream users to fund security work rather than accepting obligations you cannot perform.
For a foundation or possible steward
- Map projects, staff, funding, support commitments and commercial intent.
- Document the organisation’s role in each project’s viability.
- Maintain vulnerability handling, disclosure, cooperation and evidence procedures.
- Separate stewardship from paid hosting, consulting and product manufacture.
- Obtain fact-specific legal advice where the boundaries are unclear.
For a commercial manufacturer
- Maintain an EU product applicability register and role map.
- Produce release-specific SBOMs that reflect shipped artifacts.
- Assign vulnerability owners and support-period responsibilities.
- Test upstream coordination and reporting escalation before September 11, 2026.
- Retain evidence for exploitability decisions, fixes, communications and conformity.
- Budget for upstream security instead of relying solely on volunteer labour.
For an SME dependent on open source
- Prioritise products placed on the EU market, not every internal script.
- Start with inventory and release-to-SBOM traceability.
- Choose tools based on firmware, binary, air-gapped and export requirements, not marketing claims alone.
- Scale governance as product scope grows; a scanning tool cannot replace accountable risk decisions.
Bottom line
The open-source ecosystem is becoming better informed and better supported, but it is not uniformly prepared for the CRA. The evidence points to an awareness and execution gap: many practitioners do not know whether the law applies to them, and too few organisations have complete SBOM, vulnerability-response and reporting operations.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →The fairest reading is neither “every maintainer is liable” nor “open source is exempt.” Volunteer projects, stewards, manufacturers, importers and distributors occupy different legal positions. Manufacturers placing products on the EU market carry the central product-level burden, while qualifying stewards face a lighter regime. If companies invest in upstream capacity and build evidence-led product processes before the September 11, 2026 reporting date, the CRA can strengthen the software supply chain rather than merely shifting paperwork onto the people least able to carry it.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
