html

Imagine a city discovers that every lift, water pump and traffic signal it depends on was installed — and is still serviced — by three unpaid volunteers working nights. Then imagine the council's response is to require those volunteers to file a fault report with the regulator within 24 hours. That is not a parable about competence. It is a fair description of the arrangement European industry has relied on for two decades, and of the legal clock that started running against it on 11 September 2026.

A Regulatory Stopwatch Nobody Heard Start

Article 14 of the EU Cyber Resilience Act (Regulation (EU) 2024/2847) became applicable on 11 September 2026, obliging manufacturers — and, under a narrower regime, "open-source software stewards" — to send an early warning to ENISA and national CSIRTs within 24 hours of becoming aware that a vulnerability in a product with digital elements is being actively exploited. The remainder of the regulation applies from 11 December 2027, which makes the next fourteen months a rehearsal that already carries legal weight.

Five developments underpinning this analysis

  1. 11 Sep 2026 — CRA Art. 14 incident and exploited-vulnerability reporting goes live via ENISA's single reporting platform.
  2. 10 Dec 2024 → 11 Dec 2027 — CRA in force; full conformity, CE-marking and support-period duties land at the end of the transition.
  3. 2024–2026 — Schleswig-Holstein's migration of roughly 30,000 public-sector workstations to LibreOffice and Linux moves from resolution to rollout.
  4. 2023–2025 — Licence volatility hardens into forks: Terraform→OpenTofu, Redis→Valkey, followed by partial reversals at Elastic and Redis.
  5. 2025–2026 — Maintainer intake collapses under machine-generated vulnerability reports; curl moves to wind down its paid bug bounty.

Where the Liability Actually Lands

The regulated unit is a product; open source ships components. The CRA's steward category — a legal person that systematically supports the development of free and open source destined for commercial use — resolves that mismatch by routing obligations toward organisations rather than pseudonymous contributors. The second-order effect is governance arbitrage. Foundations become liability shelters. Expect projects that once resisted institutional affiliation to seek it precisely for the legal wrapper, and expect foundation membership terms, trademark custody and release-signing authority to be repriced as risk-transfer instruments. This is industrial policy for foundations, delivered through product-safety law, and almost nobody is covering it that way.

Your SBOM cannot see a licence change. Terraform's move to the Business Source Licence in 2023 and Redis's 2024 shift away from BSD produced OpenTofu and Valkey within months, both under Linux Foundation stewardship; Elastic and Redis subsequently restored AGPL options. Code risk was never the exposure — governance risk was. The Census II study by the Linux Foundation and Harvard's Laboratory for Innovation Science found that just 136 developers accounted for more than 80% of code added across the top 50 non-npm packages.[1] Procurement teams now need a governance bill of materials alongside the software one: bus factor, contributor-licence-agreement ownership, trademark holder, and who controls the signing keys.

The clock starts on awareness, and awareness is now adversarial. curl's maintainer Daniel Stenberg documented the flood of plausible-but-fabricated machine-generated security reports in his 2025 essay "Death by a thousand slops," a triage burden that preceded the project's decision to retire its paid bounty.[2] Pair that with a 24-hour statutory trigger and the incentive structure turns perverse: an unmonitored security@ address becomes a compliance asset, and looking becomes a liability. Regulators have inadvertently priced curiosity.

CounterpointThe Rulebook Has a Case

The argument above reads as an indictment, and it should not. Article 24 is a deliberately lighter regime, not a mandate to industrialise volunteer work, and the drafting explicitly contemplates non-commercial hobby development outside scope. A single EU-wide duty also displaces the emerging patchwork of 27 national interpretations that would have been far costlier for small vendors. More uncomfortably for the deregulatory position: the absence of any duty of care is what produced a two-year social-engineering operation against xz-utils. Black Duck's 2024 Open Source Security and Risk Analysis found open source in 96% of scanned codebases and at least one known vulnerability in 84% of them.[3] A market that externalised that ratio for twenty years has limited standing to complain about the invoice.

Heartbleed's Unfinished Lesson

The precedent is April 2014. Heartbleed triggered the Core Infrastructure Initiative, which became the OpenSSF, which eventually begat national maintenance funding such as Germany's Sovereign Tech Fund. Capital arrived; the maintenance model did not change. Ten years later, the xz backdoor was caught not by an audit but by an engineer annoyed at latency. Andres Freund's oss-security post of 29 March 2024 remains the most damning sentence in modern supply-chain security: "Saw sshd processes were using a surprising amount of CPU, despite immediately failing because of wrong usernames etc."[4] Half a second of lag, noticed by accident.

Incident-driven capital is episodic. Maintenance is structural. Every reform since 2014 has funded the former and assumed the latter.

What a Forty-Person Software Shop Should Do This Quarter

  1. Classify your role in writing. Manufacturer, importer, distributor or steward — the obligations diverge sharply, and "substantial modification" can promote you between categories without a single new line of code.
  2. Generate SBOMs from the build, not the repository. SPDX 3.0 or CycloneDX 1.6, paired with CSAF 2.0 or OpenVEX so that non-applicable CVEs stop consuming triage hours you no longer have.
  3. Rehearse the 24-hour clock. Name one accountable PSIRT contact, define the moment of "awareness," and run a tabletop exercise. Most SMEs will fail their first attempt.
  4. Renegotiate for governance risk. Licence-change notice periods, fork rights, escrow, SLSA build provenance and signed attestations belong in the contract, not the security questionnaire.
  5. Fund the bus factor. Redirect 1–2% of licence savings into maintainer-of-record arrangements for your five most load-bearing dependencies. Municipalities migrating to LibreOffice should treat this as a line item, not charity.

CounterpointMunich Already Ran This Experiment

Sovereignty framing deserves the same scepticism. Schleswig-Holstein's 30,000-seat migration is real, but so is LiMux: Munich moved roughly 15,000 desktops to Linux from 2003, then voted in February 2017 to return to Windows before reversing again in 2020. Licence savings are the visible number; retraining, macro compatibility, printing estates and procurement inertia are the ones that decide outcomes. Digital sovereignty is a defensible strategic objective and a poor short-run cost argument. Anyone selling it on the licence line alone is repeating 2004.

By May 2027

Expect the first ENISA reporting statistics to be low-volume and high-noise, and expect enforcement to be irrelevant next to procurement: CRA readiness will appear in enterprise tenders twelve months before regulators act. A handful of high-profile maintainers will geo-fence EU distribution rather than an exodus; several dozen projects will seek foundation shelter; and "steward" will become a marketable legal posture with insurance products attached. Paid maintainer-of-record roles move from experiment to budget line. The genuine cliff remains 11 December 2027 — which means the spending decisions are being made in 2027 budget cycles that are being drafted right now.