TDF position on EU’s proposed Cyber Resilience Act
THE DOCUMENT FOUNDATION Summary of Issues of the Cyber Resilience Act (in the current status) Introduction The Cyber Resilience Act (CRA) sets out a number of cybersecurity and vulnerability management requirements for manufacturers (Annex I) and will require products to be accompanied by information and instructions for users (Annex II). Software vendors will also be required to conduct a risk assessment and produce technical documentation (Annex V) to demonstrate compliance. Currently, the text implies that if a developer or supplier derives commercial benefit from OSS, it would be subject to the Cyber Resilience Act. It even implies, in relation to the distribution of software, that open source producers or developers could be held liable if their open source projects are used commercially. If the Cyber Resilience Act becomes EU law without clarification, the impact on several European-based open source projects, such as products based on LibreOffice technology, could have devastating (unintended) consequences. The Commission recognises that not all products in our society are equally dependent. The Cyber Resilience Act therefore distinguishes between products and critical products, reflecting the level of cybersecurity risk associated with these products. On the other hand, the CRA ignores the security risks associated with files created
