Open-source readiness for the EU Cyber Resilience Act is uneven—and awareness is still a major gap. Linux Foundation Research’s 2026 report says 66% of respondents were unfamiliar with the CRA and 56% did not know about non-compliance fines. It also reports that private-fork workarounds cost an average of $258,000 in labor per release cycle. The findings point to a shared effort: manufacturers must take an active role in compliance, while open-source projects need support for security work and clear governance.
What the Linux Foundation reports say about CRA readiness
The Linux Foundation’s work offers two kinds of evidence: surveys of awareness and readiness, and examples of how open-source projects address security practices relevant to the Act. Read together, the reports describe an ecosystem that is not uniformly prepared. Some projects have established practices that can support compliance, but manufacturers and maintainers still face gaps in knowledge, resources, and responsibility.
The 2025 announcement introduced two reports. Unaware and Uncertain: The Stark Realities of Cyber Resilience Act Readiness in Open Source examines awareness and readiness through a survey. Pathways to Cybersecurity Best Practices in Open Source looks at practices in the Civil Infrastructure Platform, Yocto Project, and Zephyr Project. The 2026 follow-up, 2026 CRA Awareness and Readiness, updates the picture with quantified awareness and cost findings.
| Report | Focus | What it contributes |
|---|---|---|
| Unaware and Uncertain: The Stark Realities of Cyber Resilience Act Readiness in Open Source (2025) | Survey-based awareness and readiness | Reports that most respondents were unfamiliar with the Act, unsure about deadlines, and unaware of penalties. |
| Pathways to Cybersecurity Best Practices in Open Source (2025) | Security practices in three open-source projects | Examines the Civil Infrastructure Platform, Yocto Project, and Zephyr Project as examples of governance, documentation, vulnerability response, and lifecycle practices aligned with CRA requirements. |
| 2026 CRA Awareness and Readiness (2026) | Updated awareness and readiness findings | Quantifies unfamiliarity, awareness of fines, and labor costs associated with private-fork workarounds. |
The reports do not establish that every open-source project—or every manufacturer—is at the same readiness level. Survey findings describe respondents, while the project examples show practices that can be relevant to compliance; they are not proof that every project or product meets every legal obligation.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11#1 Best Overall
Awareness and the cost of waiting
Linux Foundation Research’s 2026 report found that 66% of respondents were unfamiliar with the CRA and 56% were unaware of non-compliance fines. The 2025 survey had already identified widespread uncertainty about the Act’s deadlines and penalties. Together, the reports suggest that many stakeholders may not yet understand what the regulation means for their role.
The 2026 report also puts a labor cost on one response to uncertainty: private-fork compliance workarounds averaged $258,000 in labor per release cycle. This is a reported average for that workaround, not a universal estimate of CRA compliance spending. The figure does, however, illustrate why treating upstream security work as someone else’s problem can become costly when manufacturers maintain separate versions instead of engaging with shared projects.
Who is responsible: manufacturers, maintainers, and stewards
The reports describe responsibility as shared, but place the primary compliance burden on manufacturers. An organization that brings a product to market should not assume that an upstream open-source project will do all of its security work or deliver every fix the product needs.
- Manufacturers need to engage actively in vulnerability handling and software-supply-chain security, rather than relying passively on upstream patches.
- Open-source maintainers and stewards can support responsible security practices through governance, documentation, vulnerability response, and lifecycle work. The reports also call for more funding and legal support for projects.
- Regulators and ecosystem organizations have a role in making requirements clearer and providing implementation resources, training, and tooling.
This division matters because an upstream project’s security practices and a manufacturer’s product-level compliance are related but not interchangeable. A project can provide useful processes and information; the manufacturer remains responsible for assessing and addressing obligations for its own product.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What the project examples show—and what they do not
Pathways to Cybersecurity Best Practices in Open Source examines the Civil Infrastructure Platform, Yocto Project, and Zephyr Project. The Linux Foundation presents them as examples of how governance, documentation, vulnerability response, and lifecycle practices can align with core CRA requirements.
These examples make the topic more practical than a discussion of legal obligations alone: security readiness depends on project processes as well as the way manufacturers use and support software. But the examples should not be read as a blanket certification, nor as evidence that a project’s practices automatically satisfy every manufacturer’s obligations. The report’s stated focus is how the projects address core requirements, not a universal determination of compliance for all products or uses.
How open-source projects and manufacturers can prepare
The reports’ recommendations point to a coordinated preparation effort. The following steps turn those themes into a workable starting plan; they do not replace legal advice or a product-specific compliance assessment.
- Identify the relevant roles and products. Determine which organization is acting as manufacturer for each product and which open-source projects or components it depends on. Make responsibility explicit instead of assuming an upstream maintainer will handle product obligations.
- Review vulnerability handling together. Establish how manufacturers and project teams will receive, assess, communicate, and address vulnerability information. Manufacturers should participate actively rather than wait for an upstream fix without a response plan.
- Organize supply-chain and product documentation. Review software-supply-chain security and documentation practices, including SBOM-related work where applicable. The reports identify SBOM and documentation practices as important preparation areas, but do not specify a single tool or format that every organization must adopt.
- Make governance and lifecycle practices visible. Document who makes security decisions, how issues are handled, and how maintenance responsibilities continue over a product’s lifecycle. Project-level practices can help manufacturers understand how components are maintained.
- Budget for sustained work. Treat security response, documentation, and coordination as ongoing effort, not a one-time paperwork exercise. The reported $258,000 average for private-fork labor per release cycle illustrates the potential cost of one workaround, not a general compliance budget.
- Use training and implementation support. The official Linux Foundation report page points to the free OpenSSF Express Learning course Understanding the EU Cyber Resilience Act (CRA) (LFEL1001). Projects may also need additional funding and legal support, while clearer regulatory guidance and practical implementation resources remain important.
What the December 2027 date means for planning
The 2026 report frames December 2027 as the approaching CRA deadline and urges manufacturers, stewards, and developers to begin implementation work now. That is a practical planning signal: organizations should not wait until the deadline draws near to establish responsibilities, improve vulnerability handling, or organize documentation.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Best Value
The report summary does not set out a detailed schedule for each individual legal duty. December 2027 should therefore be treated here as the date highlighted by Linux Foundation Research, not as evidence that every obligation begins on the same day. Organizations should confirm the applicable requirements and timing for their products with authoritative legal guidance.
What the findings mean for open source
The reports do not describe open source as uniformly ready or uniformly unprepared. They show a wide spectrum: low awareness in the surveyed population, established practices in the featured projects, and a need for manufacturers to participate more actively in security work. Hilary Carter, SVP Research at the Linux Foundation, said the reports offer actionable conclusions for stakeholders preparing for 2027. Gabriele Columbro, General Manager of Linux Foundation Europe, emphasized balancing compliance with the fundamental principles of open-source development.
The practical implication is that compliance cannot be pushed onto volunteer maintainers alone, nor can manufacturers rely on the existence of a healthy upstream project as a substitute for their own work. Shared security practices need resources, coordination, and a clear understanding of who is responsible for each product and component.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems
