CN CRA NotebookCRA 閱讀筆記
Working note — actively evolving, may be revised. See /errata for change log. 推進中的筆記,可能持續修改。修訂紀錄見 /errata
Last reviewed 25 Apr 2026最後校閱 2026-04-25 · ~14 min read閱讀 14 分鐘 · Article 24第 24 條 · Working書寫

Who is an “open-source steward”? The CRA’s new puzzle piece 誰是「open-source steward」?這是 CRA 多出來的一個角色。

Article 24 invented a role nobody asked for. Three scenarios where APAC OSS contributors need to care — and three where they should not. 第 24 條發明了一個沒人要求的角色。APAC 的開源貢獻者該在意的三種情境,加上三種可以不用管的。

An APAC industrial gateway maker ships embedded Linux devices across the EU under its own brand. The Linux distribution it uses is OpenHarmony — the OS Huawei donated to the OpenAtom Foundation in Beijing, and which is brought to Europe through Oniro, governed by the Eclipse Foundation AISBL in Brussels. The company's compliance lead reads CRA Article 13 (manufacturer obligations), confirms what already seems obvious — the company is the manufacturer of its own gateway, with full Article 13 obligations attached — and starts planning the Article 14 reporting capability for September 2026. Standard work.

Then a question lands from the engineering team: "are we also a steward?" The team contributes patches upstream to Oniro on a regular basis, runs a small group of Brussels-based engineers paid by the APAC parent to maintain a downstream module, and lists itself as an Oniro Strategic Member. The compliance lead reads Article 24, then Article 3(14), then Recital 19. Two hours later he is not certain about the answer.

That uncertainty is what Article 24 is for. The CRA invented a legal category that did not exist in any prior EU regulation — open-source software steward — and dropped it in front of every legal entity that systematically supports an open-source project intended for commercial use. The category catches some organisations cleanly, releases others cleanly, and leaves a gap in the middle that APAC sponsors of open-source projects need to read carefully because it is exactly where many of them sit.

§ 01The category Article 24 invented, and the problem it was solving

Before the CRA, EU product safety law had two relevant categories for software in commerce: manufacturers, who place products on the market and bear full conformity obligations, and nobody else. Open-source contributors as a class did not appear. A volunteer maintaining a popular library out of personal interest, a foundation systematically funding a critical project, a company sponsoring an OSS distribution it then sells products on top of — all three sat in the same legal void.

The CRA had to decide what to do about that void. Treating every OSS contributor as a manufacturer would crush volunteer maintainers and large foundations alike under conformity assessment costs designed for commercial product makers. Treating none of them as anything would leave foundations that systematically support critical commercial software completely outside the regulatory framework — which is politically untenable when those foundations underpin EU industry's software supply chain.

Article 24 is the compromise. It invents a new category — open-source software steward — with a regulatory regime described in Recital 19 as "light-touch and tailor-made". The category catches legal persons that systematically and sustainably support OSS projects intended for commercial use, but it carries a fraction of the manufacturer obligation set, and it carries them with the explicit recognition that OSS governance is structurally different from product governance.

Three structural design choices in Article 24 are worth seeing on their own, because each one is a deliberate signal:

Stewards cannot affix CE marking. Recital 19 is explicit: "they should not be permitted to affix the CE marking to the products with digital elements whose development they support." The CE mark is reserved for entities that did the conformity assessment work — manufacturers. Stewards do not do that work, do not claim that bar, and the mark is not theirs to apply.

Stewards do not pay administrative fines. Article 64(10) exempts stewards from administrative fines for any infringement of the CRA. This is the single largest indicator that the EU intended the steward regime to be cooperative rather than punitive. Manufacturers face penalties up to €15M or 2.5% of global turnover. Stewards face zero.

Stewards' core obligation is one document, made verifiable. Article 24(1) requires a written cybersecurity policy promoting secure development and effective vulnerability handling, kept "in a verifiable manner". That is the substantive ask. There is no SBOM obligation, no support period declaration, no technical documentation file, no Annex VII, no conformity assessment route to choose, no notified body queue to wait in. The asymmetry is enormous, and it is enormous on purpose.

Anchor — what the regulation actually says Recital 19: introduces stewards as "certain foundations as well as entities that develop and publish free and open-source software in a business context". States the regime is "light-touch and tailor-made" and explicitly forbids CE marking for stewards. Article 64(10): "open-source software stewards shall not be subject to administrative fines for infringements of this Regulation." Article 24(1): cybersecurity policy obligation, framed as "fostering" secure development rather than mandating it.

§ 02Article 3(14): the four words that decide everything

The steward category is gated by Article 3(14). Reading the definition slowly is the difference between knowing whether you are inside or outside the regime.

The definition reads: an open-source software steward is "a legal person, other than a manufacturer, that has the purpose or objective of systematically providing support on a sustained basis for the development of specific products with digital elements, qualifying as free and open-source software and intended for commercial activities, and that ensures the viability of those products."

Five elements have to be present together. Each one is a gate.

Element 1 — "legal person". A natural person — an individual maintainer, a volunteer, a hobbyist contributor — cannot be a steward. The definition is not ambiguous on this point, and the Open Regulatory Compliance Working Group's CRA FAQ confirms it: "the obligations of open-source software stewards described in Article 24 therefore do not apply to solo maintainers acting in their personal capacity." A legal person means a company, a foundation, an association, a registered non-profit. An unincorporated developer collective is not a legal person, and is not a steward.

Element 2 — "other than a manufacturer". The same legal entity cannot be both manufacturer and steward for the same product. But Commission Draft Guidance (March 2026, draft, non-binding) confirms a single legal entity can be steward for one project and manufacturer for another. A foundation that hosts a community version while a separate paid enterprise version is sold on top — common in the OSS world — could see the foundation as steward for the community version and the company selling the enterprise version as manufacturer for it.

Element 3 — "purpose or objective of systematically providing support on a sustained basis". Two cumulative requirements: systematic (organised, not ad hoc) and sustained (over time, not one-off). A foundation that exists to fund a project ongoingly is in. A company that contributed a feature once and walked away is not. The Commission Draft Guidance lists examples of "support on a sustained basis": hosting collaboration platforms, maintaining governance, steering development direction.

Element 4 — "intended for commercial activities". The OSS itself must be aimed at commercial use somewhere downstream. Recital 18 is the key instrument here: "the mere circumstances under which the product with digital elements has been developed, or how the development has been financed, should not be taken into account when determining the commercial or non-commercial nature of that activity." Recital 19 sharpens it: software "ultimately intended for commercial activities, such as for integration into commercial services or into monetised products with digital elements". A library that is only ever used in academic research, with no commercial integration anywhere, falls outside. A library widely integrated into commercial IoT products falls inside — even if every contributor is a volunteer and the library itself is given away.

Element 5 — "ensures the viability". The legal person plays a primary role in keeping the project alive. A minor contributor among many is not a steward. The party that the project would not exist without — or would not survive without — is.

All five gates have to open. Miss one and you are not a steward in the legal sense, regardless of how OSS-adjacent the activity is in everyday speech.

Anchor — Article 3(14) verbatim Article 3(14): "open-source software steward means a legal person, other than a manufacturer, that has the purpose or objective of systematically providing support on a sustained basis for the development of specific products with digital elements, qualifying as free and open-source software and intended for commercial activities, and that ensures the viability of those products". Recital 18: how the software is financed does not by itself decide commercial vs non-commercial nature. Recital 19: examples of stewards include "certain foundations" and "entities that develop and publish free and open-source software in a business context, including not-for-profit entities".

§ 03Three scenarios where the regime bites

The cleanest way to feel where Article 24 lands is to walk through three structural archetypes that fall inside.

Scenario A — Foundation-hosted OSS with industrial integration. The Eclipse Foundation AISBL, Brussels-incorporated since January 2021, hosts hundreds of OSS projects including the Eclipse IDE family, Jakarta EE, and Oniro. Each project is integrated into commercial products by EU manufacturers. Eclipse AISBL is a legal person, has systematic and sustained support as its core purpose, the projects target commercial use, and the foundation ensures their viability. All five gates open. Eclipse AISBL is a steward for those projects. The Apache Software Foundation, despite being Delaware-incorporated, falls into the same analysis to the extent it has European exposure — its projects are everywhere in EU industrial software stacks.

Scenario B — Sub-foundation under a parent, parent absorbs the obligation. The Cloud Native Computing Foundation and the OpenJS Foundation are not independent legal persons — they are projects of the Linux Foundation (US 501(c)(6), EIN 46-0503801, registered in Delaware). The CNCF cannot be a steward in its own right because it is not a legal person. If steward obligations apply, they apply to the Linux Foundation as the parent legal entity. APAC contributors to CNCF projects need to look at the parent for the regulatory consequence, not the sub-foundation.

Scenario C — Corporate-stewarded project with EU commercial nexus. Huawei donated OpenHarmony source code to the OpenAtom Foundation in Beijing in 2021. OpenAtom itself is a Chinese NGO under MIIT supervision and lacks an EU legal person. The pan-European version, Oniro, is governed by Eclipse Foundation AISBL — and that is the entity in EU jurisdiction. Eclipse AISBL is the steward for Oniro. Huawei is the manufacturer of any EU-market product (gateways, automotive head units, IoT devices) it ships running OpenHarmony, which means full Article 13 manufacturer obligations on its own products plus a sponsor relationship to a steward (Eclipse). Two roles, two obligation sets, on the same software stack — but cleanly separated by which legal person did what.

The pattern across all three is the same: stewardship attaches to the legal person systematically and sustainably keeping the project alive, with EU jurisdictional reach. APAC organisations sponsoring OSS via a EU-incorporated foundation effectively channel their stewardship through that foundation — the foundation is the steward in EU eyes, not the APAC sponsor.

§ 04Three scenarios where it does not

The mirror image is more important to read carefully, because the noise around the CRA tends to over-include.

Scenario D — Solo maintainer, regardless of project popularity. An individual developer in Taipei maintaining a popular Rust crate, downloaded weekly by EU industrial software vendors, is not a steward. Article 3(14) requires a legal person; a natural person does not qualify. Recital 18 reinforces it: contributing source code to a project not under one's responsibility puts the contributor outside the regulation entirely. The maintainer is not a steward, not a manufacturer, not anything CRA-defined. This holds regardless of how widely the crate is integrated commercially. The risk shifts to the manufacturers that integrate it — they have to handle vulnerabilities in their own SBOMs — but it does not shift to the maintainer.

Scenario E — Unincorporated developer collective. A small group of developers in Tokyo collaborating informally on a shared project, no legal entity, no foundation, no incorporation — falls outside Article 3(14) for the same reason. There is no legal person to attach steward obligations to. If the group later forms a foundation or non-profit (whether in Japan, the EU, or elsewhere) and that entity systematically supports the project, the analysis changes. Until then, the collective is invisible to the CRA.

Scenario F — Project where commercial use is downstream, not the steward's. A Korean academic group maintains a research-oriented OSS toolkit. The toolkit is freely available; its primary use is in academic publications and graduate research. A subset of EU manufacturers happens to integrate parts of the toolkit into commercial IoT products. The academic group does not "intend" the software for commercial activities — its purpose is research. The integration was downstream, performed by the manufacturers themselves. Recital 19's phrasing — "intended for commercial activities" — keys on intent, not coincidental downstream use. The academic group is not a steward.

The thread connecting D, E, and F is that not every OSS contribution carries steward consequences. The category is narrow on purpose. APAC contributors who assume they fall in tend to overcommit; APAC contributors who actually fall in tend to underprepare. Reading Article 3(14) closely is how you know which bucket you are in.

Anchor — what releases you from the regime Article 3(14): legal person requirement excludes natural persons, and "intended for commercial activities" excludes projects whose intent is non-commercial regardless of downstream integration. Recital 18: contributing source code to a project not under one's responsibility falls outside the regulation entirely. Article 13: the manufacturer integrating the OSS bears the full conformity assessment burden in any case — the maintainer's exemption does not move that risk back upstream.

§ 05Article 52(3) and Article 64(10): why the regime has teeth and where it does not

It is tempting to read the asymmetry between manufacturer and steward obligations as meaning the steward regime is performative — light obligations, no fines, no real enforcement. That reading misses Article 52(3).

Article 52(3) makes market surveillance authorities "responsible for carrying out market surveillance activities in relation to the obligations for open-source software stewards laid down in Article 24". Where an MSA finds non-compliance, it "shall require the open-source software steward to ensure that all appropriate corrective actions are taken". The MSA can enter a steward's processes, demand documentation in a language it understands, and order corrective action. The Article 24(1) cybersecurity policy is not a private internal document — it is auditable.

What the MSA cannot do is the part that distinguishes the regime. Manufacturers face the full Article 54–58 toolkit: corrective measures, mandated recall, market withdrawal, prohibition on placing on the market, administrative fines. Stewards face only the corrective-action requirement. No recall (because there is no product to recall — the steward is not a manufacturer). No withdrawal. No fines (Article 64(10)). The MSA can require the steward to fix its policy and processes; it cannot impose the financial pain that manufacturers face.

This calibration is structural rather than accidental. The regime says: "we recognise you keep critical software alive, we want a verifiable cybersecurity policy from you, we will inspect it, but we will not financially destroy you for getting it wrong because the OSS commons depends on you continuing to exist." The policy is a real obligation. The penalties are deliberately not.

The practical consequence for steward-eligible APAC organisations is that the cost of getting the policy wrong is reputational and operational (the MSA can disrupt your operations and require remediation work) rather than financial. The cost of being mistakenly classified as a manufacturer when you are actually a steward, however, is enormous — €15M-class fines plus full Article 13 burden. Reading Article 3(14) carefully matters not because the steward regime is heavy, but because the manufacturer regime next door is.

Anchor — enforcement powers Article 52(3): MSA market surveillance authority over stewards' Article 24 obligations, with corrective-action power. Article 52(15): ADCO market surveillance coordination group "shall also address specific matters related to the market surveillance activities in relation to the obligations placed on open-source software stewards" — recognition that steward enforcement needs its own coordination. Article 64(10): complete exemption from administrative fines.

§ 06What APAC OSS contributors should actually do

Five concrete moves, in order of priority.

Move 1 — Map your legal person against Article 3(14). If you are an individual, you are out. If you are an unincorporated group, you are out. If you are a company, foundation, or association, walk through the five elements: legal person ✓, not the manufacturer of the same product ✓, systematic and sustained ✓, intended for commercial activities ✓, ensures viability ✓. Five tickmarks means you are in. Less than five means you are out (or you are something else, like a manufacturer).

Move 2 — If the answer is "out but adjacent", document the analysis. APAC sponsors of OSS that route stewardship through a EU foundation (Eclipse AISBL, etc.) are typically not stewards themselves — the foundation is. But MSAs may ask. Having a one-page analysis showing why the foundation is the steward and you are the sponsor (with the legal-person, systematic-and-sustained, viability arguments worked out) is much cheaper to produce in advance than to reconstruct under an MSA reasoned request.

Move 3 — If the answer is "in", start with the cybersecurity policy. Article 24(1) requires it documented "in a verifiable manner". That means a real document, version-controlled, dated, with a named responsible individual, that is actually applied in practice. It must address vulnerability handling, secure development promotion, and explicit encouragement of voluntary vulnerability reporting per Article 15. The 2026 March Draft Guidance gives examples of policy elements. Use those, plus your own governance documents (charter, contribution guidelines, security.txt), as the building blocks. The policy is the central artefact MSAs will read first.

Move 4 — Consider whether EU legal-person status is operationally helpful. Eclipse moved its primary legal seat to Brussels (AISBL) before the CRA was even adopted. The move turned out to be strategically advantageous: Eclipse is now the home-jurisdiction defendant for EU MSA matters, sits on the CRA Expert Group, and hosts the Open Regulatory Compliance Working Group. APAC-sponsored foundations without an EU legal person face MSA contact friction — not regulatory invisibility (the obligation still exists), but practical difficulty in cooperation. For foundations whose primary commercial users are in the EU, an AISBL or comparable EU entity is worth costing out. For foundations whose commercial users are dominantly elsewhere, it is not.

Move 5 — Distinguish between your steward role and your manufacturer role on the same software. If your organisation contributes to an OSS project (steward exposure) and sells products integrating that OSS in the EU (manufacturer exposure), the two regulatory tracks run in parallel. Steward role: Article 24, cybersecurity policy, no fines. Manufacturer role: Article 13, full conformity assessment, CE marking, SBOM, support period, Annex VII, full fines. Don't conflate them. The Commission Draft Guidance explicitly confirms a single legal entity can hold both roles for different projects or different versions. Documenting which role applies to which project is part of getting both right.

§ 07The asymmetry that makes the puzzle worth solving

Return to the APAC gateway maker. The compliance lead reads Article 24, then Article 3(14), then Recital 19, and the analysis resolves.

The company is the manufacturer of its own gateway — full Article 13 obligations, full Article 14 reporting clock, full conformity assessment route. That part was never in question.

The company is also a sponsor of Oniro through its Strategic Member contribution. But the steward of Oniro is Eclipse Foundation AISBL — the legal person systematically and sustainably supporting the project, with EU jurisdictional reach. The APAC company is not the steward. It is a contributor and a sponsor. Recital 18 confirms that contributing source code to a project not under one's responsibility puts the contributor outside the regulation entirely.

So the company has one regulatory role (manufacturer of its gateway) and one supporting relationship (sponsor of a project whose steward is Eclipse). Two pieces, both well-defined. The puzzle was not in the answer; it was in figuring out that there were two pieces and not three.

That is what Article 24 added to EU regulatory architecture: a piece of the puzzle that did not exist before. It catches some legal entities cleanly, releases others cleanly, and asks the rest to read five lines of Article 3(14) carefully. The reading is not difficult once the gates are visible. But until the gates are visible, the gap looks deeper than it is.

The light-touch regulatory regime in Recital 19 is doing a real job. It says: foundations and corporate-sponsored OSS bodies that keep critical commercial software alive get a regulatory regime calibrated to OSS realities — verifiable policy, MSA cooperation, no fines. It also says: individuals, informal groups, and projects without commercial intent stay outside. The category is narrow, the obligations inside are limited, the penalties are zero. The only thing required is reading the five gates closely.

For APAC OSS contributors, that reading is the work. Once it is done, most are outside. A few are inside. Almost none are in the bucket they assumed they were in on first read.

一家 APAC 工業閘道製造商,以自有品牌出貨嵌入式 Linux 裝置到歐盟。它用的 Linux distro 是 OpenHarmony——華為捐給北京 OpenAtom Foundation 的那個 OS,透過 Oniro 這個由 Brussels 的 Eclipse Foundation AISBL 治理的歐洲版本進入 EU。公司的合規主管讀過 CRA 第 13 條(製造商義務)、確認看似明顯的事實:公司是自家閘道的製造商,要扛完整 Article 13 義務、開始規劃 2026 年 9 月 11 日要上線的 Article 14 通報能力。標準工作。

然後工程團隊丟了個問題:「我們是不是 steward?」團隊定期提交 patch 上 Oniro,在 Brussels 還有一小組由 APAC 母公司付薪、維護一個 downstream 模組的工程師,公司本身列名為 Oniro Strategic Member。合規主管讀第 24 條、再讀第 3(14) 條、再讀 Recital 19。兩個小時後,他不確定答案是什麼。

這個不確定,正是第 24 條存在的目的。CRA 發明了一個先前任何 EU 法規都沒有的法律類別——open-source software steward——把它丟到每一個系統性支援、且該支援軟體以商業使用為目的之法人面前。這個類別乾淨地抓到一些組織、乾淨地放掉另一些組織,中間留下一塊縫隙——而很多 APAC 開源贊助者剛好就在那塊縫隙裡。

§ 01第 24 條發明的類別、以及它在解的問題

CRA 之前,EU 產品安全法對「商業流通的軟體」只有兩個相關類別:製造商,承擔完整符合性義務;以及其他人,無分類。開源貢獻者作為一個群體不存在。一位個人興趣維護熱門函式庫的志工、一個系統性資助關鍵專案的基金會、一家贊助 OSS distro 然後在上面賣產品的公司——這三者全都在同一個法律真空裡。

CRA 必須決定怎麼處理這個真空。把每個 OSS 貢獻者都當成製造商,會用為商業產品設計的符合性評鑑成本壓垮志工 maintainer 跟大型基金會。一個都不抓、會讓系統性支撐關鍵商業軟體的基金會完全在規範框架之外——這在政治上站不住腳,因為那些基金會從底下撐起 EU 產業的軟體供應鏈。

第 24 條是這個妥協。它發明了一個新類別——open-source software steward——配上 Recital 19 描述為「light-touch and tailor-made」(輕度且量身打造)的規範體制。這個類別抓到系統性、持續性支援 OSS 專案、且該專案以商業使用為目的之法人,但只附加製造商義務的一小部分,而且明確認知 OSS 治理結構上跟產品治理不一樣。

第 24 條有三個結構性設計選擇值得單獨看,因為每一個都是刻意的訊號:

Steward 不能貼 CE 標示。Recital 19 寫得明白:「they should not be permitted to affix the CE marking to the products with digital elements whose development they support」。CE 標示保留給做了符合性評鑑工作的法人——製造商。Steward 不做那項工作、不主張那個門檻,標示也不是它能貼的。

Steward 不繳行政罰鍰。第 64(10) 條讓 steward 對 CRA 任何違反免於行政罰鍰。這是 EU 立意這個 steward 體制是合作性、不是懲罰性的最大單一指標。製造商面對最高 €15M 或全球年營業額 2.5% 的罰款。Steward 是零。

Steward 的核心義務是一份文件,要可驗證。第 24(1) 條要求一份書面的網路安全 policy,促進安全開發跟有效的弱點處理,且「in a verifiable manner」(可驗證地)保存。這就是實質要求。沒有 SBOM 義務、沒有 support period 宣告、沒有技術文件、沒有附件七、沒有要選的符合性評鑑路徑、沒有要排隊的 notified body。這個不對稱是巨大的,而且是刻意這樣設計的。

錨點:法規實際說了什麼 Recital 19:把 steward 引介為「certain foundations as well as entities that develop and publish free and open-source software in a business context」。明文指出此體制為「light-touch and tailor-made」、且明確禁止 steward 貼 CE 標示。第 64(10) 條:「open-source software stewards shall not be subject to administrative fines for infringements of this Regulation.」第 24(1) 條:cybersecurity policy 義務,措辭是「fostering」(促進)安全開發,而非強制。

§ 02第 3(14) 條:決定一切的那四個字

Steward 類別由第 3(14) 條設立的閘門守住。慢慢讀這個定義,是「知道自己在不在這個體制裡」跟「不知道」的差別。

定義原文:open-source software steward 是「a legal person, other than a manufacturer, that has the purpose or objective of systematically providing support on a sustained basis for the development of specific products with digital elements, qualifying as free and open-source software and intended for commercial activities, and that ensures the viability of those products」。

五個要素必須同時成立。每一個都是一道閘門。

要素 1——「legal person」。自然人——個人 maintainer、志工、業餘貢獻者——不能是 steward。定義在這一點上沒有模糊空間,Open Regulatory Compliance Working Group 的 CRA FAQ 也確認:「the obligations of open-source software stewards described in Article 24 therefore do not apply to solo maintainers acting in their personal capacity」。法人指的是公司、基金會、協會、登記在案的非營利組織。一個未登記的開發者集合不是法人,也不是 steward。

要素 2——「other than a manufacturer」。同一個法人對同一個產品不能同時是製造商跟 steward。但 Commission Draft Guidance(2026 年 3 月、draft, non-binding)確認:同一個法人可以對某個專案是 steward、對另一個專案是製造商。一個 foundation 主持社群版本,另外有付費 enterprise 版本在上面銷售——這在 OSS 世界很常見——可能 foundation 對社群版本是 steward、賣 enterprise 版本的公司對 enterprise 版本是製造商。

要素 3——「purpose or objective of systematically providing support on a sustained basis」。兩個累積要件:系統性(有組織、不是隨機)、持續性(長期、不是一次性)。一個以資助專案為持續宗旨的基金會在裡面。一家貢獻過一個功能就走人的公司不在。Commission Draft Guidance 列舉「sustained basis」的支援樣態:主持協作平台、維護治理架構、引導開發方向。

要素 4——「intended for commercial activities」。OSS 本身必須以下游商業使用為終局目的。Recital 18 是這裡的關鍵工具:「the mere circumstances under which the product with digital elements has been developed, or how the development has been financed, should not be taken into account when determining the commercial or non-commercial nature of that activity」。Recital 19 把它說得更精確:「ultimately intended for commercial activities, such as for integration into commercial services or into monetised products with digital elements」。一個只在學術研究中使用、沒有任何商業整合的函式庫,在範圍外。一個被廣泛整合到商業 IoT 產品的函式庫在範圍內——即使每個貢獻者都是志工,函式庫本身是無償提供的。

要素 5——「ensures the viability」。該法人在維持專案存續上扮演主要角色。在許多貢獻者中只是其中一個小貢獻者的,不是 steward。「沒有它專案就不會存在或存活不下去」的那一方,才是。

五道閘門全都要打開。漏掉一個,你在法律意義上就不是 steward,無論這個活動在日常用語裡多 OSS-adjacent。

錨點:第 3(14) 條原文 第 3(14) 條:「open-source software steward means a legal person, other than a manufacturer, that has the purpose or objective of systematically providing support on a sustained basis for the development of specific products with digital elements, qualifying as free and open-source software and intended for commercial activities, and that ensures the viability of those products」。Recital 18:軟體如何被開發或如何被融資,本身不決定商業或非商業性質。Recital 19:steward 範例包括「certain foundations」與「entities that develop and publish free and open-source software in a business context, including not-for-profit entities」。

§ 03三種體制會咬人的情境

感受第 24 條落點的最乾淨方式,是走過三種會落在裡面的結構性原型。

情境 A——基金會主持的 OSS、有產業整合。Eclipse Foundation AISBL 自 2021 年 1 月起在 Brussels 註冊,主持上百個 OSS 專案,包含 Eclipse IDE 系列、Jakarta EE、Oniro。每一個專案都被 EU 製造商整合進商業產品。Eclipse AISBL 是法人、以系統性與持續性支援為核心宗旨、專案目標是商業使用、基金會確保它們的存續。五道閘門全開。Eclipse AISBL 對這些專案是 steward。Apache Software Foundation 雖然註冊在 Delaware,但就它對歐洲的 exposure 來說,分析方式相同——它的專案無所不在於 EU 工業軟體堆疊。

情境 B——母基金會旗下的子基金會、由母基金會吸收義務。Cloud Native Computing Foundation 跟 OpenJS Foundation 不是獨立法人——它們是 Linux Foundation(US 501(c)(6),EIN 46-0503801,在 Delaware 註冊)旗下的專案。CNCF 自身不能是 steward,因為它不是法人。如果 steward 義務適用,是適用在 Linux Foundation 這個母法人身上。APAC 對 CNCF 專案的貢獻者,要看母法人作為法規後果的對象,不是子基金會。

情境 C——企業 stewarded 的專案、有 EU 商業 nexus。華為於 2021 年把 OpenHarmony 原始碼捐給北京的 OpenAtom Foundation。OpenAtom 自身是中國 PRC NGO(受工信部監督),缺乏 EU 法人身分。歐洲泛用版本 Oniro 由 Eclipse Foundation AISBL 治理——而那是 EU 管轄裡的法人。Eclipse AISBL 對 Oniro 是 steward。華為對它出貨到 EU 的任何產品(閘道、車機、IoT 裝置)若搭載 OpenHarmony,自身就是製造商,扛全套 Article 13 製造商義務、加上對某個 steward(Eclipse)的贊助關係。同一個軟體堆疊上兩個角色、兩套義務——但乾淨地由「哪個法人做了什麼」分開。

三個情境共通的模式是同一個:steward 身分附著在系統性、持續性維持專案存續、且具備 EU 管轄觸達的法人上。APAC 組織透過 EU 註冊基金會贊助 OSS 的,實質上是把 stewardship 透過該基金會輸送出去——基金會在 EU 眼裡是 steward,APAC 贊助者不是。

§ 04三種不會落入的情境

鏡像版本反而更值得仔細讀,因為 CRA 周圍的雜音傾向過度涵蓋。

情境 D——個人 maintainer,無論專案多受歡迎。一位台北的開發者個人維護一個熱門 Rust crate,每週被 EU 工業軟體廠商下載,不是 steward。第 3(14) 條要求法人;自然人不符。Recital 18 補強:對自己沒有責任的專案貢獻原始碼,把貢獻者放在法規之外。這位 maintainer 不是 steward、不是製造商、不是任何 CRA 定義的東西。這個結論不因 crate 被多廣泛地商業整合而改變。風險轉移到整合它的製造商身上——他們得在自家 SBOM 中處理弱點——但風險不會轉回 maintainer。

情境 E——未登記的開發者集合。一群東京開發者在共享專案上非正式合作,沒有法律實體、沒有基金會、沒有登記,基於同樣理由落在第 3(14) 條外。沒有法人可以附加 steward 義務。如果該團體後來成立基金會或非營利組織(無論在日本、EU 或其他地方),且該實體系統性支援該專案,分析就會改變。在那之前,該集合對 CRA 而言是隱形的。

情境 F——商業使用發生在下游、不發生在 steward 身上的專案。一個韓國學術團體維護一個研究取向的 OSS 工具集。工具集無償提供;主要使用是在學術論文跟研究生研究上。一部分 EU 製造商剛好把工具集的部分整合到商業 IoT 產品。學術團體並未把該軟體「以商業活動為目的」(intended for commercial activities)——它的目的是研究。整合是下游發生、由製造商自己進行的。Recital 19 的措辭「intended for commercial activities」是看意圖、不是看下游偶發整合。學術團體不是 steward。

串連 D、E、F 的線索是:不是每個 OSS 貢獻都帶 steward 後果。這個類別是刻意窄的。假設自己落在裡面的 APAC 貢獻者傾向過度準備;實際上落在裡面的 APAC 貢獻者傾向準備不足。仔細讀第 3(14) 條,是知道自己在哪一邊的方式。

錨點:什麼把你從體制裡釋放出來 第 3(14) 條:法人要件排除自然人;「intended for commercial activities」排除意圖非商業的專案,無論下游整合如何。Recital 18:對自己沒有責任的專案貢獻原始碼,落在法規之外。第 13 條:整合該 OSS 的製造商無論如何承擔完整符合性評鑑負擔——maintainer 的豁免不會把風險推回上游。

§ 05第 52(3) 條與第 64(10) 條:為什麼這個體制有牙、以及哪裡沒有

很容易把製造商跟 steward 義務的不對稱讀成「steward 體制是表演式的——輕度義務、沒有罰款、沒有真正的執法」。這個讀法漏掉第 52(3) 條。

第 52(3) 條讓市場監督機關「responsible for carrying out market surveillance activities in relation to the obligations for open-source software stewards laid down in Article 24」。當 MSA 發現不合規時,「shall require the open-source software steward to ensure that all appropriate corrective actions are taken」。MSA 可以介入 steward 的流程,要求以它能理解的語言提供文件、命令採取修正措施。第 24(1) 條的 cybersecurity policy 不是私下內部文件——它是可稽核的。

MSA 不能做的,才是區別這個體制的部分。製造商面對完整的第 54-58 條工具箱:修正措施、強制召回、市場下架、禁止投入市場、行政罰鍰。Steward 只面對修正措施要求。沒有召回(因為沒有產品可以召回——steward 不是製造商)。沒有下架。沒有罰款(第 64(10) 條)。MSA 可以要求 steward 修正它的 policy 跟流程;不能施加製造商面對的財務痛點。

這個校準是結構性的、不是偶然的。體制說:「我們認知你維持關鍵軟體存活、我們要從你拿到一份可驗證的 cybersecurity policy、我們會稽核它,但我們不會因為你弄錯而在財務上摧毀你,因為 OSS 公共資源依賴你繼續存在。」Policy 是真實義務。罰則是刻意不附加。

對 steward 資格 APAC 組織的實務後果是:把 policy 弄錯的成本是聲譽跟營運(MSA 可以打亂你的營運,要求補救工作),不是財務。但被誤分類為製造商、實際上應該是 steward 的成本,是巨大的——€15M 級別的罰款加上完整 Article 13 負擔。仔細讀第 3(14) 條的重要性,不是因為 steward 體制重,而是因為旁邊那個製造商體制重。

錨點:執法權限 第 52(3) 條:MSA 對 steward 第 24 條義務有市場監督權限,含修正措施權力。第 52(15) 條:ADCO 市場監督協調群「shall also address specific matters related to the market surveillance activities in relation to the obligations placed on open-source software stewards」——認知 steward 執法需要自己的協調。第 64(10) 條:對行政罰鍰的完全豁免。

§ 06APAC OSS 貢獻者實際該做什麼

五個具體動作,按優先順序排。

動作 1——把你的法人對著第 3(14) 條檢核。如果你是個人,你在外面。如果你是未登記團體,你在外面。如果你是公司、基金會或協會,逐一走五個要素:法人 ✓、不是同一產品的製造商 ✓、系統性與持續性 ✓、以商業活動為目的 ✓、確保存續 ✓。五個 ✓ 代表你在裡面。少於五個代表你在外面(或你是別的東西,例如製造商)。

動作 2——如果答案是「在外面但鄰近」,把分析寫下來。把 stewardship 透過 EU 基金會(Eclipse AISBL 等)輸送的 APAC OSS 贊助者,自身典型不是 steward——基金會才是。但 MSA 可能會問。事先準備一頁分析,說明為什麼基金會是 steward、你是贊助者(把法人、系統性與持續性、確保存續這些論點寫清楚),比在 MSA reasoned request 抵達時臨時重建便宜得多。

動作 3——如果答案是「在裡面」,從 cybersecurity policy 開始。第 24(1) 條要求 policy 以「verifiable manner」(可驗證的方式)保存。意思是真實文件、版本控制、有日期、有指定負責人、實際上被應用。它必須處理弱點處理、促進安全開發,並明確鼓勵依第 15 條進行的自願性弱點通報。2026 年 3 月的 Draft Guidance 列了 policy 元素的範例。用這些,加上你自己的治理文件(章程、貢獻準則、security.txt),當建構基石。Policy 是 MSA 第一個會讀的核心成品。

動作 4——考慮 EU 法人身分在營運上是不是有幫助。Eclipse 在 CRA 立法之前就把主要登記地搬到 Brussels(AISBL)。這個搬遷事後證明戰略上有利:Eclipse 現在是 EU MSA 事務的本地對接窗口、坐在 CRA Expert Group、主持 Open Regulatory Compliance Working Group。沒有 EU 法人的 APAC 贊助基金會面對 MSA 接觸摩擦——不是法規上隱形(義務還是存在),而是合作上有實務困難。對主要商業使用者在 EU 的基金會來說,AISBL 或可比擬的 EU 實體值得估算成本。對商業使用者主要在別處的基金會來說,不值得。

動作 5——分清楚同一軟體上你的 steward 角色跟製造商角色。如果你的組織貢獻 OSS 專案(steward exposure),同時銷售整合該 OSS 的產品到 EU(製造商 exposure),兩條法規軌道平行跑。Steward 角色:第 24 條、cybersecurity policy、零罰款。製造商角色:第 13 條、完整符合性評鑑、CE 標示、SBOM、support period、附件七、完整罰款。不要混。Commission Draft Guidance 明確確認同一個法人可以對不同專案或不同版本同時握有兩種角色。記錄哪個角色適用於哪個專案,是把兩邊都做對的一部分。

§ 07讓拼圖值得解的不對稱

回到那家 APAC 閘道製造商。合規主管讀完第 24 條、再讀第 3(14) 條、再讀 Recital 19,分析就解了。

公司是自家閘道的製造商——完整 Article 13 義務、完整 Article 14 通報時鐘、完整符合性評鑑路徑。這部分從來不是問題。

公司也是 Oniro 的贊助者,透過它的 Strategic Member 投入。但 Oniro 的 steward 是 Eclipse Foundation AISBL——系統性、持續性支援該專案、且有 EU 管轄觸達的法人。APAC 公司不是 steward。它是貢獻者跟贊助者。Recital 18 確認:對自己沒有責任的專案貢獻原始碼,把貢獻者放在法規之外。

所以公司有一個法規角色(自家閘道的製造商)跟一個支援關係(贊助一個 steward 是 Eclipse 的專案)。兩塊,都定義良好。拼圖不在答案裡;拼圖在「搞清楚這裡有兩塊、不是三塊」這件事上。

那就是第 24 條為 EU 法規架構增加的東西:一塊原本不存在的拼圖。它乾淨地抓到一些法人、乾淨地放掉另一些法人,要求剩下的人仔細讀第 3(14) 條的五行字。一旦看到閘門、讀起來不困難。但在看到閘門之前,那個縫隙看起來比實際深。

Recital 19 那個 light-touch 規範體制在做真實工作。它說:維持關鍵商業軟體存活的基金會跟企業贊助 OSS 機構,會拿到一個對齊 OSS 現實的法規體制——可驗證 policy、跟 MSA 合作、零罰款。它也說:個人、非正式團體、無商業意圖的專案待在外面。類別窄、裡面義務有限、罰款是零。唯一要做的,是仔細讀那五道閘門。

對 APAC OSS 貢獻者來說,那個閱讀就是工作。一旦做完,多數在外面。少數在裡面。幾乎沒有人在他們第一次讀時以為自己會落入的桶子裡。