Open Source Under the Cyber Resilience Act: Compliance automation and governance models for sustainable security

Abstract: This paper examines how the EU Cyber Resilience Act (CRA) and the revised Product Liability Directive reshape accountability for open source software once integrated into commercial products. It highlights emerging compliance burdens, persistent ambiguity over exemptions and challenges in allocating liability among contributors, foundations and integrators. The study explores how DevSecOps automation through SBOM generation, continuous vulnerability scanning and policy as code enforcement can operationalize legal requirements within engineering workflows. It evaluates governance solutions such as stewardship foundations and shared responsibility models to prevent regulatory pressure from discouraging voluntary participation. The paper concludes that sustainable security requires hybrid frameworks that combine enforceable obligations for commercial actors with automation, community support and safeguards that preserve open collaboration as a driver of innovation and resilience. Note: Selected for distribution in the SSRN Software Engineering eJournal (CompSciRN/CMBO), Vol. 8, Issue 108 (Nov 28, 2025).Scheduled for distribution in the Innovation Law & Policy eJournal (IRPN) and Risk, Regulation & Policy eJournal (LSN) on Dec 9, 2025; in the Cybersecurity, Privacy & Networks eJournal (CompSciRN) on Apr 28, 2026; and in the Entrepreneurship & Law eJournal (ERPN) on Jun 4, 2026. Official reference version:Zenodo DOI: https://doi.org/10.5281/zenodo.17479259Parallel version available: SSRN: https://ssrn.com/abstract=5552760 - DOI: https://doi.org/10.2139/ssrn.5552760Preservation copy at the Internet Archive: https://archive.org/details/zenodo.17479259