Automated Regulatory Compliance Assessment for Open-Source Software: A Machine-Readable Policy Approach Applied to the Cyber Resilience Act

The entry into force of the EU Cyber Resilience Act (CRA) imposes mandatory cybersecurity obligations on software products, yet compliance assessment tools available to manufacturers remain largely manual, costly, and unable to produce actionable, rule-level reports. This paper proposes a policy-driven framework for automated regulatory compliance assessment of open-source software. The framework combines a machine-readable policy model extending ODRL with pre-condition constraints, an automated evidence collection method based on GitHub’s public REST API, and a rule evaluation engine built on Open Policy Agent. The approach is validated through a black-box test suite of 34 test cases and a full end-to-end assessment of Home Assistant Core version 2026.6.1 against a formalisation of CRA Annex I comprising 21 obligations and 7 pre-conditions. In this use case, 24 of the 29 required operands (83%) were collected automatically from public artefacts without vendor cooperation, of which 8 constitute direct evidence and 16 proxy indicators. The resulting rule-level pre-assessment shows that the component supports 14 of the 21 applicable obligations. Of the 7 it does not support, 5 can be addressed by the integrating manufacturer through its packaging, distribution, risk assessment or own vulnerability disclosure. These results establish the feasibility of the approach for one regulation and one project. Its generality across projects and regulations remains to be evaluated.