{"MetaKeywords":null,"MetaDescription":"Does the EU Cyber Resilience Act apply to your online store, your plugins or the e-commerce software you sell? Dates, obligations and what to prepare now.","MetaTitle":"Cyber Resilience Act and open-source e-commerce","SeName":"cyber-resilience-act-open-source-ecommerce","Title":"The EU Cyber Resilience Act and open-source e-commerce: who has to do what","PictureModel":{"ImageUrl":null,"ThumbImageUrl":null,"FullSizeImageUrl":null,"Title":null,"AlternateText":null,"Style":null,"ExtraField":null,"Id":null,"UserFields":[]},"Body":"

The EU Cyber Resilience Act (CRA) sets security rules for \"products with digital elements\" sold in the European Union - hardware and software alike. It entered into force on 10 December 2024 and applies in two steps:

\n\n

If you run or build online stores, the question is not whether the CRA exists but whether it applies to you. The short answer: it depends on whether you sell software, not on whether you sell online.

\n

This article explains the regulation in plain terms. It is not legal advice; for your own case, ask a lawyer.

\n\n

Who is in scope in e-commerce

\n\n\n\n\n\n\n\n\n\n\n
You are...Likely position under the CRA
A merchant running your own online storeGenerally not in scope for the store itself. A website people use in a browser is not, on its own, a product placed on the market. Your obligations come from other laws (GDPR, NIS2 if you are large enough).
Selling plugins, themes or add-ons in the EUA manufacturer of those products: reporting since September 2026, the full set of obligations from December 2027.
Selling or licensing an e-commerce product built on an open-source platformA manufacturer of that product - including the open-source components inside it, which you must check and keep updated.
An agency building custom stores for clientsDepends on what you deliver and how. Custom development for one client and a packaged product sold to many are treated differently; this is the case to take to a lawyer.
Contributing to an open-source project without monetising itNot a manufacturer. The CRA explicitly avoids burdening non-commercial open-source development.
An organisation that supports an open-source project used commerciallyPossibly an open-source software steward - a lighter regime focused on a security policy and cooperation with authorities.
\n\n

Reporting: what has applied since September 2026

\n

A manufacturer that learns of an actively exploited vulnerability in its product, or a severe incident affecting its security, notifies it through the single reporting platform run by ENISA:

\n
    \n
  1. an early warning within 24 hours of becoming aware,
    2. \n
  2. a notification with more detail within 72 hours,
    3. \n
  3. a final report within 14 days after a fix is available (for a vulnerability) or within a month (for an incident).
    4. \n
\n

You can only meet those deadlines if you hear about problems quickly - from your own monitoring, from users, and from the upstream projects your product is built on.

\n\n

The open-source components inside your product

\n

If you sell a product that includes open-source code - an e-commerce platform, libraries, a database driver - the CRA expects you to exercise due diligence on those components. In practice that means:

\n\n\n

What to prepare now

\n
    \n
  1. Decide which of the roles above is yours, product by product.
    2. \n
  2. Publish a vulnerability disclosure policy - a page and an address where researchers can report issues.
    3. \n
  3. Generate an SBOM for every release you ship.
    4. \n
  4. Write down your support period: which versions receive security updates, and until when.
    5. \n
  5. Rehearse the 24-hour warning: who decides, who writes it, who submits it.
    6. \n
\n\n

How GrandNode fits in

\n

GrandNode is open source under GPL-3.0. The project publishes a security policy with a way to report vulnerabilities, and from the next release on, its Docker images on GitHub Container Registry are signed and carry an SBOM and build provenance. Security fixes for the latest version are published to everyone.

\n

If you build products on GrandNode and need fixes on one version for longer, GrandNode Official adds LTS releases with a 24-month lifecycle, backported security fixes, private notice of vulnerabilities before they are disclosed publicly, and a compliance pack with the security policy and CVE history. It gives you the inputs your own CRA process needs; it does not make your product compliant on your behalf - nothing a supplier sells can.

","BodyOverview":"

Since 11 September 2026, the EU Cyber Resilience Act requires manufacturers of software to report actively exploited vulnerabilities. Here is who that means in e-commerce, and what to prepare before the main obligations apply in December 2027.

","AllowComments":false,"NumberOfComments":0,"CreatedOn":"2026-10-03T10:00:00","Tags":["Cyber Resilience Act","security","compliance","open source"],"Comments":[],"AddNewComment":{"CommentText":null,"DisplayCaptcha":true,"Captcha":{"ReCaptchaChallengeField":null,"ReCaptchaResponseField":null,"ReCaptchaResponseValue":null,"ReCaptchaResponse":null},"Id":null,"UserFields":[]},"Id":"6ac0dd893fddd1b1aaa3969c","UserFields":[{"Key":"gnc.blog.hash","Value":"ee30038bd278d1bef3e908113a4ecbaad88d922a","StoreId":""}]}