Open Source Under the Cyber Resilience Act: Compliance automation and governance models for sustainable security

This paper examines how the EU Cyber Resilience Act (CRA) and the revised Product Liability Directive reshape accountability for open source software once integrated into commercial products. It highlights emerging compliance burdens, persistent ambiguity over exemptions and challenges in allocating liability among contributors, foundations and integrators. The study explores how DevSecOps automation through SBOM generation, continuous vulnerability scanning and policy as code enforcement can operationalize legal requirements within engineering workflows. It evaluates governance solutions such as stewardship foundations and shared responsibility models to prevent regulatory pressure from discouraging voluntary participation. The paper concludes that sustainable security requires hybrid frameworks that combine enforceable obligations for commercial actors with automation, community support and safeguards that preserve open collaboration as a driver of innovation and resilience. Note: Version updated in repository for preservation and digital accessibility. Original intellectual content remains unchanged. Generative AI tools were used solely for translation and linguistic refinement. No AI tools were involved in the conception or substantive development. The final text was reviewed and approved by the author. Official reference version:Zenodo DOI: https://doi.org/10.5281/zenodo.17479259Parallel version available: SSRN: https://ssrn.com/abstract=5552760 - DOI: https://doi.org/10.2139/ssrn.5552760Preservation copy at the Internet Archive: https://archive.org/details/zenodo.17479259