> For the complete documentation index, see [llms.txt](https://www.mica.wtf/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.mica.wtf/cra/chapter-ii-obligations-of-economic-operators-and-provisions-in-relation-to-free-and-open-source-soft/24.md). # Art. 24 — Obligations of open-source software stewards CRA Article 24 — Obligations of open-source software stewards. Regulation (EU) 2024/2847, Chapter II — Obligations of economic operators and provisions in relation to free and open-source software. 1. Open-source [software](https://headlesslaw.com/definitions/cra/software/) stewards shall put in place and document in a verifiable manner a [cybersecurity](https://headlesslaw.com/definitions/cra/cybersecurity/) policy to foster the development of a secure [product with digital elements](https://headlesslaw.com/definitions/cra/product-with-digital-elements/) as well as an effective handling of vulnerabilities by the developers of that product. That policy shall also foster the voluntary reporting of vulnerabilities as laid down in [Article 15](/cra/chapter-ii-obligations-of-economic-operators-and-provisions-in-relation-to-free-and-open-source-soft/15.md) by the developers of that product and take into account the specific nature of the [open-source software steward](https://headlesslaw.com/definitions/cra/open-source-software-steward/) and the legal and organisational arrangements to which it is subject. That policy shall, in particular, include aspects related to documenting, addressing and remediating vulnerabilities and promote the sharing of information concerning discovered vulnerabilities within the open-source community. 2. Open-source software stewards shall cooperate with the market surveillance authorities, at their request, with a view to mitigating the cybersecurity risks posed by a product with digital elements qualifying as [free and open-source software](https://headlesslaw.com/definitions/cra/free-and-open-source-software/). Further to a reasoned request from a [market surveillance authority](https://headlesslaw.com/definitions/cra/market-surveillance-authority/), open-source software stewards shall provide that authority, in a language which can be easily understood by that authority, with the documentation referred to in paragraph 1, in paper or electronic form. 3. The obligations laid down in [Article 14(1)](/cra/chapter-ii-obligations-of-economic-operators-and-provisions-in-relation-to-free-and-open-source-soft/14.md) shall apply to open-source software stewards to the extent that they are involved in the development of the products with digital elements. The obligations laid down in [Article 14(3)](/cra/chapter-ii-obligations-of-economic-operators-and-provisions-in-relation-to-free-and-open-source-soft/14.md) and (8) shall apply to open-source software stewards to the extent that severe incidents having an impact on the security of products with digital elements affect network and information systems provided by the open-source software stewards for the development of such products. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://www.mica.wtf/cra/chapter-ii-obligations-of-economic-operators-and-provisions-in-relation-to-free-and-open-source-soft/24.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.