开源软件管理者
以开源软件管理者身份参与开源活动的组织，承担相对较轻的专门义务。
类别解释
Open source software stewards
CRA 为开源软件设置了专门规则：不以商业方式投放市场的自由和开源软件通常不由 CRA 直接约束；而以开源软件管理者身份参与开源软件商业活动的组织，需建立并公开网络安全政策、配合漏洞与事件报告，并向下游用户提供必要的安全信息。
English
The CRA has dedicated rules for open source software: free and open source software not placed on the market commercially is generally out of scope, while stewards involved in commercial open source activity must adopt and publish a cybersecurity policy, cooperate on vulnerability and incident reporting and inform downstream users.
CRA 第 24 条对开源软件管理者的专门安排
Dedicated rules for open source software stewards under Article 24 of the CRA
不按产品类别开展合格评定，而是履行较轻的专门义务；将开源软件投放市场的商业主体仍按产品类别承担完整义务。
No product-based conformity assessment applies; stewards comply with a lighter set of obligations, while commercial actors placing open source software on the market carry the full obligations.
开源软件管理者的主要义务
建立并公开网络安全政策，促进开源项目的安全开发与漏洞处理。
按要求配合报告已利用漏洞与严重事件，并告知下游用户相关安全信息。
明确与商业集成方之间的责任边界。
English
- Set up and publicly document a cybersecurity policy that fosters secure development and vulnerability handling.
- Cooperate on reporting actively exploited vulnerabilities and severe incidents and inform downstream users.
- Clarify responsibility boundaries with commercial integrators.