The Cyber Resilience Act (CRA) is an EU regulation designed to enhance the cybersecurity of products with digital elements. It introduces a specific legal category for 'open-source software stewards', defined as legal entities like foundations or non-profits that provide sustained support for the development of open-source software intended for commercial use. This category acknowledges the unique, often non-commercial, nature of open-source development. The CRA's rules apply to open-source software only when it is supplied as part of a commercial activity; individual contributors and purely non-commercial projects are generally exempt. Stewards are subject to a lighter, tailor-made regulatory regime compared to commercial manufacturers. Key obligations include establishing a cybersecurity policy to promote secure development, ensuring effective vulnerability management, cooperating with market surveillance authorities, and reporting actively exploited vulnerabilities and severe security incidents. A notable distinction is that open-source software stewards are not subject to administrative fines for infringements.