Am I a manufacturer? The CRA question nobody answers.

The question fits in one sentence. You built a WordPress plugin, it sits in the open directory, anyone can download it, and you sell a pro version alongside. Does that make you a manufacturer under the Cyber Resilience Act, Regulation (EU) 2024/2847?

The honest answer is uncomfortable. It depends, the sources contradict each other at this point, and some of the loudest voices sell the tooling meant to solve it. In August 2026 we checked the claim that free plugins with a pro version automatically fall under the CRA against every source we could reach. The result is neither a clean yes nor a clean no.

So this article does not offer an answer that does not exist. It sets out what the regulation says, what the Commission says about it, where the two diverge, and which questions let you sort out your own case. This is an explanation and not legal advice.

The sentence that makes most developers flinch

Start with the definition. The exception comes after. Article 3(1) CRA describes a product with digital elements as "a software or hardware product and its remote data processing solutions, including software or hardware components being placed on the market separately". A separately distributed software module is covered. A plugin is a separately distributed software module.

Article 3(13) CRA then defines the manufacturer: anyone who develops or has developed products with digital elements and markets them under their own name or trademark, "whether for payment, monetisation or free of charge". That last phrase is where the discussion usually ends before it starts. Price is not a feature of the manufacturer definition. Marketing under your own name is.

One caveat applies to the whole article: EUR-Lex returned no content for us across several URL forms, so the article quotations come from full-text mirrors that agreed with one another. Check any verbatim quote against EUR-Lex before reusing it.

The counterweight sits in the Commission guidance

In late July 2026 the European Commission published application guidance on the CRA, reference C(2026) 5252, made up of a communication and an annex carrying the actual guidance. Roughly 80 pages, 67 practical examples, flowcharts, explicitly aimed at microenterprises and SMEs. A note on accuracy: the Commission dates the document Brussels, 27 July 2026, while heise online reports publication on 28 July 2026, probably issue date against publication date. We write late July and give the reference number.

On substance the guidance says the opposite of what many expect after reading Article 3. Freely available open-source software is in principle outside the scope of the CRA as long as it is not commercialised. Commercial activity according to the guidance includes selling the software, paid enterprise editions, monetising services through the program, requiring personal data beyond security and interoperability purposes, and donations that are in effect a condition of access.

Explicitly not commercial according to the guidance: voluntary contributions, public funding and sponsorship on their own. Paid support services do not automatically bring a project under the CRA as long as the software itself stays freely available.

Note what the regulation leaves out. The CRA does not define commercial activity in the articles themselves, so the criteria come from the recitals and from this guidance. That gap is where the readings diverge.

The steward role is lighter, not free

There is a third role between manufacturer and bystander. Article 3(14) CRA defines the open-source software steward as a legal person that is not a manufacturer and whose purpose is sustained, systematic support for the development of specific open-source products intended for commercial activities.

Article 24 spells out what follows: a documented cybersecurity policy fostering secure development and vulnerability handling, including voluntary reporting under Article 15, and cooperation with market surveillance authorities, on reasoned request in a language they easily understand. Paragraph 3 applies Article 14(1) to stewards for the products they help develop, plus Article 14(3) and (8) where severe incidents hit the steward's own development infrastructure.

Remember the combination: stewards carry a reporting duty from 11 September 2026, and under Article 64(10) no administrative fine. If you hear "in scope of the CRA" and picture penalty notices, that picture is wrong for this role. What applies to manufacturers from 11 September 2026 and which clocks start running is covered in the article on CRA reporting obligations.

This is where the sources part ways

The core case: a free plugin in the open directory, a paid pro version from the same vendor alongside. Two readings exist, and they lead to different outcomes.

Reading A: the free version is assessed on its own

Under this reading the free version is judged for itself. If it is not monetised, meaning no purchase required, no access or update gate behind payment, no data processing beyond security and interoperability purposes, then it does not automatically attract full manufacturer obligations just because the same vendor sells a pro version alongside. The Open Regulatory Compliance Working Group reports the guidance as allowing one legal person to hold different roles at once, including for different versions of the same software, community edition and monetised edition alike. Recital 18 backs this up: providing products qualifying as free and open-source software that are not monetised by their manufacturers should not be considered a commercial activity. It also records that regular releases and financial support from manufacturers do not on their own make the activity commercial.

Reading B: the pro version colours the free one

Several vendors specialised in CRA compliance put it more bluntly. If you sell the plugin, offer a pro version, provide paid support or monetise it in any way, you are supplying in the course of commercial activity and you are in scope regardless of the GPL licence. One of those same vendors draws a finer line elsewhere, asking whether the free product works as a marketing channel for a paid offering.

Now the disclosure that belongs with this position. Those vendors sell CRA compliance tooling and consulting to plugin developers. An economic interest in the widest possible reading cannot be ruled out, because more developers in scope means more customers. That is a disclosure and no accusation, and it does not make the statement wrong. It only means the wording does not come from the guidance itself. It comes from market participants with a stake in the outcome. Weighing a source means weighing its interest too.

Another caveat almost nobody ships with their advice: the annex of C(2026) 5252 could not be read by machine. Every substantive statement about open source here comes from the Commission press release, trade media and NGO blogs. We have not read the 67 examples or the precise boundary criteria ourselves. Anyone who tells you exactly what page 41 says either has more access than we do, or is telling you more than they know.

On top of that, no statement from an authority or from the Commission names WordPress plugins explicitly. Treating plugins as products with digital elements is well founded through Article 3(1) and 3(13). The sources that name plugins by name are, without exception, blogs run by vendors selling compliance tooling.

Seven questions to place your own case

These questions replace nobody's legal assessment. They are a sorting grid built from the criteria the guidance and the recitals name. The more often the right column points towards commercial, the more sense it makes to behave as a manufacturer as a precaution.

Our free CRA self-declaration tool turns your answers into a security.txt file and the public contact details for vulnerability reports, without collecting an email address. It does not settle the classification question. It finishes the part that makes sense whichever way the question falls.

Where we place ourselves

hafenstudios is precisely the case under dispute. We ship several plugins with a free version and a paid pro version, among them Wellenbrecher, in the WordPress directory since 21 August 2026. With the Hafen theme we also ship software with no paid edition. Everything is licensed under GPLv2 or later.

Our position: we behave like a manufacturer. That is the cautious assumption, and it costs us less than being wrong would. In practice it means documented contact routes for vulnerability reports, a process for the Article 14 deadlines, and preparation for the full obligations from 11 December 2027: CE marking, technical documentation, conformity assessment and the software bill of materials from Annex I Part II.

We say openly that the question is not settled. A meeting with a lawyer about it is booked. That is more honest than claiming a certainty the sources do not support. To be explicit at the point where it matters: this article is an explanation and not legal advice. For a binding assessment of your own situation you need a qualified lawyer.

The uncertainty is the actual damage

Here is the opinion this article was written for. Regulation as such is not the problem. Security requirements for software running on hundreds of thousands of websites are easy to justify. The problem is that nobody can say reliably who is covered.

That uncertainty lands unevenly. A large company has a legal department to write an assessment and a budget that survives a wrong one. A two-person shop has an evening and a results page where the first five hits come from vendors selling a subscription. The cost of the ambiguity falls on the small player, even though the guidance was written explicitly for microenterprises and SMEs.

National implementation adds to the noise. Reports go to the CSIRT of the member state where the manufacturer has its main establishment, for Germany the BSI with CERT-Bund. The German CRA implementing act was still not in force on 21 August 2026, sitting in the legislative process as Bundestag document 21/6134 of 26 May 2026. It creates no new obligations, it names the competent authorities, and Article 14 applies directly from 11 September 2026 regardless.

What follows is unglamorous. Behave as a manufacturer as a precaution if several of the seven questions point towards commercial. Write down how you reached your classification. And distrust any source that answers this question in two sentences, especially when the third sentence is selling something.

Frequently asked questions