CRA Article 14 is live since 11 September. Which integration authors does it actually reach?

Development
1

Disclosure first: I am a developer in Rennes building a small toolkit around this regulation, not a Home Assistant maintainer. No link here, this is a question, not a pitch. I read the EU Cyber Resilience Act with Home Assistant in mind, because the usual summaries talk about “manufacturers” and most people here are hobbyists. Here is where I landed, with the articles, and I would like to be corrected.

  • A custom integration on HACS written by an individual, no revenue: outside the regulation. Recital 18 excludes free and open-source software that is not monetised. HACS has no payment mechanism, so this is the dominant case.
  • A sponsor link that covers a test device or hosting: still outside (recital 18 explicitly allows donations that do not exceed costs). Regular income that funds your time is where it starts to look like a commercial activity.
  • An integration maintained by the manufacturer of a device (core or custom): the device is the product, the integration is part of it, the company is the manufacturer (Article 13). All the “Works with Home Assistant” partners are here.
  • A paid add-on, or an add-on that fronts a paid service: manufacturer.

What is live since 11 September 2026: Article 14. A manufacturer who learns that a vulnerability in its product is actively exploited files an early warning within 24 hours on the ENISA platform, then a notification within 72 hours. The rest (Annex I requirements, SBOM, disclosure policy, technical documentation, fines) starts on 11 December 2027.

Two things I could not find and would like to know:

  1. Has Nabu Casa or the Open Home Foundation said anything about the CRA for the core and for HACS? The Foundation looks like what Article 24 calls an “open-source steward”, but I found nothing published.
  2. For those of you maintaining an integration for a device you also sell: how are you handling the 24-hour clock in practice? Who watches the CVE feeds for your dependencies?

Not legal advice. I am a developer who read the text, not a lawyer.

2

Thanks for posting these interesting questions. I am just a user, not a maintainer, and also not a lawyer. I am active in the software development business and I am very interested in the answers to your questions.

You mention core and HACS in one go in your final questions, but from what I’ve read HACS is considered a partner to the Open Home Foundation. So while the OHF supports HACS, I would not expect them to make any statements on their behalf.

As for manufacturers selling a device and providing an integration for it, this is an interesting dilemma. Fo instance Skoda is now building an official integration to interact with a brand new official API to their cars. I do not know if the integration comes with a disclaimer. I also don’t know if it is possible to shy away from their responsibilities with an “at your own risk” statement, but they should.

HA, despite all its efforts to promote local only, is basically a security nightmare. I dare say if HA is used to exploit the API to the cloud functions for the car, that it is unlikely that it is just the integration and the API, but rather the whole of the HA system that needs serious work. So it might not be in the manufacturers ability to plug the hole. It is also i possible for OHF or Nabu Casa to take on the responsibility.

Likewise I applaud Skoda for creating an official integration. I would hate it if they shy away because of the increased risk.