{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2024-11-20","gaps":[],"covered":["CRA L1"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/cra/articles/25","url":"https://www.headlesslaw.com/cra/articles/25","title":"Article 25 — Security attestation of free and open-source software","family":"l1_generated","work_id":"cra","status":"not_yet_applicable","force_status":"in_force","date_state":"not_yet_applicable","requested_date":null,"as_of":"2026-11-02","applies_from":"2027-12-11","application":{"state":"not_yet_applicable","next":"2027-12-11","dates":[{"at":"2027-12-11","note":"Article 71(2)"}]},"version_label":"Consolidated version of 20 November 2024","check":{"against":"EUR-Lex","on":"2026-10-26"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02024R2847-20241120","valid_from":"2024-11-20","valid_until":"2027-12-11","revision":1,"content_id":"ed492263c6a202f6","change_date":null,"nearest_versions":["2024-11-20"],"first_text_date":"2024-10-23","correction_applies":false,"versions":["2024-11-20"],"version_url":"https://www.headlesslaw.com/cra/articles/25/versions/2024-11-20","revision_url":"https://www.headlesslaw.com/cra/articles/25/versions/2024-11-20/rev/ed492263c6a202f6","versions_url":"https://www.headlesslaw.com/cra/articles/25/versions","relations_url":"https://www.headlesslaw.com/cra/articles/25/relations","source_line":null,"attribution":null},"provenance":{"official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02024R2847-20241120","check":{"result":"matched","checked_at":"2026-10-26","against":"EUR-Lex"},"repo_path":"spaces/cra/articles/25.md","body_sha256":"58704ff8385c50c109a22213a68b264aa76cc3c7a4b5afc1a636a09d4816b611"},"units":[{"locator":"cra/art/25","kind":"article","status":"in_force","label":null,"heading":"Security attestation of free and open-source software","text":"","marks":[],"revision":1,"text_hash":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","reason":null},{"locator":"cra/art/25/subpara/1","kind":"subparagraph","status":"in_force","label":null,"heading":null,"text":"In order to facilitate the due diligence obligation set out in Article 13(5), in particular as regards manufacturers that integrate free and open-source software components in their products with digital elements, the Commission is empowered to adopt delegated acts in accordance with Article 61 to supplement this Regulation by establishing voluntary security attestation programmes allowing the developers or users of products with digital elements qualifying as free and open-source software as well as other third parties to assess the conformity of such products with all or certain essential cybersecurity requirements or other obligations laid down in this Regulation.","marks":[],"revision":1,"text_hash":"371f72db8f78ecb713e0db9a08ce1487d1bc4d1f0990d3b24e3914cdfb48a959","reason":null}],"markdown":"---\ntitle: \"Article 25 — Security attestation of free and open-source software\"\ntype: regulation\nlegal_status: in_force\nsource: \"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02024R2847-20241120\"\nsource_retrieved: 2026-10-03\nshortTitle: \"Article 25 — Security attestation of free and open-source software\"\ninstrument_type: level1_regulation\nauthority: Commission\nbinding: true\nbinding_character: binding\nmica_level2: false\nlegal_basis: \"Regulation (EU) 2024/2847\"\ninstrument: cra\ncelex: \"32024R2847\"\nregulation: CRA\nregulation-full: \"Regulation (EU) 2024/2847\"\narticle: 25\nstatus: in_force\nobject_id: eu.cra.legal_text.article.25\ntext_version: \"Consolidated version of 20 November 2024\"\nsource_url: \"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02024R2847-20241120\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\n---\n\n*In force · Consolidated version of 20 November 2024 · Checked against EUR-Lex on 26 Oct 2026 · [Official source](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02024R2847-20241120)*\n\nIn order to facilitate the due diligence obligation set out in [Article 13(5)](13.md), in particular as regards manufacturers that integrate [free and open-source software](https://www.headlesslaw.com/definitions/cra/free-and-open-source-software) components in their products with digital elements, the Commission is empowered to adopt delegated acts in accordance with [Article 61](61.md) to supplement this Regulation by establishing voluntary security attestation programmes allowing the developers or users of products with digital elements qualifying as free and open-source software as well as other third parties to assess the conformity of such products with all or certain essential [cybersecurity](https://www.headlesslaw.com/definitions/cra/cybersecurity) requirements or other obligations laid down in this Regulation.\n\n***\n\n[Chapter II — Obligations of economic operators and provisions in relation to free and open-source software](../chapters/ii.md) · [← Article 24](24.md) · [Article 26 →](26.md)\n"}