<!-- headlesslaw {"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2024-11-20","gaps":[],"covered":["CRA L1"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/cra/articles/25","url":"https://www.headlesslaw.com/cra/articles/25","title":"Article 25 — Security attestation of free and open-source software","family":"l1_generated","work_id":"cra","status":"not_yet_applicable","force_status":"in_force","date_state":"not_yet_applicable","requested_date":null,"as_of":"2026-11-02","applies_from":"2027-12-11","application":{"state":"not_yet_applicable","next":"2027-12-11","dates":[{"at":"2027-12-11","note":"Article 71(2)"}]},"version_label":"Consolidated version of 20 November 2024","check":{"against":"EUR-Lex","on":"2026-10-26"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02024R2847-20241120","valid_from":"2024-11-20","valid_until":"2027-12-11","revision":1,"content_id":"ed492263c6a202f6","change_date":null,"nearest_versions":["2024-11-20"],"first_text_date":"2024-10-23","correction_applies":false,"versions":["2024-11-20"],"version_url":"https://www.headlesslaw.com/cra/articles/25/versions/2024-11-20","revision_url":"https://www.headlesslaw.com/cra/articles/25/versions/2024-11-20/rev/ed492263c6a202f6","versions_url":"https://www.headlesslaw.com/cra/articles/25/versions","relations_url":"https://www.headlesslaw.com/cra/articles/25/relations","source_line":null,"attribution":null}} -->
---
title: "Article 25 — Security attestation of free and open-source software"
type: regulation
legal_status: in_force
source: "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02024R2847-20241120"
source_retrieved: 2026-10-03
shortTitle: "Article 25 — Security attestation of free and open-source software"
instrument_type: level1_regulation
authority: Commission
binding: true
binding_character: binding
mica_level2: false
legal_basis: "Regulation (EU) 2024/2847"
instrument: cra
celex: "32024R2847"
regulation: CRA
regulation-full: "Regulation (EU) 2024/2847"
article: 25
status: in_force
object_id: eu.cra.legal_text.article.25
text_version: "Consolidated version of 20 November 2024"
source_url: "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02024R2847-20241120"
check_status: matched
verified: true
last_checked: 2026-10-26
---

*In force · applies from 11 Dec 2027 · Consolidated version of 20 November 2024 · Checked against EUR-Lex on 26 Oct 2026 · [Official source](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02024R2847-20241120)*

In order to facilitate the due diligence obligation set out in [Article 13(5)](13.md), in particular as regards manufacturers that integrate [free and open-source software](https://www.headlesslaw.com/definitions/cra/free-and-open-source-software) components in their products with digital elements, the Commission is empowered to adopt delegated acts in accordance with [Article 61](61.md) to supplement this Regulation by establishing voluntary security attestation programmes allowing the developers or users of products with digital elements qualifying as free and open-source software as well as other third parties to assess the conformity of such products with all or certain essential [cybersecurity](https://www.headlesslaw.com/definitions/cra/cybersecurity) requirements or other obligations laid down in this Regulation.

***

[Chapter II — Obligations of economic operators and provisions in relation to free and open-source software](../chapters/ii.md) · [← Article 24](24.md) · [Article 26 →](26.md)