CRA?

CRA?

The reason that this is all a bit shaky is that placing on the market as a term of art applies to free (and gratis) software projects, too, and the CRA has very specific exemptions to cover "normal" open source activities. This is quite deliberate, because the Act's drafters do not want to exempt "open core" from the CRA's requirements (e.g. just because a bug is in AOSP should not mean that Google is exempt from the CRA's provisions as they apply to Pixel phones), nor do they want to create a situation where you release a "data collection" app as open source (depending on your Internet services to do anything useful) and get exempted, where your competitor who does all the work on-device is not exempt.

Instead, there's two significant classes of exception, which are intended to cover most FOSS activities:

1. Where you give away the software for free, separately to hardware, permit onwards distribution under the same terms as direct distribution from you and you neither collect personal data not necessary to the operation of the software, nor accept donations in excess of your costs. This is intended to cover most personal projects; if you take code you wrote, slap a FOSS licence on it, and upload it to Savannah or equivalent services, this exception covers you. It should also cover a lot of corporate open source, but it pushes companies wanting to be under this exception into a place where they have no way to prevent a competitor hiring away their developers and making more money from the project that the originating company did.
2. Where the previous exception does not apply, but you act as an "open source steward" (which means accepting contributions from outside your organisation on the same terms as you licence the final product, as one example), you are covered, but you cannot be fined for a breach of the Act. You still face the other penalties in the Act (e.g. being required to take the project off the market if you can't fix your security processes quickly enough), but there's no monetary penalty for breaching the Act, only for keeping the project on the market yourself after failing to meet the required schedule for fixing things. This one's meant to cover things like CentOS Stream

In this specific case, Clear Linux should come under the first exception; it doesn't collect personal data, you can't give them money, and you're allowed to redistribute Clear Linux under the same terms as Intel.