The Python Software Foundation on European cybersecurity

EXcluded from one definition, but INcluded in other places, sometimes explicitly, sometimes implicitly. It's the latter (perhaps unintentional) stuff that has everyone worried, and nobody wants to become the legal guinea pig to find out how the courts will ultimately rule on each member state's legislative interpretation of the CRA. (Again, it's not the _well intentioned_ folks I'm worried out, it's the "crap, we're facing down a metric f-ton of liability, how can we try to get out of this? I know, let's try to foist this onto our 'suppliers' by claiming they're responsible" folks. Or just plain malicious parties,)

For example, the use of the words "made available" instead of "sold" -- My software is written and hosted in the US, but it's "made available" to folks in the EU by virtue of being on the public internet, and plenty of EU-based folks download/use it -- and ask me for support, sometimes paying me for my efforts. That latter scenario explicitly makes me into a "manufacturer" conducting "commercial activity" (the ISC calls this out) thus promoting me into a category where I would have widespread responsibilities and liabilities under the CRA.

Meanwhile, there is plenty of EU precedent for regulations intentionally applying broadly and extra-trerritorially (see: GPDR), so it is quite plausible that the liabilities under the CRA don't just apply to EU-based persons/organizations, so long as the end-user/person-who-holds-the-digital-element-containing-widget-in-their-hands is an EU citizen.