To be clear, global open source software projects will be unable to strictly comply with provisions contained in current drafts of the CRA. Much of the world's open source software will likely soon be either 1) blocked for distribution in the EU or 2) publicly accessible with caveats similar to “this software is not appropriate or approved for use or distribution in the European Union market.”
Linux foundation's fear of the CRA is not so much the requirements made wrt software, but the requirements of demonstrating/documenting compliance. #openvraag what are the carve outs in current texts? What do the pre-ambles say wrt who specific admin reqs apply to. Isn't OS by definition compliant in the sense that the rationale of OS party is increasing its security?