If I maintain an open source codebase, and am treated as a "manufacturer" or "steward", what penalties could I face for violating the CRA?

If you are a solo or small-team maintainer of an open source codebase, but do get treated as a manufacturer or steward for some reason (such as monetization), you may be subject to some penalties. However, the penalties should be limited. In particular:

• If you are regulated because you are a steward, stewards are explicitly exempted from any fines, though you may still be required to take corrective actions for any problems that are uncovered. See Article 64.

• If you are regulated because you are a manufacturer, penalties must still be constrained. Specifically, all penalties must be "proportionate" (Recital 120; Article 64). In addition, when imposed on a natural person, the penalties must take into account "the economic situation" and "size" of the entity (Recital 121; Article 64). As a result, while it is not formally required, most regulators will likely to request corrective action before imposing a fine.