Earlier quoted context omitted.
Big parts of the legislation are good and long overdue. The big problem is that this effectively also includes many free/open-source software projects, as the definition for what constitutes "commercial" or "commercial-grade" is very broad. You host a FOSS library on Github that can/is used by others? Congrats, you now have to fulfil all requirements. Look for "Update on the European Cyber Resilience Act" by the Ecli…
But if they don't include free/OSS projects, then commercial companies sponsoring FLOSS is an obvious way to launder liability, is it not?
Sure, that is something that has to be avoided. The problem is that "commercial" is so broadly defined that basically everyone is covered, even non-profit organizations or single developers. A lot of those that want to release open-source stuff suddenly have to comply with all the requirements, which means having to spend a lot of time or money that non-commercial entities often don't have. This effectively kills nearly all of open-source in the EU. A sibling response mentions some improvements, but it still contains stuff like: (10a) "[...]Similarly, where the main contributors to free and open-source projects are developers employed by commercial entities and when such developers or the employer can exercise control as to which modifications are accepted in the code base, the project should generally be considered to be of a commercial nature."