The EU Cyber Resilience Act latest text has some pretty good words on open source. These words are to be found in the preamble & "recitals". Contrary to what some people are now claiming, these words on open source do determine what the act means & how judges will read it. These are not just 'non-binding comments':
https://berthub.eu/articles/posts/eu-cra-recitals-comments-compiler-judge/