Article 6, Numeral 2 "In determining the level of cybersecurity risk, one or several of the following criteria shall be taken into account" seems very reasonable in scope and wouldn't include most open source/free software.