So I don't really know what I'm talking about...

But isn't the EU cyber resiliency act about requiring companies to provide guarantees on their software?

Open source projects alone cannot provide those, but it seems like something a secondary organization could provide ala a 'pay us a fee, and we will provide a legal guarantee' on software quality + liability insurance.

The only way that those liability organizations could provide those type of guarantees is by being associated with the project/updates, and ideally use the money they get from liability fees to cover developer pay?