First: IANAL, EU law is complicated. This is my understanding as of now:

TL;DR: The EU Cyber Resilience Act (CRA) aims to enhance cybersecurity standards for products with digital elements. It introduces mandatory requirements for manufacturers and retailers to ensure cybersecurity throughout a product’s lifecycle. The CRA excludes open-source software developers unless their software is used commercially as part of a “product with digital elements”.

would lemmy be regulated by CRA?

Lemmy, as an open-source project, would likely not be directly regulated by the CRA. The Act specifically excludes open-source developers from its scope unless their software is used commercially.

Whaz about lemmy instances?

Lemmy instances might be regulated by the CRA if they are operated commercially as part of a “product with digital Elements”. (Is there a pay for access instance or hosting as a service for lemmy? I am not aware of one.) However, since most instances are run non-commercially or for personal use, they would likely fall outside the CRA’s scope.

Is there a difference if there is a fee or a recurrent donations?

Yes:

• A fee is typically a mandatory payment for a service or product, e.g. a feature locked behind a paywall.
• A recurring donation is a voluntary, regular contribution to support an organization or cause, often without receiving goods or services in return.

The key distinction lies in the obligation attached to the payment. Fees come with an expectation of receiving something in return, while donations are given freely without such expectations.