Can someone summarize the impact on say, an open source project with no actual paid release? Is this a case of, if anyone in europe compiles your software, and

Can someone summarize the impact on say, an open source project with no actual paid release? Is this a case of, if anyone in europe compiles your software, and it doesnt meet standards, you are now a criminal? Or is the onus on europeans to install only certified software? Obviously dependencies go pretty deep these days, is say Package B certifying for itself and Package A. Or is Package B assuming Package A will also provide its own certification? Can you comprehensively fail the certification and have it revoked?