Open Source and European Digital Sovereignty: A Call to Action

About a week ago, I had the opportunity to discuss ideas and perspectives with Ibrahim Haddad regarding the evolving functions of OSPOs and open source in an increasingly geopolitical era. Following our discussions and his insightful LinkedIn article, I would like to share additional thoughts on the growing importance of digital sovereignty, regulatory compliance, market access, and industrial policy as essential elements of open source strategies for EU organisations. I will conclude with a call to action.

Open source as a policy enabler

Arguably, Open Source Program Offices (OSPOs) have always played an implicitly political yet industry-centric role due to their pivotal role in software acquisition, software development, use-case exploration, go-to-market strategies, and developer empowerment. We often see open source as a means to lessen vendor lock-in, spread innovation, or reduce dependence on costly software solutions, patches and add-ons. We strongly emphasise the capacity of users to implement code changes and have meritocratic input into software roadmaps as critical elements that distinguish authentic open source projects from those that merely claim the label.

These characteristics of open source hold significance not only in business but also in public policy; they embody software freedoms, assist public institutions in creating, sharing, and making inspectable taxpayer-funded software, encourage citizen engagement, promote open access to public data, and embolden movements like “public money, public code.”

Open source and digital sovereignty

In today’s increasingly polarised world, the often-mentioned advantages of open source are seen as strong enablers of “digital sovereignty.” This concept encompasses not only the freedom to choose and change among products and suppliers but also the importance of maintaining access to code bases and services that cannot arbitrarily be restricted or blocked. The concept embodies the significance of protecting company and citizen data from appropriation and misuse, safeguarding public investments and taxation capabilities, and ensuring that products, services, and platforms align with regional values and laws.

Everyone wants to see their own “neck of the woods” do well. It’s human nature. It’s financially sound. It’s good ol’-fashioned healthy capitalist competition. It’s socially responsible. And, in the case of politicians, it’s a matter of political life or death. However, frictions and cracks in traditional trade relations have spurred companies and governments to focus not just on how their budgets are being invested, but on where their budgets (taxpayer money, shareholder value, free cash, etc.) are being invested. When consumer wallets are tight, industrial outlook murky, and trading rules unstable, it might be said that a certain degree of “keeping it local” is a somewhat sensible posture.

The evolving role of the OSPO

In this context, OSPOs are evolving into roles that extend beyond mere compliance and community interaction. They are becoming actors of policy, risk advisors, champions of transparency, and navigators of changing regulatory environments.

As key influencers in the development and execution of IT policy -whether within a corporation, nonprofit, or public organisation- European OSPOs and open source leaders bear a growing responsibility to their organisations to contribute to several areas beyond their conventional focus:

• Tracking proposed regulatory changes and, where possible, feeding into these before they are adopted. The EU Cyber Resilience Act is a case in point.
• Tracking adopted regulatory changes, identifying impacts and opportunities, and providing actionable guidance. For example, the EU AI Act or the EU Accessibility Act.
• Identifying potential risks related to the provenance of the open source solutions and components that their organisation uses. This includes understanding how cross-border partnerships, even within neutral open source foundations and consortia, could be subject to broader political sensitivities.
• Supporting the well-being of their organisation’s open source dependency pipeline (you may see this called “open source sustainability”). For example, pushing code patches or providing contributor time, offering direct financial support, donating free services or hardware, assisting with promotion, meetups and events, etc.

Call to action

Open source has consistently been a strong catalyst for collaboration across borders, uniting diverse cultures, viewpoints, talents, and energies worldwide.

Open source is a powerful force for breaking down silos, promoting social inclusion, facilitating knowledge sharing, enhancing personal education, fostering collaborative innovation, driving scientific discovery, generating capitalist value, enhancing product sustainability, multiplying investments, achieving peer-reviewed excellence, and upholding liberty.

To strengthen the European open source ecosystem as a vital driver of technical innovation, digital independence, business growth, civic inclusion, and ethical, non-partisan collaboration, I urge European business leaders, IT decision-makers, and public institutions to adopt a sea change in approach:

1. Open source projects initiated by European entities, including companies, non-profits, institutes, and government bodies, should favour European open source organisations. This approach reduces the potential risk, albeit unlikely, of being eventually disconnected from these projects (security), bolsters the sustainability of these organisations (resilience), and enhances the network effect they create (business). A fragmented and struggling European open source ecosystem does not serve the interests of a vibrant, innovative, and sovereign European industrial and service economy within a global hyper-digital world.
2. European open source organisations (such as OW2) represent a public good. They provide an open, reusable code base — essentially, a digital commons — within a rules-based governance structure that benefits everyone, not just their members (paying or not). It is crucial that European governments recognise and support such organisations, for instance, through tax exemptions and annual grants. Conceivably, such support might require establishing a set of common eligibility criteria, collaboratively developed by policymakers and the European open source community, that creates a fair and equitable environment for nurturing homegrown open source organisations across Europe.

Championing open source projects and platforms based in Europe isn’t inward-looking, nor is it nationalistic or exclusionary. It’s good business sense and sound public policy. It supports European open source developers, small businesses, and industry. Above all, it promotes European values all the while encouraging global collaboration.