Open source sovereignty gets down to the boring business of making it work

The Open Source Summit Europe 2026 in Prague centered on digital sovereignty, with Linux Foundation board chair Nithya Ruff and Research Institutes of Sweden's Johan Linaker delivering a keynote on geopolitics and the fight to stay open. Sessions covered OpenSSF's CRA Baseline For Open Source Consumption (CRABFOSC) for Cyber Resilience Act compliance, whose 24-hour reporting obligations for actively exploited vulnerabilities began last month and whose main requirements apply from December 2027, plus Éléonore Daxhelet's presentation of the 2026 digital sovereignty report.

software https://www.theregister.com/tag/software Open source sovereignty gets down to the boring business of making it work Open Source Summit EU Migration targets, security rules, and management metrics take center stage at this year's event AI and digital sovereignty dominated this year's Open Source Summit Europe. But beyond the AI noise, the sovereignty discussions offered something useful: practical plans for putting open source to work. The recurring theme of digital sovereignty started right from the first day's keynotes, with Geopolitics https://osselceu2026.sched.com/event/2Rb7E/keynote-open-source-at-a-crossroads-geopolitics-sovereignty-and-the-fight-to-stay-open-nithya-ruff-chair-linux-foundation-board-johan-linaker-senior-researcher-rise-research-institutes-of-sweden-adjunct-assistant-professor-lund-university , https://osselceu2026.sched.com/event/2Rb7E/keynote-open-source-at-a-crossroads-geopolitics-sovereignty-and-the-fight-to-stay-open-nithya-ruff-chair-linux-foundation-board-johan-linaker-senior-researcher-rise-research-institutes-of-sweden-adjunct-assistant-professor-lund-university Sovereignty https://osselceu2026.sched.com/event/2Rb7E/keynote-open-source-at-a-crossroads-geopolitics-sovereignty-and-the-fight-to-stay-open-nithya-ruff-chair-linux-foundation-board-johan-linaker-senior-researcher-rise-research-institutes-of-sweden-adjunct-assistant-professor-lund-university , https://osselceu2026.sched.com/event/2Rb7E/keynote-open-source-at-a-crossroads-geopolitics-sovereignty-and-the-fight-to-stay-open-nithya-ruff-chair-linux-foundation-board-johan-linaker-senior-researcher-rise-research-institutes-of-sweden-adjunct-assistant-professor-lund-university and the Fight to Stay Open https://osselceu2026.sched.com/event/2Rb7E/keynote-open-source-at-a-crossroads-geopolitics-sovereignty-and-the-fight-to-stay-open-nithya-ruff-chair-linux-foundation-board-johan-linaker-senior-researcher-rise-research-institutes-of-sweden-adjunct-assistant-professor-lund-university , by the Linux Foundation's Nithya Ruff https://osselceu2026.sched.com/speaker/nruff and Johan Linaker https://osselceu2026.sched.com/speaker/johan.linaker from Research Institutes of Sweden, whose name is considerably longer than its URL: ri.se https://www.ri.se/en . This isn't just some European issue. Ruff stressed that it mattered "from Canada, to Sierra Leone, to Trinidad and Tobago." This was followed by Open Source Security as the Foundation of European Sovereignty https://osselceu2026.sched.com/event/2RfuK/open-source-security-as-the-foundation-of-european-sovereignty-madalin-neag-mirko-boehm-the-linux-foundation , focusing on OSS supply chains. Then ORBIT Launchpad: Building the Due Diligence Bridge Between Manufacturers and Open Source https://osselceu2026.sched.com/event/2RaX4/orbit-launchpad-building-the-due-diligence-bridge-between-manufacturers-and-open-source-sarah-evans-dell-technologies-rao-lakkakula-microsoft?iframe=no&w=100%25&sidebar=yes&bg=no , with speakers from Dell and Microsoft discussing OpenSSF https://openssf.org/ 's efforts to build catalogs of open source components to help companies achieve CRA compliance, such as CRABFOSC – the CRA Baseline For Open Source Consumption. The EU's Cyber Resilience Act https://www.theregister.com/security/2023/12/04/eu-lawmakers-finalize-tough-cyber-security-rules/1170170 CRA is now starting to bite: reporting obligations https://www.theregister.com/security/2026/09/11/eus-cyber-resilience-act-starts-the-24-hour-vulnerability-clock/5295821 for actively exploited vulnerabilities and severe security incidents began last month, with its main requirements applying from December 2027. Hearing Dell and Microsoft discuss how to meet those requirements, rather than simply why they matter, was encouraging. Éléonore Daxhelet presented the 2026 report https://osselceu2026.sched.com/event/2RaYW/digital-sovereignty-institutionalisation-and-international-momentum-2026-osor-report-on-progress-and-trends-eleonore-daxhelet-openforum-europe from the EU's Open Source Observatory https://interoperable-europe.ec.europa.eu/collection/open-source-observatory-osor , or OSOR. Emphasizing that this isn't just an EU matter, she highlighted Diaa https://expo.diia.gov.ua/ about-diia , from the Ministry of Digital Transformation of Ukraine, as well as the Swiss EMBAG legislation we recently covered https://www.theregister.com/os-platforms/2026/09/09/switzerland-tests-a-foss-escape-route-from-microsoft-365/5294878 . The slides are online https://hosted-files.sched.co/osselceu2026/3c/Open%20Source%20Summit%20Europe OSOR%20Presentation 2026%20Report%20on%20Progress%20and%20Trends.pdf PDF . Then, as if to emphasize that further, Kazuki Imamura from Japan's Innovation Platform Agency https://www.ipa.go.jp/en/ IPA presented the Japan-Type OSS Model https://osselceu2026.sched.com/event/2Rfv5/the-japan-type-oss-model-native-species-seeding-strategy-and-rules-as-code-kazuki-imamura-ipa-innovation-platform-agency-japan . The IPA looked at hundreds of companies in seven countries, and more than 30,000 GitHub repositories, and found that while a lot of organizations are talking about open source, few are actually doing it. Japan has its own three-axis approach, where the public sector attempts to plant seeds and cultivate efforts by local commercial vendors, with a strong emphasis on the need for machine-readable legislation and rules. Again, the slides are online https://hosted-files.sched.co/osselceu2026/5a/japan-type-oss-model.pdf PDF and contain some uncomfortable numbers. To pick out the single talk with the most information, it might be Strategic Approach To Demonstrating the Value of OSS Efforts https://osselceu2026.sched.com/event/2RaY5/strategic-approach-to-demonstrating-the-value-of-oss-efforts-dawn-foster-fast-wonder by Dr Dawn Foster of Fast Wonder https://fastwonder.com/ . She started with the Linux Foundation's report on Measuring OSPO Value https://www.linuxfoundation.org/research/measuring-ospo-value , examining open source program offices, and then presented a remarkable amount of guidance and info from the CHAOSS Project https://www.chaoss.community/about-chaoss/ . It stands for Community Health Analytics in Open Source Software, and Foster's dense slide deck https://hosted-files.sched.co/osselceu2026/6c/Demonstrating%20Value%20OSSEU%202026.pdf PDF linked to multiple different guides from the CHAOSS Practitioner Guides https://www.chaoss.community/about-chaoss-practitioner-guides/ . There is a lot of reading here, including a series on viability metrics https://www.chaoss.community/oss-viability-metric-supermodel/ , a guide on demonstrating organizational value https://www.chaoss.community/practitioner-guide-demonstrating-org-value/ , and a guide on how to research software impact https://www.chaoss.community/practitioner-guide-research-sw-impact/ . To our eye, this looks like pragmatic stuff: info on how to introduce and run FOSS programs, on how to talk to users, and, perhaps most importantly, on how to explain it to executives. Many talks made reference to Schleswig-Holstein's moves away from the US cloud https://www.theregister.com/software/2025/10/15/schleswig-holstein-waves-auf-wiedersehen-to-microsoft-stack/1543638 . One was from two of the people behind Berlin's Strategy for Digital Sovereignty https://osselceu2026.sched.com/event/2RaY2/open-source-as-a-government-goal-berlins-strategy-for-digital-sovereignty-lessons-learned-marcel-scholze-pwc-germany-florian-ebel-senatskanzlei-berlin . Berlin is both a city and a German state, with more residents than Schleswig-Holstein. The city government is working with PwC to manage its migration – not the first name that springs to mind in FOSS, but a sign that the giant consultancies see business here too. We were not surprised to see the only mention of KPIs at the entire summit here; we were slightly more surprised by the timescales, which aim to make 70 percent of the software stack on administrative workstations open source by 2032. The slide deck https://hosted-files.sched.co/osselceu2026/0d/Open%20Source%20as%20a%20Government%20Goal.pdf PDF reveals a rather bureaucratic planning process, but that's not a big surprise; nor is quite a lot of discussion of Governance, Dependencies, and Measures. Executives, in our experience, tend to like numbers they can measure and targets they can aim for. Emiel Brok from SUSE talked about the State of the OSS Union: Assessing Your Stack's Autonomy Under EU Law https://osselceu2026.sched.com/event/2Rajh/state-of-the-oss-union-assessing-your-stacks-autonomy-under-eu-law-emiel-brok-suse-dosba . This covered the European Commission's proposed Cloud and AI Development Act https://digital-strategy.ec.europa.eu/en/policies/cloud-and-ai-development-act CADA and how organizations can measure their readiness for it. Some of this revolves around the EU Cloud Sovereignty Framework https://commission.europa.eu/document/download/09579818-64a6-4dd5-9577-446ab6219113 en PDF , and its definitions of eight Sovereignty Objectives SOV-1 to SOV-8 and Sovereignty Effectiveness Assurance Level, the SEAL scale, from SEAL-0 No Sovereignty to SEAL-4 Full Digital Sovereignty , defined as "complete EU control, subject only to EU law, with no critical non-EU dependencies." Brok mentioned SUSE's online Cloud Sovereignty Framework Self Assessment https://www.suse.com/cloud-sovereignty-framework-assessment/ , which lets you get an idea of where your organization stands in ten minutes. All this may sound dry beside the kernel GPU driver discussions happening elsewhere at the event. But plans, targets, and measurements are signs that organizations are treating open source as infrastructure rather than an experiment. Sometimes, being bureaucratic is a win. ®