Open source sovereignty needs practical plans, targets and measures
Digital sovereignty and AI were major themes at the Open Source Summit Europe, but speakers focused on practical steps for organisations to adopt open source. Their proposals included migration targets, security processes, public-sector policies and ways to measure whether open source programmes deliver value.
The EU Cyber Resilience Act’s reporting duties for actively exploited vulnerabilities and severe security incidents began in September 2026, with its main requirements due from December 2027. Japan’s Innovation Platform Agency reviewed hundreds of companies across seven countries and more than 30,000 GitHub repositories, finding that few organisations that discuss open source put it into practice. Berlin is working with PwC on a migration programme that aims for open source to make up 70 per cent of software on administrative workstations by 2032.
- Summit speakers focused on practical open source adoption.
- EU cyber incident reporting duties began in September 2026.
- Berlin targets 70 per cent open source workstation software by 2032.
Both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
Practical targets and measures can turn digital sovereignty from an aspiration into changes organisations can track, fund and evaluate. Migration goals, security processes and public-sector policies may reduce dependence on a small number of technology providers while helping organisations build open-source skills and contribute to shared projects.
The case against
Targets can encourage organisations to prioritise the percentage of open-source software over whether it meets users’ needs, works securely or costs less over its full life. Migration also takes time and expertise, and strict deadlines or reporting requirements may divert resources from other improvements; organisations should retain flexibility to choose proprietary tools where they are the better fit.
Read the full article at the source →
Originally published by The Register as “Open source sovereignty gets down to the boring business of making it work”.