Open source emerges as a route to Europe’s digital sovereignty

At the Linux Foundation Open Source Summit Europe, Madalin Neag and Mirko Boehm argued that Europe’s push for digital sovereignty depends on securing the software supply chains its economy relies on. The initiatives they discussed include NIS2, DORA, the Cyber Resilience Act (CRA) and the EU’s broader technology-sovereignty agenda.

The European Commission says non-EU providers account for more than 80% of the bloc’s digital products, services, infrastructure and intellectual property. Its technological sovereignty package, launched in June 2026, includes the Chips Act 2.0, the Cloud and AI Development Act (CADA) and a new EU Open Source Strategy. The Commission estimates that implementing the open-source strategy will require about €2 billion ($2.23 billion) in public and private investment over the next seven years.

The article says the Commission estimates Europe will need about €200 billion ($223 billion) to expand data-center capacity by 2036, plus €100 billion ($111 billion) for cloud and AI initiatives, AI Factories and Gigafactories. Open source, the article argues, could give European organizations more ability to choose, inspect, maintain and replace technologies they rely on.

Neag and Boehm called for organizations to identify critical open-source dependencies, work with maintainers, contribute fixes upstream and provide long-term support where appropriate. They said suggested code contributions could return 3.3 times their cost, community contributions 2.5 times and direct financial contributions 2.3 times. Maintaining private forks was estimated to cost organizations an average of $258,000 per release cycle. Their presentation also proposed Sovereignty Effectiveness Assurance Levels, from SEAL-0 to SEAL-4, to describe the degree of EU control over technology and operations.