Open Source Summit Europe Puts Digital Sovereignty Into Practice
Digital sovereignty and artificial intelligence dominated this year's Open Source Summit Europe, but the discussions also delivered practical approaches to reducing technology dependence, strengthening software security and measuring the value of open source adoption.
The event opened with a keynote on geopolitics and the future of open source, featuring Nithya Ruff of the Linux Foundation and Johan Linaker of Research Institutes of Sweden. Ruff stressed that digital sovereignty is a global concern, extending beyond Europe to countries including Canada, Sierra Leone and Trinidad and Tobago.
Other sessions examined open source software supply-chain security and efforts by the Open Source Security Foundation (OpenSSF) to develop component catalogs that help companies meet the requirements of the EU Cyber Resilience Act (CRA). Speakers from Dell and Microsoft discussed CRABFOSC, an initiative intended to help organizations assess their use of open source components.
The issue is becoming more urgent as the CRA's reporting obligations for actively exploited vulnerabilities and serious security incidents take effect. Its main requirements are scheduled to apply from December 2027.
International approaches to digital sovereignty
Éléonore Daxhelet presented the 2026 report from the European Union's Open Source Observatory (OSOR), highlighting developments beyond the EU, including Ukraine's Diia platform and Switzerland's EMBAG legislation.
Kazuki Imamura of Japan's Innovation Platform Agency (IPA) presented the Japan-Type OSS Model, drawing on research covering hundreds of companies across seven countries and more than 30,000 GitHub repositories. The findings indicated that widespread discussion of open source does not necessarily translate into widespread adoption.
Japan's approach has three axes, including public-sector efforts to nurture local initiatives and encourage commercial vendors, alongside an emphasis on making legislation and rules machine-readable.
Measuring the value of open source
Dawn Foster of Fast Wonder outlined ways to demonstrate the organizational value of open source programs. Her presentation drew on Linux Foundation research and resources from the CHAOSS Project, which focuses on Community Health Analytics in Open Source Software.
The material covered establishing and managing open source programs, engaging users, assessing project viability and demonstrating software's organizational impact. It also addressed a key challenge: explaining the value of open source initiatives to senior executives.
Berlin's digital sovereignty strategy offered another practical example. The city government is working with PwC to manage its transition to open source software, targeting a 70 percent share of open source software in administrative workstation stacks by 2032.
Europe's framework for measuring technological independence
Emiel Brok of SUSE examined the European Commission's proposed Cloud and AI Development Act (CADA) and how organizations can assess their readiness for its requirements.
The discussion drew on the EU Cloud Sovereignty Framework, which defines eight Sovereignty Objectives and a Sovereignty Effectiveness Assurance Level (SEAL) scale. The scale runs from SEAL-0, representing no sovereignty, to SEAL-4, defined as full digital sovereignty: complete EU control under EU law, without critical non-EU dependencies.
Brok also highlighted SUSE's online Cloud Sovereignty Framework Self Assessment, which allows organizations to estimate their position in around ten minutes.
While these discussions may appear less exciting than technical debates over kernel GPU drivers, they point to a broader shift. Measurable targets, implementation plans and assessment tools suggest that organizations are increasingly treating open source as strategic infrastructure rather than an experiment.