Open source sovereignty gets down to the boring business of making it work

AI and digital sovereignty dominated this year's Open Source Summit Europe.

But beyond the AI noise, the sovereignty discussions offered something useful: practical plans for putting open source to work.

The recurring theme of digital sovereignty started right from the first day's keynotes, with Geopolitics, Sovereignty, and the Fight to Stay Open, by the Linux Foundation's Nithya Ruff and Johan Linaker from Research Institutes of Sweden, whose name is considerably longer than its URL: ri.se.

This isn't just some European issue.

Ruff stressed that it mattered "from Canada, to Sierra Leone, to Trinidad and Tobago." This was followed by Open Source Security as the Foundation of European Sovereignty, focusing on OSS supply chains.

Then ORBIT Launchpad: Building the Due Diligence Bridge Between Manufacturers and Open Source, with speakers from Dell and Microsoft discussing OpenSSF's efforts to build catalogs of open source components to help companies achieve CRA compliance, such as CRABFOSC – the CRA Baseline For Open Source Consumption.

The EU's Cyber Resilience Act (CRA) is now starting to bite: reporting obligations for actively exploited vulnerabilities and severe security incidents began last month, with its main requirements applying from December 2027.

Hearing Dell and Microsoft discuss how to meet those requirements, rather than simply why they matter, was encouraging.

Éléonore Daxhelet presented the 2026 report from the EU's Open Source Observatory, or OSOR.

Emphasizing that this isn't just an EU matter, she highlighted Diaa, from the Ministry of Digital Transformation of Ukraine, as well as the Swiss EMBAG legislation we recently covered.

The slides are online [PDF].

Then, as if to emphasize that further, Kazuki Imamura from Japan's Innovation Platform Agency (IPA) presented the Japan-Type OSS Model.

The IPA looked at hundreds of companies in seven countries, and more than 30,000 GitHub repositories, and found that while a lot of organizations are talking about open source, few are actually doing it.

Japan has its own three-axis approach, where the public sector attempts to plant seeds and cultivate efforts by local commercial vendors, with a strong emphasis on the need for machine-readable legislation and rules.