European Tech Sovereignty / Open-Source Strategy

Scale up the Open Internet Stack to provide a shared catalogue, a one-stop shop for open source building blocks and sovereign solutions in Europe.

Increase awareness of the EU sovereign tech solutions available, including by mobilising European, national and regional support networks (such asthe Enterprise Europe Network). This includes providing tools for private and public organisations to assess the sovereignty of their digital value chains, building on existing initiatives and the sovereignty framework introduced by the Cloud and AI Development Act.

Promote the development and uptake of open source solutions across the EU Digital Identity ecosystem, anchored by the Identity Wallet (EUID) and the European Business Wallet (EBW). The Commission will:

i) provide tools to support the interoperability, integration and reuse of open source stacks, including a Software Development Kit to support integration of the EUID into relying-party systems and an open source reference implementation protocol for legally valid communication channels for the EBW;

ii) procure the development of open source solutions for the EBW, ensuring reuse of the European Digital Identity Framework standards and components;

iii) transfer the long-term stewardship of the open source reference implementations of the EUID and the EBW to the European Digital Public Infrastructure Foundation;

iv) provide support for implementing the fully open source age verification solution in cooperation with EUID open source communities.

Partner with Member States, in particular with the European Digital Infrastructure Consortium (EDIC) on the Digital Commons, and explore the possibility of launching an EDIC on digital education to facilitate the development and/or adoption of secure open source alternatives. In the short term, the priority will be on domains where EU open source alternatives are established, such as cloud infrastructure and digital workplace applications, with the view to reach at least 30 million active users by 2030 for open source collaboration and productivity tools, instant messaging and secure email.

Strengthen the open source social media space76 by supporting open and decentralised social media solutions and platforms. The Commission currently runs a Mastodon instance, which hosts the Commission’s presence and plans to extend the users basis to EU institutions.

Semiconductors: to develop, under the Chips Act 2.0, open source hardware IP such as the one based on RISC-V , targeted investment in open source electronic design automation tools; operating systems: computer operating systems, mobile operating systems, internet of things, robotics and drone operating systems;

future internet architecture: software development & delivery infrastructure; open source building blocks for the Web 4.0 and architectural frameworks for virtual worlds;

cloud stack: software stack supporting the European cloud-to-edge continuum, expanding across the compute, connectivity, data and AI service layers;

software development infrastructure (DevOps) to accelerate software delivery, enhance security and improve code quality and federating tools for regulatory compliance, dependencies identification, and vulnerability management;

AI stack: to focus on the development of open source AI models, taking into account the appropriate safeguards, including state-of-the-art model architectures, foundational models and agentic frameworks and to prioritise the development of an open source software stack for AI Factories and AIGFs;

Cybersecurity: open source cyber threat intelligence frameworks, tooling for vulnerability coordination and disclosure, assurance and verification tools to strengthen the security of widely used open source components and support compliance with the Cyber Resilience Act.

mainstream open source deployment in the Apply AI strategy calls, focusing on strategic sectors such as automotive, energy, mobility, healthcare and pharmaceuticals, agri-food, robotics, manufacturing, geospatial and aerospace;

support industrial collaboration platforms where competitors jointly develop open source building blocks78 to create common software stacks and increase the overall efficiency of digital transformation, as demonstrated, among others, in the automotive79, aviation, and railway sectors80

Developing a ‘stewardship toolkit’ (on legal set-up, branding, interface usability, business models) for the establishment of associations/foundations in the EU;

Identifying priority areas/sectors and financial support for creating steward organisations, as proposed in the CADA Regulation;

Supporting the establishment of a European Digital Public Infrastructure Steward Organisation, in close cooperation with the Digital Commons EDIC and the eID open source communities. The aim is to provide a single EU-anchored home to govern strategic open source assets developed or co-funded by the EU, beyond code stewardship and reference framework implementation and conformance. This Steward Organisation could also serve as a channel to feed in experience in implementing European assets into European and international standardisation processes;

Launching a feasibility study on establishing an EU-level framework that would identify the most suitable measures the Commission could implement to enable European foundations/associations to be governed by a single set of rules across the single market;

Amplifying the voice of open source communities and their representativeness in the public space and supporting the set-up of professional association(s) for open source contributors.

expedite the development of voluntary security-attestation programmes under Article 25 of the Cyber Resilience Act (CRA) and create a voluntary EU assessment framework for open source, attesting compliance of the solutions with key EU security rules and providing a qualitative assessment;

build on the concept of dependency analysis under the CRA, by creating, with the support of ENISA, a list of most exposed open source software and infrastructure dependencies85;

create an ‘Open Source Maintenance Instrument’ for supporting the maintenance and security upkeep of essential components, creating a European capacity and capability to fork projects;

support, with the help of ENISA, a strategic contingency programme setting up mirroring and build capabilities, including for source code and software packages, to ensure continued access where there are the most critical and security-relevant dependencies;

promote the use of trustworthy AI in experimental settings, such as support to self- healing mechanisms that improve the swift detection and secure remediation of vulnerabilities in open source software;

support efforts to increase the security of AI-generated open source code, as the trade-off between development speed and security may introduce a high rate of inherent design flaws that could lead to systemic vulnerabilities.

master programmes on collaborative open source development, on integrating open source software skills, community governance and sustainability models, following successful precedents in the Digital Europe programme;

learner mobility, under the 2027 Erasmus+ programme, to develop awareness and expertise in open source principles and methodologies, and cooperation partnerships amongst organisations to promote the use of open source solutions;

skills training for civil servants on open source and digital interoperability by further expanding the training provided by the Interoperable Europe Academy

developing, building on the experience of Member States96 and on the upcoming review of the public procurement rules and the CADA, guidelines and best practices on:

i) drafting calls for tenders for the procurement of software that include open standards, specifications and models and allow open source solutions to compete with proprietary solutions;

ii) evaluating bids based on open source solutions;

iii) drafting calls for innovative partnerships for open source alternatives including provisions for prototypes and maintenance97;

promoting the participation of open source developers in policy labs shared by practitioners and policymakers to increase both contribution of open source experts into policymaking and awareness and compliance with EU policies.

draw up a coherent set of operational guidance consolidating existing legal, security, architectural and technical practices for adopting, developing and publishing open digital assets and services;

strengthen the Open Source Programme Office and EU Public Sector OSPO Network and relevant mechanisms under the Interoperable Europe Act as central hubs for guidance and organisational learning, including compiling a catalogue of services that support the adoption, development and publication of open digital assets; Member States are also encouraged to give their OSPOs advisory tasks with regard to public procurement processes;

enhance the visibility, reuse and strategic resilience of open digital assets to improve discoverability and systematic reuse across Commission departments, EU bodies and Member States;

cooperate with European Digital Infrastructure Consortia (EDICs) such as IMPACTS and the Digital Commons EDICs and other groups to jointly identify and develop key open digital assets (such as DCAT-AP);

develop and enforce common security baselines for the Commission’s open source code repositories covering security monitoring, vulnerability management, licence compliance and automated dependency risk detection.

Strengthen its internal communities98 and develop skills in open collaboration. It will integrate open digital ecosystem competencies for the public administration into training and professional development programmes and highlight meaningful contributions to open

source, open data, open science and standards development in its recognition mechanisms.

Enable structured and secure participation in European open ecosystems for the public administration clarifying and simplifying rules for participation in external open source and open knowledge communities. It will step up cooperation with other EU institutions and Member States through a structured EU OSPO Network within the Interoperable Europe Community.

Expand engagement with innovation communities both at European and global level.

embed the goals of openness and sovereignty-by-design in digital investments and project lifecycles by integrating structured assessment criteria into governance checks and maturity frameworks to ensure that control, interoperability, portability and sustainability considerations are systematically evaluated from the earliest design stages;

review and update the digital-ready policymaking framework to further integrate openness, interoperability and sovereignty considerations, and encourage open source reference implementation, ensuring that legislative and strategic initiatives promote reusable, interoperable and transparent digital solutions.