European Open Digital Ecosystems

European Commission · Have your Say · Initiative 16213

Towards European open digital ecosystems – Commission Communication on the open source sector and open digital assets · Statement of October 28, 2026

Core statement: Open code makes the structure readable – but readable is not owned. Whoever uses and develops open code only on someone else’s infrastructure owns no structure, but a dependency with source text. The strategy diagnoses the value drain correctly: open source carries the majority of the stacks, the value leaves. The mistake would lie in the therapy, if the sector were merely „funded“. Value arises from operation – from European procurement, European development infrastructure and European operators of open structures. The strategy needs teeth, not eulogies: open source as the default of the public sector, as a procurement and funding condition, and as infrastructure that runs on Stage-B infrastructure.

What the initiative provides

The communication „Towards European open digital ecosystems“ is to set out a strategic approach to the open source sector of the EU – open source as a crucial contribution to technological sovereignty, security and competitiveness – and an operational framework for the use, development and reuse of open digital assets within the Commission, continuing the Commission’s 2020–2023 open source software strategy. The call for evidence (6 January to 3 February 2026) drew 1,658 contributions. The Commission names the causal chain correctly: network effects of dominant actors, restricted access to public procurement, capital and hosting barriers. Planned measures run along the entire life cycle – development, maintenance, market integration, sustainability – from supply chain security to business and foundation models and public-private partnerships.

Recognition: the right yardsticks and the right energy

GISAD acknowledges three things. First, the initiative measures open source against the sovereignty yardstick – not as a niche economy but as a question of security and ownership. Second, it covers the life cycle: code maintenance is work, not a hobby item at the end of innovation. Third, the participation has shown that the civic energy is there: 1,658 contributions in four weeks, many from maintainers with decades of service – that is participation in the literal sense, and a strategy that gathers this energy instead of consuming it already holds the most important raw material of European digital sovereignty in its hands.

Criticism 1: open code on foreign infrastructure is half sovereignty

The Commission itself names hosting infrastructure as a barrier – and yet the overwhelming part of the European open source sector develops on GitHub, builds packages via US registries and distributes through marketplaces under US jurisdiction. The CLOUD Act does not end at the licence text: whoever operates the tools of their own sovereignty project on the infrastructure of a US corporation shifts the dependency from the software layer to the operations layer. The strategy therefore needs a European development infrastructure as its lead requirement: forge, package registry and CI/CD chain in European hands and under European legal order – on Stage-B infrastructure, not as an appendix.

Criticism 2: a communication without procurement teeth changes no incentives

The most powerful instrument of the public sector is not the funding category but the order. As long as public procurement de facto favours proprietary solutions – for legacy interoperability, vendor lock-in or mere habit – open source remains the status of the voluntary. The strategy must make the public sector the anchor customer: public money, open code as the rule, exceptions subject to justification. This includes the hard variant of the origin yardstick: funded and procured openness only counts if operation, maintenance and infrastructure are European-controlled – otherwise open source becomes an open-washing award for resale.

Criticism 3: the strategy must not play the sector off against the CRA

The Cyber Resilience Act deliberately created a lighter regime for open source stewards – rightly, because manufacturer obligations for volunteer maintainers would have ended the European open source sector. But the reporting obligations for stewards providing operational infrastructure (Article 14(3) CRA) and the practical compliance burdens hit precisely the foundations and communities the strategy wants to strengthen. The contradiction is resolvable, but it must be named and managed: steward-friendly CRA guidance, transition periods for the compliance maturity of foundations, and no strategy that praises open source while other regulation burdens it.

Criticism 4: maintenance is work – sustainability is a question of recognition

The sustainability models the strategy is looking for begin with recognition: open source maintenance is charitable work and should be treated as such – the demand from the consultation to recognise contributions as tax-free voluntary service is consistent. Foundations need not alms but orders: maintenance contracts from the public sector for open projects are the most sustainable growth fund there is.

GISAD’s recommendations

1. European development infrastructure as lead requirement: forge, registry and CI/CD chain in European hands and under European legal order (Stage-B criterion); migration of publicly funded projects away from US platforms as a measurable strategy target.
2. Procurement as the lever: public money, open code as the rule; an anchor customer programme through which administrations procure open solutions first; exceptions subject to justification and publication.
3. Origin yardstick as a strategy indicator: measure and publish the operator and infrastructure control of open projects – only European-controlled openness counts as a sovereignty contribution (measurement outside the manipulable area).
4. Actively shape the relationship with the CRA: steward-friendly guidance, funding for the compliance maturity of foundations, no manufacturer obligations for volunteer maintenance.
5. Maintenance as an order: maintenance contracts from the public sector for open projects; recognition of open source contributions as charitable work; sustainability indicators (maintainer coverage, security response times) instead of mere distribution figures.