.png){kind=logo}
Aug 2026
This article was originally published in Decoding, our monthly briefing on the latest trends in government technology. Sign up here to receive future editions directly in your inbox.
.png){kind=logo}
Open source now sits at the centre of the EU's digital policymaking. On 3 June 2026, in what was described as “a major shift in its approach to technology”, the European Commission released its Tech Sovereignty package, which includes an Open Source Strategy. The package positions open source as a structural lever of sovereignty and highlights that reducing dependence on foreign providers for the EU’s digital infrastructure is essential to Europe’s economic strength, security, and competitiveness.
In this issue of Decoding, we take a closer look at the EU’s open source strategy and research from OpenForum Europe that has contributed to its development. We highlight that the open source debate has largely focused on software, potentially leaving unresolved dependencies deeper in the tech stack.
In this edition, you’ll read about:
%20(1).jpg)
The EU currently spends EUR 264 billion a year on mostly US-proprietary IT products and services, leading to a dependency that limits Europe’s control over key digital infrastructures and raises risks around vendor lock-in, security and compliance. Open source offers a path to avoid this dependence by promoting the adoption of open source solutions in both the public and private sectors, with the goal of reinforcing the EU’s technological sovereignty.
The EU Open Source Strategy links open source to the EU’s technological sovereignty by promoting European open source alternatives to non-EU proprietary solutions in critical domains.
The strategy forms part of the EU’s Tech Sovereignty Package, released alongside proposals for a Cloud and Development Act, a Chips Act 2.0 and the Strategic Roadmap for Digitalisation and AI in Energy. Together, these initiatives aim to create a framework for Europe’s digital infrastructure, strengthening resilience, competitiveness and strategic autonomy.
The EU Open Source Strategy outlines four main objectives:
The strategy builds on a 2021 study by OpenForum Europe and Fraunhofer ISI that investigates the economic impact of open source software (OSS) and open source hardware on the EU economy. The Commission's framing of open source as a strategic investment seems to refer to the study's core finding that every euro of public investment in open source generates a return of between four and five euros for the European economy.
While the EU Tech Sovereignty Package positions open source as a lever of structural sovereignty and a means of reinforcing digital resilience, the focus is largely on OSS. Researchers argue that this is only part of the picture and that true sovereignty is a full-stack challenge in which open source hardware is key. They suggest that the same principle should be applied to hardware, where the stakes are higher because the design layer is largely controlled by non-European actors, creating structural dependencies that are harder to escape than in software.
In a previous issue of Decoding, we asked then-Minister for Digital Affairs Caroline Stage about the role of open source solutions in Europe’s digital future. This was in June 2025, and Denmark was among the first countries to explore open source alternatives to proprietary software in the public sector.
Denmark’s role in the open source debate extends beyond its borders. A 2024 study commissioned by the Danish Agency for Digital Government and Local Governments Denmark examined how 16 digitally mature countries frame OSS in policy and put it into practice. Researchers Johan Linåker and Sachito Muto have since built on that work, arguing that unlocking the full potential of OSS in government requires better measurement, i.e. understanding how governments actually use and support open source, enabling knowledge sharing and benchmarking, and factoring these measures into global digital maturity indexes. Their proposed toolbox treats OSS as core infrastructure for digital government rather than a tactical detail, a framing that traces back to the questions Denmark first commissioned research to answer.
In December 2025, the Danish Agency for Digital Government published a report on the use of open source in the Danish public sector. The report finds real prospects for OSS in the public sector, but also heavy dependencies on proprietary software. Authorities, the report notes, often lack the resources to share code they have developed with one another. With open source, the report highlights, authorities gain greater control over license terms, security updates, and software maintenance, but also take on greater responsibility for the IT solution than if they were to purchase proprietary software from a supplier. Some Danish authorities have handled this by working with an organisation or private supplier of OSS.
OS2 is such an organisation: a body of public bodies in Denmark that works with OSS, giving public authorities direct ownership of the code and the freedom to choose vendors based on public needs. Earlier this year, we wrote about the OS2 Skole initiative, an open source school platform that shows how local GovTech choices can reduce reliance on large US vendors while strengthening control over data, costs, and capabilities.
To support the use of open source, the initiative Fællesoffentlige Digitale Arkitektur (Public Digital Architecture) has created a practical introduction to key considerations for public sector employees and strategic decision-makers when making IT acquisitions.
Denmark’s open source developments over the last few years reflect a growing recognition: the digital dependencies we saw as unproblematic a decade ago have become a risk to our digital autonomy. Open source is increasingly presented as a tool for building a resilient society, both in Denmark and across Europe.
🇪🇺 EU: The AI Act enforcement begins: From 2 August, the EU Commission’s AI Office and national authorities began enforcing new provisions of the AI Act, including transparency rules for general-purpose AI models. AI systems must now disclose when users are interacting with AI, and all AI-generated content must be labelled. Enforcement responsibilities are split among the AI Office, national authorities, and the European Data Protection Supervisor, depending on the system in question.
🇬🇧 UK: Cyber Security and Resilience Bill advances through parliament: The Bill, which would extend the UK’s existing NIS Regulations to cover additional organisations including data centres and managed service providers, is scheduled to enter the House of Lords Committee Stage on 1 September 2026 after the Bill passed the Commons in June. The Bill signals a shift in what’s expected of organisations when it comes to managing cyber risk and building resilience.
🇸🇪 Sweden: New interoperability requirement takes effect for public data sharing: A new law requiring interoperability in public-sector data sharing entered into force on 15 August, as part of Sweden’s 2025-2030 digitalisation strategy. The requirement obliges public authorities to design digital services and data exchanges to be interoperable by default, aimed at cutting administrative duplication and enabling more efficient, data-driven public services.
🇩🇪 Germany: Government funds four studies on the Deutschland-Stack: Germany’s National Competence Centre for Digital Administration announced on 11 August that it is funding four short studies examining different dimensions of the Deutschland-Stack, the country’s planned shared digital foundation for federal, state, and municipal government. The studies will examine organisational barriers to modernisation, application in planning and permitting processes, the role of open source, and governance for federal-level coordination. Results are expected to be published by mid-2027.
🇫🇷 France: Tax data breach exposes gaps in cybersecurity readiness: The DGFiP breach, now confirmed to affect 678 000 individuals and businesses, has taken on a political dimension as France has not yet transposed the EU’s NIS 2 directive, nearly 2 years after Brussels’ deadline. The Senate is moving to establish a parliamentary inquiry into France’s broader digital sovereignty, citing structural dependence on non-European providers for hosting state and business data.
🇩🇰 New Danish AI model leads global benchmarks in its size class: Mimir is a new Danish language model that performs on par with international models up to five times larger. The model was trained on eight GPUs in under three weeks, using only legally and ethically sourced data, demonstrating that data sovereignty is feasible, with sensitive data not having to leave the country. Mimir was developed by a Danish research team from the University of Southern Denmark (SDU) and Ordbogen A/S.
For questions, comments, or suggestions regarding this article, please contact Emilia Lindén Guíñez.
Enjoyed this edition of Decoding? Subscribe here to receive future insights on digital public services directly in your inbox.
.png){kind=logo}
