If you care about open source becoming real digital sovereignty (not just a slogan), take 5 minutes and submit your feedback to the EU consultation:
Even a short message helps: ask for productization, long-term maintenance funding, security requirements (SBOM/signing), and “open source fair” procurement .
Let’s make sure the people shaping the rules hear from the builders — not only from the big vendors.
Thak you for your support!
What we said as Nethesis.
If the EU truly wants to reduce digital dependency, it must stop treating open source as “research” and start treating it as critical infrastructure and an adoptable product. Today Europe generates open source value, but it’s often scaled and monetized outside the EU, while public administrations and businesses remain stuck on proprietary stacks due to procurement, inertia, and lock-in.
The problem isn’t a lack of open source software.
The problem is that the EU mostly funds the birth of projects, but not enough:
- ongoing maintenance and security (patching, hardening, QA, vulnerability management);
- productization (packaging, documentation, reliable updates, migrations, UX);
- real adoption (legacy integration, training, support, SLAs).
Result: open source “exists”, but it doesn’t become the default choice in public administrations and SMEs.
What’s needed (concrete EU measures)
- Incentives for adopting Open Source software, not only for innovation.
- Vouchers or direct programs for public administrations and SMEs to migrate and integrate open source solutions (with measurable goals: reduced lock-in, portability, resilience, operational continuity).
- Grants for those who build European open source products that are ready to use.
- Funding EU companies that build and maintain product-oriented open source: release management, updates, documentation, roadmap, testing, support. Not “one-off features”: multi-year maintenance with clear accountability.
- “Open source first” procurement where possible, and “open source fair” always.
- EU tender specs and guidelines that remove criteria favoring incumbents (e.g., “vendor size”) and instead evaluate: interoperability, open standards, SBOM, artifact signing, governance, SLAs/support, exit strategy.
- Mandatory supply chain security in critical contexts.
- SBOM, signing, provenance/attestation, and vulnerability management policies must become minimum requirements for solutions adopted in public administrations and regulated sectors. Open source without supply chain security doesn’t scale; with these requirements, it scales better than opaque proprietary software.
Priority areas: Cybersecurity, VoIP, and Hybrid Cloud
- Cybersecurity: firewalls, network security, logging/monitoring, and supply chain tools are essential for resilience. The EU needs verifiable, governable EU alternatives here.
- VoIP/Unified Communications: communication is essential infrastructure for public sector, healthcare, and businesses. The EU should support reliable open source solutions (PBX/UC, SBC, identity integration, compliance) with migration and professional support.
- Hybrid cloud: the foundation for workloads and data. The EU needs reliable, supported EU/open source stacks for virtualization and hybrid cloud management (orchestration, storage/networking, identity and policy), to avoid infrastructure lock-in and keep portability across on-prem and cloud.
Conclusion
If the EU wants technological sovereignty, it must fund what changes the market: adoption + productization + secure maintenance. Having open source isn’t enough — it must become the easiest, safest, and most cost-effective choice for public administrations, ICT partners, and SMEs.