APELL Conference 2026 Report

In the first keynote, we had the honour to welcome the Director of the Digital Commons EDIC, Laurent Rojey. Rojey outlined that the Digital Commons EDIC (European Digital Infrastructure Consortium) considers Open Source as an integral part to the eponymous Digital Commons. With the support of the European Commission, the EDIC considers the Digital Commons as part of the solution to the ambition of increasing European technological sovereignty, and Europe's technological capabilities.
For Rojey, businesses provide the integration capacity to bridge the gap between policy ambition, and actual deployment capability at scale across the EU. Public administrations can play an important role in building further trust as anchor customers.
He encouraged the audience of business leaders and entrepreneurs to make use of the opportunity that the debate around extra-EU dependencies creates not only for more Open Source business in Europe, but world-wide.

The DC-EDIC's operating model consists of three pillars:

• 'Connect' signifies that what brings us together should be stronger than our differences, both in Member States and Communities. While parts of the ecosystem may have different demands, they should come together to speak with one voice.
• 'Deploy' wants to translate the Commons into usable options, not (only) by building in-house, but by creating migration paths, and building trust. Standardisation and increased interoperability improve marketability and credibility with users. Public funding should always also lead to more adoption beyond, in the private sector.
• 'Maintain' means taking Open Source seriously as digital public infrastructure. In conclusion, if Open Source is strategic, then so is its maintenance, stewardship and support. The DC-EDIC works on a Sovereign Tech Fund-pilot for its members, identifying procurement routes, while avoiding a duplication of what the market already provides.
  With a broad agenda, Rojey sees the EDIC's first task as prioritising, relying on open and transparent criteria, built for the long-run, and to iterate until it has found the right approach.
  With currently five members and seven observing countries, the DC-EDIC is looking to enlargement, and wants to learn from APELL in that regard. The EDIC should become a true European vehicle, at scale.
  He encouraged APELL's, and its members', criticism and support.

A call for nominations to the DC-EDIC's Advisory Board has been launched after the APELL Conference.

In the next keynote presentation, Jean-Luc Dorel of the European Commission's Future Internet Unit in DG CONNECT introduced the Open Source Strategy, recently published with the broader Tech Sovereignty Package, as a part of the Communication on European Technological Sovereignty. The package also brought forward the legislative proposal for a Cloud and AI Development Act.

While the Open Source Strategy is not new, the present iteration is a first full strategy, not only for internal IT purposes of the Commission, but to address the needs of the Open Source ecosystem. Dorel acknowledged that not everyone is equally convinced in strong contributions to Open Source.

The EU is strong in contributions to Open Source, as measured, for example, by the share of committers on GitHub. This is also reflected in own measures such as NGI funding, and contributions to the commons. The perception being that the EU is strong with regard to people invested in Open Source, but we are not capturing all value today.
The European market is huge with 264 billion EUR yearly paid to services provided from outside the EU. Even reallocating 1% of that would be a significant increase in the share of IT budgets. For that to happen, decision makers should become conscious that alternatives exist, through better productisation and ensuring scale, as well as putting recognisable brand labels on solutions for decision makers.

On key technologies, such as in Open Hardware, in particular design tools for semiconductors, Operating Systems, Cloud, AI and models, an industry should grow with providers and integrators for scale. In order for companies to scale, they need capital in manpower, infrastructure, as well as in finance. Financial tools for companies may comprise loans, venture capital, etc.

Governance is key, as we do not want intellectual property to be taken over. Therefore stewardship as introduced in the Cyber Resilience Act is required, but needs to become even stronger.

The Open Source Strategy's Maintenance Instrument includes for instance mirroring capabilities to have Open Source stacks ready for EU engineers.

Dorel highlighted APELL's role for representation of the business ecosystem of suppliers, and the need for full dialogue with decision-makers in customer and user organisations such as TOSIT.

Other next steps for the Commission include improving the OSPO network for the public sector, strengthening Interoperable Europe facilities, and going through security and dependency checks.

Standardisation is becoming increasingly important for interoperability and for reaching network effect. The Commission wants to further facilitate access to standardisation bodies for contributors.

While there are no commitments yet, the Open Source ecosystem should use the opportunity and talk to governments and representatives like Members of the European Parliament, as for the next 7-year budget, 2 billion EUR in funding are being discussed. Some funding is still available until the current budget runs out in 2027 through Next Generation Internet (NGI) and Open Internet Stack (OIS).

In their presentation, Æva Black, the founder of Null Point Studio, laid out how the Cyber Resilience Act (CRA) has set new standards for the use of Open Source Software across industry. Meanwhile, Project Glasswing and related advances in AI-driven vulnerability discovery have drastically reduced the time window from disclosure to exploit; though this affects Open Source first, its effects will not stop there. While regulatory speed and quality can be perceived as mutually exclusive, the industry and regulators must move quickly, and funding for the maintenance of Open Source remains an open question. The CRA and the EU Tech Sovereignty Package outline an opportunity — voluntary security attestations could reduce industry’s compliance burden when incorporating OSS and, in exchange, provide non-profit organisations a new revenue stream to help sustain stewardship. However, the specifics remain unclear in terms of format, distribution, and dispute-resolution, and may require additional standardisation.

In Gina Plat's keynote, the program manager at the Dutch Ministry of the Interior and Kingdom Relations (BZK)'s Open Source Programme Office (OSPO) underlined how the public sector has a responsibility to ensure that projects it works with is reliably maintained. Some, in particular not-for-profit projects, rely on funding and contributions in-kind. The OSPO BZK has recently contributed fixes and financed further improvements for Mastodon, improving the quality of the project not only for the Ministry's own uses, but globally for all users.
Plat called on governments to get out of their own way, and described Open Source technology as ready, but new ways of funding and support need to be identified to accommodate projects' individual needs. This, in return, gives more credibility to governments and their actions.

Grist has been part of the French La Suite and Dutch Mijn Bureau projects for some years. It has found an enthusiastic user base among public agents, and that popularity has now spread to the private sector. Governments theorise that if they lead the way, the private sector will follow, and once the private sector follows, Open Source software will be funded by this growing usage. However, the assumption that usage leads to revenue has not borne out. Anais Concepcion, CEO of Grist Labs, pointed out while a market has developed around Grist, most business goes to resellers, who do not contribute back to the project upstream. This depletes the digital commons as many businesses seek rent on software they do not help sustain.

When a resource in any commons is depleted, governments have a responsibility to make the market more sustainable and protect the resource. Concepcion pitched one possible initiative: incentivise vendors that contribute back, and disincentivise others. For this to work, the project developers themselves should name who contributes back. Today, resellers claim upstream contributions that are either misleading or far too paltry. Public tenders should go to vendors that do contribute upstream, as verified by project maintainers, not reseller marketing. Procurement laws adapted to this need are key in mitigating the tragedy of the digital commons.

There are ways of cooperating on the same Open Source software while being competitors on the market, according to Matthew Hodgson, CEO/CTO at Element and Project Lead for Matrix. The Members of the non-profit Matrix foundation contribute to the empowerment of end-users of Open Source.
However, in practice there are often challenges with public sector procurement, and sometimes local integrators are chosen that deploy Matrix but only on the basis of the public repository, ignoring the need for upstream contributions to keep the project alive.
Regulation could help restore some balance, for example by implementing the Open Source Business Alliance (OSBA)'s procurement guidelines.
Hodgson reminded the audience that upstream support in the form of code contributions can be a double-edged sword, or, "giving code is like giving a puppy". While paid custom developments can in principle be helpful, only sustained contributions can help a project in the long run, or they risk making things harder in effect.

In her presentation, Jutta Horstmann, Co-CEO of the Heinlein Group, outlined how the Tech Sovereignty Package passes the baton (or ball) to the Open Source business ecosystem, "putting Open Source to the test", as was pointed out in an article by Open Forum Europe (OFE) in Tech Policy Press recently.
According to Horstmann, it is thanks to the efforts of the group of full-time Open Source lobbyists in Brussels (currently, APELL, OFE, the Open Source Initiative, Eclipse Foundation, Linux Foundation, Mozilla, Red Hat, SUSE and a few others have employees working full-time on Open Source policy advocacy in Brussels) that have made highly positive language possible in both the Open Source Strategy and the Cloud and AI Development Act (CADA) proposal. At the same time, the wording is not as ambitious as it should be and would have to be to meaningfully change the course of, for example, public procurement for Open Source.
In the Franco-German Joint paper on Digital Sovereignty published mid-June, wording can be found that makes digital sovereignty dependent on risk assessments and wants to keep the door open to trusted partners.

Horstmann calls on the Open Source businesses to fund lobbying like they fund the maintenance of and contribution to Open Source projects that they depend on: By financing full-time employees within APELL or by leasing employees to the organisation for that purpose, instead of relying only on comparatively small contributions such as by participating in the APELL Advisory Board. Open Source needs continuous, professional advocacy, backed by serious funding at the same level with funding for their technology development.

To compete with hyperscalers, Horstmann asks European service providers for increased maturity of services and service levels, and to deliver services at a user experience level that is expected by end-users.

In order to score, European providers must offer scale, and in order to deliver it, increase cooperation and overcome fragmentation.