Europe Writes Open Source Code and Skips the Governing Seats

European organisations supply 38% of the code contributors to Linux Foundation projects and 15% of the money that funds them. That split, not a shortage of patches, is what the foundation put on stage in Prague when it told firms to stop only consuming open source.

Thierry Carrez, general manager of Linux Foundation Europe, said open source can cut dependence on a single vendor or country, then added the line the summit kept repeating: consuming the code does not give you control. The fifth annual State of Open Source survey, released on 7 October 2026 at Open Source Summit Europe, measured how far European organisations still sit from the committees, budgets and liability rules that now sit around that code.

94% Call Sovereignty a Priority

Linux Foundation Research, Linux Foundation Europe and NeoNephos surveyed 367 European organisations and interviewed maintainers, policymakers and practitioners. Authors Dr. Mirko Boehm and Paula Grzegorzewska of Linux Foundation Europe, with Marco Gerosa of Northern Arizona University, framed 2026 as the year digital sovereignty and AI stopped being talking points and became operational mandates.

THE SURVEY IN FOUR FIGURES

• Sovereignty: 94% of organisations call it important to their technology strategy, and 61% call it very important, 12 percentage points above the rest of the world.
• The money: Open source returns 4.1 times its cost on average, 4.6 times with advanced governance and 3.6 times with no formal governance.
• The gap: 31% still have no formal open source governance, while 59% send code upstream and only 37% take part in project governance.
• The driver: Security and privacy lead at 71%, ahead of vendor lock-in and cost risk at 55%.

Hilary Carter, senior vice president of research at the Linux Foundation, said five years of this work shows how much Europe already depends on the commons, and that the 2026 Tech Sovereignty Package’s planned €2 billion only pays off if governance and contribution show up with the cash. Carrez put the same point more sharply in the official release: Europe has heard the sovereignty message, and the next step is participation.

94% of European organisations say digital sovereignty is strategically important. The 2026 State of Open Source in Europe report finds open source returns 4.1x benefit-to-cost, rising to 4.6x with mature governance.

Read the report: https://t.co/gWiwOiBpsh pic.twitter.com/8qvgWvjFn3

— The Linux Foundation (@linuxfoundation) October 21, 2026

Europe Writes the Code and Funds 15% of the Table

Carrez told the Prague keynote that across the 620 projects the Linux Foundation hosts, 38% of code contributors over the past 12 months came from Europe. European organisations supply 15% of foundation funding across those same projects. Mirko Boehm, speaking as the report landed, said that share of code implies people on the continent are already involved, and that very few companies seem to invest themselves.

EUROPE’S SHARE OF CONTRIBUTORS ON FLAGSHIP PROJECTS

Those are not the numbers of a region that refuses to write patches. They are the numbers of a region that writes them and then leaves the board calendar, the charter and the invoice to someone else. Carrez said Europe is not strategically investing in the governance of those open projects, so from the outside the same projects look dominated by companies from the US and from China.

Calling sovereignty a priority is cheap. Control sits with whoever funds the work and sits on the committees, and a compliance programme around software you do not steer still leaves you running a stack whose cloud, chips and roadmaps are set elsewhere. Foundation-hosted, neutrally governed projects are already Europe’s preferred model at 52%, eight percentage points ahead of the rest of the world, which makes the empty seats harder to explain.

The Cyber Resilience Act Already Bills the Users

The sovereignty speech had a legal clock running underneath it. Regulation (EU) 2024/2847, the Cyber Resilience Act, is a horizontal product-safety rule for hardware and software placed on the Union market. It treats manufacturers as the people who put a name on a product, and it tells them to exercise due diligence when they pull in third-party components, including free and open source software that was never sold as a product of its own.

WHEN THE CYBER RESILIENCE ACT BITES

1. 10 December 2024: The regulation enters into force.
2. 11 June 2026: Rules on notifying conformity assessment bodies begin to apply.
3. 11 September 2026: Manufacturers must start notifying actively exploited vulnerabilities and severe incidents, including on products already on the market.
4. 11 December 2027: Essential cybersecurity requirements, CE marking, technical files and market surveillance apply in full. Open-source software stewards pick up their lighter reporting duties on the same date.

Commission services summarise the reporting obligations set out in Article 14 as a 24-hour early warning to the national CSIRT and to ENISA, a fuller notice within 72 hours, and a final report no later than 14 days after a fix is available for an exploited flaw. Those reporting duties have applied since 11 September 2026. Full product rules still wait until 11 December 2027, which is why so many programmes were built around the later date and then discovered the earlier one already reaches products on shelves.

That is the second-order pressure behind “please contribute.” A firm that only consumes a library still has to explain, under due diligence, how that library does not compromise the product. Upstream work and a seat in the project are how you hear about a breaking change, how you get a patch accepted, and how you show a market-surveillance authority you were not a tourist in your own dependency list. Christopher Robinson, a chief security architect speaking in Prague, said the investment is in skills, and that if you make it you can mould software that might be 90% of what you ship and then tailor the rest.

Private Forks Keep the Cost Off the Books

The survey’s ugliest operating number is not the 31% with no governance framework. It is the 48% of organisations that keep private forks of open source projects. Those teams spend an average of 311 hours per release cycle patching 9.5 forks, and 28% cannot say what that costs. Sixty-three percent have already raised spending on open source dependency management under regulatory pressure, which is the bill arriving before the CE mark does.

A private fork feels like control because the diff lives on your servers. It is the opposite of a seat. You inherit every future bug, you lose the 83% of contributing organisations that get advance warning before a breaking change lands, and you still owe CRA due diligence on code you no longer share with the people who can fix it fastest. Adoption blockers cluster around procedure rather than missing engineers: security at 39%, licensing at 36%, support at 35% and leadership buy-in at 34%.

The return gap is modest on the page and ugly in a budget. An organisation extracting 3.6 times from the same technology a peer extracts 4.6 times from is not standing still. Upstream contribution itself returns between 2.3 and 3.3 times, so the extra point of governance maturity is not a slogan, it is the difference between paying for a fork farm and paying for a voice.

San Jose Filled the Agentic Table First

If Prague was the sermon about seats, San Jose showed who already owns a new one. The Linux Foundation formed the Agentic AI Foundation on 9 December 2025 around Anthropic’s Model Context Protocol, Block’s goose and OpenAI’s AGENTS.md, with eight American platinum members at launch: Amazon Web Services, Anthropic, Block, Bloomberg, Cloudflare, Google, Microsoft and OpenAI. Ericsson, SAP and SUSE appeared lower down the ladder as gold or silver names. The standards that will tell software agents how to talk to tools, data and each other are being written in that room.

PLATINUM NAMES AT THE AGENTIC AI FOUNDATION’S LAUNCH

• Cloud and chips: Amazon Web Services, Google, Microsoft.
• Model labs: Anthropic and OpenAI, which also donated launch projects.
• Infrastructure and data: Block, Bloomberg and Cloudflare.

On 22 October 2026, while European policy still talked about a seat at the table, the foundation said it had reached 305 member organisations worldwide in under a year and grown from three hosted projects to ten. New code came from Anthropic, OpenAI, Hugging Face and Alibaba, announced at AGNTCon and MCPCon North America in San Jose. Gold names added that week included Ant Group, MongoDB, Nutanix, Vercel, Vultr, the Royal Bank of Canada and the Gates Foundation. The report had already warned about a governance lag in which Europe writes a large share of the code behind AI systems without a seat where the standards for those agents get set.

Laura Tacho, senior principal technologist for developer experience at AWS, told the Prague keynotes that things are moving fast and that trust in the tools is not. She pointed to data showing that over 80% of developers had concerns about the accuracy of data coming from AI models, a different “over 80%” from the survey’s finding that Europe relies on non-EU providers for over 80% of its digital products, services, infrastructure and IP. GitHub’s October figures, cited at the same summit, showed that one in three pull requests now involves an AI agent, against fewer than one in ten a year earlier.

Kernel Maintainers Now See 230 CVEs a Week

Greg Kroah-Hartman, a Linux Foundation fellow, kernel maintainer and winner of the EU Prize for Excellence in Open Source in 2026, used the report’s foreword to describe what those agents look like from the receiving end. Over nine months he has watched a wave of new contributors arrive with fixes based on LLM reports that claim hundreds of bugs. Almost always, he wrote, the inflated counts collapse once people who know the code review them.

The rise in Linux kernel CVEs issued this year, from an average of 55 per week before the tools started, to the current rate of 230 per week, shows their value in making open-source projects more secure and bug-free. But these submissions also create a lot of extra work for reviewers and maintainers, because the tools often produce incorrect results that can easily fool developers, thanks to the “wall of text” LLMs generate by default.

Greg Kroah-Hartman, Fellow, Linux Foundation, foreword to the 2026 State of Open Source in Europe

With graduate students in the computer security programme at Vrije Universiteit Amsterdam, he tested the output of the strongest available tools and saw that almost half of the produced changes were incorrect. Linux maintainers are now pushing the burden of proof back onto submitters. Robinson, speaking to the same AI shift, said a lot of people who are not trained software engineers can now write and customise software with agents. That lowers the cost of a drive-by patch and raises the cost of the people who still have to say no.

The survey’s AI chapter cuts both ways. Ninety-four percent of organisations already use or are evaluating generative AI coding tools, 76% say those tools help their team get more value from the open source they already run, and 48% report more open source use because of the assistants against 5% reporting less. Only 28% expect the tools to reduce their reliance on open source later. The same 94% who rank sovereignty as a strategy also rank a coding assistant as a daily fact, which is how a region can feel more autonomous while sending more of its review load to maintainers it does not pay.

What a Seat in Governance Buys

Johan Linåker, a senior researcher at the RISE Research Institutes of Sweden, told the geopolitics keynote that open source lets governments share digital public infrastructure even when they do not align at the top, and pointed to work on sharing information about political bribery. That is the civic version of Carrez’s argument: you get continuity, not just a tarball. Contributors already report a concrete payback that has nothing to do with branding, with 83% getting advance warning before a breaking change lands. Seventy-six percent say open source involvement improves engineering skills, and 53% say it helps recruitment and retention.

Set against that, the Open Source Strategy inside the Tech Sovereignty Package commits €2 billion over seven years. The European public sector’s own proprietary IT spending is €264 billion a year. Two billion is under 1% of a single year of that public bill, and it becomes a strategy rather than a rounding error only if open source programme offices and procurement rules travel with it. Nithya Ruff, chair of the Linux Foundation board, shared the Prague stage with Linåker on the fight to stay open under sovereignty politics. The report’s own close is blunter still: Europe’s resilience depends on deepening participation in the commons it already helped build, and the next 12 to 24 months decide whether that happens from a seat at the table or from outside looking in.

The 11 December 2027 application date does not move because a survey was polite. Manufacturers who still treat open source as a free input will meet that date with a dependency list, a due-diligence file and, if they have not joined the projects they ship, no one upstream who owes them a call.