Prague summit report puts European groups at 15% of open-source governance
Linux Foundation Europe's Thierry Carrez said at the Open Source Summit in Prague that switching to open source alone will not end Europe's dependence. European groups supply 15% of governance participation, The Stack reported, so teams that switch adopt projects governed mostly from outside Europe.
The Engineer · Build desk
What happened
- Only 37% of European groups did any open-source governance work, according to a report released during the Open Source Summit in Prague.
- CNCF's Jonathan Bryce told a summit panel that access to source code does not give operational sovereignty without the skills to run, secure and monitor systems.
- Carrez said Europe is short of local companies able to package and support mature open-source projects such as OpenStack.
- Carrez described proposed cloud and AI assurance levels set per workload, with the top level requiring effective control of the full supply chain, hardware included.
Why it matters
- What it costs cost Without a local partner the support bill falls on the adopter; Carrez said Societe Generale built its expertise in-house because it lacked one.
- Who's exposed exposure Under the Cyber Resilience Act, Robinson said, manufacturers carry substantial responsibility for the open-source components they ship, so a switch puts security due diligence on the adopter's own team.
- Who has to decide decision Teams would have to sort workloads by assurance level under Carrez's proposal; below the top tier, he said, confidential computing can limit a host's access to a workload.
- What doesn't add up contradiction The Stack calls Europe's thin governance role unsustainable, while Bryce argued that broad contributor bases make projects more resilient.
Next story · Build · yesterday
Akrites staff say similar AI models keep sending maintainers the same bug reportsOne report1 publisher
Europe's 15% share of governance participation [2] leaves 85% with groups based elsewhere [26]. The figures as The Stack reported them do not break that 85% down by country. Carrez, general manager of Linux Foundation Europe, gave his own answer on who fills it. "Europe is not necessarily strategically investing in the governance of those open ecosystems, and so from the outside if you look at those ecosystems, they are going to be dominated by companies from the US and from China," he told The Stack [3].
Part of the gap is payroll. Many US and, increasingly, Chinese developers are paid by their employers to contribute to open-source projects, The Stack wrote [5]. In its view, the only way to shape where open source goes is to participate early and often [6]. Carrez said the same thing more bluntly: "If you don't talk to the people that are building the technology that you're using, then it's just another dependency." [4] He also said the EU is making progress in pushing the private sector to do more [7].
Carrez shared a summit panel with CNCF's Jonathan Bryce and Linux Foundation Europe's Paula Grzegorzewska [25]. Their case for switching rested on the ability to leave. "The most valuable thing with open source is the choice," Bryce said [9]. His example was Kubernetes, which can run on an organisation's own infrastructure or on commercial clouds [10]. Grzegorzewska added the condition. An alternative helps only when switching is practical, and moving between proprietary systems can take substantial time and expertise, particularly for governments [11].
Most of the panel's warnings were about operations. Free code can start as an engineering experiment and turn into a critical system that needs sustained support [17]. The French Ministry of Finance went looking for partners after its OpenStack deployment grew beyond its original scope, Carrez said [20]. His prescription was to invest in local service companies, not to rebuild existing global projects [21].
Hardware sits outside both fixes. Bryce said the sovereignty debate he heard around a conference in Shanghai centred on chips and optical systems, because China has long taken part in open-source software [13].
The governance figures back a narrow version of the worry: a European team that switches lands on projects it has little hand in governing [2]. The panel judged sovereignty against an EU cloud sovereignty framework with eight objectives, among them legal, data and AI, operational and supply-chain sovereignty [24]. I think the panel's emphasis on local support is the right one for a team planning a migration now. Governance share decides who steers a project. Support capacity decides whether a European team can keep it running. The panel's joint statement called it naive to believe any region can be 100% sovereign [23].
What to watch
- Whether the per-workload cloud and AI assurance levels Carrez described are adopted, and which workloads are placed in the top tier that counts hardware.
- Whether a follow-up to the summit report splits the non-European 85% of governance participation by country, which would test Carrez's claim about US and Chinese dominance.
- Whether local firms emerge to support OpenStack for public buyers such as the French Ministry of Finance.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+15
- Incentives55
- Confidence50
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
According to a report released during the Open Source Summit in Prague, only 37% of European groups contributed to open-source governance work.
- [2]
European groups made up just 15% of overall open-source governance participation, according to the report released during the summit.
- [3]
"Europe is not necessarily strategically investing in the governance of those open ecosystems, and so from the outside if you look at those ecosystems, they are going to be dominated by companies from the US and from China,"
- [4]
"If you don't talk to the people that are building the technology that you're using, then it's just another dependency,"
- [5]
Many US (and increasingly Chinese) developers working for tech companies are paid by their employers to contribute to open-source projects.
- [6]
The only way to shape the future direction of the open-source movement is to participate, early and often.
- [7]
According to Carrez, the EU is making progress encouraging the private sector to step up its game.
- [8]
Europe's low share of governance is not a sustainable state of affairs for a continent that would like to carve out its own tech stack.
- [9]
"The most valuable thing with open source is the choice,"
- [10]
Bryce cited Kubernetes as a platform that can run on an organization's own infrastructure or on commercial clouds.
- [11]
Grzegorzewska said an alternative is useful only when switching is practical; moving between proprietary systems can demand substantial time and expertise, particularly for governments.
- [12]
Bryce said access to source code alone does not provide operational sovereignty; organisations also need to know how to run, secure, and monitor their systems.
- [13]
Recounting conversations around a conference in Shanghai, Bryce said China's sovereignty discussion focused less on open-source software, in which it has long participated, and more on access to chips and optical systems.
- [14]
Carrez described proposed cloud and AI assurance levels that would vary by workload; the highest level would require effective control over the full technology supply chain, including hardware.
- [15]
Carrez raised confidential computing as a way to limit a host's access to workloads when the highest level of control is not required.
- [16]
Discussing the EU Cyber Resilience Act, Robinson said manufacturers bear substantial responsibility for the products they sell, including the open-source components they incorporate.
- [17]
Freely available code can begin as an engineering experiment and later become a critical system requiring sustained support.
- [18]
Carrez identified a shortage of local companies able to package and support mature projects such as OpenStack.
- [19]
Carrez cited Societe Generale as a bank that built expertise in-house because, he said, it lacked a suitable partner.
- [20]
Carrez described the French Ministry of Finance seeking partners after its OpenStack deployment grew beyond its original scope.
- [21]
Carrez's proposed response was investment in local service capabilities, not rebuilding existing global projects.
- [22]
Bryce argued that broad contributor bases make projects more resilient.
- [23]
A joint statement during the panel said it is naive to believe that a region of the world can be 100% sovereign.
- [24]
The EU cloud sovereignty framework displayed during the panel lists eight objectives, including legal and jurisdictional sovereignty, data and AI sovereignty, operational sovereignty, and supply-chain sovereignty.
- [25]
The Open Source Summit Europe panel in Prague featured Jonathan Bryce of CNCF and the Linux Foundation, Christopher Robinson of OpenSSF, and Paula Grzegorzewska and Thierry Carrez of Linux Foundation Europe.
- [26]
Groups outside Europe account for 85% of open-source governance participation in the report.
Sources
2 independent publishers whose own reporting we read for this story.
- infoq.comTechnological Sovereignty Requires Choice, Skills, and Support, Panelists Say During OSS EU
1 article · October 8, 2026
- thestack.technologyRuntime: Open source isn't Europe's sovereign computing answer — yet
1 article · October 8, 2026
Topics and entities
Entities
- Linux Foundation Europe
- Christopher Robinson
- Société Générale
- Open Source Summit Europe
- Cloud Native Computing Foundation
- Kubernetes
- EU Cyber Resilience Act
- Paula Grzegorzewska
- OpenSSF