Digital sovereignty was the dominant theme at Open Source Summit Europe, but the tone was notably practical. Speakers from the Linux Foundation, Research Institutes of Sweden, and the EU's Open Source Observatory framed sovereignty as a global concern, citing examples from Canada, Ukraine, Japan, and Switzerland. The focus quickly shifted from why sovereignty matters to how organizations can actually achieve it.
A recurring thread was compliance with the EU Cyber Resilience Act, which now has active reporting obligations and full requirements due in December 2027. Dell and Microsoft discussed OpenSSF efforts to build catalogs of open source components, helping manufacturers meet CRA due-diligence expectations. Meanwhile, Berlin's digital sovereignty strategy stood out for its explicit targets: 70% open source on administrative workstations by 2032, managed with the help of PwC and tracked through KPIs.
Measurement was also central to other sessions. SUSE introduced a self-assessment based on the EU Cloud Sovereignty Framework, which defines sovereignty levels from SEAL-0 to SEAL-4. Dr Dawn Foster of Fast Wonder presented CHAOSS Project guides for demonstrating the value of open source program offices to executives. Japan's IPA shared data from a study of 30,000 GitHub repositories, finding that many organizations talk about open source but few actively practice it.
The overall message was that open source is increasingly treated as infrastructure, not an experiment. Bureaucratic planning, metrics, and compliance tools may be less glamorous than kernel driver debates, but they signal a maturing approach to digital sovereignty across both public and private sectors.