In June 2026, the European Commission dropped something unusual: a policy package that treats proprietary software not as a market inefficiency, but as a strategic vulnerability.
The European Technological Sovereignty Package includes the first comprehensive EU Open Source Strategy, and it opens with a striking admission. The EU spends €264 billion annually on IT products and services — the vast majority proprietary, the vast majority controlled by non-EU vendors. The Commission finally says the quiet part out loud: this isn’t just expensive, it’s structurally dangerous.
What’s new here isn’t that Europe likes open source. Research programs and public procurement have favored it for years. What’s new is the framing: open source as sovereignty by design.
The Cloud and AI Development Act (CADA) mandates open source components. The EU Digital Identity Wallet (EUDI) must be open source. The target is 30 million active users of open source collaboration tools by 2030. And perhaps most tellingly, the package explicitly links vendor lock-in to strategic dependency — a conceptual jump that previous EU strategies avoided.
A 2021 study by OpenForum Europe and Fraunhofer ISI found that every euro of public investment in open source generates 4-5 euros of return for the European economy. That evidence base now sits at the center of Commission policy. Open source isn’t charity, and it isn’t ideology — it’s infrastructure with measurable returns.
The strategy isn’t flawless. Open source hardware (RISC-V, open EDA tools) gets brief treatment despite €500 million in existing Chips Joint Undertaking investment. The connection between CHIPS Act 2.0’s “open foundry” ambitions and the Open Source Strategy isn’t drawn. And implementation — always implementation — remains the hard part.
But the governance architecture is surprisingly concrete: an EU OSPO Network, a Digital Commons EDIC, a proposed European Maintenance Instrument for under-resourced critical projects. These are delivery mechanisms, not just aspirations.
The timing isn’t accidental. The “Claude Mythos” incident (referenced in policy documents, still echoing in security communities) intensified debates about whether open source is a security asset or liability. The EU’s answer, formalized in strategy, is that auditability is security. You can’t inspect what you can’t see.
For anyone building digital infrastructure — and increasingly, that’s everyone — the signal is clear. The era of treating software as a black-box procurement decision is ending. Europe is betting that transparency isn’t just ethically preferable; it’s strategically necessary.
Source: Tech Policy Press analysis of the EU Technological Sovereignty Package, June 2026.