The Open Source Dilemma in European Technological Sovereignty
This is one of the questions I keep coming back to while following the debate on European technological sovereignty. It deserves a calm, practical answer—not an ideological one.
Can Europe build a truly sovereign technology stack by relying on community-driven open source?
For those of us who have spent years in the technology sector, open source is not a slogan. We have watched Linux evolve from a niche curiosity into the backbone of the modern internet. We see Apache, PostgreSQL, Kubernetes, Python, Git, and OpenSSL acting as the invisible infrastructure of daily life.
But we have also witnessed the flip side:
- Forks that quietly die.
- Foundations that struggle to survive.
- Maintainers burning out under unpaid pressure.
- Vendors abruptly shifting licenses to proprietary models.
- The word “community” degraded into a cheap buzzword for marketing decks.
Ultimately, the vision of a united digital future relies on developing sovereign technology that meets the needs of all Europeans. Open source matters deeply; it is one of the strongest tools Europe has to reduce dependency, increase transparency, and build reusable digital public infrastructure.
However, a hard question underpins the current sovereignty debate: Can every critical layer of a European technology stack genuinely be built on solutions that are fully open source, mature, secure, and driven by a truly independent community?
Understanding Sovereign Technology: The Two Faces of the Stack
In certain domains, the answer is a clear and resounding yes. Open source is no longer an experiment here—it is industrial infrastructure:
- Operating systems
- Containers and automation
- Observability platforms
- Developer platforms and the cloud-native ecosystem
In other areas, however, the reality is far more complicated:
- Cloud infrastructure and semiconductors
- GPUs and AI models
- Training datasets and security supply chains
- Quantum technologies and critical operational platforms
In these fields, “open” is rarely binary.
Sometimes a technology becomes the hyper-stable, pervasive backbone of public administration, only for its licensing terms to be retrofitted or restricted overnight by the single commercial entity that controls it.
Sometimes a project is led by a single supplier, yet the code becomes stable, widely adopted and genuinely useful to both communities and enterprises. That should not be dismissed: strong stewardship can help technologies mature faster, harden in production and reach a level of operational quality that purely volunteer-driven projects may struggle to sustain.
The question is not whether a supplier is involved. The question is whether users retain practical control: roadmap transparency, deployment choice, portability, security processes, operational knowledge and credible exit paths.
Sometimes model weights are public, but the training data remains opaque. In other cases, the expertise required to run critical engines at scale is concentrated in very few hands.
This is why “open” should not be treated as a binary label. It is a spectrum of practical control.
This is exactly where Europe needs a more mature conversation.
Moving Beyond the License
The question should not be: “Can we publish the perfect European open-source stack?”
The better question is: “What makes a technology component sovereign enough for critical European use?”
Achieving true sovereignty means looking far beyond the license file. It requires asking hard, operational questions:
- Who controls the roadmap?
- Who maintains the project when the initial enthusiasm fades?
- Who fixes vulnerabilities at 2 a.m.?
- Can public administrations contribute upstream, or are they stuck maintaining isolated, dying forks?
- Can multiple European providers actually operate and support it?
- Is there real portability, or just a beautiful architecture diagram?
This is the dimension we routinely underestimate. A public administration does not simply adopt code; it adopts risk. It inherits a supply chain and a dependency map that may last for decades. Technological sovereignty cannot be reduced to a binary of “open source good, proprietary bad.” Reality is far more demanding.
The Two Traps to Avoid
As Europe navigates this path, it must avoid two distinct pitfalls:
- Open Source Romanticism: The naive belief that community software automatically yields sovereignty. It does not. Without funding, dedicated stewardship, rigorous security engineering, and long-term maintenance, even the best open-source software becomes fragile infrastructure.
- Sovereignty-Washing: Replacing a foreign monolithic dependency with another foreign dependency, but calling it “independent” simply because the local vendor stamped their label on it. This does not create sovereignty; it merely relocates the vendor lock-in.
The Real Discipline
Europe should aim higher. The goal must be a qualified, dynamic technology framework built on community-led open source—one where mature open standards, transparent governance, and shared investment in the digital commons meet ruthless security and operational responsibility.
Sovereignty is not just the right to see the code.
It is the practical capacity to understand it, run it, secure it, maintain it, replace it, and evolve it under pressure. Open source is essential to that story, but it is not a magic word.
It is a discipline.
