Keynote: Open Is Sovereign - Gabriele Columbro  ## Metadata - Author: [[The Linux Foundation]] - Full Title: Keynote: Open Is Sovereign - Gabriele Columbro - Category: #articles - Document Note: --- tags: - #OpenSource - #DigitalSovereignty - #EU Author: Gabriele Columbro Source: Keynote: Open is Sovereign Reference: [Keynote Video](https://www.youtube.com/watch?v=XChY_WVEMDs) date created: 2025-09-06 20:15 --- # Title: 🌍 Open is Sovereign — The Role of Open Source in Digital Autonomy ## Table of Contents: - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#️-notes) - [📖 References](#-references) - [🗣️ Paraphrase](#-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Assessment](#-deib-assessment) - [✅ Logical Validity](#-logical-validity) - [🛡️ DARVO Analysis](#-darvo-analysis) - [🔍 SEO Evaluation](#-seo-evaluation) - [🎯 Conclusion](#-conclusion) --- ## 📝 Summary Gabriele Columbro argues that **open source is both an economic driver and a foundation for digital sovereignty**. The EU benefits from billions in GDP impact, yet execution lags behind optimism. Fragmentation among initiatives, underfunding compared to the US, and lack of EU corporate contributors hinder progress. Columbro emphasizes the need for **open ecosystems, commercial sustainability, and cross-border collaboration** rather than a “European-only” open source. He frames open source as one of the last bastions of global cooperation and calls for **ecosystem-level strategies, funding consolidation, and industry buy-in** to strengthen Europe’s role. --- ## 📖 Main Content Columbro situates open source in the broader geopolitical context, noting its role in digital sovereignty amid the AI arms race. He warns against Balkanizing open source into regional silos and stresses that duplication would be prohibitively costly. Instead, he urges Europe to leverage global collaboration while consolidating initiatives like the **EU Sovereign Tech Fund** and **EPCCIS**. He highlights commercial ecosystems, VC funding, regulatory frameworks, and neutrality as critical to sustainable growth. Examples like France’s open-source-first procurement policy demonstrate tangible pathways, while GitHub contributor stats show Europe’s participation gap. --- ### 🗒️ Notes - [00:05](https://www.youtube.com/watch?v=XChY_WVEMDs&t=5) Open source contributes €65–95B to EU GDP. - [02:40](https://www.youtube.com/watch?v=XChY_WVEMDs&t=160) Open source impacts financial + geopolitical balances. Optimism exists, but execution lags. - [05:24](https://www.youtube.com/watch?v=XChY_WVEMDs&t=324) Fragmented EU initiatives create complexity → need for consolidation. - [07:55](https://www.youtube.com/watch?v=XChY_WVEMDs&t=475) Rebuilding OSS in Europe = €4.1B cost (Harvard study). Unsustainable. Global org contributions = €7.7B annually. - [10:28](https://www.youtube.com/watch?v=XChY_WVEMDs&t=628) Build **ecosystems**, not silos. Analogy: pizza ingredients → projects (flour + water), VCs (yeast), enterprises (toppings). - [12:48](https://www.youtube.com/watch?v=XChY_WVEMDs&t=768) End users + regulatory frameworks sustain OSS. Neutrality critical for long-term success. - [15:10](https://www.youtube.com/watch?v=XChY_WVEMDs&t=910) OpenSSF Baseline → helps compliance/security harmonization. EU Sovereign Tech Fund = promising model. - [17:33](https://www.youtube.com/watch?v=XChY_WVEMDs&t=1053) Europe has dev talent but lacks funding. Commercial OSS model outperforms proprietary in funding metrics. - [19:56](https://www.youtube.com/watch?v=XChY_WVEMDs&t=1196) EU underrepresented in GitHub top contributors. Traditional industries (auto, finance) need to step up. --- ## 📖 References - European Commission Study (2021) on OSS GDP contribution - Harvard Business School OSS funding studies (2023–24) - EU Sovereign Tech Fund announcements - OpenSSF Baseline Security framework - French open-source-first procurement policy --- ## 🗣️ Paraphrase 1. Original: *“Open source is the last way we collaborate globally—regionalizing it would break the virtuous cycle.”* Paraphrase: Global cooperation in open source is one of the few remaining shared efforts; fragmenting it by region would disrupt its benefits. 2. Original: *“Rebuilding open source in Europe would cost €4.1 billion—resources we don’t have.”* Paraphrase: Attempting to recreate Europe-specific open source infrastructure would drain billions, a cost the EU cannot sustain. --- ## 📰 Newsletter 💡 **Open Source as Sovereignty** At OSSummit, Gabriele Columbro reminded us: **open source is both an economic engine and a sovereignty safeguard**. With an estimated €95B GDP impact in the EU, open source underpins digital autonomy—but Europe lags in execution, funding, and corporate contribution. Key takeaways: - Fragmentation of EU initiatives risks inefficiency—**consolidation needed**. - Rebuilding OSS regionally? Harvard pegs it at €4.1B. Global collab is cheaper and better. - EU developers are abundant, but funding lags US levels. - Policies like France’s “open-source-first” procurement show real progress. 👉 Watch [the keynote here](https://www.youtube.com/watch?v=XChY_WVEMDs). --- ## ✅ Action Items - Map Columbro’s **ecosystem model** to WordPress: plugin maintainers (flour), hosting companies (toppings), funding orgs (yeast). - Frame GoDaddy’s OSPO strategy around **ecosystem sustainability + neutrality**. - Advocate for **EU-style procurement policies** in WordPress governance (OSS-first). - Position WordPress in **global compliance/security frameworks** (OpenSSF, CRA). - Encourage **corporate + industry contributors** to step up in WordPress, avoiding dependence on US-dominant funding. --- ## 🧪 Hypotheses - H1: Consolidated EU OSS initiatives increase efficiency and adoption by 30%. - H2: OSS-first procurement accelerates SME OSS uptake across Europe. - H3: Commercial OSS outperforms proprietary models in ecosystem health + funding growth. ### 📊 Methodology - Compare fragmented vs. consolidated EU OSS initiatives. - Survey enterprises adopting OSS-first procurement policies. - Analyze funding metrics of OSS vs. proprietary ecosystems. ### ❓ Questions - Can OSS-first procurement scale beyond France? - How can WordPress adopt EU-inspired compliance practices? - What incentives can bring more EU corporates into top contributor ranks? ### 🔮 Future Research - Comparative analysis of regional OSS funding models (EU vs. US vs. APAC). - OSS ecosystems in non-tech industries (healthcare, automotive). - Long-term sustainability of sovereign tech funds. ### 💡 Implications - Stronger OSS ecosystems boost sovereignty + innovation. - Procurement reforms could normalize OSS adoption in gov + enterprise. - Europe’s OSS funding gap highlights opportunities for WordPress + GoDaddy positioning. --- ## 🧠 Learning Styles Assessment - **Reading Level**: Graduate-level policy/tech mix. - **Visual**: Limited visuals; pizza metaphor helps. More infographics needed. - **Aural**: Strong (live keynote format). Could add podcast/audio replays. - **Verbal**: Excellent storytelling. More glossaries for policy terms. - **Kinesthetic**: Absent. Could add OSS ecosystem mapping exercises. - **Logical**: Strong causal chains (GDP → sovereignty → policy). - **Social**: Strong (policy + community references). - **Solitary**: Weak. No prompts for reflection. - **Naturalistic**: Absent. Could link OSS ecosystems to ecological systems. --- ## 📊 Accessibility Assessment - Transcript available (screen reader compatible). - Visuals minimal; alt-text missing. - No mention of keyboard navigation. - Color contrast unverified. - Needs mobile-first adaptation of slides. --- ## 🌍 DEIB Assessment - Cultural scope EU-focused → limited global lens. - Language inclusive, but heavy jargon risks exclusion. - No neurodiversity accommodations (dense policy text). - Representation skewed toward policymakers, not main - Summary: Don't miss out! Join us at the next Open Source Summit in Seoul, South Korea (November 4-5). Join us at the premier vendor-neutral open source conference, where developers and technologists come together to collaborate, share knowledge, and explore the latest innovations and advancements in open source technology. Learn more at https://events.linuxfoundation.org/ Keynote: Open is Sovereign - Gabriele Columbro, Executive Director, Fintech Open Source Foundation (FINOS) & General Manager, Linux Foundation Europe - URL: https://www.youtube.com/watch?v=XChY_WVEMDs Uh, and so today I want to sort of do a little bit of a recap of what we've learned and and how hopefully we can help. Um, just before jumping into the topic, um, I think over the last couple of days we we heard quite a bit about the the value of open source uh, from a economic and social standpoint. Um I'm assuming many of you have seen this 2021 I would say landmark study uh from from the commission um showing how much open source actually contributes to the EU GDP and it's it's estimated to be again this was three years ago so I I would say this is a conservative um estimate as far as today uh if you sort of plot it towards today uh between 65 to 95 billion. Um so I think that is a you know kind of a given uh in all the conversations uh especially within the open source community and increasingly at policymaker level uh there is a clear understanding of of the value of open source or at least a clear estimation but over the last again three years um and particularly in the last you know six months nine months obviously uh uh the geopolitical climate evolutions uh sort of have pushed the conversation of digital sovereignty uh uh and how open source can be a key pillar for achieving that uh sort of to the forefront. And you know earlier in the week you might have heard we released our uh annual uh open source report on Europe. It's pretty clear that uh the industry experts and leaders uh see open source as a concrete pillar for that. Um I'm quoting also a report from wire uh um earlier in the year which again puts open source u for its transparency for the sort of vendor locking prevention and so many other sort of inherent qualities of open source as the as the key um for achieving digital autonomy. Um and despite this guy is not necessarily European. Um as as the AI race accelerates uh we are seeing uh open source being used um you know to shift uh uh geopol or at least attempt to shift or influence geopolitical balances. Um I would say especially in the last six months and this is both sort of when I uh work with my fenos hat on and have conversations with financial institutions as well as as I come here in Europe sort of after the deepseek moment. It's been um very different level of conversations when it comes to how open source can uh you know shift market balances or uh uh um shift geopolitical balances. I mean it is very interesting to see how uh OpenAI just a couple of weeks ago had to sort of had to or felt like it was the right uh way forward to open source uh some of their models or at least put it open weight. Again, I'm not going to go into that debate right now. Um, and you know, if you ask the president of Europe, well, I don't know if you guys have seen, there's been a a funny funny quote out there of of Trump calling itself the president of Europe. Um, or at least saying that the EU leaders call him like that. Um, again, this is not just a EU thing. Um it is being recognized that open source uh can truly shift the balance of uh uh sort of where technology and innovation happens. Uh it seems to me that when I look at the different uh sort of data points uh in terms of research articles out there uh there still seem to be though um a gap between the vision of yes open source is a great pillar of digital sovereignty uh and actual execution and actual progress. Um again quoting those two reports uh uh both our report the state of digital sovereignty report uh they're clearly again while there's optimism around open source there are sort of doubts about how ambitious or how uh um optimistic folks are um that we will be able to achieve uh you know a progressive quick plan uh towards uh European digital autonomy as we were preparing with the team. Um, so an article from actually the CEO of of SAP on uh sort of a critique I would say on the current approach to digital sovereignty out there. And while it's not necessarily related per se to to the open-source uh part of it, it is interesting that the the executive of of the largest European tech company uh um has concerns as to the progress towards uh this this very valuable goal. And so I'm encouraged to see uh obviously so many initiatives out there. I don't know if you guys are familiar with any of this, but there are at least three four um initiatives out there that put uh open source front and center I would say uh of of the digital sovereignty conversation. Uh the EPCCIS is a project that we uh uh have been tracking for a while. You might have seen our announcement around neo uh earlier in the in the year. Um but again there's I think the good news is that there are multiple separate initiatives again funding and putting forward the vision that opensource um should be at the core of of digital sovereignty uh plans for Europe but it also creates fragmentation you know from the standpoint of the open source communities it is really hard to follow these different uh in some cases massive and you know highly sort of complex bureaucratic initiatives and so uh I think when I look again at the landscape sort of fragmentation uh of the initiatives and and sort of the need for consolidation um it's certainly the first things the first thing that stands out um more recently um you know there's been calls really for uh buying European you know if you look at those 40 initiatives or at least a couple of those uh you know it's not just about open source from a technical standpoint by how uh you know the public sector procures software and and I think you know clearly this is an important uh uh aspect but um it it's easy I would say to fall into the temptation to say by European means we need to have European open source um I think there's no such concept European open source American open source or Chinese openour source um open source is effectively the last or one of the last ways that we are uh globally collaborating and so um you know whilst it's not just sort of a principle here in my mind if you think about uh you know if you look at some data points um as Europe you know wants to really play an important role especially again as the AI AI race accelerates it's it will just simply be unsustainable to uh you know create a European version of open source or maintain or rebuild. Um the study from 2024 uh uh from Harvard Business School, you know, it estimates sort of the rebuild cost of of open source out there uh to over four 4.1 billion. and and I don't think there's, you know, frankly time or or resources uh to do so. Um that's a static picture of sort of the value of open source last year. But uh if you think on an ongoing basis, uh you know, we talked over the previous days, obviously there it all starts with individual maintainers. Um but corporates and organizations have certainly contributed to fueling open source to where it is right now. And they do it in a few ways. They do it through uh financial contributions. They do it through uh uh labor and and you know effectively sponsoring uh their employees to uh participate open source community or direct to maintainance funding. Um so just by quoting another uh Arvard business study that's the open source funding survey uh that was published last year. um the overall contributions from organization globally, so that includes Europe, we're estimated at something uh around 7.7 billion a year. Um and so would we want to miss out on the ongoing um you know support and innovation that comes from global organizations. uh it almost is like if uh the you know Europe should base its uh sort of scientific progress on research that just comes out of the EU. In fact, I wouldn't be able to quote these Arvard studies if if that was the approach. Um and again I'm not going to go dwell sort of into this too much but there's also in my mind very practical uh considerations like what what does even open source mean? What's the thresholds? um how do we sort of detangle this very highly interconnected network of of components that make up architectures uh sort of modern architectures. I mean again uh open source has proven to be um you know it works and it works in a way that uh uh as Jim was saying on Monday you know pushes down cost and and pushes up the value the innovation we can build and if we are to sort of break it and rationalize regionalize it bulcanize it uh I fear we're not going to see the same uh sort of virtue circle. So what do we do? Um I think from my perspective having you know now lived also in the US for for many years uh I think when I when I've built communities whether it being sort of banks or or what I see across many of the projects of the Linux Foundation is that we need it's not really just about open source but it's about creating uh open ecosystems on top of uh uh uh open source projects and I would argue openly governed truly openly governed ecosystems on top of openour source. Um, what do I mean by that? Well, I was going to do a whole diagram of sort of how the value chain flows in open source, but just being a little stereotypical, I figured I would talk about a pizza. And um, you know, obviously the core of a successful ecosystem is is projects and and the communities around that. And so I would say that's that's flower and water. Um, but as we as you probably heard in the last few days, uh, also from our state of of commercial open source report, I really do think that it's key to have a vibrant sort of commercial open source ecosystem built around these open source projects. Um, ultimately, if you think about the public sector or large enterprises, they mostly procure software um, you know, through service providers that give them support, give them liability. And I've heard so many times, where do I sign? I'm like, well, that's open source. So, if you want to sign somewhere, you probably need uh some some company building a product or or a service around open source. Um, obviously, you got to activate yeast. And so, VCs uh uh and and again, public sector funding are the way to really get this open ecosystem uh commercial ecosystem going on top of open source projects. Um I might be biased but uh I've worked for so many years in in vertical industries and I think ensuring that it's not only technology companies but the actual end users uh uh you know Daniel was mentioning the automotive industry on Monday and how many contribute back being able we're able to show value and uh you know foster organic contributions whether financial or labor from from large enterprises I think it's it's another critical aspect here. Um, and then finally, this wouldn't happen without the right uh regulatory or the right economic uh framework around it. Um, and I would argue in many cases for strategic projects, you know, not every project needs to be neutally owned. Uh but we've seen over the last years the growth of uh you know single vendor open source uh projects changing their license ensuring sort of the long-term sustainability and neutrality of a project is is really what uh foundations like us are uh are about. So it also gave me the chance of testing uh chip skills in drawing a pizza doesn't look very Italian anyway. Um, so how can we help? Trying to stay to stay on time here. Um, I mentioned we've we've announced the new NEOS project earlier in the year. Uh, this is one of the first outcomes from the IPSCIS sort of cascade funding. Um, uh, it is built under LF Europe. um you know it's not meant to uh build the whole stack rather to work uh also with several other uh projects at the Linux Foundation. It was in fact announced at CubeCon. Um and so I think this is a really good model to think about focusing on European specific collaborations while working sort of the global digital commons that we have available. Um there's been a few panels, there's one later today. Make sure that you check it out. Um, one thing that I haven't touched much on is also that uh when you think about supporting our projects and our communities in um, you know, complying with global regulations, that's another expect sort of aspect of uh, being global. Um, you know, we feel like uh, the Linux Foundation can support not only its projects but the whole ecosystem. And so one project that I'm particularly very interested uh in also with my financial services hat on is the open SSF baseline. It really provides a tool to uh not only assess the security posture of a uh any open source project but really maps back to the different global regulations and so provides again in the thinking about Daniel's uh uh Stanberg uh talk on Monday and the added pressure on maintainers uh to maintain projects. uh I think this is a a great tool to hopefully uh harmonize uh the burden uh for an open source maintainers that you know brings that project uh in different regions and different regulatory regimes. Um, when I think uh with my Italian hat on, what I'd love to see uh happen in Europe to foster the growth of this ecosystem. I mean, there are some very promising initiatives. Um, you might have seen couple of weeks ago the the announcement for a feasibility study for the creation of an EU sovereign tech fund. Um many of you I hope are familiar with the German sovereign tech fund which over the last three years uh really made sort of charted the path for u uh a nation state supporting the uh maintenance of critical open source dependencies. Um again there are mission that are sort of critical to the sovereignty of that nation state. um in sort of the spirit of consolidation that I was talking about before. I think it's it's really cool to see a proposal that tries to harmonize that at U level. Uh ultimately the projects we're trying to support are the same and so the more uh uh we can have consolidated efforts. Uh I think it's a it's a very positive thing and positive development. Um again I'm not going to go into policy proposals here. It's not my place. But uh uh as the EU looks at uh uh public procurement policies uh for software uh and as the sort of EU GDP is is very much uh you know there's a large chunk that is sort of public sector uh u driven it's important to fully understand the um the value chain of open source. We discussed the aggression not just of open source projects but the whole open ecosystem that can ensure uh not only these projects go to market but they get sustained. Uh and so uh again quoting another Harvard business school uh uh work from a few years ago. Uh this is these are some of the metrics uh you know of studying the impact of France introducing a sort of an open source first uh um policy in their procurement. Uh I think again understanding the full uh extent and nature of the ecosystem is critical here uh in new policy proposals. Last but not least, um again those of you who've seen the keynote on day one, um I really think there is a uh major opportunity to accelerate uh the commercial open source ecosystem in Europe. And this is an opportunity for you know uh VCs for for obviously founders and creators out there, open source project creators out there. um you know still the largest share of funding globally for for commercial open source companies comes from the US. Um but what the study showed us with numbers is truly that uh commercial open source is a great business model uh that it outperforms in sort of funding metrics um proprietary alternatives and that it does benefit the upstream project itself both in terms of contributors releases which obviously sort of contributes creating this opt cycle. So I think uh you know there's a lot of opportunity here. Um and I'm sort of yeah you don't have to trust an Italian on that. Uh this is slide is from a from a French uh um venture capital was creating a uh open sour commercial open source uh uh dedicated fund for Europe. Um and you know some of the numbers are interesting that there's more developers, there's more opportunities but there's much less funding as the monetization still comes the fund the funding and the access still come from the US. So I think that's where the gap and the opportunity are. Um and last but not least that's uh I think a good uh segue into the rest of of today's program. Um this is the open source contributor index. uh it's maintained by EPAM. Um when I look at the top 10 uh organizations uh contributing, this is just basic sort of GitHub metrics out there. Um there's no European in the top 10. There's two Europeans in the top 20. I will let you guess who who they are. Uh you can actually click through. I couldn't just feed them in a in a page. Um and so I think going back to part of uh what we uh should look at is is ensuring that more EU companies might not be tech, it might be industry um realize the value of open source and start uh truly stepping up in terms of contributing back uh to the community. Um again, I might be biased and and you'll hear quite a bit later today. The next two panels are about how industries uh sort of traditional industries which are very strong in Europe are looking at open source. Uh we have at least three or four vertical foundations in the in in the Linux foundation that are helping again traditional industries to to in this journey. Um who know I could this be the the the sort of block that is so strong in Europe that accelerate open source? Um before I leave you, if you are interested to learn more uh about the findings in the sort of European report that we published earlier in the week, pull up your phone. You got a QR code here and uh I'm sure uh uh you'll find something useful. I'd love to hear from you if you uh uh are able to catch me around. I'll be I'll be around the next couple of hours. So, thank you., Keynote: Open Is Sovereign - Gabriele Columbro, The Linux Foundation, 01k4gnef6rb1dq6e8ezrevtqqp.