Who Owns the Stack? The Sovereignty Panel at OSS Europe 2026

On the first afternoon of Open Source Summit Europe 2026 in Prague, the Linux Foundation hosted a press and media panel in the Small Theater: “Who Owns the Stack? Rethinking Digital Sovereignty in the AI Era”. I attended as a media partner for Udienza and recorded it. It was the most substantive hour on sovereignty I heard all week.

The panel:

• Thierry Carrez, General Manager, Linux Foundation Europe
• Paula Grzegorzewska, Strategic Partnership Senior Manager, Linux Foundation Europe
• Jonathan Bryce, Executive Director, CNCF / Cloud & Infrastructure, Linux Foundation
• Christopher “CRob” Robinson, CTO, OpenSSF and Akrites
• Moderated by Stephen Sopko, Practice Lead, HyperFRAME Research

The official topic: European technological sovereignty across AI, cloud, semiconductors and open source, and the dependencies around models, compute, data, tools and agent infrastructure.

Quotes below are from my recording, lightly edited for clarity. The transcript does not always make the speaker explicit, so I attribute only where the context is clear.

Is open source enough for sovereignty?

The opening question was whether open source is inherently the centre of digital sovereignty. Thierry Carrez answered that it gets you part of the way, but not all of it:

“Open source gives you access to the technology and the ability to look into the code and check for any kill switches. But it doesn’t give you continuity of access, which is the next step. For that you need more than just open source. You need to be able to fork the code as a last resort, and to be able to do that you need to participate in those ecosystems.”

His conclusion: openly governed ecosystems, and real participation in them, are what complete the picture. That is the same argument as the State of Open Source in Europe report presented that morning: participation in openly governed open source is the solution.

The moderator added a story every procurement veteran will recognise. He once negotiated source-code escrow into a contract; the vendor went out of business, the code was delivered, and nobody in the room had ever touched it. Having the code is not the same as being able to run it.

From niche to policy priority

Paula Grzegorzewska, who works on policy for the Linux Foundation in Europe, described how fast the political climate has changed. Seven years ago, when she said she worked on open source policy, it raised eyebrows. Now it is seen as a viable choice, partly because European-born proprietary alternatives simply did not exist. She expects a significant shift soon:

“Under the open source strategy, we will most probably have an OSPO in every member state. I think this will change so much in terms of how governments interact with the open source communities and the ecosystem.”

The European Commission’s proposals this year gave ministries what they needed:

“I’ve been talking to many people working in ministries around Europe, and finally they say: okay, I have this piece of paper from Brussels that says this makes sense. Suddenly budgets are found, new units are being built. It’s a bit late, but it is happening now.”

Source code alone is not sovereignty

Jonathan Bryce took the operational angle:

“Source code on its own is not worth a ton if you don’t understand it, if you don’t know how to maintain it, deploy it, monitor it.”

He pointed to OVHcloud, which has long talked about operational sovereignty being as important as open source. Jonathan also brought a global perspective from the Linux Foundation’s work in China, where at a recent event in Shanghai the sovereignty conversation was “much less about open source software”, since China has been a huge adopter for decades. It was about hardware: chips and optical systems. True choice, in his view, needs the other layers too.

The moderator added a nice detail from a briefing with OVHcloud: when he asked whether building their own servers was a new sovereignty move, they said they had always done it. The market’s sensitivity has simply caught up with how they have done business for almost 30 years.

Choice is the point

The line from Jonathan that I keep coming back to:

“The most valuable thing with open source is the choice. It’s not necessarily ‘don’t use Azure or don’t use AWS’. To me, it’s: make sure that you have a choice to not use them. You may use them because they fit your needs very effectively. But if you have no choice, that’s when you get into a really bad situation.”

His practical test is to ask where your organisation truly needs choice, usually around where data lives, who can access it and which laws apply. Then put open platform layers there. Kubernetes, which runs in your own data centre, in a factory, air-gapped on OpenStack or on a hyperscaler, gives “option value” above and below it. The projects that have lasted decades and built billions of dollars of value, like the Linux kernel and OpenStack, and now PyTorch in AI, are those platform-type projects.

Paula added two dimensions to choice: interoperability and the cost of switching. The impact assessments for the EU Cloud and AI Development Act include calculations of the cost of switching to open source for the public sector. She described that as the first proper exercise of its kind.

How far down the stack does it go?

Thierry described how the Cloud and AI Development Act slices sovereignty into assurance levels. Some workloads need little sovereignty. The highest levels require effective control over the whole technology supply chain, down to hardware, which is very hard to reach. Confidential computing, which stops a host from accessing the workloads it runs, can help at the lower levels.

The first goal, in his view, is to remove the dependencies that can be exploited:

“When you’re locked in with one single vendor or one single country, in today’s world you get exploited for that vulnerability, in trade negotiations, or through aggressive pricing changes.”

With open ecosystems, investment in a technology is not lost when you switch provider. And the most efficient path to effective control is to join the community rather than write your own:

“If you join a community working on the same software, like Kubernetes, you’ve invested in a common thing. You participate enough to be sovereign with that technology, knowing how to deploy it and add features to it, without having to make the full investment from scratch.”

The CRA: “literally nothing new”

CRob, CTO of the OpenSSF, who also leads Akrites, a vulnerability disclosure and incident response team focused on getting fixes landed upstream, was refreshingly blunt about the Cyber Resilience Act:

“I really like that the CRA has codified about 30 years of cybersecurity best practice. There is literally nothing new in the CRA. The things in it were my checklist on my first day as a junior cyber person.”

He placed responsibility squarely on manufacturers, the organisations that “sold you something for money” and chose which open source components to build on, including supporting those upstream projects. He also highlighted the CRA’s effect on due diligence: if you can see the code, you can see how a community responds to vulnerabilities and feature requests, and then “trust the vendor and verify yourself”.

Thierry added that the CRA is the first product legislation that really takes open source into account. Early drafts were written with “a box you buy in a shop” in mind, and the open source community managed to explain how software is actually assembled from many downloaded pieces.

On AI changing build-versus-buy decisions, CRob was clear:

“You’re not going to replace the Linux kernel with one prompt.”

For more on the CRA, see my notes on CRA SBOM requirements and Greg Kroah-Hartman’s view of the CRA as an ingredients list.

What should Europe do next?

The closing question asked each panellist what Europe’s approach should be. Four answers, four complementary ideas.

Paula: get involved in making policy. Good policy takes years and needs input. The Commission’s consultation on open digital ecosystems received over 1,600 responses, a record, because the community showed up. “We need more involvement from the open source community in actually creating those policies.” And she argued against despair: “I think we’re actually in a pretty good spot.”

CRob: don’t be isolationist.

“Try not to be isolationist. Understand that open source is the single greatest invention ever in humanity. An idea is just as valid from someone in Kenya, someone in Lisbon or someone in Poughkeepsie. But grow and cultivate that expertise, and train up the next generation, so you can be self-sufficient if you so choose.”

Jonathan: a broad contributor base is resilience. No region can build all the technology it needs. Projects with a broad base of contributors are less likely to miss a serious security incident or go through a licence change. And quoting Captain Jean-Luc Picard: “One impossible thing at a time.” Pick open source adoption first, then contribution, and do not try to solve everything at once.

Thierry: don’t reinvent the wheel. Build the missing link.

“It’s very important that Europe doesn’t fall into the trap of reinventing the wheel. The technology is there. There’s no need to make ‘European open source’, whatever that would be. What you need is an ecosystem of companies that take that open source software and package it in a way that’s consumable locally.”

His example was striking. Everyone in France wants their own private cloud, and when they ask him who can help them build one, the answer is a couple of companies and “maybe 20 people in France who can actually do that right now”. Everyone else ends up with a US-based provider. The French Ministry of Finance built a very large OpenStack cloud on its own, and is now looking for partners because it has outgrown its own capacity to run it.

From the audience: cost and innovation

Two audience questions were worth repeating.

One attendee said a round table of European leaders had concluded that sovereignty stifles innovation: the last 10–20% that open source does not cover is hard to fill without deep engineering, and turning to a local provider can mean swapping global lock-in for local lock-in. Thierry’s answer was that the software is mature. What is missing is commercial support when an internal project becomes critical and needs 24/7 coverage.

Another said enterprise clients expect open source to be cheaper, and turn back to proprietary software when it is not. Thierry agreed this is the root of under-investment. Open source is “permissionless innovation” that starts free in the lab, but once it becomes critical it needs strategic investment, which US and Chinese companies are far more willing to make. He noted that the Cloud and AI Development Act’s criteria for higher assurance levels include working with healthy open source upstreams. Paula added that this is why the community needs health metrics and studies on the return on investment of open source.

CRob described the corporate failure mode memorably: companies treated open source like an all-you-can-eat buffet, grabbing components without building the capability to contribute, without due diligence, and forgetting that almost every licence says the software comes without warranty.

Bridges, not fortresses

The moderator closed with a metaphor I liked. The night before, he had walked around Prague’s thousand-year-old fortress and posted about sovereignty. Then, in the morning keynotes, he heard that Prague is known as the city of bridges, not fortresses. Sovereignty is less about locking down and more about building connections you control.

My takeaways

1. Open source is necessary but not sufficient. Add participation, operational skills and local support partners.
2. Design for choice. Put open platform layers where you need the option to leave.
3. Count switching costs. The EU is now doing it explicitly. Your architecture review should too.
4. Invest like it is strategic, because it is. Free to start is not free to run.
5. Do not build fortresses. Contribute globally, and grow local expertise.

For the keynote side of the same day, see Open Source at a Crossroads, and for the governance argument in depth, Digital Sovereignty Is an Open Source Governance Problem.

More from Open Source Summit Europe 2026

• Open Source Summit Europe 2026: Complete Prague Guide
• State of Open Source in Europe 2026: Numbers from Prague
• Sovereign AI Models: Teuken, Apertus and OpenEuroLLM