Open source in Europe: Opportunities, challenges, and the path forward in 2024
Reviews open source in Europe: Opportunities, challenges, and the path forward in 2024 and evaluates key implications for security practitioners.
Summary
### Overview At the Open Source Summit in Vienna, Austria, Mirco Böhm (Senior Director of Community Development at the Linux Foundation) and Kellen Osborne (Researcher at the Linux Foundation) discuss the release of the 2024 report titled *Open Source Maturity in Europe* (formerly the *World of Open Source Europe Spotlight* report). The report combines a worldwide quantitative survey featuring over 1,100 respondents (including 348 European respondents) with 22 qualitative expert interviews to capture trends, adoption patterns, and challenges across the European open source landscape.
### Key Topics - **Regional Differences & Grassroots Culture**: While industry-backed open source projects are heavily concentrated in North America, Europe maintains a deeply vibrant grassroots community of individual contributors. Europe has also piloted key governance norms, such as separating technical steering from project management, while contending with distinct public-sector and regulatory dynamics. - **The Role of Policy and Regulation**: European governments and the European Union play an increasingly active regulatory role compared to the US, notably through policies like the EU AI Act. - **Public Sector Adoption and Lag**: There is an overwhelming theoretical consensus supporting open source in government, highlighted by 82% of respondents endorsing the "public money, public code" principle. However, practical implementation severely lags: only 30% of surveyed public sector entities have an open source strategy covering use, reuse, and contribution, and merely 10% maintain an Open Source Program Office (OSPO). Notable exceptions include France's DINUM, Germany's Sovereign Tech Fund and Zendis, and Denmark's OS2 network. - **Perceptions of Security**: A prominent finding is that respondents strongly perceive open source software and its development model as leading to more secure software than proprietary alternatives, primarily because inspectability eliminates the "unknown unknowns" of closed-source systems. - **Open Source AI**: Machine learning and AI ranked as the top technology respondents believed would benefit from open sourcing (43%). Experts highlighted that conditional exceptions within the EU AI Act for free and open source systems make licensing definitions critical. To address this, the Linux Foundation introduced the Model Openness Framework to decompose models into components and recommend licensing schemes.
### Technical Details & Organizational Barriers - **Sector-Specific Hesitancy**: Sectors such as healthcare and automotive exhibit friction with the open source model. The medical industry often mistakenly expects community software to arrive pre-audited and production-ready for devices without internal work or intermediaries. Meanwhile, automotive organizations often restrict upstream contributions over liability concerns or intellectual property protection, limiting their engagement to mere consumption. - **Developer Motivations & Diversity**: Learning and personal development remain the primary motivations for individual open source contributors. Although barrier-to-entry is theoretically low, structural hurdles persist, prompting mentoring efforts by groups like PyLadies to support women and non-binary individuals across coding, documentation, and evangelism. - **The Role of OSPOs**: OSPOs serve as internal and external "diplomats" and signs of strategic maturity. They translate organizational strategy into concrete implementation, establish policies, educate staff, and manage cross-sector collaboration (e.g., the UN's OSPOs for Good Summit and the TODO Group network). However, OSPOs require mandate, funding, and top-level leadership support to be effective rather than treated as a silver bullet.
### Takeaways To close the gap between widespread support and actual implementation, European public and private entities must mature beyond basic consumption. Bridging this gap requires formal open source strategies, adequate funding, leadership backing, and the establishment of functional OSPOs to coordinate contributions, comply with emerging regulatory frameworks, and maintain long-term sustainability.
Related talks
The Linux Foundation·45 min
Outlines panel: Europes Open Source Motivations and Mandate: Findings From the 2025 World of Open Source and evaluates key implications for security practitioners.
The Linux Foundation·44 min
Investigates panel: Securing Europes Open Source Infrastructure: A Technical Case for an EU-Wide Sovereign T and evaluates key implications for security practitioners.
The Linux Foundation·16 min
Laws Like CRA
Outlines openSSF and LF Europe Collaborate to Ensure Open Source Compliance With Laws Like CRA and evaluates key implications for security practitioners.


