Europe's open-source infrastructure gap and how to fix it

The European Commission is preparing a European Open Digital Ecosystem Strategy. It frames open source as a crucial contribution to EU technological sovereignty, security, and competitiveness.

That framing is right. The hard part is acting on it.

The open-source infrastructure Europe depends on is already everywhere. Yet we still fund it like a hobby. We even procure it as if sustainability doesn’t matter. If Europe wants European digital sovereignty in practice, we need to change the economics: open-source funding, public procurement rules, and the incentives that, right now, reward the wrong business models.

I have spent 21 years building open-source software in Europe. XWiki started in 2004, one year after Atlassian Confluence. We built it 100% open source, with no external investors, funded entirely by our customers. CryptPad, which we also develop, now has more than 10,000 users registering every month on CryptPad's flagship instance alone. This February, 4 million documents were opened from 367,000 internet addresses, and 142,000 IPs interacted with a CryptPad form.

Both products compete daily with providers who have larger budgets and use bundling strategies to discourage switching. Meanwhile, procurement systems keep rewarding “cheapest today” over “resilient tomorrow”.

FREE WEBINAR

Your path beyond Atlassian Data Center

Learn how to plan a smooth migration from Atlassian Data Center to XWiki and OpenProject.

Join webinar

When the Commission launched this consultation, I wanted to contribute more than just a public endorsement (or token approval). What I can add is practical experience building open-source businesses in Europe. That includes direct experience with European and French public funding: what works, and what doesn’t.

Open source can play a decisive role in rebuilding Europe's digital competitiveness and in achieving real strategic autonomy.

But it will not happen on its own. Today’s incentives work against open-source builders and in favor of large proprietary players. If we don’t change this, we’ll keep getting the same outcome.

*

Open-source infrastructure in Europe: What it actually delivers

Europe can lead in open source because it already produces and sustains critical parts of the global software stack. The Commission’s strategy should build on what already works.

• Europe is a key contributor to open-source software worldwide. European developers created MySQL, MariaDB, VLC, and e/OS, and contribute heavily to foundational projects like Linux and GitLab.
• It also has B2B open-source companies that have proven it is possible to build durable businesses, create skilled jobs, and compete against Big Tech: Nextcloud, Collabora, Matrix, Passbolt, OpenProject, Murena, XWiki, and more.
• The European ecosystem has a strong culture of volunteering, supported by social safety nets. That is one reason small teams here can produce world-class software on modest budgets.

So the question isn’t whether Europe has the talent. The question is why the outcomes don’t match Europe’s priorities. Part of the answer is how open source gets evaluated. In procurement, it is still treated as a cost line. I’ve seen that drive bad decisions. It misses what open source actually delivers for European digital sovereignty.

Here is what open source actually delivers for European digital sovereignty:

The right to know what you are running

This is the core. Not a vendor promise, but the right to inspect, verify, and if needed fork the software processing your data. Transparency increases security and trust, and at the same funding level, open source is stronger than proprietary software in security outcomes.

Genuine exit rights

With open source, the right to change provider is built in. A 100% open-source provider cannot prevent a customer from moving to a different hosting or switching service providers. That is the point: Exit rights are not negotiable. Open core and proprietary models cannot offer the same guarantee.

Full control over how you run the software

A provider of 100% open source cannot forbid a customer from running the software on their preferred infrastructure. This is what real digital autonomy looks like in practice. With XWiki, that means you can deploy on premises or self-host, and use your own setup that fits your constraints and compliance requirements.

Competition and the ability to fork

Forking is a competition mechanism. It keeps software aligned with user needs, not only provider interests. Nextcloud is a positive example of a fork from OwnCloud that allowed users to move in the direction they needed. CryptPad is another example: an end-to-end encrypted fork of OnlyOffice.

Mutualization at European scale

Open source is the only model that allows different countries and organizations to co-develop shared digital components while each keeping local control and strategic autonomy. A solution built once can be reused, improved, and extended instead of being rebuilt independently by each actor. Investments compound across the ecosystem, turning individual contributions into shared progress. That is how small teams can produce world-class software without world-class budgets.

Long-term cost advantage

The cost advantage of open source is real, but the timing matters. In the short term, proprietary and cloud providers use aggressive pricing and bundling to lock in customers. Over the long term, open source is cheaper because mutualization works.

And one thing matters more than spreadsheets: Lock-in is what drives costs up over time. Open-source software limits that. Customers can move their data and tools elsewhere, which keeps providers accountable.

Why Europe still loses despite having the talent

\I’ve seen this repeatedly: Europe has the builders, but the system keeps paying the wrong layers. \

Funding models that do not fit open source

Venture capital (VC) is rarely adapted to open source. When VC invests, it often creates pressure to progressively close the model over time. That is how the incentives work.

MySQL, Nuxeo, Strapi, and Talend are examples of European open-source projects that went to US-based VC firms, several of which were later acquired by US companies. In the absence of regulation or strong incentives to maintain fully open offerings, VC tends to push toward closing.

Public funding helps, but it often falls short of what open-source infrastructure requires: long-term maintenance, security processes, and predictable capacity.

Procurement that rewards the wrong outcome

A large share of commercial value is captured by actors who contribute little to the projects they rely on. This is open-source washing in practice: Selling the label while underfunding the work. Public procurement often makes the problem worse by prioritizing the lowest price over contribution, expertise, and sustainability.

The result is a market that rewards aggregation over creation, and incumbency over resilience.

Lock-in economics driven by bundling

In the digital workplace, bundling makes competition irrational: replacing one component does not reduce what you pay for the bundle. Migration friction and proprietary formats add switching costs. The Teams module being priced separately after a Slack complaint shows de-bundling can happen under pressure. It should not be the exception.

Bundling doesn’t just package software. It removes choice.

A regulatory burden that scales badly for small actors

The Cyber Resilience Act introduces compliance obligations that disproportionately affect smaller developers compared to large vendors. Lobbying against open source exists, and it shapes outcomes. When regulation increases obligations without improving funding pathways, it increases pressure on maintainers rather than improving resilience.

The B2C challenge

In the consumer market, open source faces an additional problem. Highly funded proprietary vendors, financed by advertising revenue, provide broad solutions at zero visible cost to users. GDPR has helped by forcing companies to explain their data-extractive models, which increases the perceived value of privacy-respecting alternatives. But only a fraction of users are currently ready to pay for open-source alternatives, and the offer remains fragmented.

CryptPad competes in this market directly. We see the demand. But the funding asymmetry is real.

Open-source innovation that gets captured by proprietary companies

Wikis were invented by Ward Cunningham in 1995 and popularized by Wikipedia as open source. The main commercial beneficiaries became Atlassian Confluence and Notion, both proprietary. XWiki launched the next year after Atlassian Confluence, which was able to leverage revenue from Jira to fuel its growth. This is an advantage XWiki, as a fully independent open-source project, did not have. Today, as Atlassian forces customers onto its AWS cloud, many of its customers are choosing XWiki as a long-term solution that protects their data and autonomy.

AI is following the same pattern. The foundations are open source, built by universities and independent researchers. The commercial capture will go to whoever has the funding to develop. Unless Europe changes the incentive structure, European companies will not be doing the capturing.

What Europe should actually do

We’ll know the European Open Digital Ecosystem Strategy worked if it changes the economics. Words are easy. Incentives decide outcomes.

Here’s the simple part: Treat open source as infrastructure, then act accordingly. That means funding it properly, fixing procurement, so maintainers get paid, and changing the rules that block competition. If I had to pick the levers that actually move the market, I'd focus on:

#1 Funding open-source sustainability at infrastructure level

//Annual European open-source funding has never exceeded 100 million euros. Compare that to what Europe invests in cloud and AI, sectors that are themselves built on open-source foundations. This doesn’t add up. Maintenance doesn’t fit 12-month projects. It needs multi-year capacity.//

Cascade funding that reaches developers

Extend and sustain mechanisms like Next Generation Internet and NLnet: low overhead, money going to actual development. Both XWiki and CryptPad have benefited from these programs. They should be extended, not abandoned. Horizon collaboration projects, by contrast, tend to redirect project missions and result in much less money reaching development.

Multi-year grants for mature projects

Projects with proven usage that have not yet reached financial sustainability need 3-year funding visibility to make long-term hires. This category of funding currently does not exist.

An EU Sovereign Tech Fund with the right scope and governance

Fund long-term maintenance and security fixes for libraries, core software, and widely used applications. Scale the model of the German Sovereign Tech Fund at European level. Governance matters: It should be guided by people with real knowledge of open-source ecosystems and user needs. If the EU funds bug bounties or security analyses, it must also fund fixing what is found. Otherwise it creates pressure without capacity.

Explore a software contribution levy

A 1 to 2% tax on software revenue directed to a maintenance fund for open-source components. Almost all software depends on open source. Contributing back is not proportional to the value extracted. This is exploratory and needs careful design, but the economic logic is sound.

#2 Fixing public procurement for open source

Procurement is where the free rider problem is most directly addressable.

Score contribution, not just compliance

Public tenders should favor providers who actively contribute to the open-source software they sell, or who partner directly with the original developers.

Use an allotment strategy

Split tenders into 2 lots: one for software subscription contracted directly with the publisher, one for integration and services. This ensures the company writing the code receives recurring revenue.

Mandate total cost of ownership, including exit costs

Make dependence visible. Require TCO calculations that include migration and exit costs, not only short-term purchase price.

Enforce "Public Money, Public Code"

Software developed with public funding should be released as open source by default.

Mandate resilience scoring

Procurement criteria should include whether the solution can be self-hosted, whether the provider is European, and what a real migration would cost.

#3 Regulating Big Tech while protecting European alternatives

If switching stays irrational, autonomy remains theoretical.

Address bundling in cloud and digital workplace markets

Extend DMA/DSA-style logic to bundling strategies that make switching economically irrational. Current thresholds and scopes are too limited for the practices that do the most damage.

Reduce burden for smaller vendors

Regulate large vendors while protecting SMEs and open-source actors. The Cyber Resilience Act remains unclear for small businesses offering open-source solutions while building a business strategy around them.

When regulatory burden scales disproportionately, it advantages dominant vendors and raises barriers for SMEs. The result is market consolidation, not openness.

Require portability, interoperability, and de-bundled pricing

Require proper data exports in usable formats, open standards at the core, real-time interoperability, and de-bundled pricing so customers can replace components without a bundle penalty.

Where Europe should invest first

If we're serious about European digital sovereignty, we should prioritize the layers where dependency becomes structural. Not the areas that stand out in a strategy document, but the ones that determine whether Europe can actually operate, maintain, and evolve its digital infrastructure independently.

Technology areas

#1 Collaborative and productivity software

This is where lock-in becomes operational. These tools sit at the core of daily work for public administrations, companies, and individuals, and they are dominated by suites such as Microsoft 365 and Atlassian. If Europe wants credible alternatives here, the priorities are concrete:

• Office editor components compatible with Office formats (OOXML and OpenDocument), so migration and interoperability are realistic and switching costs drop
• Open standards implementation libraries, because interoperability is how you avoid replacing one lock-in with another
• Decentralized technologies and libraries that reduce single points of failure and allow federated or self-hosted deployment aligned with sovereignty requirements
• End-to-end encrypted collaboration tools for citizens and the B2C market, to reduce dependency on data-extractive business models
• Integrations between open-source tools, because people do not adopt “a project”, they adopt workflows

#2 Mobile operating systems and devices

Mobile devices are the primary access point to digital services for most European citizens. Dependencies on proprietary app stores and tightly controlled mobile ecosystems concentrate control over distribution, access, and user data in the hands of a few non-European platforms. Open-source mobile stacks reduce that structural risk by increasing transparency and strategic autonomy.

#3 Open-source cloud stacks

Open-source cloud infrastructures enable European actors to build sovereign cloud services, reduce dependency on hyper scalers, and support compliance with European regulations. Without sovereign cloud stacks, sovereignty becomes mostly contractual and fragile.

#4 Security libraries and tool chains

Security components are upstream dependencies for nearly everything. Investing here improves auditability, speeds up vulnerability response, and increases trust across the ecosystem. This category has one of the strongest multipliers because improvements propagate through many products.

Sectors where impact is immediate

The same logic applies to military and security sectors, where auditability and the absence of foreign-controlled dependencies are not optional, and to cloud providers, where open-source stacks are the foundation of any credible European alternative to US hyperscalers.

A personal conclusion

After 21 years of building open-source software in Europe, I have learned to recognize a familiar pattern.

When things go well, open source is praised as "the foundation." When things get hard (security work, long-term maintenance, boring reliability), open source suddenly becomes "a community effort."

Critical infrastructure, but funded like a hobby.

I have lived this from the inside. Not as an observer, but as someone who has had to choose, again and again, between what is urgent and what is important: Shipping features customers ask for, keeping the lights on, responding to security expectations, and still investing in the long-term work that makes software durable.

That experience makes me skeptical of sovereignty statements that do not touch economics. If a strategy does not change procurement rules, funding mechanisms, and the incentives that decide who gets paid, it will not change outcomes. It will just produce another document that everyone agrees with and nothing changes.

I say this having navigated exactly that environment for 2 decades. We built XWiki and CryptPad through all of that. Without investors. Without shortcuts. We are still here, which I take as proof that the model works.

But I should not have to feel like surviving is the achievement. The software is good. The usage is real. What has always been missing is a system that recognizes open-source development as the infrastructure work it actually is, and funds it accordingly.

That is what I hope this consultation leads to. Not another report, but concrete changes to how Europe funds, procures, and regulates software, so that the next 21 years look different from the last ones.