The essentials
- Among 367 European organisations surveyed, 94% call digital sovereignty strategic—yet 31% still have no formal open source governance.
- 48% maintain private forks; the report’s typical profile spends about 311 hours per release cycle keeping them up to date, and 28% of those respondents cannot measure that effort.
- Without governance, only 15% say they fully know which open source components sit in their products; that rises to 25% at the most advanced governance stage.
- SMBs carry extra risk: 44% lack formal governance versus 23% among larger organisations, even though they already rely heavily on open source in their stack.
The meeting where everyone says yes
The CEO asks for an update on digital sovereignty. People talk about hosting in Europe, relying less on US hyperscalers, and using open software. Heads nod. Then someone asks the awkward question: do you know which open source components run in your website, your connected ERP, or the business app shipped last year? Silence. That scene is not fiction—it is the gap measured in the fifth State of Open Source in Europe report, published in October 2026 by the Linux Foundation from 367 European respondents.
The paradox is sharp. 94% say digital sovereignty matters to their technology strategy, 61% call it “very important.” Yet 31% have no formal open source governance—no inventory rule, no process before adopting a library, no named owner. The ambition is there; the register that would make it real is missing.
Consume without governing
Europe contributes code: 59% of organisations do. It joins governance less often: 37% take part in project governance, versus 47% elsewhere. In practice, many prefer foundation-hosted, neutrally governed projects (52% choose that model), but only 27% use a formal, consistent process to assess a project’s health before adoption—13 points below the non-European average. Well-governed projects are welcome, as long as someone else does the governing.
Another expensive habit: 48% keep private forks—in-house copies that must be patched on every upstream release. The report’s typical profile spends about 311 hours per release cycle on roughly ten forks. 28% of those respondents admit they cannot quantify the effort. Open source is not “free”; part of the bill hides until a vulnerability or an obsolete branch blocks a go-live.
AI speeds adoption—not visibility
The 2026 edition tracks generative AI coding assistants: 94% of organisations use or pilot them; 48% report more open source components because of them; 76% say those tools increase the value they get from existing OSS. Productivity wins—traceability does not. More suggested dependencies, more auto-generated upgrades, without a frame to check licence, project maintenance, and attack surface.
The report also highlights the agentic layer—protocols and frameworks that orchestrate AI agents. The Agentic AI Foundation, launched in December 2025, hosts efforts such as MCP and AGENTS.md; top-tier founding members are US-based, while European names (SAP, SUSE, Ericsson) mostly sit lower. Same pattern as cloud: heavy use, thin influence on the rules. For an SMB preparing agents on a private network or sovereign hosting, the question is concrete: who will set the standards your tools inherit next year?
What the figures mean for an SMB
The survey links governance maturity to perceived return: a 3.6× benefit-to-cost ratio without formal governance, 4.6× at the most mature stage, 4.1× on average in Europe. Correlation is not causation—but dependency visibility moves the same way: only 15% without governance say they fully know which OSS components are in their products, versus 25% at the advanced stage. SMBs are more exposed: 44% lack formal governance, against 23% in larger organisations.
- Quarterly inventory of dependencies for critical websites and apps (in-house and vendor-built), with a last-reviewed date.
- Before major releases: list new or updated libraries, licence, whether the project is still maintained, recent security fixes.
- Private forks: document them or retire them; compare internal cost to upstream contribution or switching components.
- Vendors: require an OSS component list with every delivery—not only at tender time.
The Cyber Resilience Act is already moving budgets: 63% of respondents increased spending on dependency management ahead of obligations. For an SMB, the point is not to copy a corporate OSPO, but to close the blind spot—a Next.js site, a PHP module, a JavaScript library in checkout—any of which is a door left open if nobody knows what is installed.
Sources
This note was drafted with AI tools from the cited sources, then reviewed and published under the responsibility of Jordan FOUASSIER, publication director. We summarise the facts and add our reading; source text and images are not reproduced. An error? Write to contact@aigyrosgroup.com.