The EU's open-source strategy: four objectives, no euros attached yet

What the strategy actually commits to

The European Commission's Open Source Strategy, published as part of the June 2026 European Tech Sovereignty package, frames its core thesis plainly: it "places open source at the centre of the EU's technological sovereignty by promoting European open alternatives to non-EU proprietary solutions in critical domains." It is organised around four objectives:

• Tech sovereignty — scale the Open Internet Stack catalogue; push open-source alternatives in cloud, workplace tools, secure email and decentralised social media; embed open source in the EUDI Wallet and age verification.
• A vibrant ecosystem — accelerators and licensing help for startups, a stewardship toolkit, a new Open Source Maintenance Instrument with critical-dependency mapping, and skills investment.
• Open source in public administration — procurement guidelines for open standards, a strengthened Commission Open Source Programme Office (OSPO) and EU Public Sector OSPO Network, and "openness and sovereignty-by-design" in digital investment.
• Standards and outreach — promote EU developers internationally and feed open-source communities into standardisation.

The one thing the document does not contain: any specific budget figure or deadline. That absence framed the entire discussion.

The thread's first question: "is any money going into it?"

The top comment was a single line — "is any money going into it, or are they just 'supporting'?" — and the answers were not reassuring. A founder whose software is already used across EU government institutions described the perverse incentive that vague support creates:

"There is money but it's all vague and hard to get and usually with tax breaks instead of just money… Many EU gov institutions use our software and would LOVE for us to open source it - they would immediately stop paying." — a founder selling software to EU institutions

A high-karma commenter argued the funding shape is structural, not accidental:

"Just giving people money to work on open source directly would violate state aid/market disruption rules… the EU can't do anything strategically, or fix anything. It's by design… that is what market liberalism is." — a commenter on the EU as a neoliberal institution

Another predicted exactly who the money reaches: "no money will be directed to the thousands of core and essential OSS projects that are maintained by individuals," only "consortium of suckers and eventually nice but useless researchers in University."

The liability landmine the strategy ignores

The sharpest technical objection came from developers pointing at the EU's own Product Liability Directive. It exempts open-source software — but only when it's developed or provided outside commercial activity. The moment a company ships it inside a product, the exemption evaporates:

"As soon as a company integrates OSS into its own commercial product or uses it for economic purposes, the company becomes liable for any potential defects in the open-source component." — a cloud solution designer

The replies split into a genuine debate. One pushed back hard — if you sell a product for profit, you're liable for all its subcomponents, "it doesn't matter if you found the components in a hole in the ground or on github." The counter: paired with the Cyber Resilience Act, the combination makes it economically irrational to either open-source your own work or build commercially on someone else's, since "the risk outweighs any potential profit."

"Just use the open source already available"

Several practitioners argued the strategy aims at the wrong target. A developer noted that EU bodies already operate under a "you must open source, unless you explain why not" rule — and the "unless" is precisely where procurement quietly reverts to Microsoft cloud under the US CLOUD Act. The concrete counter-example came from a Dutch civil-service project:

"this is a 'collaboration suite for civil servants' that's basically a collection of existing open source projects… this looks like a good step in the right direction to me" — a technical publisher citing the Dutch mijn-bureau project

The same commenter added the realistic caveat: NextCloud, Matrix and the like will probably be "deemed not good enough compared to Google Workspace." A self-described EU-friendly voice granted the goals "sound great" — strengthening the OSPO, open-source-friendly tendering — but asked the unanswerable question: "is it very concrete? It sounds like it, but I don't see how it is."

The so-what: a list of intentions, graded by what it omits

Even the thread's most thoughtful participant — who complained that EU threads on HN collapse into reactionary negativity — couldn't point to a commitment with teeth. The document is, as one commenter put it, "not in fact a strategy but a list of key goals and requirements, put together in technocratic jargon." If the headline had read "EU invests 100B into open source," the thread agreed, the reception would be different. Until a euro figure and a fix for the liability trap appear, this reads as direction without force — and the people who maintain the actual dependency graph it wants to protect are the ones it's least equipped to pay.