OSS + ELC EU 2026

Open Source compliance is no longer just about coping with legal headaches; between navigating the Cyber Resilience Act & managing strict SBOM mandates it is a critical regulatory hurdle. Enforcing these standards without slowing developer velocity is a giant challenge. To solve this, the Uber OSPO overhauled our ecosystem of 6 Monorepos, 4k microrepos & over 35k dependencies to move away from manual audits & remove the friction placed on our engineers.
We built a system that scans our entire codebase every 24 hours, but detection is only half the battle. By integrating agentic tooling with our compliance policies & historical exception data, our system now makes calculated judgments on resolution versus escalation. The OSPO agent autonomously raises tickets, remediates issues & learns how to handle complex scenarios that would have required legal insight. This has automated our checks and eradicated high risk libraries from our codebase.
It’s not all as complex as it looks though. With clear policies, legal alignment, and a commitment to learning by doing, any organisation can do this. I'll share Uber's blueprint for turning open source governance into an automated & smart engine.

Open source communities are entering a new phase as more contributions are created with AI assistance. This raises a practical question for the ecosystem: how should projects, maintainers, and companies handle AI-assisted contributions while preserving accountability, trust, and review quality?

This session brings together two complementary perspectives:
1. An outside-in view of how open source communities are responding, including early observations on how such contributions are being identified and categorized, and
2. An inside-out view of what this shift means for OSPO strategy, compliance, and coordination across engineering, legal, IP, and security stakeholders.

Rather than debating AI in the abstract, the talk focuses on concrete issues communities and companies are already facing, including human accountability, maintainer workload, traceability, stewardship, and software supply chain quality.

Attendees will leave with a practical framework for discussing AI-assisted contributions inside their projects, OSPOs, and cross-functional governance teams.

The TODO Group’s mission is to empower and educate open source management best practices inside organizations through effective Open Source Program Offices (OSPOs) and similar initiatives. With the latest developments in AI, as well as the shift of importance in open source across different industries, several new initiatives have been spun up that the community has embraced with fresh energy.

Join the TODO Group Steering Committee as they present the latest updates from the community, including a new Working Group focused on agentic AI tooling for OSPOs, changes to how our content is created and shared, as well as the growth in local events by TODO Group Ambassadors from around the world. The Steering Committee will also share the data they’re collecting in partnership with LF Research that informs ecosystem trends worth exploring and what the TODO Group community wants to focus on most in terms of learnings and growth.

Plan on attending if you’re in an OSPO, looking to create one at your organization, or interested in helping to spin up new open source initiatives!

Everyone is talking about digital sovereignty - but what happens when a federal state takes this concept seriously? In 2025, Berlin adopted an Open Source strategy to achieve innovation and digital independence through OSS, open standards, and collaboration.
We report on how this strategy came about and what its implementation means in a complex administrative landscape. Seven measures form the backbone—from establishing an OSPO at ITDZ Berlin to identifying critical software dependencies to giving Open Source priority in procurement law. Behind each measure lie organizational, cultural, and legal challenges.
What are the low-hanging fruits? Where do strategies reach their limits? And how do you keep a “learning” strategy alive - rather than letting it fizzle out? An honest account of progress and setbacks that shows what others - whether government agencies or companies - can learn from Berlin’s Open Source journey.

We’ve probably all had leadership question the value of our OSS efforts. It can be difficult to frame the value in ways that resonate with stakeholders and clearly articulate the benefits gained through continued OSS contributions. Taking a strategic approach that connects the OSS work with the broader goals and objectives of the organization can demonstrate the value of this work so that the organization can continue to allocate resources to the OSPO or other OSS teams.

Using examples from my decades of experience in OSS, this talk will provide details about how to demonstrate value by focusing on how your OSS work helps the organization achieve their strategies and goals. Every organization has unique needs and goals based on what they are trying to achieve, so there is no “one size fits all” way of demonstrating value, but aligning your OSS strategy with your organization’s goals and focusing on the most strategic projects can help show the value of your efforts. This talk will help you reason about how OSS efforts allow your organization to achieve its goals along with framing and communicating that value in ways that resonate with leadership, funders, and stakeholders.

Many organizations have bought into the value of open source, but don't choose to open source everything. This Bird of a Feather session focuses on the inflection points for public sector organizations: what actually causes an organization to move projects from closed source to Open Source, or — just as importantly — to make a deliberate call that something should stay closed. The triggers are rarely just technical. Public Sector organizations may consider the ROI on open sourcing; whether the codebase, the team, and the organization are actually in a position to do this well; if there are regulatory obligations or policy considerations that push you towards being more open or closed. Sometimes the honest answer is that the perceived collaboration overhead (e.g. documentation, governance) may not be worth it for code that's considered throwaway or not ready for public consumption. Session participants will include researchers, representatives from InnerSource Commons and OSPOs in public sector organizations who have experience navigating these decisions.

Open protocols are creating a new layer of infrastructure for how AI agents connect to tools, data, and each other. For OSPOs and open source managers, this also creates a new governance surface: How should open source repositories document instructions for AI agents?; What policies are needed for AI-assisted contributions?; How can OSPOs help bring an open source perspective into agentic AI policies and processes while working with the teams responsible for security, legal and platform engineering?

This talk will introduce the basic concepts behind the open agent protocol landscape, with a special focus on the Model Context Protocol (MCP), and explore how OSPOs can apply this knowledge to open source policies, developer experience, contribution workflows, and reporting

The session will close with a few open questions and practical considerations for open source managers starting to explore this space, including how collaborative efforts such as TODO Group’s Agentic AI to Empower OSPOs initiative can help the community build in collaboration

Artificial Intelligence is fundamentally changing the open-source ecosystem, promising unparalleled development velocity. However, this speed scales risk simultaneously. Open-source software (OSS) maintainers—already heavily resource-constrained and unevenly funded—are finding themselves caught in a crossfire of AI-driven complications.

This session, led by the Open Source Security Foundation (OpenSSF), breaks down the three critical security paradigm shifts introduced by AI:

Securely Using AI to Build Software: How insecure-by-default code suggestions, copied risks, and hallucinated packages compromise codebase integrity.

Using AI to Secure Software: The reality of how upstream maintainers are overwhelmed by a massive influx of automated vulnerability reports generated by AI bug hunters.
AI as an Attack Surface: Moving past traditional DevSecOps to address MLSecOps pipeline vulnerabilities, including data poisoning, model theft, and container security across the machine learning lifecycle.

Attendees will walk away with an understanding of OpenSSF’s recommended approach designed to shift the focus from cheap "findings" to valuable, validated "fixes".

Many initially hardware-driven industries, undergo a profound transformation and become more defined by software like it is the case in the automotive industry. Driven by increasing software complexity, this shift demands unprecedented levels of collaboration and joint integration. As many organizations whose core business was not selling software accelerate towards a more software-defined world, a critical question is how to consume, grow, run and consume the involved Open Source projects to deliver lasting value.

While many of the effects of open collaboration are not unique to a particular domain, the lessons learned from already more "software-defined" industries unlock invaluable insights that are collected in the TODO Group Business Guide.

Taking the learnings from that guide, this panel will delve into how Open Source activities effectively contribute to reaching business goals.

Join us to uncover enablers of sustainable Open Source development, learn from cross-industry successes, and equip your teams with the necessary competencies to thrive in the rapidly evolving software-defined world.