OSS + ELC EU 2026

Ten years ago, the OpenChain Project launched at this very event. A decade on, it has built the global baseline for open source compliance, culminating in ISO/IEC 5230 — the "1.0" era. With Mary Meixia Wang as Executive Director, OpenChain now enters its next chapter, and this panel asks what "2.0" must deliver.

Two frontiers define the road ahead. First, Automotive SBOM: as vehicles become software-defined, the deepest supply chain anywhere needs SBOM practices scaling from silicon to OEM. Second, license compliance in the era of generative

AI and "vibe coding": as more code is generated by AI than written by hand, licensing of models, training data, and AI-produced code raises questions traditional compliance never anticipated. Regulation such as the EU CRA adds urgency, making machine-readable SBOMs effectively mandatory and reinforcing the trust and security OpenChain pursues.

The panel goes beyond discussion: it first shares the community's latest work on these challenges — from the Automotive SBOM Guideline to evolving thinking on compliance for AI-generated code — then opens a cross-industry conversation on what the shift from 1.0 to 2.0 must deliver in practice.

Open source software powers critical digital infrastructure across every industry. But, how do you know if the software you are depending on is actually healthy? A project that looks active may have one key maintainer. A package you've never heard of may be a single point of failure for thousands of downstream projects. npm's scale and deep dependency chains turn that uncertainty into real supply chain risk – remember Shai-Hulud?

Based on learnings from open source community health analytics projects like CHAOSS, OpenSSF Scorecard, and GrimoireLabs, Bloomberg and AboutCode are building an open, data-driven framework that applies the Goal-Questions-Metrics methodology to assess project health across the npm ecosystem.

This talk presents our npm Health Model and open source tooling, early findings, and how this approach can extend to other OSS project ecosystems. We are sharing the model, methodology, data, and tooling openly so other organizations can apply it to their own processes. Attendees will leave with a practical framework for assessing open source health at scale, and a path to contributing to this open effort.

Have you ever felt frustrated that your legal counsel simply does not seem to understand what you are saying? Or are you a lawyer who simply cannot understand why the developers you are trying to help can’t speak clearly? Then you are not alone, and this is the session for you! Lawyers and engineers often speak different languages, which can lead to frustration when collaborating in an open source setting.

Removing friction between legal and engineering communication is no small task. However, doing so unlocks significant value: legal can provide clearer, more actionable advice and better understand risks, while engineers and developers gain a deeper understanding of that guidance. We will will share personal OSPO insights and practical strategies for enabling efficient, clear communication between these distinct functions.

The goal is not to turn engineers into lawyers or lawyers into software developers, but rather helps both sides understand and support each other more effectively. Without a shared language between engineering and legal, messages to management risk getting lost in translation. With clear communication we can all work more efficient together!

As AI transforms the tech landscape through AI-generated code and new security threats, software supply chains and corporate environments face an unprecedented paradigm shift. Consequently, the OSPO's role is becoming more complex, requiring broad coordination across internal and external organizations. We will discuss how enterprises position their OSPOs to realize comprehensive strategic value—including governance and risk management—as well as the challenges they face.

In this joint presentation, Mary Meixia Wang (Executive Director of OpenChain) and Hiroshi Ota (Senior Manager of the Governance & OpenTech Division leading the OSPO at LY Corporation and a W3C Advisory Board member) will deliver a dialogue exploring the strategic convergence of open source, technical standards, and corporate technology governance.

To drive smooth operations and growth while mitigating technical risks, we will share the LY Corporation model. Through this case introduction, we will highlight the enterprise challenges such as the impact of AI and the expectations companies have for open-source communities like OpenChain. Responding to these realities, Mary will share OpenChain's global vision.

The benefits of building software on top of open source solutions are well understood, such as avoiding reinventing the wheel, leveraging global expertise, and enabling interoperability. Another benefit is the ability to customise open source software for your use case, but in practice this will often be done by making a fork of the project, which can result in a significant maintenance overhead.

This talk is a case study of the BBC's fork of dash.js, a JavaScript library for media playback that is a key dependency for BBC web and connected TV apps. We will explore the reasons why a fork is being maintained, what the costs and benefits have been, and what is being done to reduce the maintenance overhead going forwards, including contributing to the mainline and engaging with the community. Attendees will come away with a better understanding of why and why not to fork, and how to reduce the burden of maintaining a fork.

Most organizations consuming open source have no systematic way to assess whether the projects they depend on are thriving, stagnating, or quietly dying. Scanners tell you about license, origin, and known vulnerabilities. Nothing tells you a maintainer is burning out or release cadence has silently stalled until it’s too late.

This talk introduces project health as a missing layer of supply chain risk management. We’ll cover the core metrics that matter from the work of CHAOSS (Community Health Analytics for Open Source Software) and how they complement security-focused efforts like OpenSSF Scorecard.

We’ll look at what’s ahead: making health data federated, queryable, and built into the tools and metadata infrastructure teams already use, so a health check becomes as automatic as a vulnerability scan. We’ll cover what’s being built now, what’s still unsolved, and how you can get involved.

Leave with a practical framework for evaluating dependency health today, and understand where this ecosystem is headed: toward a future where operationalized open health data at scale makes project health visible, measurable, and actionable for everyone who depends on open source.

University researchers create innovative open source ecosystems that can reshape global digital infrastructure, however translating that work into sustainable partnerships with open source communities - and industry - remains difficult. Promising projects disappear based on funding cycles and student/faculty transience. Barriers to collaboration – IP issues, funding models, institutional culture – remain difficult to tackle. While these challenges are universal, the landscape looks different depending on in which part of the world you sit. Funding, technology transfer norms, and expectations from academic partners vary significantly between the EU and North American contexts. This panel brings together university OSPO practitioners to examine what a genuinely international model for university-industry open source collaboration could look like. They will share what's working in their ecosystems, where barriers lie, and whether shared infrastructure could bridge regional differences. The session includes space for audience input on what is most needed to make academic partnerships stronger at a global level.