OSS + ELC EU 2026

Open Source compliance is no longer just about coping with legal headaches; between navigating the Cyber Resilience Act & managing strict SBOM mandates it is a critical regulatory hurdle. Enforcing these standards without slowing developer velocity is a giant challenge. To solve this, the Uber OSPO overhauled our ecosystem of 6 Monorepos, 4k microrepos & over 35k dependencies to move away from manual audits & remove the friction placed on our engineers.
We built a system that scans our entire codebase every 24 hours, but detection is only half the battle. By integrating agentic tooling with our compliance policies & historical exception data, our system now makes calculated judgments on resolution versus escalation. The OSPO agent autonomously raises tickets, remediates issues & learns how to handle complex scenarios that would have required legal insight. This has automated our checks and eradicated high risk libraries from our codebase.
It’s not all as complex as it looks though. With clear policies, legal alignment, and a commitment to learning by doing, any organisation can do this. I'll share Uber's blueprint for turning open source governance into an automated & smart engine.