OSS + ELC EU 2026

European digital policy is often discussed through frameworks such as NIS2, the CRA, DORA, the CSA, and the broader Tech Sovereignty agenda. Yet these initiatives share a common objective: securing the software supply chains underpinning Europe’s critical digital infrastructure.

OSS is the foundation of modern technology stacks, from cloud services and critical infrastructure to financial systems and AI. It is also inherently global, developed and maintained by a distributed ecosystem across borders. As reliance on OSS grows, the challenge is no longer whether it is used, but how it is integrated, governed, and secured throughout its lifecycle within this global dependency network.

This session explores software supply chain security as the common thread across Europe’s cyber and digital policy landscape. It examines how regulations converge on transparency, dependency management, vulnerability handling, provenance, and secure development practices.

Finally, it connects these developments to EU Tech Sovereignty goals, arguing that secure and standardized consumption of globally developed open source is key to Europe’s resilience, competitiveness, and technological sovereignty.

The EU Cyber Resilience Act requires manufacturers to exercise due diligence when integrating open source components — but what does that actually look like in practice? ORBIT Launchpad is an OpenSSF initiative building the catalogs, criteria, and tooling that help manufacturers demonstrate they've done the work.

This talk covers how ORBIT Launchpad bridges the gap between regulatory intent and operational reality. We'll share how the CRAB-FOSC and CRAB-FOMA catalogs translate CRA obligations into actionable criteria that manufacturers can evaluate against, how we're aligning with complementary efforts across foundations to avoid duplication, and what the open source ecosystem needs to provide so that due diligence doesn't become an unfunded mandate on maintainers.

Attendees will leave with a practical understanding of: what due diligence means for manufacturers consuming open source under the CRA; how ORBIT Launchpad's open catalogs and tooling reduce that burden; and how standards bodies and open source communities can work together to make compliance achievable.

This presentation gives an overview of the European Commission’s Open Source Observatory’s (OSOR) activities and latest Paper on Progress and Trends. The report examines how open source software has evolved within public administrations, based on the country reports published in 2025. It covers 18 EU member states and includes for the first time five candidate countries from the Western Balkan region, namely Albania, Bosnia and Herzegovina, Kosovo, Serbia and North Macedonia. The session provides insights into the state of open source adoption and regulation in Europe, with a particular focus on findings from the Balkan countries, providing insights into how EU integration shapes digital policy in candidate countries.

Open source is now social infrastructure, rarely recognized until it fails. To shape a forward-looking strategy, we must know where we stand. In 2025, IPA ran two foundational surveys: a software-trends survey of domestic firms, and a GitHub study of 30,298 public-sector repositories across seven countries.

The findings show modest but clear momentum. Corporate OSS policy adoption rose from 32.0% to 36.7% (normalized), and vague "don't know" answers gave way to concrete work on security and talent development—a shift from awareness to practice. Japan's government OSS repositories rank alongside Germany, Singapore, and Estonia, with GIS and geospatial strengths grown from frontline needs—now a uniquely AI-ready foundation.

We propose a "Japan-Type OSS Model" with three axes: cultivating "native species" OSS rooted in real needs; a "seeding strategy" where the public sector publishes building blocks industry scales into services; and "Rules as Code," making institutions machine-readable for trustworthy AI.

This session shares what one country learned from mapping its terrain—and calls for cross-border collaboration on how open source will underpin digital sovereignty worldwide.

SBOM adoption is growing, driven by global regulation such as the EU Cyber Resilience Act(CRA). Today’s software supply chains are complex and global, involving many organizations, tools, and layers of dependencies. In this environment, SBOMs need to accurately share software component information without confusion.

A high‑quality SBOM enables precise, unambiguous information exchange between organizations, minimizing gaps and misinterpretation.

To achieve this, the OpenChain SBOM Working Group released a draft SBOM Document Quality Guide in April 2026 on the foundation of the Telco SBOM Guide. Global public comments have been incorporated into the official version released at this session. It defines what should be contained, how to evaluate, and how to exchange between organizations. 

In this panel, we will discuss:
- why each of us engaged in this work
- the distinct SBOM quality challenges from our own vantage points
- how we actively utilize the guide to address industry-specific quality hurdles
We hope this sparks dialogue with many addressing Cyber Resilience Act and other security regulations 

The EU Cyber Resilience Act (CRA) is fundamentally changing how companies develop, secure, and bring products to market in the European Union. It introduces comprehensive security requirements across the entire software development lifecycle—including how open source components are selected, integrated, and maintained.
Timo and Gergely provide a practitioner-focused view of what CRA means in practice, with a particular emphasis on open source.

In their talk, they examine the CRA from a product vendor perspective, with focus on open source. They will break down the practical implications of the regulation across three key areas: open source consumption, vulnerability management, and open source stewardship. They will also highlight where the regulation leaves room for interpretation and share insights from ongoing industry discussions that are shaping emerging best practices.

The electrical energy sector can largely be defined by the IEC standards that ensure compatibility and conformity. In this way IEC standards serve our industry very well, both in the physical and digital realm. Although the open source projects and IEC share a similar goal of compatibility and innovation, in practice they conflict with one another. This has to do with the way in which IEC standards are created, licensed and distributed.

In this presentation Nico will share his experiences in dealing with IEC licenses from the perspective of an OSPO supporting open source development. This will highlight various issues, big and small, that hinder open source development. The presentation will also gather insights from the standards group in the LF Energy community group. By presenting this constructive assessment Nico hopes to foster discussion and encourage improvement of the situation. Much of the content will carry over to other closed standards.

In the past 9 months, the two largest smart-metering providers serving rural mini-grids entered insolvency or severe distress, putting ~250,000 meters in 30+ countries at risk of losing billing, payment, and remote management, and threatening to leave over a million people, plus clinics and schools, in the dark. The cause was structural and familiar to anyone in open source: vertically integrated proprietary stacks, cloud lock-in, and no "supplier of last resort" for critical infrastructure.

This talk is a field report on the open-source response: an alliance of competitors, NGOs, and operators building an unbundled, multi-vendor platform on Digital Public Good principles. We cover the architecture (open APIs, multi-OEM interoperability, code and key release tied to bridge funding), the governance model for an asset that must outlive any single contributor, and how critical open infrastructure can be funded sustainably.

We close with concrete contribution paths: protocol work, hardware integrations (DLMS/COSEM, MQTT, STS), security review, and governance participation.

Synchronous Transmission (STX) techniques have matured over a decade of research, enabling a new approach to low-power wireless networking. STX protocols exploit floods that, unlike traditional methods, purposefully embrace on-air collisions via tightly synchronized transmissions. Research repeatedly shows order-of-magnitude gains in reliability, and reduced latency and energy use over conventional approaches.

Standardization is now needed to make STX industry-ready. The OpenSTX Foundation aims to define an open standard from radio interface to application layer, targeting IEEE 802.15.4, Bluetooth, and UWB.

OpenSTX excels where routing-based protocols fall short: network-wide flooding completes in milliseconds with bounded latency; end-to-end reliability is above 99.9% in dense, interference-prone settings; and the absence of routing tables and topology maintenance makes networks inherently tolerant to failure and mobility. Radio duty cycling extends battery life, and network-wide time synchronization is a free by-product.

This session overviews STX techniques, showcases OpenSTX primitives across a layered architecture, presents the roadmap, and describes how to get involved.

The Open Quantum Safe (OQS) project was founded with the mission of supporting the transition to Post-Quantum Cryptography. On its way, it became one of the most important open-source post-quantum cryptographic organizations. The subsequent publication and adoption of the first PQ standards by major cryptographic projects helps the cryptographic community in the adoption of this required type of cryptography. The mission of the OQS organization remains being at the forefront of PQC research. This talk provides an update of what these efforts look like in the era of the first PQ standards. It will include lessons learned along the way, challenges encountered when handling a PQ Open Source project and future directions, such as: 

1) Addition of new PQ schemes being considered for standardization or relevant to the PQ cryptographic community (e.g. NIST on-ramp signature schemes)

2) Inclusion of new functionalities like: new hybrids or constant-time analysis.