Free software and open source are undergoing a rapid phase of reconfiguration. European regulatory pressure, the race for artificial intelligence, and geopolitical tensions over technological supply chains are reshaping the contours of this ecosystem. Far from just a debate about the free availability of code, the issues are shifting towards governance, compliance, and real control over infrastructures.
Digital Sovereignty and Open Source: The Trap of Invisible Layers
Open source is frequently presented as a lever for European digital sovereignty, particularly to reduce dependence on non-European cloud and artificial intelligence providers. This perspective deserves nuance.
A software whose source code is open and auditable does not, by itself, guarantee complete technological independence. Dependence can shift to hardware layers, particularly GPUs and certain infrastructure components controlled by a limited number of manufacturers. An organization that migrates its applications to open source solutions but deploys them on an American hyperscaler cloud with proprietary hardware has merely shifted the lock-in point.
Several recent sector analyses emphasize this contradiction: the opening of code accelerates software innovation, but the hardware components and managed services surrounding them remain largely closed. Field feedback varies on this point, with some organizations believing that control over the code is sufficient to mitigate risk, while others highlight the impossibility of reproducing a complete environment without access to proprietary firmware and drivers.
To keep up with these developments and identify free solutions suitable for different professional contexts, resources like espacelibre.net aggregate news and tools from the sector.
Regulatory Compliance: The AI Act and the Cyber Resilience Act Change the Game
The adoption of open source in Europe is no longer solely motivated by flexibility or reduced licensing costs. Regulatory compliance is becoming a central driver of adoption. Two texts structure this evolution: the AI Act and the Cyber Resilience Act.
The AI Act imposes transparency and traceability requirements on artificial intelligence systems deployed in the European Union. For foundation models, access to source code and training data facilitates the auditing and technical documentation required by the regulation. Open source projects that publish their datasets and training methods are structurally better positioned to meet these obligations.
The Cyber Resilience Act, on the other hand, regulates the security of digital products placed on the European market. It distinguishes commercial software from non-commercial community projects, but the boundary remains blurred for open source publishers offering paid enterprise versions. The available data does not yet allow for conclusions about the concrete impact of this text on small publishers and foundations that maintain widely used software components.
What These Texts Imply for Technical Teams
Documentation, vulnerability tracking, and incident notification obligations apply to any organization integrating open source components into a marketed product. Specifically, this entails:
- An accurate inventory of software dependencies (SBOM, Software Bill of Materials), updated with each version, to trace the origin of each integrated component
- Active monitoring of vulnerabilities published in reference databases, with correction timelines governed by regulation
- Internal governance that defines responsibilities among development teams, community maintainers, and integrators
These requirements are not new for large organizations, but they formalize previously voluntary practices and make them legally enforceable.
Concrete Deployments: Governance Takes Precedence Over Doctrine
Recent conferences and feedback show a clear shift in discourse. The focus is on operational uses rather than philosophical debates between “free” and “open source.” Dominant topics concern the reproducibility of environments, traceability of MLOps pipelines, and management of internal contributions.
In machine learning environments, reproducibility is a direct technical issue. A model trained with a specific version of an open source library can produce different results with a later version. Teams deploying models in production must freeze their dependencies, document the versions used, and be able to reconstruct an identical environment months later.
Governance of Contributions: An Often Overlooked Angle
The question of internal governance of open source contributions remains under-addressed in many organizations. When a company contributes to a community project, it potentially engages its intellectual property. Contribution policies must define what can be published, under which license, and with what validation process.
A disgruntled contributor with high access rights can jeopardize months of collective work. This type of risk pushes projects to review their permission models and separate code write rights from infrastructure administration rights.
Free Software and Open Source AI: Where is the Boundary?
The term “open source” applied to artificial intelligence models is the subject of intense debate. Publishing the weights of a model is not sufficient to make it truly open if the training data, preprocessing code, and reproduction conditions are not also accessible.
European initiatives are attempting to bridge this gap. The European Union is funding projects aimed at creating foundation models capable of handling its official languages, with a more transparent approach than that of large American or Chinese laboratories. However, dependence on GPUs remains a structural barrier: training a large model requires massive access to hardware whose production is concentrated among a few manufacturers.
This tension between software openness and hardware closure will not be resolved by code alone. It calls for investments in European computing infrastructures and a reflection on architectural alternatives to dominant accelerators.
- Open models facilitate regulatory auditing but do not guarantee reproducibility without access to complete training data
- The GPUs necessary for training remain a bottleneck controlled by an industrial oligopoly
- The governance of open models (licenses, usage restrictions, liability) varies significantly from one project to another
The current landscape of free software and open source is now viewed through this triple lens: compliance, governance, and control of the entire chain, from silicon to code. Organizations that approach open source solely as a free alternative to proprietary solutions are missing the ongoing transformation.