Sovereign by design vs the global commons: nationality, lock-in and export control

root · 24 August 2026 14:34

One of six themes that emerged from the EOLE 2026 online kick-off workshop (25 June). Background: see the kick-off topic.

Why it matters for sovereignty. The push to make everything “French / Italian / German”, or EU-level, sits in tension with open source, which is global by nature. As one participant put it, open source is “sovereign by design” and has been fostering sovereignty for decades; you do not scan a passport to accept a contribution. What can legitimately be national or European is the competence and know-how to use, install and run free software, not the code itself.

What came up at the workshop. “European open source” as a policy buzzword is largely incoherent: no real open source project sources its contributions from a single country, and there is a real risk that sovereignty money ends up with large proprietary actors labelled as national champions. Yet “avoiding vendor lock-in” raises a genuine question: lock-in to whom, proprietary vendors, or simply non-EU providers? A distinct and harder sub-topic is export control and dual-use: defence-adjacent producers may publish open source but cannot run a fully open community, which creates conflicts with licence non-discrimination clauses (GPL) and leads to practices such as excluding contributors or maintainers from certain countries. The kernel community’s exclusion of certain maintainers was cited as a live case, alongside the debate on “know your contributor” (DCO / CLA).

What already exists to build on. inno3’s export control decision tree (schema, CC BY-SA); DCO / CLA mechanisms; licence non-discrimination clauses (OSD / GPL); the debates around open source foundations based in the US or China.

Open questions. Can export-controlled or defence software meaningfully “do open source”, and how far? How to reconcile know-your-contributor needs with licence non-discrimination? Is avoiding non-EU lock-in a coherent sovereignty goal, or a contradiction? How does AI’s “trained in a specific geography” change the picture?

How to contribute. Reply below with cases, clauses and analyses, ideally by end of September 2026. Rapporteurs welcome for the Barcelona event (November 2026): volunteer by replying below or by direct message on this forum. Possible outputs: a decision guide on open source under export control and a note on KYC vs non-discrimination.

root · 21 October 2026 08:49

Hello all,

This thread has had no reply since 24 August. Four items move some of the open questions. The discussion continues on Friday 27 November 2026 at Universitat Pompeu Fabra, Barcelona (registration is free, see EOLE 2026 – EOLE).

Know-your-contributor versus non-discrimination. The Commission’s proposed Cloud and AI Development Act (COM(2026) 502, 3 June) sets four sovereignty assurance levels (Article 16 and Annex II). At level 3, Annex II 3.1(d) requires EU citizenship for the personnel providing the audited service, covered subcontractors included, and 3.1(g) excludes third-country control, with a derogation for associated countries. This concerns service providers and their staff, not upstream maintainers as such, but it brings nationality into procurement: https://data.consilium.europa.eu/doc/document/ST-10104-2026-ADD-1/en/pdf

Nationality as a trust signal. Euro-Office, an ONLYOFFICE fork announced on 27 March 2026 by a coalition including Nextcloud and IONOS, gives the Russian origin of the original as one of its reasons, alongside collaboration and licensing concerns, while stating that contributions are judged on merit regardless of origin: Euro-Office · GitHub

Export control and AI. On Lawfare (29 September 2026), Joe Khawam argues that published open weights cannot be recalled and that many leading open-weight developers sit in China, where US publication controls have little reach: How Export Controls Can—and Cannot—Reduce the Risks of Open-Weight Models | Lawfare

Is avoiding lock-in outside the EU coherent? In a July analysis of the EU Open Source Strategy, Agustín Benito Bethencourt argues that its sovereignty definition centres on control, while open source works through influence: Evaluating the EU Open Source Strategy: Strengths and Weaknesses – toscalix

For a project selling to defence or public-sector customers: would you accept a nationality condition on the people with commit rights, and if not, which control would you put in its place?

Benjamin, for the EOLE committee