Free software is no longer in an adoption phase. It is entering a phase of regulation. The European texts adopted in the last two years redefine the obligations of publishers, integrators, and administrations that deploy open code. Understanding these regulatory movements has become as strategic as following commits on a Git repository.
Cyber Resilience Act and Free Software: What the New Security Framework Changes
The European Cyber Resilience Act (CRA) now imposes concrete obligations on software publishers bringing products to market: vulnerability management, provision of a SBOM, and security updates throughout the product lifecycle. For open source projects distributed in a commercial context, these requirements apply regardless of the business model.
Related reading : The latest trends and highlights in sports not to miss in 2024
However, the regime provides for a lighter treatment for non-commercial open source. A volunteer maintainer who publishes code on a public forge is not subject to the same constraints as a publisher who integrates this code into a paid offering. The boundary between these two statuses remains blurred in several use cases, particularly for foundations that provide precompiled binaries.
We observe that this distinction is pushing some projects to formalize their governance. Producing a usable SBOM requires tracing every dependency, including transitive ones. For medium-sized community projects, this is a significant tooling effort that goes beyond existing documentation. The resources available at https://www.espacelibre.net/ allow for tracking the evolution of these issues around free software and its communities.
See also : The latest trends and essential information in the business world to discover
ANSSI and Open Source Industrial Policy in France
ANSSI changed its stance on open source in February 2026. The agency no longer merely recommends good security practices for free components: it now presents free software as a lever for industrial policy. Issues of licensing, project transfers between entities, and the internal use of open source solutions by the agency itself are part of this new approach.
This change in discourse is not cosmetic. By positioning free software as a tool for technical sovereignty, ANSSI sends a signal to public order givers. Administrations that hesitated to include free software in their contracts now have more explicit institutional support.
Export Control and Open Source Licenses
A topic still little addressed in community circles concerns export control applied to open source software. Dual-use regimes can theoretically apply to code published under free licenses, as long as it includes cryptographic functions or surveillance capabilities. The question arises with new urgency for European projects collaborating with contributors located in jurisdictions under sanctions.
European Interoperability: 100-Day Sprints
The European Union has launched an accelerated collaboration format in the form of 100-day sprints dedicated to the interoperability of open source components. The first target scope is the French Digital Suite and its German and Dutch equivalents. The goal is to converge sovereign tools developed independently towards common protocols.
This format contrasts with the usual European standardization cycles, which span several years. Concentrating technical work on a narrow scope with short-term deliverables forces teams to prioritize real friction points (file formats, federated authentication, identity management) rather than producing theoretical specifications.
We recommend closely following this work. If the sprints produce concrete results, they could become a replicable model for other areas, particularly health or education, where free suites coexist without interoperability.
Akrites Initiative: Coordinating Open Source Vulnerabilities in the Age of AI
The Linux Foundation and its partners have launched Akrites, an open source cybersecurity initiative aimed at better coordinating the disclosure and remediation of vulnerabilities in free projects. The context is clear: AI accelerates the discovery of flaws, and manual triage processes can no longer keep up.
Akrites does not replace CVEs or existing reporting channels. The project structures a layer of coordination between maintainers, security researchers, and industrial users. Three main axes emerge:
- A coordinated disclosure protocol tailored for community projects that do not have a dedicated security team
- Automated triage tools to prioritize vulnerabilities based on their actual exploitability, not just their CVSS score
- A downstream notification mechanism for distributions and integrators that include open source dependencies
The link with the CRA is direct. Publishers subject to the European regulation will need to demonstrate that they actively manage vulnerabilities in their dependencies. Akrites provides a shared infrastructure to meet this obligation, which reduces the individual burden on each project.
Open Source AI: The Tension Between Openness and Control
The role of open source in artificial intelligence has taken on a new dimension. A large portion of language models and training frameworks rely on open code. However, the very notion of open source applied to AI is debated: publishing the weights of a model without the training data or preprocessing code does not meet the classical criteria of software freedom.
This ambiguity has concrete consequences. The so-called “open” models published by major industrial players often use restrictive licenses that prohibit certain commercial uses or impose redistribution conditions incompatible with traditional free licenses. The term open source applied to AI encompasses very different legal realities depending on the projects.
The entry into force of the European regulation on AI adds a layer of complexity. Transparency and documentation obligations vary according to the risk level of the system. A model published under a free license but integrated into a high-risk system inherits the regulatory constraints of the final system, not those of its license.
Free software changes nature when it shifts from a developer tool to a regulated component. Communities that anticipate this shift by structuring their governance, tooling their compliance chain, and participating in standardization efforts position themselves to remain relevant in an ecosystem where code alone is no longer sufficient.