LF Member European Forum 2026

Every Linux Foundation member relies on community-maintained open source, but regulations like the EU CRA now mandate upstream contributions. This "enforced collaboration" has led some companies to shove pull requests and demand immediate response from the community, often lacking awareness of the diverse open source governance and contributing norms.

Co-presented by open source leaders from Red Hat and Ericsson, this session outlines how member organizations can responsibly contribute back to open source while preserving upstream health. It highlights two OpenSSF initiatives. First, a Concise Guide for Upstream Collaboration, developed by the Best Practices WG and aiming to help OSPOs guide employees through security upstream contributions. Second, the deliverables of the Global Cyber Policy WG, including CRA Maintainer Guidance, demonstrating how community developers can establish clear consumption expectations, shielding them from unreasonable compliance pressure.

Attendees will leave with a clear sense for how to shift their open-source strategies from a corporate risk function to a collaborative model that secures their products and helps the broader open-source ecosystem.

Did you know that 62% of European survey respondents use Zephyr in commercial products, such as sensors and monitoring equipment? Europe also has strong evaluation pipelines for those considering Zephyr. These are just two Europe-specific insights on a growing, real-time operating system for connected and resource-constrained devices, spanning IoT, industrial systems, automotive platforms, and edge computing.

This session celebrates Zephyr’s first decade and explores what has driven its success—from technical architecture and open governance to a vibrant global contributor community. Drawing on insights from a new Linux Foundation Research study, the discussion will highlight key milestones, ecosystem growth, and the forces shaping Zephyr’s future.

In this session, we’ll explore:

-The Zephyr features that are most valued
-Growth of the global Zephyr developer ecosystem
-Real-world Zephyr practitioner use cases & insights

Key questions:
-How is Zephyr being used across embedded products?
-What are the defining features of Zephyr that have contributed to its adoption?
-What are the attributes of the Zephyr community that contribute to the project's growth and health?

European organizations face a strategic challenge between proprietary vendor lock-in and isolated, redundant infrastructure builds. True digital sovereignty isn't achieved through isolation, which forces public and private entities to waste up to 90% of their engineering resources on baseline data preparation. European sovereignty requires open data, shared reference standards, and neutral governance.

Using the Overture Maps Foundation as a primary case study, this session demonstrates how open spatial data and universal entity identifiers function as public utility infrastructure for Europe. We examine how open infrastructure eliminates the data harmonization tax for municipalities and enterprises, enables trustworthy AI grounding, and balances European digital autonomy with global open source collaboration. Attendees will gain actionable frameworks for leveraging federated, open data layers to preserve operational independence while accelerating innovation across the European technology commons.

Open source was never just about code, it was about care, context, and trust. But AI-generated contributions are flooding projects with plausible-looking noise: slop PRs, hallucinated bug reports, vibe-coded patches no one understands. We are having multiple testimonials of examples where maintainers are overwhelmed. This talk argues we must redefine "contribution" beyond lines of code. In the age of AI slop, the real signal is human judgment, review rigor, and community stewardship. We don't need more code, we need more care.

Europe's goal on digital sovereignty is reshaping how governments, industry, and open source communities think about software, security, and trust. Regulations such as the Cyber Resilience Act and Sovereign Tech Funds are creating legitimate expectations around resilience, accountability, and secure software supply chains. At the same time, open source has been built through global collaboration, shared codebases, and contributions that transcend national borders.
Can Europe strengthen its digital sovereignty without fragmenting the global open source ecosystem?
This panel brings together leaders from European telecom, cloud infrastructure, enterprise SW, and open source foundations to discuss how we can separate code commons from deployment sovereignty. Together they will explore the evolving roles of industry, governments, foundations, and communities in supporting secure software supply chains, sustainable project maintenance, and regulatory compliance while preserving the openness that has made open source successful worldwide.

Sylva from LF Europe aims to strengthen digital sovereignty by reducing vendor lock-in, improving transparency, enabling interoperability, and helping build a European ecosystem for cloud and edge infrastructure.
In this perspective Sylva can contribute to digital Sovereignty and and fully aligned with EU Digital Package. This package includes measures on platform regulation, data sharing, AI, cybersecurity, digital identity, and digital infrastructure : IPCEI, NIS2, AI Act, CRA.
We will showcase how TIM and Orange are leveraging on Sylva to develop their telco CLoud or Sovereign Cloud program supported by the IPCEI funding

Open Source Software (OSS) has been very successful in bringing together contributors, crossing organizational, cultural, regional borders. Clouds combine a lot of technology into cohesive platforms and are thus harder. Big Tech uses a lot of OSS, but ultimately combines it into highly proprietary platforms built to lock-in customers into vendor-specific APIs and service sets. To compete successfully without the vast amount of financial resources, strong collaboration practices and a powerful vision is needed to motivate the broad cross-project work.

Sovereign Cloud Stack (SCS) is a European initiative that creates an open, transparent, and vendor-neutral cloud ecosystem that guarantees sovereignty. SCS is based on certifiable standards, a modular software stack, and practical knowledge transfer. The project is steered by a community project board with standardization and certification overseen by the Forum SCS-Standards.

Standing on the shoulders of giants, it builds on top of many successful open-source components, such as OpenStack and Kubernetes. The certifiable standards assure that workloads can be switched easily between cloud environments that are SCS-compatible.

The Cyber Resilience Act settled the legal side of the open source relationship: product responsibility stays with the manufacturer, stewards carry a light-touch regime, maintainers shielded from manufacturer-grade duties. The operational side is far less settled. Manufacturers must consume and interpret upstream security signals, but what that takes is rarely described from the manufacturer's seat.

This session walks that seat in concrete terms. From 11 September 2026, a manufacturer has 24 hours from awareness of active exploitation to file an early warning. Awareness at that speed is only dependable when machine-readable upstream signals (SBOMs, VEX, provenance, project health) are continuously correlated against what was actually shipped, per product, per configuration, with the record written as it happens, not assembled afterwards.

It also covers the return path: contributions rather than contracts, funding rather than warranties, and a defence of the transparency-versus-assurance boundary that keeps the voluntary model sustainable.

Presented three and a half weeks after the reporting duty goes live, it closes with first field observations from September.

Digital sovereignty has become a strategic concern for businesses of all sizes. Dependence on a small number of technology providers can create operational, economic, and cybersecurity risks.

This talk examines digital sovereignty from a business perspective and argues that FLOSS is not merely
a technical or ideological choice, but a practical tool for
resilience, competition, and strategic autonomy. We will explore how FLOSS helps organizations preserve freedom of action, reduce lock-in risks, improve transparency, and maintain control over their digital infrastructure.

Finally, we will examine a frequently overlooked aspect of digital
sovereignty: payments. While open-source solutions now exist across much of the technology stack, businesses often encounter proprietary dependencies at the very point where commercial activity occurs.

The workshop part is designed to demonstrate how concepts such as openness, interoperability, privacy, and freedom from platform lock-in can be applied to payment systems, and to spark discussion about what true digital sovereignty means for businesses.