CNLL communiqué on the adopted EU Tech Sovereignty Package (3 June 2026)
On 3 June 2026, the European Commission adopted the Tech Sovereignty Package — Communication, Cloud and AI Development Act (CADA) proposal, and EU Open Source Strategy. The CNLL confirms the essence of the historic shift it had welcomed in late May: open source is elevated to the rank of an instrument of European industrial policy. But the CNLL publicly regrets two significant setbacks introduced between the leaked draft and the adopted text:
- "Open source first" (CADA Article 41) — the title is ambitious, the body is weak. The verb is "encourage", word for word the verb used by France's Digital Republic Law since 2016, with broad derogations ("security, total cost, and any other duly justified objective criterion") and no documented or auditable assessment requirement. The phrase "open source first" appears only in the article's title, not in its body.
- "Public money, public code" (CADA Article 42) — reduced to a conditional cataloguing obligation: the article imposes nothing on the decision to release software, only on the mechanism when an entity discretionarily chooses to do so. The structural publication obligation that the European open source industry has defended for ten years is not in the CADA.
Two further lexical softenings in the Communication: "key lever" became "crucially contributes"; "sovereignty-washing" was removed. The draft promised to go beyond the limit France has known since 2016 — the adopted text reproduces it at European scale.
Confirmed acquis: the OSI definition is now anchored (incl. EUPL); APELL (the European Open Source Business Association) is named in the document; Open Source Maintenance Instrument with fork capability and security-mirroring programme are retained; envelope doubled from 1 to 2 B€ / 7 years (public + private); EuroStack cited in CADA IA study footnote.
The CADA is still a proposal. The CNLL calls for industry and MEP mobilisation over the next twelve months on four priorities: (1) transform Article 41 into an enforceable obligation in the trilogue, with documented/auditable assessment of derogations, in convergence with European OSS editors signatories of the 3 June open letter; (2) mobilise the existing national legal acquis (Article 16 Digital Republic, Article L. 123-4-1 Code de l'éducation, Italian Article 68, German IT-Planungsrat, Dutch frameworks), which becomes proportionally more important; (3) defend the licence-based legal definition of OSS; (4) neutralise the practice of sovereignty washing — push enforceable jurisdictional immunity criteria (no CLOUD Act / FISA exposure) at the highest CADA sovereignty levels.
I have made some experiments with P2W, my experimental Python (subset) to WASM compiler. Initial figures are encouraging (5x speedup, on specific programs).
It is a disgrace how Google has managed this situation.
To recap the storyline, as far as I understand it: last August, Google announced plans to heavily restrict sideloading. Following community pushback, they promised an "advanced flow" for power users. The media widely reported this as a walk-back, leading users to assume the open ecosystem was safe.
But this promised feature hasn't appeared in any Android 16 or 17 betas. Google is quietly proceeding with the original lockdown.
The impact is a direct threat to independent AOSP distributions like Murena's e/OS/ (which I'm personally using). If installing a basic APK eventually requires a Google-verified developer ID, maintaining a truly de-Googled mobile OS becomes nearly impossible.
70 propositions from the European Alliance for Industrial Data, Edge and Cloud, written in part by yours truly (in early 2025, i.e. before the "Trump effect" was in full force) and published by the Commission in July 2025:
Here is the complete list of proposals from the roadmap, translated into English and organised by pillar.
### Pillar 1: Technological Development
- Define technical specifications as open standards for European Open Source cloud, edge and IoT environments.
- Fund interoperability pilot projects that prioritise the use of European Open Source technologies.
- Require all EU-funded digital infrastructure projects to adhere to these interoperability standards.
- Promote and enforce the implementation of open standards throughout the EU.
- Create a ‘European Open Source Sovereignty Fund’ (EOSSF) dedicated to essential projects. [NB: this would now be called the EU-STF].
- Offer targeted grants for the security, maintenance and strengthening of the sovereignty of Open Source projects.
- Foster in-depth collaboration with European academic institutions and Open Source Programme Offices (OSPOs).
- Develop a practical guide for public procurement managers to evaluate European Open Source solutions.
- Create sector-specific reference architectures based on European Open Source technologies.
- Launch large-scale demonstration projects to illustrate the practical benefits of European Open Source solutions.
- Produce and distribute comprehensive ‘playbooks’ for the deployment of European Open Source solutions.
- Implement policies to actively encourage the adoption of these reference implementations in public procurement.
### Pillar 2: Skills Development
- Organise industry-focused training workshops with a European emphasis on Open Source tools and platforms.
- Offer targeted training grants to SMEs and public sector organisations for European Open Source skills development.
- Launch certification programmes for mastery of European Open Source technologies and standards.
- Establish EU-funded retraining programmes to help professionals transition into European Open Source roles.
- Collaborate with industry partners to create hands-on learning and placement opportunities in Open Source.
- Offer financial incentives to companies that participate in retraining programmes and use European Open Source.
- Develop a European Open Source resource platform that brings together training materials, best practices, and case studies.
- Integrate European Open Source principles into STEM (Science, Technology, Engineering, and Mathematics) curricula from secondary school to university.
- Support the creation of European Open Source ‘centres of excellence’ in universities.
- Develop EU-wide coding competitions and hackathons focused on European Open Source solutions.
- Introduce training on European Open Source business models into vocational training.
- Create vocational training modules for European Open Source project management.
- Establish certification for mastery of European Open Source business skills.
### Pillar 3: Public Procurement Practices
- Launch a consultation with public sector bodies and Open Source providers to identify challenges related to public procurement.
- Make ‘Public Money, Public Code, Open Source First, European Preference’ policies mandatory in public procurement.
- Develop comprehensive guidelines for public procurement to evaluate and select European Open Source solutions.
- Fund demonstration projects showing the success of replacing proprietary systems with European Open Source.
- Establish clear criteria for defining what constitutes a ‘European’ Open Source solution.
- Provide a practical guide for public procurement managers to evaluate Open Source solutions.
- Collaborate with industry and standardisation bodies to develop accessible evaluation criteria for Open Source.
- Create a public directory of recommended European Open Source solutions.
- Encourage public sector organisations to adopt solutions developed under the Next Generation Internet (NGI) initiative.
- Launch cross-border pre-commercial procurement (PCP) projects focused on European Open Source.
- Create knowledge-sharing platforms for feedback on PCP initiatives and Open Source best practices.
- Actively involve European Open Source providers in the co-design of solutions in the PCP process.
- Publish guidelines to help public sector organisations manage and support European Open Source.
- Promote the active participation of public sector representatives in European Open Source communities.
- Support training programmes for public sector staff on project management and Open Source compliance.
- Engage stakeholders to collaboratively refine and simplify procurement practices for Open Source.
### Pillar 4: Growth and Investment
- Create a European Open Source Investment Platform (EOSIP) to centralise information on funding.
- Organise information workshops for European SMEs and start-ups on how to obtain investment.
- Establish partnerships with private investors to form a network of venture capital funds focused on European Open Source.
- Expand the Next Generation Internet (NGI) initiative with a focus on Open Source cloud, edge and IoT.
- Regularly assess the impact of funding programmes on community growth and market adoption.
- Allocate dedicated funding to high-impact European Open Source projects that meet strategic needs.
- Develop co-investment models that combine public funds with European private sector investments.
- Launch accelerators and incubators specifically designed for European Open Source technologies.
- Develop an EU-wide branding strategy to highlight the quality and sovereignty of European Open Source.
- Showcase European Open Source successes on international platforms through marketing campaigns.
- Form strategic partnerships with European industry organisations to increase project visibility.
- Establish public-private R&D consortia on European Open Source for high-priority projects.
- Offer incentives for private sector contributions to critical European Open Source initiatives.
- Develop platforms for knowledge exchange and cross-sector collaboration within the European ecosystem.
### Pillar 5: Governance
- Conduct vulnerability assessments for critical European Open Source projects.
- Collaborate with European cybersecurity agencies to develop threat models for Open Source environments.
- Publish findings and best practices from security assessments to the European ecosystem.
- Offer tailored compliance advice to help European Open Source projects navigate EU regulations.
- Facilitate accessibility to Cyber Resilience Act (CRA) certification for European Open Source projects.
- Provide resources and support for the documentation and auditing of European projects.
- Ensure stable, long-term funding for core European Open Source infrastructure.
- Establish mentoring programmes focused on developing European talent for critical projects.
- Create a European Open Source Advisory Board to oversee project funding and direction.
- Require EU-supported European projects to adhere to transparent governance and accountability practices.
- Support European community involvement in Open Source project governance.
- Facilitate community input into European Open Source policy development.
- Publish guidelines on best practices for managing the lifecycle of European Open Source projects.
- Provide resources for responsible maintenance and end-of-life support for European projects.
- Encourage comprehensive documentation and knowledge sharing within the European ecosystem.
Initiated by the city of Munich, LiMux aimed to migrate public administration systems from Windows to a Linux-based OS to increase control over IT infrastructure and reduce costs. Despite initial success (announced at LinuxTag in 2014, I was there for the announcement), the project faced intense political lobbying by Microsoft leading to a reversion to Windows.
(I studied schemes 10 years before, but I quit maths in 2000 so this book wouldn't have helped me. It seems like a good introduction, looking at the TOC. Grounded on actual geometry, not just category theory like other textbooks).
The "Acme Klein Bottle Wine Bottle" is incredible. It strongly reminds me of Jacques Carelman's "Catalogue d'objets introuvables" (1969) [translated as "Catalog of fantastic things", 1971 by Ballantine Books in New York].
As wikipedia states:
> Carelman is best known for his Catalog of fantastic things (Catalogue d'objets introuvables) also known as Catalogue of Unfindable Objects, made in 1969 as a parody of the catalog of the French mail order company Manufrance. This work has been translated into 19 languages (including Korean, Hebrew and Finnish). Among these imaginary objects are, for instance, a "Kangaroo gun" whose "barrel is extensively studied ... to give the bullet a sinusoidal trajectory which follows the animal in its leaps", or a disposable "Plaster anvil ... (sold by the dozen) to be discarded after use, allowing you to make substantial savings." The most famous item in this catalog was Carelman's "Coffeepot for Masochists", a coffeepot with a backwards facing spout that would scald the user. This design became a symbol for the critique of everyday things and was featured on the cover of Don Norman's book on the topic, The Design of Everyday Things.
(I didn't make the connection with Don Norman's book, another, more serious, classic).
The "EU" is not a political institution. It is a "a supranational political and economic union of 27 member states that are located primarily in Europe.".
The (main) political institutions of the EU are:
- the European Parliament,
- the European Council (of heads of state or government),
- the Council of the European Union (of member state ministers, a council for each area of responsibility),
Here's a TL;DR in English:
CNLL communiqué on the adopted EU Tech Sovereignty Package (3 June 2026)
On 3 June 2026, the European Commission adopted the Tech Sovereignty Package — Communication, Cloud and AI Development Act (CADA) proposal, and EU Open Source Strategy. The CNLL confirms the essence of the historic shift it had welcomed in late May: open source is elevated to the rank of an instrument of European industrial policy. But the CNLL publicly regrets two significant setbacks introduced between the leaked draft and the adopted text:
- "Open source first" (CADA Article 41) — the title is ambitious, the body is weak. The verb is "encourage", word for word the verb used by France's Digital Republic Law since 2016, with broad derogations ("security, total cost, and any other duly justified objective criterion") and no documented or auditable assessment requirement. The phrase "open source first" appears only in the article's title, not in its body.
- "Public money, public code" (CADA Article 42) — reduced to a conditional cataloguing obligation: the article imposes nothing on the decision to release software, only on the mechanism when an entity discretionarily chooses to do so. The structural publication obligation that the European open source industry has defended for ten years is not in the CADA.
Two further lexical softenings in the Communication: "key lever" became "crucially contributes"; "sovereignty-washing" was removed. The draft promised to go beyond the limit France has known since 2016 — the adopted text reproduces it at European scale.
Confirmed acquis: the OSI definition is now anchored (incl. EUPL); APELL (the European Open Source Business Association) is named in the document; Open Source Maintenance Instrument with fork capability and security-mirroring programme are retained; envelope doubled from 1 to 2 B€ / 7 years (public + private); EuroStack cited in CADA IA study footnote.
The CADA is still a proposal. The CNLL calls for industry and MEP mobilisation over the next twelve months on four priorities: (1) transform Article 41 into an enforceable obligation in the trilogue, with documented/auditable assessment of derogations, in convergence with European OSS editors signatories of the 3 June open letter; (2) mobilise the existing national legal acquis (Article 16 Digital Republic, Article L. 123-4-1 Code de l'éducation, Italian Article 68, German IT-Planungsrat, Dutch frameworks), which becomes proportionally more important; (3) defend the licence-based legal definition of OSS; (4) neutralise the practice of sovereignty washing — push enforceable jurisdictional immunity criteria (no CLOUD Act / FISA exposure) at the highest CADA sovereignty levels.