Panelists at Open Source Summit Europe Discuss Technological Sovereignty

Sovereignty Through Choice and Skills

During a panel discussion at the Open Source Summit Europe in Prague, experts concluded that European organizations can achieve technological sovereignty by having credible alternatives and the necessary skills to utilize them. This approach differs from outright avoiding global technology providers. The panel explored dependencies across cloud infrastructure, open source, security, and hardware.

EU Cloud Sovereignty Framework and Practical Dependencies

The discussion referenced the EU cloud sovereignty framework, which outlines eight objectives including legal, jurisdictional, data, AI, operational, and supply-chain sovereignty. Panelists focused on identifying which dependencies organizations must be able to change or control. Jonathan Bryce of CNCF and the Linux Foundation stated that choice is the most valuable aspect of open source, citing Kubernetes as an example of a platform offering flexibility across different infrastructures. Paula Grzegorzewska of Linux Foundation Europe added that alternatives are only useful if switching between them is practical, especially for governments dealing with proprietary systems.

Operational Knowledge and Hardware Gaps

Bryce also noted that access to source code alone does not guarantee operational sovereignty; organizations must possess the knowledge to run, secure, and monitor their systems. He identified hardware as a remaining gap, contrasting China's focus on chip and optical system access with the software-centric sovereignty discussions in other regions. Thierry Carrez described proposed cloud and AI assurance levels, with the highest requiring control over the entire technology supply chain, including hardware. He also mentioned confidential computing as a method to limit host access to workloads when full control is not essential.

Security Due Diligence

Christopher "CRob" Robinson of OpenSSF and Akrites connected sovereignty to security due diligence. He explained that open code and project documentation assist buyers in examining vulnerability-response practices and verifying vendor compliance.