Free software refers to any program whose source code is accessible, modifiable, and redistributable under the terms of an open license. This principle, rooted in the culture of software development for several decades, is undergoing rapid changes. European regulation, the digital sovereignty strategy of the French public sector, and the increasing pressure from artificial intelligence on governance models: shifts are occurring on multiple fronts simultaneously.
Cyber Resilience Act: what the European regulation changes for open source code
The Cyber Resilience Act (CRA) adopted by the European Union redefines the security obligations applicable to digital products, including those that integrate open source components. The text introduces a distinction between free software distributed in a commercial context and that maintained by volunteer communities without direct commercial activity.
Specifically, a publisher that integrates an open source library into a sold or monetized product becomes responsible for its compliance. The notion of “placing on the market” extends to updates and security patches: a missing patch can now be considered a defective product under the new European directive on product liability.
For non-commercial community projects, the CRA provides a protected status, but the boundary remains unclear. A foundation that receives donations from companies or offers paid support could fall into the commercial scope. The OpenSSF (Open Source Security Foundation) has dedicated several sessions to clarifying these gray areas, particularly regarding when a component is considered “shipped” and the chain of responsibility between maintainers and integrators. Several pieces of information on rockette-libre.org allow tracking these regulatory developments as they are published.
GNU/Linux in the French administration: DINUM’s plan to reduce dependencies
In April 2026, the Interministerial Digital Directorate (DINUM) announced the transition of all its administrators’ workstations to GNU/Linux. This initiative is part of an interministerial plan to reduce non-European dependencies, presented during a seminar initiated by the Prime Minister.
The DINUM, which is set to become ARIANE (Reference Authority for AI and Digital of the State), explicitly links this migration to the construction of a digital commons ecosystem. The reasoning goes beyond simply replacing the operating system: it is about mastering the software components on which public services rely, from the workstation to business applications.
This type of large-scale migration raises concrete questions that institutional announcements do not always detail:
- The compatibility of existing business applications, often developed for a Windows environment, requires a complete application audit and sometimes partial rewriting.
- Training public agents in a new desktop environment represents a human and organizational cost that conditions the success of the project.
- The long-term maintenance of the chosen Linux distributions must be guaranteed, lest a new dependency on a new publisher or a fragile community be recreated.
The political signal remains strong. When a member state engages its own IT services on free software, it legitimizes the approach for all local authorities and public institutions.
Open Source Maintenance Instrument: funding the sustainability of software components
The European Commission’s open source strategy includes a rarely discussed aspect in the mainstream press: the issue of long-term maintenance of free components. The idea of an Open Source Maintenance Instrument aims to directly fund the maintenance of libraries and tools on which thousands of projects, both public and private, depend.
The problem has been documented for years. An encryption library or a network protocol analyzer, maintained by a handful of volunteer developers, can find itself at the heart of critical infrastructures without anyone funding its audit or evolution. The Log4Shell vulnerability dramatically illustrated this risk.
The Commission also plans mechanisms for dependency analysis to map the open source components used in European systems. The goal is twofold: to identify the weak links in the software chain and to direct funding towards the projects that need it most.
Artificial intelligence and open source licenses: a governance model under pressure
The announced acquisition of Hugging Face by Nvidia for nearly thirteen billion dollars illustrates a fundamental trend: major open source AI platforms are attracting massive investments, raising questions about their future independence. Nvidia has claimed it wants to preserve the openness of the platform to various models, clouds, and accelerators, but the history of free software shows that promises of openness often struggle against profitability logic.
The licensing model applied to artificial intelligence components remains a subject of debate. Can a language model whose weights are published under a permissive license, but whose training data remains opaque, truly be considered open source? The Open Source Initiative is working on an adapted definition, distinct from that which applies to traditional software code.
The EU AI Act adds an additional layer of regulation. General-purpose AI models distributed under a free license will have to meet transparency obligations regarding training data and risk assessments. The compliance timelines of the CRA and the AI Act overlap, complicating the task for developers and foundations maintaining these projects.
The European strategy explicitly covers cloud, edge computing, cybersecurity, and development tools, with a stated goal of reducing lock-in. Free software is no longer just a matter of philosophy or cost: it is becoming an industrial policy lever. The coming months will determine whether the funding and governance mechanisms keep pace with the stated ambitions.
