Abilian Econ Lab
Keynote · 5 October 2026

The Right to LeaveDigital sovereignty, Europe and open source

Stefane Fermigier  ·  Abilian Econ Labecon.lab.abilian.com
Show of hands

Everyone, raise your hand.

Lower it if…

  1. your email or shared documents are on Microsoft 365 or Google Workspace
  2. your meetings run on Teams, Zoom or Google Meet
  3. you reach your members or supporters mainly through Facebook, Instagram, LinkedIn or WhatsApp
  4. your organisation’s computers run Windows or macOS
Where I speak from

I am not neutral: here are my hats

My company
Open Source software vendor and R&D lab
Co-president
The French association of Open Source companies
Co-founder, board member
EuroStack Foundation e.V., the industry initiative for a European digital stack
Co-founder, management board
The European federation of national Open Source business associations
Researcher
The economics of digital sovereignty: the evidence in this talk
Open Source developer
Libera Suite, Hop3 (a self-hosted cloud platform), several Python compilers, digital workplaces
Digital sovereignty and open source
Where we are going

Five steps

  1. What the word means, and where it comes from
  2. What dependence costs
  3. What open source changes
  4. What Europe is deciding this year
  5. What you can do
Digital sovereignty and open source
Frontispiece of Hobbes's Leviathan: a crowned giant whose body is made of people
Part 1

What the word means, and where it comes from

Abraham Bosse, frontispiece of Hobbes’s Leviathan (1651) · British Library · CC0 · Wikimedia Commons
1 · What we mean

“Digital sovereignty”: one word, three uses

Each lowered hand was a dependence. When people speak of managing them, they mean one of three things:

A caricature
  • Autarky: making everything at home
  • Protectionism: keeping foreign suppliers out
Means
  • Location: data kept in Europe
  • Labels: a “trusted cloud” certificate
  • Nationality: buying from European suppliers
The end

Keeping control of your own choices, at every link of the chain

Digital sovereignty and open source
1 · What we mean

Not a new idea: ten years of reports in France and Germany

FRANCE GERMANY UNION 201320162017 201820192020 20212026 Senate report:“a digital colony?” Commissariat report:“political will must prevail” Senate inquiry:“the duty of sovereignty” Law, article 16:control, durability, independence Cyberdefence review:a first definition National Assembly:fact-finding mission Market analysis for the Interior Ministry:dependence on single vendors IT-Planungsrat: a definition for“individuals and institutions” Commission Open Sourcestrategy: “digital autonomy” From reportsto legal texts
Senate (2013, 2019) · Law 2016-1321, art. 16 and 29 · CGE (2017) · SGDSN (2018) · National Assembly (2021) · PwC Strategy& for the BMI (2019) · IT-Planungsrat (2020) · European Commission (2020)Digital sovereignty and open source
1 · What we mean

2016: French law already said it

“Administrations […] shall ensure that they preserve the control, durability and independence of their information systems. They encourage the use of free software and open formats […]”

« Les administrations […] veillent à préserver la maîtrise, la pérennité et l’indépendance de leurs systèmes d’information. Elles encouragent l’utilisation des logiciels libres et des formats ouverts […] »

The first sentence is an obligation, but who enforces it? The second is an encouragement. 7 October 2026: ten years.

Law 2016-1321 of 7 October 2016 for a Digital Republic, art. 16 · translation oursDigital sovereignty and open source
1 · What we mean

Three official definitions, one idea

Revue stratégique de cyberdéfense, 2018
France · 2018

France’s capacity “to act sovereignly in the digital space, keeping an autonomous capacity of assessment, decision and action”; not doing everything nationally, but keeping “autonomy and freedom of choice”.

IT-Planungsrat, Eckpunkte, 2020
Germany · 2020

“The abilities and possibilities of individuals and institutions to exercise their roles in the digital world independently, self-determined and securely.”

Franco-German joint paper, 2026
France and Germany · 2026

“The capability and capacity to develop, provide, use, adapt and control digital technologies […] in an independent, self-determined and secure manner”, with systems that enable “a change of provider … within reasonable time and financial expenditure.”

In plain words: you are sovereign over a tool to the extent that you decide how it evolves, and can leave it at a reasonable cost.
SGDSN, Revue stratégique de cyberdéfense (12 Feb. 2018), p. 93 · IT-Planungsrat, Eckpunkte (2020) · France–Germany joint paper (17 June 2026) · translations oursDigital sovereignty and open source
1 · What we mean

It comes in degrees; the right degree depends on the use

Dependent In control A newsletteracceptable here A trade union’s membership listneeds to be here France and Germany, 2026: requirements graded by how critical the use is.
France–Germany joint paper (17 June 2026)Digital sovereignty and open source
Show of hands

Raise your hand if you think digital sovereignty is exclusively a matter for States.

1 · What we mean

Every scale has a position, and levers of its own

The European Unionthe rules its Member States pool: single market, competition, trade
A Member Stateits own laws, procurement, funding, security; its vote on EU texts
A region or a cityprocurement, its own IT
A companycontracts, architecture
An associationtool choices, pooled funding
A personformats, accounts, votes

The levels are linked: one actor’s choice sets the next one’s constraints. Europe’s position is the sum of all these decisions.

Digital sovereignty and open source
1 · What we mean

An objection: “sovereignty belongs to the State”

“Sovereignty is an exclusive attribute of States.”
Cigref, 2023
“It cannot be attributed to a technical object, a supplier or a private company.”
Cigref, doctrinal note
  1. The substance is shared. Cigref’s own criteria include “control of users’ dependence on their suppliers”.
  2. The texts cover private actors. France and Germany, 2026: sovereignty strengthens “the EU, a state, an administration, or a private organisation”.
  3. The bill falls on each buyer. Next part.

Prefer “maîtrise”, “independence” or “strategic autonomy” for an organisation? Different names, but the levers are the same.

H. d’Agrain (Cigref), Enjeux numériques n° 23, Sept. 2023 · Cigref doctrinal note, quoted by CNLL, June 2026 · translations oursDigital sovereignty and open source
1 · What we mean

A chain breaks at its weakest link

A HYPOTHETICAL EXAMPLE HardwareHosting Operatingsystem Identityand login ApplicationData if it has no alternative and is controlled from outside …the whole service can be stopped

One condition was enough to lower a hand. An average of scores hides the weak link.

Digital sovereignty and open source
1 · What we mean

For each link: who controls it, and is there an alternative?

What people use
WebsiteCRMEmailOffice suite and filesVideo calls
Plugged-in services
Email deliveryPayments and donationsMapsBackupsSocial networksAI assistants
Foundations
Identity and loginOperating systemsHostingAI (inference)
An Open Source application can depend on a closed service three links away.
Digital sovereignty and open source
A motorway toll plaza near Paris
Part 2

What dependence costs

Photo: Quistnix · CC BY 3.0 · Wikimedia Commons
2 · What dependence costs

Four ways a dependence costs you; three of them every year

Every year
Price

What you pay rises with what leaving would cost you

Every year
Exit

What leaving would cost you

Every year
Control

Someone else decides what the product becomes

If and when
Law

Who else can read it, or switch it off

Digital sovereignty and open source
Show of hands

Raise your hand if your organisation uses software that a large vendor gives free, or at a discount, to nonprofits.

1 July 2025
Microsoft ends its free Business Premium and E1 licences for nonprofits (up to ten)
Instead: discounts of up to 75%, and up to 300 free licences of the basic tier
The giver sets the terms of a gift. The cost of leaving builds up during the free years; the price is set after them.
Microsoft partner notices, May–July 2025 (e.g. TechImpact)Digital sovereignty and open source
2 · What dependence costs

Price: your supplier’s margin is bounded by your cost of leaving

83%
of the €400bn European organisations spend a year on cloud and software goes to US vendors
+8.7%
a year: spending on these services, reported by 54 IT directors
How much is price and how much new use is not established
What a supplier can charge before you walk away Competitive cost Premium you concede capped by your cost of leaving Lower the cost of leaving, and the premium falls
Asterès for Cigref (2025; 2026)Digital sovereignty and open source
2 · What dependence costs

A larger case: VMware after its purchase by Broadcom

+35%
paid by the French State at its three-yearly renewal
National Assembly inquiry report, 2026
up to ×10
licence increases reported by European cloud providers
Complaint documents: interested parties
National Assembly inquiry report (2026) · CISPE members’ complaints (2025)Digital sovereignty and open source
2 · What dependence costs

Exit: what leaving actually costs

  • Moving the data out: the smallest part
  • Re-integrating with everything else: the largest
  • Retraining people
  • Downtime
  • Contract timing: notice periods, commitment discounts
And bundles
A feature included “for free” has no budget line, so it never comes up for comparison at renewal. AI added to existing contracts is the current wave.
Abilian Econ Lab, position on technology stacks (2026)Digital sovereignty and open source
2 · What dependence costs

Control: the supplier decides the roadmap, and open source leaves a way out

Licence closedFork that continued the open version
Elastic · 2021→OpenSearch
HashiCorp Terraform · 2023→OpenTofu
Redis · 2024→Valkey
A fork: taking the last open version and continuing it under a new name. Possible only because the code was open source.
2026: Euro-Office, a fork of ONLYOFFICE led by Nextcloud and IONOSDigital sovereignty and open source
2 · What dependence costs

Law: who else can read it, or switch it off?

  • Extraterritorial law: US CLOUD Act, FISA section 702
  • Sanctions: the International Criminal Court’s email, 2025 (Microsoft’s account differs)
For associations and unions
A membership list can reveal union membership, political opinions, religion or health.

A new transatlantic data deal would settle this channel on paper, and leave the other three untouched.

GDPR, art. 9: special categories of personal dataDigital sovereignty and open source
2 · What dependence costs

Pay every year, or pay once in a crisis

Every year
Price, exit, control
In a crisis
Law, supply cuts

Open interfaces and code anyone may fork pay off in both: lower rents in normal times, a smaller loss in a crisis.

Digital sovereignty and open source
A fork in a forest track
Part 3

What open source changes

Photo: Ann Cook · CC BY-SA 2.0 · Wikimedia Commons (geograph.org.uk)
Show of hands

Raise your hand if you have changed integrator or hosting provider while keeping the same software.

That is the right to leave, already used.

The licence
Use, study, modify, redistribute
→
Two rights
The right to leave, the right to fork
→
The result
One software, many providers
3 · Open source

The official texts already make open source a strategy

Revue stratégique de cyberdéfense, 2018
France · 2018

“An industrial strategy based on open source, provided it is part of a well-thought-out commercial approach, can enable French or European manufacturers to gain market share where they are absent today, and thereby France and the European Union to regain sovereignty.”

Franco-German joint paper, 2026
France and Germany · 2026

Systems should “enable a change of provider and technology within reasonable time and financial expenditure. Open source solutions can and should play an important role in this regard.”

SGDSN, Revue stratégique de cyberdéfense (12 Feb. 2018), p. 93 · France–Germany joint paper (17 June 2026), dimension 3.5 · translation of the 2018 text oursDigital sovereignty and open source
3 · Open source

What open source does not give automatically

Maintainers

Someone has to fix the bugs and the security holes

Skills

In your organisation, or at a provider you trust

The rest of the chain

Open code can still run on a closed chain

Governance

A project one company controls can change its licence

Digital sovereignty and open source
3 · Open source

Open Source code is a public good; support and hosting are sold

Building blocks

Libraries, protocols, frameworks. Anyone can use them, so each user is tempted to let others pay: pooled funding, foundations and public programmes fit.

Products

A CRM, an office suite. The code is shared; support, hosting and accountability are sold, usually by a company.

Company-led open source is fine as long as you can leave: an open licence with no added restrictions, open standards, development in the open.
“Public good” in the economic sense: no one can be excluded, and one user’s use takes nothing from another’sDigital sovereignty and open source
3 · Open source

Everyone benefits from maintained code; someone has to pay for it

Memberships

Of the project or its association

Service companies

Those who sell services on the code

Users pooling money

For a feature they all need: a buyers’ club

Public programmes

Germany’s Sovereign Tech Agency, for example

Digital sovereignty and open source
The hemicycle of the European Parliament in Strasbourg, in session
Part 4

What Europe is deciding this year

Photo: Diliff · CC BY-SA 3.0 · Wikimedia Commons
4 · Europe in 2026

2026: after ten years of reports, legal texts

Communication on European Tech Sovereignty and EU Open Source Strategy
3 JuneTech Sovereignty Communication and EU Open Source Strategy
Proposed Cloud and AI Development Act
3 JuneProposed Cloud and AI Development Act
Franco-German joint paper on digital sovereignty
17 JuneFrance–Germany joint paper on digital sovereignty
Proposed Public Procurement Act
9 SeptemberProposed Public Procurement Act
COM(2026) 503 · COM(2026) 502 · France–Germany (2026) · COM(2026) 590 · also under way: review of the European Interoperability FrameworkDigital sovereignty and open source
4 · Europe in 2026

The Open Source Strategy makes open source industrial policy

  • Open source named an instrument of European industrial policy
  • A definition anchored on the Open Source Initiative, with a list of recognised licences
  • A maintenance instrument, able to back a fork
  • A network of public Open Source programme offices
The money
€2bn “to be mobilised” over seven years, public and private: an estimate, with no budget line behind it.
COM(2026) 503, 3 June 2026 · CNLL, “Stratégie open source européenne : deux reculs significatifs”, 4 June 2026Digital sovereignty and open source
4 · Europe in 2026

The Cloud and AI Development Act: two steps back on open source, and no European preference

  1. “Open source by default” in the May draft became “encourage” (art. 41): cloud and AI only, wide exemptions, no audit
  2. “Public money, public code” became a catalogue, if the code is published at all (art. 42)
  3. No European preference; non-price criteria stay “ancillary and not decisive” (art. 32); implementation left to Member States, years away
COM(2026) 502 · CNLL, 4 June 2026 · EuroStack, “EC’s Tech Sovereignty Package: update”, 8 June 2026Digital sovereignty and open source
4 · Europe in 2026

Rules that already apply, or soon will

Data ActSwitching charges, egress fees included, banned from 12 January 2027
Cyber Resilience ActVulnerability reporting from September 2026, full application December 2027; a lighter regime for Open Source stewards
NIS2Cybersecurity duties for essential and important entities, public and private
GDPRThe one associations already know
Regulation (EU) 2023/2854 · Regulation (EU) 2024/2847 · Directive (EU) 2022/2555 · Regulation (EU) 2016/679Digital sovereignty and open source
4 · Europe in 2026

France tried “encourage” for ten years

€233m → €293m
Microsoft purchases through UGAP, the State’s central purchasing body, 2024 to 2025

No workstation migration to free software completed since the Gendarmerie’s, finished before the 2016 law.

National Assembly inquiry report, 2026

July 2026: the National Assembly’s inquiry proposes moving “from a logic of encouragement to a binding logic”.

National Assembly, inquiry report n° 3054 (2026) · Abilian Econ Lab, “Dix ans d’encouragements” (2026)Digital sovereignty and open source
4 · Europe in 2026

Who is pushing, and for what

Buy European, sell European, fund European
Demand, supply and capital for a European stack
Priorité au logiciel libre
Free software first: asked for since 2012; the 2016 Digital Republic law chose “encourage” instead
20% open source now, 100% by 2035
In European public procurement
eurostack.eu · cnll.fr · apell.info (7 July 2025) · the speaker co-founded EuroStack and APELL, sits on both boards, and is co-president of the CNLLDigital sovereignty and open source
4 · Europe in 2026

A text sets a ceiling; buyers deliver

Health Data Hub
  • 2019–2020: hosted on Azure
  • November 2020: the government commits to leave
  • April 2026: move to Scaleway announced
  • Not done yet; no timeline announced
Schleswig-Holstein
  • ~80% of workstations on LibreOffice
  • ~44,000 mailboxes on Open-Xchange
  • >€15m a year in licence savings, against €9m invested in 2026
AEF info, 23 April 2026 · Land Schleswig-Holstein (2025, 2026)Digital sovereignty and open source
A member of an audience raising a hand
Part 5

What you can do

Photo: delegateconnectimages · CC BY 2.0 · Wikimedia Commons
5 · Your turn

What can you do?

The European Unionsets common rules, and enforces them
A Member Statelegislates, buys, funds, and votes in the Council
A region, a citybuys, and builds
A companycontracts, and designs for exit
An associationchooses, pools, and fundsIn this room
A providercontributes, and makes leaving easyIn this room
A personchooses formats, and votesIn this room
Digital sovereignty and open source
5 · Your turn

As an end user

  • Know where your data live, and which services touch them
  • Export everything once a year, and check you can open it
  • Prefer open formats
  • Report bugs, write documentation, translate
Digital sovereignty and open source
5 · Your turn

As an organisation, and its board

  • Put leaving in the plan and the budget, starting with the link that lowered your hand
  • Write reversibility into contracts: formats, notice, exit terms
  • Fund what you depend on
  • Join peers to buy and to fund together
Digital sovereignty and open source
5 · Your turn

As an integrator or service provider

  • Contribute upstream
  • Document each client’s chain
  • Offer a European or self-hosted option for every link
  • Make leaving easy: a client who could go and stays is won on merit
Digital sovereignty and open source
5 · Your turn

As a public buyer, or a citizen

  • The texts are being written now: “encourage” or “require” is decided this year
  • Public buyers decide what the texts become
  • Support those who push: join, sign, answer the consultations
Digital sovereignty and open source
5 · Your turn

Going further

QR code to econ.lab.abilian.com/programs/oss-migration/
Two free guides to leaving Microsoft
Back-end services and the workstation: options, costs, steps
econ.lab.abilian.com · migration guides
QR code to econ.lab.abilian.com
The papers behind this talk
With plain-language explainers
econ.lab.abilian.com
Digital sovereignty and open source
Abilian Econ Lab

Who controls your tools?Could you leave them?

Papers, notes and sources: econ.lab.abilian.com

Stefane Fermigier  ·  sf@abilian.comAbilian Econ Lab  ·  October 2026