According to the Linux Foundation, 94% of European organizations consider digital sovereignty important, which refers to the ability to control their own digital infrastructure and data. However, only 37% are actively involved in the governance of open source projects on which they rely. In response, Brussels is planning to invest 2 billion euros over seven years—combining public and private funding—to reduce its reliance on non-European technology suppliers. A 2026 report, presented on October 7 at the Open Source Summit Europe, highlights that this funding may not be enough if Europeans are not involved in the decision-making processes of these open source projects. The survey, which included 367 organizations, was conducted between June and August and involved recruitment through the Linux Foundation's networks. In terms of code contributions, Europeans account for nearly 40% of the development in major open source projects like Kubernetes and OpenStack. Furthermore, 59% of organizations send their software fixes back to the original project, a process known as "upstream" contribution. However, when it comes to governance—the committees that determine the project's direction and rules—only 37% of these organizations are represented. The Agentic AI Foundation, launched in December 2025 around the Model Context Protocol (a standard for connecting AI agents to tools), has eight founding platinum members, all American: AWS, Anthropic, Block, Bloomberg, Cloudflare, Google, Microsoft, and OpenAI. European companies like SUSE, SAP, and Ericsson are members at gold and silver levels. The Linux Foundation itself hosts the Agentic AI Foundation. According to Thierry Carrez, general director of Linux Foundation Europe, using open source software does not necessarily give organizations full control over the technology they rely on. Around 48% of organizations maintain a "fork," which is a private copy of a software project that they must update independently. Maintaining these forks is time-consuming, with some organizations spending 311 hours per release cycle on an average of 9.5 forks. Additionally, 28% of these organizations struggle to quantify the time spent on these tasks. Organizations that are actively involved in governance report benefits that are 4.6 times their costs, compared to 3.6 times for those without formal governance. However, these figures are based on estimates from 87 organizations, and the report notes that they do not prove that governance is the direct cause of the difference. AI tools are increasingly overwhelming those who maintain open source projects, and regulatory compliance is becoming more pressing. Security and privacy are the top reasons cited by organizations for pursuing digital sovereignty, with 71% emphasizing these concerns. However, maintainers—who are responsible for reviewing and integrating bug fixes and new features—are struggling with the volume of changes generated by AI. Greg Kroah-Hartman, a Linux kernel developer, notes that the number of CVEs (public identifiers of software vulnerabilities) published for the Linux kernel has risen from 55 to 230 per week since the introduction of AI tools. While some of these issues are real, including older bugs, tests with students from Vrije Universiteit Amsterdam found that nearly half of the AI-generated changes were incorrect. As a result, kernel maintainers now require contributors to prove that their changes work before they are accepted. The Cyber Resilience Act (CRA), which imposes security requirements on digital products sold in the EU, is adding further pressure. Since September 11, manufacturers must report actively exploited vulnerabilities and serious incidents within 24 hours of becoming aware of them, with a follow-up notification required within 72 hours. These rules will apply to all by the end of 2027. However, 66% of people surveyed in another Linux Foundation study were unaware of the CRA, and only 19% of organizations claim to fully understand the open source components in their products. Under regulatory pressure, 63% of organizations have increased their budgets for tracking dependencies—third-party software components.