At Open Source Summit Europe, the spotlight was on kernel GPU drivers and AI promises. But the most interesting legacy is different: digital sovereignty has stopped being a slogan and turned into component catalogs, assessment scales, and multi-year plans. Boring, perhaps; useful, almost certainly.

The sequence made that visible. The opening keynote by Nithya Ruff and Johan Linaker tied geopolitics and open source together, citing cases from Canada to Sierra Leone to Trinidad and Tobago. Soon after, the security of open source supply chains became the core of less rhetorical sessions. Dell and Microsoft presented ORBIT Launchpad and the CRABFOSC catalog, designed to help companies prepare for the EU Cyber Resilience Act. The first CRA obligations for actively exploited vulnerabilities are already in effect; the main requirements will apply from December 2027.

That is not a small detail: the presence of vendors such as Dell and Microsoft discussing due diligence and compliance, rather than flags, signals a market being formed. Digital sovereignty is becoming a procurement line item, not only a policy matter.

The picture expanded beyond the EU. OSOR recalled the work of Diaa in Ukraine and the Swiss EMBAG legislation. The Japanese model presented by Kazuki Imamura added an uncomfortable number: across hundreds of companies analyzed in seven countries and tens of thousands of GitHub repositories, many organizations talk about open source but few actually practice it. Japan's three-axis approach and its call for machine-readable rules aim to close the gap between statements and adoption.

The metrics sessions also carried weight. Dawn Foster connected the Linux Foundation report on OSPO value to the CHAOSS project guides, offering tools to measure sustainability, demonstrate organizational value, and explain to executives why an open source program is not an ancillary cost. This is material that speaks the language of management teams: indicators, targets, historical series.

The Berlin case is perhaps the most explicit. The city-state is working with PwC on its migration, aims for 70 percent open source software on administrative workstations by 2032, and shows planning around governance, dependencies, and measures. On the European front, Emiel Brok of SUSE described the Cloud Sovereignty Framework with its eight sovereignty objectives and the SEAL scale, up to full EU control without critical non-EU dependencies.

For teams managing self-hosted stacks or evaluating on-premise deployments, the message is structural. Sovereignty is not measured in words but in levels, metrics, and deadlines. AI-RADAR offers frameworks for assessing these trade-offs at /llm-onpremise, precisely because the choice among cloud, hybrid, and on-premise does not depend only on performance or TCO, but on the ability to verify the position of data, dependencies, and software.

Sometimes, being bureaucratic is a win.