A free software is defined by four fundamental freedoms: to run the program, to study its source code, to redistribute it, and to distribute modified versions. This legal and technical foundation, formalized by the Free Software Foundation, now structures an ecosystem that far exceeds the circle of developers. Digital news from 2026 shows that open source has now become a regulatory, industrial, and geopolitical issue in its own right.
Cyber Resilience Act: what the CRA changes for open source projects
Since September 11, 2026, the reporting obligations of the Cyber Resilience Act (CRA) in Europe have come into effect. Manufacturers of products containing digital elements must notify actively exploited vulnerabilities and serious incidents, according to a staggered schedule until 2027.
The most structuring point for the free software world concerns the creation of a specific legal category: open source software stewards. This term refers to entities that systematically and sustainably support a commercially oriented open source project. Individual developers and volunteer contributors remain outside the scope of these obligations.
The distinction seems clear on paper, but it raises concrete questions. An actor who regularly publishes and maintains resources around free software on espacelibre.net does not have the same status as a company that integrates an open source component into a sold product. In the latter case, the integrator may shift to the status of “manufacturer” with full compliance obligations, even if the original code is free.
This boundary between non-commercial use and commercialized supply chain has become the real compliance issue in 2026. Several legal analyses published in recent months highlight that the integration of a free component into a sold product transforms the legal status of the actor.
Software supply chain security: a priority open source project
The increase in attacks targeting the software supply chain has prompted the open source community to structure its security practices.
The central principle is traceability: every component integrated into software must be identifiable, versioned, and auditable. SBOMs (Software Bill of Materials) are becoming a standard expected by clients, whether public or private.
- The generation and updating of an SBOM for each released version allow for quick identification of a vulnerable component in the dependency chain.
- Cryptographic code signing tools (such as Sigstore) are becoming widespread to ensure the integrity of distributed packages.
For companies using open source components, the question is no longer whether they should audit their dependencies, but how often and with which tools. Software supply chain security now conditions access to the European market.
European digital sovereignty and free software: beyond the rhetoric
The European Union has initiated a consultation to structure its ecosystem of free software, in a context where digital sovereignty remains largely dependent on American cloud infrastructures. The debate goes beyond mere technical preference: it is about who controls the code of critical infrastructures.
On the side of local authorities, the movement towards free solutions continues. The French state maintains an inter-ministerial base of recommended free software, which exceeds five hundred references. This catalog covers uses ranging from office automation to database management, including messaging and collaborative tools.
The main obstacle remains the dependence on proprietary formats and the application ecosystem of major publishers. Migrating a workstation to LibreOffice or Thunderbird does not pose major technical difficulties, but interoperability with external partners using proprietary suites generates very real friction costs.
AI and open source: transparency against “open washing”
Artificial intelligence has become the most visible battleground between open and closed approaches. Several organizations, including the Open Source Initiative (OSI), have raised concerns about the practice of presenting AI models as open source when they only publish the network weights, without the training data or the complete pipeline code.
The term “open weights” does not mean open source in the sense of the four fundamental freedoms. A model whose weights are public but whose training data remains secret does not allow for reproducibility or independent auditing. This technical distinction has direct consequences on the trust that users and regulators can place in these systems.
- The EU AI Act, with some compliance deadlines arriving in 2026, imposes transparency requirements that go beyond the mere publication of weights.
- Projects like those led by the Linux Foundation are working to define open standards for the certification of AI agents, summarized by the principle “don’t trust, verify”.
The battle for open source AI is played out on the very definition of the term “open”. As long as dominant players can qualify partially open models as open source, the market will remain opaque for both users and regulators. The coming months will determine whether the standards currently being developed will succeed in imposing verifiable transparency, or if the “open” label will remain a marketing argument without technical guarantees.
