Drupal's Role in Digital Sovereignty Beyond the CMS

Five speakers from the Government Summit at DrupalCon Rotterdam 2026 have identified ways Drupal can support digital sovereignty beyond replacing proprietary content management systems. In responses provided to The DropTimes following the 28 September 2026 summit, they examined how shared software, public-sector expertise, community governance and long-term maintenance can help governments exercise greater control over their digital infrastructure.

Drupal already supports government websites, intranets and digital services. Its open-source licence allows organisations to examine, modify and redistribute the software, but those rights do not automatically ensure independence from suppliers. The speakers' perspectives raise a further question: whether public institutions have the people, processes and collaborative structures needed to use those rights effectively. Their answers draw on existing government implementations, Drupal's contribution model and the challenges of maintaining shared technology.

This is the third part of The DropTimes' four-part Government Summit series. The first part examined Microsoft 365 coexistence and the second part considered practical paths to greater digital sovereignty.

Using Existing Drupal Infrastructure to Reduce Dependence

For Klara Binon, Drupal team lead at VDAB, Flanders' public employment service, a significant obstacle is the reluctance of large organisations to assume responsibility for their own technology. Commercial software agreements can appear safer to decision-makers, even when an organisation already possesses the expertise and infrastructure to meet its requirements.

Klara believes public institutions can underestimate the support available through established open-source communities. She contrasts direct access to experienced developers with dependence on proprietary systems where technical knowledge may be accessible only through a supplier's service desk. She also observes that websites are not always treated as critical infrastructure by enterprise architects and security officers, potentially making them an easier starting point for open-source adoption.

Her Government Summit presentation, Saving Money by Using the Drupal Website You Already Have, offered a practical example. VDAB had identified a project to procure a master-location tool, while its existing Drupal intranet was already collecting, enriching and sharing location data. Klara described how Drupal functionality could reduce the need for separate commercial solutions. The publicly available session description does not establish the final procurement outcome or quantify the savings.

The wider implication concerns institutional knowledge. An organisation that understands the capabilities of its existing platform can evaluate new purchases against what it already operates. For Klara, retaining technical expertise internally is therefore part of reducing supplier dependence, rather than merely an additional cost of using open source.

Why AI Makes Software Governance More Important

Mike Gifford, open standards and practices lead at CivicActions and a Drupal core accessibility maintainer, approaches digital sovereignty through technical flexibility and accountability. He points to Drupal CMS, the Drupal AI Initiative and integration tools as opportunities for institutions managing complex services and data.

One example is the External Entities module, which allows Drupal to work with information held in external systems. Such integrations can help governments use Drupal across services that depend on multiple application programming interfaces, without necessarily moving all the underlying data into Drupal. However, the ability to connect systems does not itself give an organisation control over those external services.

Mike identifies governance as the larger challenge, particularly as artificial intelligence reduces the effort required to produce software.

His argument is reflected in Drupal's policy on AI-assisted contributions, updated on 20 October 2026, which requires contributors to understand and verify the work they submit. The policy places responsibility on people rather than allowing generated code to bypass established review and maintenance practices.

At Rotterdam, Mike's Government Summit presentation, The Accessible Digital Commons: Aligning Government Procurement to Sustain Open Source, also examined how accessibility work can be supported through public procurement. His perspective connects software governance with the continuing responsibility to maintain inclusive public services. He cautions that using an open-source CMS does not, by itself, establish sovereignty when hosting, identity management, data storage or external AI services remain dependent on other providers.

What Governments Can Learn From Drupal's Community Model

Esmeralda Tijhoff, product owner at DICTU, the Dutch government's ICT service provider, sees Drupal's organisational maturity as a contribution that extends beyond its software. Having reached its 25th anniversary in 2026, Drupal provides an established example of how a large open-source community can coordinate development, recognise contributions and manage shared responsibilities.

Esmeralda points particularly to Drupal's security team, contribution-credit system and community-led innovation. These structures offer lessons for public institutions seeking to participate in open-source ecosystems rather than simply consume their products.

Drupal's security team coordinates responses to reported vulnerabilities and supports maintainers through security advisories and documentation. Its contribution-credit system records recognised work by individuals and organisations, helping make participation visible. Neither mechanism replaces an organisation's own security responsibilities, but both demonstrate formal processes for sustaining collaboratively developed software.

Esmeralda's related DrupalCon Rotterdam session with Rikkert Steenbergen on 29 September 2026 examined DICTU's Government Drupal Platform, a shared foundation for Dutch central government websites. The session addressed reusable Drupal Recipes, architecture and competing requirements from government agencies. It also showed that shared infrastructure requires decisions about priorities and responsibility, even when participating organisations can inspect and contribute to the code.

For Esmeralda, Drupal's relevance to sovereignty lies partly in these established ways of working together. The community offers experience that other open-source projects and public institutions can adapt to their own requirements.

Government Participation Beyond Software Adoption

Teun van der Vorm, general director of DICTU, places Drupal's contribution within the broader value of its community and continuing development. He sees the project's contributor base and capacity for innovation as characteristics that other open-source initiatives can learn from.

Teun opened the Government Summit with a keynote titled The Struggle for Digital Sovereignty in Government and joined a panel examining who should sustain the open-source ecosystems on which governments depend. His perspective also builds on an earlier interview published by The DropTimes on 25 September 2026, in which he explained DICTU's preference for open-source solutions wherever reasonably possible.

That interview established an important distinction between adopting open source and contributing to it. Teun described DICTU's approach as one in which government participation includes supporting community development under the principle of Public Money, Public Code. This involves treating open-source collaboration as part of public-sector technology management rather than solely as a procurement choice.

DICTU's work on GovNL provides an example of that approach. Published on Drupal.org, the project contains reusable configurations for Dutch government web applications and invites wider participation. Its existence illustrates how a public institution can make software available for reuse beyond its own immediate requirements, although publication alone does not establish the extent of subsequent adoption or collaboration.

Teun's contribution therefore places responsibility on government institutions as well as software communities. The benefits of a mature ecosystem depend partly on whether public organisations invest in the expertise and collaborative work required to sustain it.

How Licensing Enables Shared Public Infrastructure

For Bert Boerland, chair of Stichting Drupal Nederland, the legal framework behind Drupal is central to its contribution to sovereignty. He argues that the right to share and improve software enables public institutions to collaborate without relying on a single supplier to determine future development.

Drupal is distributed under the GNU General Public License, which permits reuse, modification and redistribution under its terms. Bert points to governments sharing modules, distributions and maintenance so that solutions developed for one municipality can become available to others. He sees this collaboration as a way of keeping technical knowledge accessible across the public sector rather than concentrating it with one supplier.

At the Government Summit, Bert chaired the panel Can Local Government Build and Sustain the Digital Commons It Needs? The discussion connected his licensing argument to the practical question of how public bodies can collectively develop and maintain software. Reuse can reduce duplicated development, but shared projects still require contributors, maintainers and decisions about funding.

Bert also facilitated a separate Rotterdam discussion on sovereignty, governance and the cost of Drupal's software distribution on 29 September 2026. It examined dependencies within Drupal's own infrastructure and whether approaches such as federated distribution could address them. The discussion was exploratory, rather than an announcement of an adopted replacement.

These questions illustrate a limitation of legal freedom alone. A licence can allow governments to maintain and redistribute software, but exercising those rights depends on access to technical expertise, functioning infrastructure and sustained resources. Bert's argument puts collaboration at the centre of sovereignty while leaving governments responsible for supporting the systems they share.

Digital Sovereignty Requires More Than a Technology Decision

The five perspectives identify different responsibilities within the same challenge. Klara emphasises the value of internal expertise and existing infrastructure. Mike focuses on accountability for code and connected services. Esmeralda examines the structures that sustain collaborative development, while Teun connects government technology strategy to participation in those communities. Bert identifies the licensing rights that make shared public-sector development possible.

Together, their responses suggest that Drupal can contribute to digital sovereignty through more than its technical capabilities. Its licensing, community practices and reusable architecture provide opportunities for governments to develop services collectively and retain greater control over their evolution. Realising those opportunities, however, requires institutions to accept responsibility for procurement decisions, software maintenance, security, funding and the external dependencies that remain.

The distinction matters for governments considering open source as part of a sovereignty strategy. Replacing proprietary software may change who supplies a service. Sustaining the expertise and collaborative infrastructure behind that service determines how much control the public institution can exercise over time.