Public software is easiest to celebrate at launch, when a service is delivered, a repository is published, and an institution can point to visible progress. Its harder test begins after the original contract ends. Security response, documentation, upgrades, knowledge transfer and operational ownership must continue even when the delivery team or supplier changes. The EU Open Source Strategy, published by the European Commission on 3 June 2026, treats procurement, deployment, maintenance and governance as parts of the same software lifecycle.
Public procurement should therefore test continuity rather than initial delivery alone. Buyers need to know whether data, configuration and documentation can be transferred; whether another supplier can operate the service; whether publicly funded improvements can be reused; who will handle vulnerabilities and dependency updates; and how long transition support will remain available. An open licence can widen the range of possible suppliers, but that choice remains theoretical when system knowledge, access procedures or maintenance budgets stay with the incumbent. Avoiding lock-in requires both legal permission and the practical capacity to act on it.
The strategy proposes an Open Source Maintenance Instrument, dependency analysis, stewardship support and common security baselines for public repositories. These measures recognise that testing, release management, vulnerability response and documentation are infrastructure work rather than incidental volunteer activity. Drupal 7 reached end of life on 5 January 2025, but its source code remained available after community releases, fixes and security advisories ended. LocalGov Drupal offers a concrete model of organised stewardship by bringing councils and suppliers into shared product governance, technical maintenance and a cooperative structure intended to support financial sustainability.
Public money should produce more than software that can still be downloaded after the original team leaves. Contracts should fund security work, upgrades, current documentation, supplier handover, upstream contribution and governance across changes in vendors and budget cycles. Europe’s open-source ambitions will achieve little if institutions publish more code without retaining the capacity to operate, improve and transfer it. Public code becomes infrastructure only when responsibility survives delivery.
Follow The DropTimes on LinkedIn, X, Bluesky, and Facebook, or join #thedroptimes on Drupal Slack.
This issue of Editor’s Pick was written and curated by Kazima Abbas.
