A three-day conference turned into a ledger of costs, compliance, and constraints that large engineering teams can no longer ignore. By Tom Smith.
Ericsson Software Technology had a fork problem. Like many large engineering organizations, it kept private copies of open source projects, patched them in-house, and carried those patches forward release after release. The EU Cyber Resilience Act turned that practice into a liability, and the Open Source Summit Europe 2026 made the economics visible. Tom Smith frames the conference not as a showcase of new tools but as a reckoning: 311 hours of work per release and 1,400 fixes upstream are the numbers behind the fork tax, and they quantify exactly how expensive divergence from upstream becomes.
The technical mechanism at the heart of the discussion is the drift between internal patches and upstream evolution. Each carried patch compounds the next, so maintenance grows non-linearly and the organization loses the ability to adopt security fixes quickly. Compliance is reframed as a build output rather than a checkbox, meaning the same pipeline that produces binaries must also produce evidence of provenance, licensing, and vulnerability remediation.
Two forces shape what comes next. AI agents are entering the supply chain, and the summit argues they need limits the model cannot talk its way around. Governance must constrain what an agent can fetch, patch, or ship. Embedded systems turn 10 and the kernel turns 35, milestones that signal maturation and new expectations for stability and support.
Sovereignty is becoming an architecture decision, not a policy afterthought. Teams must decide where code lives, who can modify it, and how long they can sustain it. One more to watch is OpenGrid, which may redefine how infrastructure is shared and governed.
Engineers should watch how compliance moves from documentation to automated build output, how agent governance is codified, and whether the fork tax remains the dominant cost for large teams. Excellent read!
[Read More]