ALASCA meets Reinier van Lanschot on Cloud and AI Development Act

The history behind ALASCA

2020

Yaook is initiated by Cloud&Heat Technologies and STACKIT

Open Source transformation followed quickly

2021

Growth of Yaook’s community

2022

Founding of ALASCA in September 2022 in Dresden, Germany

2023 – today

Internal development of ALASCA and its governance

Marketing & events

Today

22 members
(17 companies, 1 association)

7 Open-Source projects

Solid governance including a Technical Steering Committee

ALASCAs goals

Development of open source technologies & promotion of their use

Contribution to public & professional education

Creation of an open & inclusive community

ALASCAs members today (03/2026)

Founders

2023

2024

2025

2026

The stack at a glance

ALASCA cosmos

Political campaigning

Round tables
Responses to the Commission’s calls for evidence — here on the European Open Digital Ecosystem Strategy
What we said: the barrier is demand, not software
- Public buyers still default to proprietary, so nothing rewards investing in open source. We asked the Commission to be the anchor customer and buy open source only, to put “open source by default” into the procurement reform, to set a dated target — European open-source cloud infrastructure from 2030 — and to fund the community work grants never cover: governance, documentation, reviews.

ALASCA's written response to the European Commission's call for evidence on the European Open Digital Ecosystem Strategy

Source: ec.europa.eu/…/16213

Cloud and AI Development Act

Timing: tabled June 2026, nothing fixed, years before it binds.
Complexity: stacked on the AI, Data, Cyber Resilience and Cybersecurity Acts.
No measure of success: an ambition, not an indicator for OSS success.
Hardware: only under 10% of the world’s chips are made in Europe and the other 90% are also very expensive. Hard to get by as a SME.
Open source is the lever: the layer Europe can own today.
Asymmetric influence: outspent by the firms it should counterbalance. (€151m in 2025)

**Timing.** Tabled 3 June 2026. The European Parliament's Legislative
              Train carries no adoption or entry-into-force date at all — secondary
              coverage quotes Q2 2029, the official file does not. Years either way,
              in a market that concentrates every quarter.

**Complexity.** Sovereignty levels and a certification regime layered
              onto four regimes that already overlap:

- **AI Act** and **Data Act**.
              - **Cyber Resilience Act**, Regulation (EU) 2024/2847. Article 24
                invents the "open-source software steward" — a legal person giving
                sustained, systematic support to open source intended for commercial
                use — which is ALASCA, by definition. Vulnerability reporting has
                applied since 11 September 2026; the main obligations bite on
                11 December 2027. So this one is not theory: we carry it already,
                and CADA lands on top of it.
              - **Cybersecurity Act**, Regulation (EU) 2019/881, which made ENISA
                permanent and set up the EU cybersecurity certification framework
                CADA's sovereignty scheme builds on rather than replacing.

Compliance capacity is something the incumbents already have and we do
              not — which is the point: each new regime is a fixed cost that a
              hyperscaler amortises over billions and we do not.

**No measure of success.** Three times the EU's data centre capacity is
              a headline, not an indicator anyone is held to.

**Reward open stacks.** A provider running an open, auditable stack
              should score for it in procurement, not merely be permitted to offer
              one. This is the thread the next three slides pull.

**Hardware.** Under 10% of the world's chips are made in Europe and 4%
              of assembly and packaging. The European Court of Auditors projects the
              Chips Act's 20%-by-2030 target to land at 11.7%. CADA changes nothing
              about what there is to buy.

**Open source is the lever.** Software is the layer Europe can own
              today, and the one where the spend stays in the local economy instead
              of leaving with a licence fee.

**Asymmetric influence.** Corporate Europe Observatory and LobbyControl,
              October 2025: tech lobbying in Brussels is now €151m a year, up from
              €113m in 2023 and 55.6% since 2021. 733 digital companies and
              associations lobby Brussels, employing 890 full-time lobbyists — more
              than there are MEPs. The top ten digital firms outspend the top ten in
              pharma, finance and automotive by three to one; Meta alone spends €10m.

Big Tech averaged more than one meeting a day with Commission officials
              and nearly two a day with MEPs. That is who sets the terms of the debate
              this Act is written into.

---

Sources, drafted and not yet cleared:

- Timing — European Parliament, Legislative Train, CADA file
              - Complexity — Covington, "The EU Cloud and AI Development Act in Depth"
              - Success measure — European Commission, Cloud and AI Development Act
              - Open stacks — SUSE, "A Major Step for Open Source"
              - Hardware — IEEE Spectrum, "Europe's AI Drive Outpaces a Fragile Chip
                Supply Chain" (carries the Court of Auditors projection)

The open-source chapter excludes ALASCA

Article 41, “open source first”: only requires measures to “encourage” use, subject to security, total cost and other “duly justified” criteria. There is no procurement preference.
- Recommendation: make it a preference, not encouragement. We back the initiative itself — see Open Source First and the Architecture of European Sovereignty.
EU OSS Catalogue, Article 43: covers software released by Union entities and public sector bodies. ALASCA is neither.
- Recommendation: turn the Catalogue into a one-stop-shop of pre-integrated, supported stacks, so a buyer acquires a sovereign environment with the convenience of a proprietary cloud. OSS Directory and openCode already do similar things — build on them, do not duplicate them.
Article 4(2)(d): “foster the creation of open-source software foundations” could mean EU money for new foundations rather than established ones.
- Recommendation: widen it beyond “creation” to sustaining the foundations that already exist — strengthen ALASCA, SCS & NeoNephos and others rather than fund alternatives to them.

“Union added value” misreads open source

Article 32(3): rewards software “designed or manufactured in the Union” and technology “developed in the Union” — and only in “innovative” cloud and AI procurements.
- Concern: ALASCA’s projects are European-led, but the stacks they manage — OpenStack, Kubernetes, Ceph — are built by global communities with non-EU governance, and the proposal does neither say how origin is measured for them nor what „innovative” means.
Article 32(2)(d): makes non-price award criteria ancillary and not decisive in the award of the contract.
- Recommendation: the provision risks making all non-price criteria irrelevant and should be deleted.

Openness is audited, not rewarded

Annex II criterion J, Annex III §10: providers using open source must run a risk process for “weak ecosystem and community support” and apply upstream updates “without undue delay”.
- Concern: ALASCA already does this, and it is unfair if it applies to open-source vendors alone — all software relies heavily on open source, whether or not its vendor says so.
Decisive only at level 4: a fully open, self-operable stack counts there and nowhere else — and level 4 is reserved for the narrowest public-order-critical use-cases.
- Concern: everywhere else, being open is compliance overhead without a procurement edge.

Public Procurement Act

The barrier is demand: public administrations still default to proprietary, so nothing rewards sustained investment in the development and security of open source — which is what holds back its spread and its long-term maintenance.
- Recommendation: if the Commission wants a robust, diverse and competitive European open-source ecosystem, it must take up its role as anchor customer consistently.
Award criteria: contracts are decided on price, which says nothing about who maintains the software underneath.
- Recommendation: move beyond price and weigh a vendor’s expertise, reliability and contribution — past and present — to the health of the underlying open-source projects, so that buying also sustains the supply chain.