The Funding Gap in Open Source Maintenance
Open source software functions as digital infrastructure that economies and societies rely on, yet its maintenance remains chronically underfunded compared with physical infrastructure like roads or bridges. GitHub’s developer policy team commissioned a study from Open Forum Europe, Fraunhofer ISI, and the European University Institute to examine how the German Sovereign Tech Agency—one of the most successful government open source programs—could be scaled to the EU level. The study was published today.
| Open source is everywhere | Open source is valuable | Open source is underfinanced |
|---|---|---|
| 96% of all code bases contain OSS | $8.8T demand-side value to global economy | 1/3 of OSS maintainers are unpaid |
| 77% of a given code base is OSS | €65-95M minimum contribution to annual EU GDP | 1/3 are the only maintainer of their OSS project |
The demand-side value of open source to the global economy is estimated at $8.8 trillion, and European Commission research shows OSS contributes a minimum of €65–95 billion to the EU economy annually. Basic technologies such as libraries, programming languages, and development tools are used across all sectors. Yet the Sovereign Tech Agency’s survey of over 500 OSS maintainers found that a third are not paid at all for maintenance work but would like to be, another third earn some income but cannot make a living from it, a third are solo maintainers, and almost three quarters of surveyed projects are maintained by three people or fewer. Incidents like the xz backdoor and Log4Shell show the security risks of overburdening small teams.
GitHub addresses this through GitHub Sponsors, the Secure Open Source Fund, and free security tooling. But the gap between public value and available funding remains significant.
Scaling the German Model
The German Sovereign Tech Agency has invested over €23 million in 60 OSS projects from 2022–2024. The study proposes that an EU Sovereign Tech Fund adopt five main areas of activity: identifying the EU’s most critical open source dependencies, investing in maintenance, security, and improvement, and strengthening the open source ecosystem overall.
Two institutional setups are proposed: a centralized EU institution (the moonshot model) or a consortium of member states providing initial funding and applying for additional EU budget resources (the pragmatic model). Either way, the minimum contribution from the upcoming EU multiannual budget should be no less than €350 million—not enough to cover the full maintenance gap, but a foundation for leveraging industry and national co-financing.
Seven Design Criteria for the EU-STF
- Pooled financing: Industry, national governments, and the EU should contribute to one central fund. Maintainers should not have to research and apply to dozens of separate funding programs with slightly different criteria.
- Low bureaucracy: The application process should be lightweight, combined with the fund’s own research to proactively contact critical infrastructure projects. Reporting requirements should be limited so maintainers spend time on project health, not administrative work.
- Political independence: The fund must be shielded from pivots to politically salient topics like blockchain or AI. Open source maintenance is foundational to all sectors and deserves consistent, focused support.
- Flexible funding: Maintainers are hired by companies, work freelance, or are organized in foundations or loose collectives. The fund should support individuals, nonprofits, and companies regardless of whether they live in the EU—software doesn’t have to be Made in the EU to benefit the EU economy, as long as it is open source.
- Community focus: The fund should collaborate with the open source community to co-define funding priorities and design the funding process, building trust and expertise that career civil servants alone cannot provide.
- Strategic alignment: The fund must demonstrate positive impact on EU strategic goals, including economic competitiveness, digital sovereignty, and cybersecurity—for example, helping companies comply with supply chain security obligations under the Cyber Resilience Act.
- Transparency: The fund must meet the highest standards of transparency in governance and funding decisions to earn trust from the open source community and the policymakers who approve its budget.
The Path Forward
The EU is negotiating its next Multiannual Financial Framework for 2028–2035, and the first legislative proposals have reached the European Parliament and the Council of Ministers. GitHub’s developer policy team is presenting the study’s findings to EU legislators and mobilizing industry support. Mercedes-Benz contributed a foreword and has supported the EU-STF idea from its inception.
Without sustainable funding and support, it is entirely foreseeable that ever more open source software projects will not receive the diligence and scrutiny appropriate for software of such criticality.
The study will also be presented at EU Open Source Summit Europe on August 26. Individuals, open source organizations, and companies can voice support for the EU-STF to the European Commission, elected representatives in the European Parliament, and national governments.
