Denmark’s public administration has not stopped its commitment to promote open source. The coalition government’s political parties agreed in 2024 to explore the possibilities and potential of open source in the Danish public sector. As a result, the Agency for Digital Government published a report in December 2025 that establishes the prerequisites for its successful use in the public sector, and provides a comprehensive explanation of open source software, Danish experiences and international cases.
Comprehensive insights about open source security concerns
The report does not only explain the different open source and proprietary licences, but explores open source governance models, the differences between inbound and outbound projects, and their security aspects. There are many reports and guidelines from Member States’ public sectors that explain open source and licences, but not many that clarify the differences between inbound and outbound open source software and dives into their security concerns.
The report considers security aspects as essential in the development of open source projects, and aims to clarify their security challenges and propose measures to tackle them. In this regard, the report emphasises the key role of maintenance and the management of sensitive elements, such as certificates, secret algorithms, and security keys. That’s why any open source project requires constant updates and testing to catch up with new threats and technological changes. When it comes to deciding how to manage sensitive elements, the report posits that it is important to carry out a risk assessment based on the overall security and project’s profile, rather than focusing exclusively on the openness of the source code. In order to prevent open source software from malicious use, the report highlights the importance of responsibilities allocation, transparency and access management, and technical controls before deciding whether to use open source software. Lastly, there is a dedicated section that illustrates how authorities handling critical digital infrastructure have to take extra precautions and recommends public authorities to embrace an active role by elaborating dedicated guidelines and internal procedures for realising the source code as well as recognizing open source in these solutions as classified information.
Illustrative cases and applicable framework
The report shares practical information about the applicable framework for open source projects in Denmark, where it brings up the ‘White Paper on a Common Public-Sector Digital Architecture’, and the lessons learned by Danish public authorities' implementing open source projects the National Health Service Platform, and Danish Courts Authority's penal and probation program; and the open source source programmes offices (OSPO): OS2 and 4S; For this, the report conducted several interviews with state agencies, regions and municipalities to collect their inputs about the complexities for its implementation, the governance model, security and economical aspects.
When it comes to include international examples, the report shares the insights from the research report ‘Software Reuse through open source software in the public sector - a qualitative survey on Policy and practice’ on Netherlands, Germany, Italy, France, and Switzerland, and explores European and international framework.
Prerequisites for a successful open source project
After explaining the fundamentals of open source and insightful cases at Danish and international level, the report proposes its most important contribution: the list of prerequisites for successful open source projects:
- Organisation and implementation. There are significant differences in the organisational and competence requirements depending on whether open source is implemented at the server or desktop layer. The report advises public authorities to develop clear competence rules for access and governance. The Aarhus Municipality elaborated an action plan on open source in 2014 that serves as a good example of organisational and implementation planning.
- Support and maintenance. Active and ongoing maintenance is an important prerequisite for software to meet the needs of the organisation and to minimize software errors. In Denmark, OS2 organisation supports small entities that lack the expertise and capacity to properly maintain open source projects. In Germany, the government has set up the Sovereign Tech Agency to support decentralised open source projects.
- Security. It is essential to assess the maturity and security levels either using internal built competencies or by obtaining them from a third party’s review of the source code. Public authorities can use international recognised standards, such as OpenSSF and ISO 27001, in their open source projects.
- Licence management and acquisition. Public authorities should search for which solutions are available, especially if it is community, internal/private or foundation-driven open source software. To ensure a proper selection criteria, public authorities should be fully aware of their needs and solution to set up concrete requirements for open source suppliers.
- Integration into other software. Authorities should check out the compatibility of those open source software they intend to integrate into their system, and assess the economic cost of such integration (for example interface adjustment). The case of National Service Platform shows the advantage of using international standards in terms of interoperability and efficient integration.
- Economy. Authorities should assess the costs of the software over its full life cycle in order to compare proprietary and open source software. France and Germany are developing and implementing open source at an aggregated national level which helps reduce the costs of the individual agencies.
Thereby, the report has used the lessons learned from Danish and international cases to consolidate these prerequisites that could guide other public administrations not only in their open source software development, but also for proprietary software applications.
