Tag Archives: TODO Group

General

2026 State of OSPOs

At the recent Open Source Summit Europe in Prague, the Linux Foundation / TODO Group just released the 2026 version of their State of OSPOs and Open Source Management Report: Expanding Open Source Management for AI Systems, Governance, and Operations.

Infographic summarizing data found in https://www.linuxfoundation.org/research/ospo-2026?hsLang=en

This report covers a lot of ground, so I won’t attempt to summarize the entire report. Instead, I will highlight a few topics that I think are important. 

OSPO Adoption

I worked in my first OSPO at Intel in 2005 where the OSPO was formed, disbanded, and morphed into various forms over the years, so it’s not surprising to see that the percentage of organizations with OSPOs has fluctuated from year to year. The latest report found that “64% of OSPOs were created within the last five years”, so people are continuing to create OSPOs, but it varies quite a bit by region. I’ve been seeing OSPOs getting more attention in Asia-Pacific recently, so it’s not surprising that “Asia-Pacific has the highest share of organizations planning an OSPO, at 20%, … while maintaining the lowest proportion of informal structures (13%)”. “Europe contains the largest segment of organizations that have never established an OSPO (49%)”, but I wouldn’t be surprised to see this grow over the next few years with the push toward using open source as a key part of the EU’s digital sovereignty strategy combined with the CRA coming into effect.

OSPOs Manage Risk

A key OSPO function has always been to manage risk with many OSPOs initially forming to focus on compliance, but this has been gradually shifting toward also taking a more proactive approach to managing risks associated with security, AI, and more. “The share of OSPOs making decisions about how employees identify security risks and build more secure software increased from 37% in 2024 to 40% in 2025 and 46% in 2026.” “As AI becomes a bigger part of OSPO work, OSPOs are also taking a more active role in how organizations govern it” with “58% of OSPOs engaged in AI-related activities.”

OSPOs are Strategic

If there is one thing I focus on more than any other, it is that OSPOs should not just manage risk. OSPOs can be a strategic function that helps their organization become more successful. “Establishing and improving open source policies and processes remains the most commonly reported responsibility, at 47%”. The report highlighted that “OSPOs are also seen as helping organizations prepare for strategic technologies”, but they also face challenges with “73% of OSPOs report taking steps at least sometimes to support their long-term sustainability.” When forming an OSPO, “the most common challenges are financially justifying the business model (37%) and securing executive support and buy-in (34%). Strategic planning and finding legal staff with open source expertise follow, both at 26%.”

Conclusion

OSPOs aren’t a new function, but they are continuing to evolve and change along with changes in technology, regulations / policy, and the broader economic environment. From the conclusion section of the report: “The findings suggest that having an OSPO is no longer just about creating a program. What matters is whether the OSPO has the authority, resources, and place in the organization to do its job as its responsibilities grow.” As I mentioned earlier, the report contains a lot of data, so I encourage you to download and read the full report: The 2026 State of OSPOs and Open Source Management!

As always, if you want feedback or help with open source strategy, sustainability, governance, or related open source topics, I’m available for consulting engagements. 

Related Resources:

As with everything I write, this was written by a human without the use of LLMs or other AI assistance.