Keynote: EMBAG - The New Swiss Open Source Law and Its Implementation
Evaluates keynote: EMBAG - The New Swiss Open Source Law and Its Implementation and evaluates key implications for security practitioners.
Summary
## Overview
A researcher and political leader from Switzerland presents on the country's new open source law (EMBAG), which mandates federal government agencies to release their software code as open source by default. The speaker leads a research institute in Bern focused on public sector transformation and has spent 20 years researching open source adoption, recently leading parliamentary efforts to advance open source policy through ParlDigi, a multi-party parliamentary group for digital sustainability.
## Background: Swiss Open Source Before the Law
Before EMBAG, Switzerland had already seen significant government open source initiatives despite legal uncertainty. Notable examples include the COVID certificate platform released on GitHub during the pandemic, which the Austrian government subsequently improved and contributed back to; InnoScala/Kaluma, a workflow management project coordinating multiple Swiss cantons; Open Justitia, a court management platform started 13 years ago by the federal court in Lausanne; and SwissTopo's mapping service, which crowdfunded over $300,000 from public agencies to improve the open layers library. However, legal ambiguity hindered broader adoption—while IT professionals published code, lawyers remained uncertain about the legal foundation for such releases, creating institutional barriers.
## The Legal Journey to EMBAG (2014–Present)
The path involved significant legal maneuvering. In 2014, a government-commissioned legal opinion concluded that releasing open source would distort the market and harm the Swiss IT industry. In response, the speaker and colleagues obtained alternative legal opinions from other law professors arguing that open source release is legally permissible and supports innovation. In 2018, the Canton of Bern implemented its own law allowing open source. A 2019 federal draft included language permitting open source under certain conditions. The speaker's organization, CH Open, lobbied to strengthen this to "open source by default." Parliamentary debate revealed a split: the Nationalrat (population representation) favored stronger language; the Ständerat (cantonal representation) preferred restrictions. Parliamentarian Matthias Michel proposed the compromise that became law: all code must be open sourced unless third-party rights or security concerns prevent it.
## EMBAG's Core Requirements
The law mandates open source as default for all code developed or commissioned by federal agencies, except where third-party intellectual property rights or security concerns apply. Agencies must justify why code should not be open. The law explicitly permits government to provide supplementary services including integration, maintenance, information security, support, and community building—recognizing that code alone requires additional services for effective adoption. Market distortion is prohibited.
## Current Impact
Since January 1st enforcement, concrete impacts are emerging. Multiple multi-million-dollar public procurement documents now explicitly require providers to release code under EMBAG. Procurement documents increasingly demand demonstrated experience in open source software development (currently weighted ~2%). Some contracts reference the OpenChain ISO standard for security and compliance. A YouTube video about the law reached 180,000 views. The speaker notes that while the law is passed, implementation requires continued community building, knowledge transfer, and government commitment to sustainability.
Related talks
The Linux Foundation·35 min
Junhyeok Yoo · Four Pillars
Outlines how x402 Brings Open Source Governance to Payments and evaluates key implications for security practitioners.
The Linux Foundation·29 min
Analyzes fusing AOSP and Linux! To Open a New Chapter… - Yong Gong, Phytium: OpenFDE open-source community and evaluates key implications for security practitioners.
The Linux Foundation·19 min
Demonstrates how Project Akrites Is Building a Global Open Source Security Response Team | CRob, OpenSSF and evaluates key implications for security practitioners.


