EU Launches €400,000 Grant Program to Secure Open-Source Supply Chains

The European Commission has launched CodeSupply, a new funding initiative designed to bolster software supply chain security through open-source research and development. Operating under the Open Internet Stack framework, the program provides grants to projects that improve the aggregation and curation of critical software metadata.

According to NLnet, the program has reserved a total of €400,000 for these open calls. Individual projects can apply for funding ranging from €5,000 to €50,000. To ensure the benefits remain public, all project results must be released under a recognized free or open-source license. The first window for proposals opens on September 3, 2026, with a submission deadline of November 3, 2026.

The Push for Digital Sovereignty

CodeSupply is a strategic component of the European Commission's "Open Internet Stack," an effort to build a resilient foundation of strategic technology commons. This work builds upon the Next Generation Internet (NGI) initiative, which seeks to re-engineer the internet to be more inclusive and value-centric. By focusing on the operational stack, the Commission aims to create a technical environment that is not dependent on a few dominant, proprietary providers.

Addressing the Supply Chain Crisis

This funding arrives as software supply chain attacks continue to rise globally. The industry currently lacks a standardized, authoritative way to track the origin, licensing, security vulnerabilities, and quality metrics of the components that make up modern software. CodeSupply aims to fill this gap by funding the creation of comprehensive metadata that can be used to automate security and compliance checks.

By supporting decentralized R&D, the European Commission intends to foster digital sovereignty. The goal is to move away from a reliance on proprietary security tools and instead establish a "trustworthy and reliable open internet stack" that is transparent and verifiable by any participant.

Next Steps for Developers

Developers and researchers should prepare proposals that align with the program's goal of enhancing software metadata. While the budget for the initial open calls is set at €400,000, the long-term success of the initiative will depend on the adoption of these open standards across the broader ecosystem. The industry will be watching to see if these grants can produce a viable, open-source alternative to the current proprietary security landscape before the November 2026 deadline.