Linux Foundation Research and the TODO Group released The 2026 State of OSPOs and Open Source Management, sponsored by CNCF and the FinOps Foundation, alongside Open Source Summit Europe. The report finds open source program offices becoming permanent corporate functions, with 57% staying in the same organizational home for the past two to three years and 53% of large enterprises running a formally structured OSPO, while Asia-Pacific is set to lead the next wave as 20% of organizations there plan an OSPO, double the rate in the Americas and Europe. On AI, 79% of OSPOs involved in AI governance contribute to policy, evaluation of open models and datasets, risk management and legal review, 85% of those in AI decision-making are engaged at or before technology selection, and the top AI risks OSPOs manage are licensing and intellectual property and security vulnerabilities at 65% each, ahead of data privacy at 59%. Agentic AI is already entering operations, with 69% of organizations prototyping or running agentic tools for OSPO workflows and 18% using them in production. Respondents ranked software quality, security and compliance as the most impactful OSPO outcome at 58%, and among organizations planning an OSPO, 79% expect to launch within two years and 66% intend to fund dedicated full-time staff.
Navigating Open Source Governance in the Age of Artificial Intelligence: The 2026 State of OSPOs and Open Source Management
Linux Foundation Research and the TODO Group released The 2026 State of OSPOs and Open Source Management, sponsored by CNCF and the FinOps Foundation, alongside Open Source Summit Europe. The report finds open source program offices becoming permanent corporate functions, with 57% staying in the same organizational home for the past two to three years and 53% of large enterprises running a formally structured OSPO, while Asia-Pacific is set to lead the next wave as 20% of organizations there plan an OSPO, double the rate in the Americas and Europe. On AI, 79% of OSPOs involved in AI governance contribute to policy, evaluation of open models and datasets, risk management and legal review, 85% of those in AI decision-making are engaged at or before technology selection, and the top AI risks OSPOs manage are licensing and intellectual property and security vulnerabilities at 65% each, ahead of data privacy at 59%. Agentic AI is already entering operations, with 69% of organizations prototyping or running agentic tools for OSPO workflows and 18% using them in production. Respondents ranked software quality, security and compliance as the most impactful OSPO outcome at 58%, and among organizations planning an OSPO, 79% expect to launch within two years and 66% intend to fund dedicated full-time staff.
Source: Linux Foundation