One day, one question, eight voices
The question:
“What does digital sovereignty look like in the systems an organisation actually runs?”
— not as a posture, but as a practice that survives a decade?
The Business Track is one day inside Plone Conference 2026, built for IT decision makers and digital leaders: Friday, 25 September 2026 in Maastricht, in English, without requiring prior Plone knowledge.
Tickets are on sale now: €180 including 21% Dutch VAT. A Friday one-day ticket at the same price also includes the Business Track.
Why this day, why now
Two pressures keep arriving in the same meeting: how do we stop depending on systems we do not control, and what should we actually do with AI. In 2026 both stopped being talking points. The EU AI Act's main obligations have applied since 2 August 2026. The Cloud Sovereignty Framework and procurement rules across Europe are pushing toward sovereign and open-source options. Sovereignty has moved from a posture to an obligation — and obligations land on operational systems, not on strategy decks.
This is the first Plone Conference since that shift completed. The day exists because the people who run Europe's open-source institutional platforms have been working inside this question for two decades, and what they know about practical AI and durable systems is suddenly what everyone needs.
Sovereignty has to be realised in operational systems.
Strategy decks merely describe it.
Running systems either enact it or they do not.
The programme — one argument in eight voices
The day opens with an independent keynote: Matthias Kirschner, President of the Free Software Foundation Europe, on who controls the software which influences our lives. It closes with a conversation that re-articulates what the day collectively showed. Between them, seven senior practitioners — people who lead Plone businesses and public-sector IT across Europe — tell one argument in a deliberate rhythm. Not a lineup: an arc.
| # | Slot | Speaker | The claim this slot makes |
|---|---|---|---|
| ⍺ | Keynote | Matthias Kirschner · FSFE | Software freedom decides whether technology keeps concentrating power, or empowers citizens, companies, and governments to act autonomously. |
| 1 | Ground | Alexander Pilz · Syslab | Partner durability is the substrate sovereignty stands on. |
| 2 | Possibility | Jens Klein · Klein & Partner | AI in the hands of a senior maintainer changes capacity, not identity. |
| 3 | Application | Stefano Marchetti · RedTurtle | Software reuse across administrations is sovereignty in practice — reusable, not rebuilt from scratch. |
| 4 | Affirmation | Jörg Zell · Interaktiv | Yes to AI in regulated environments is a discipline, not a feature. |
| 5 | Cold water | Guido Stevens · Quaive | What to keep out on principle is the question — not whether to use AI. |
| 6 | Balanced uplift | Timo Stollenwerk · kitconcept | A platform's public governance is itself a procurement criterion. |
| 7 | Landing | Joël Lambillotte · iMio | Sovereignty in production is lock-in risk weighed against delivery speed — build or buy, decision by decision. |
| Ω | Closing conversation | All speakers — and the room | The day's evidence, read together, against the audience's own cases. |
⍺ · Keynote
Matthias Kirschner — Free Software Foundation Europe
Software freedom in the age of AI
Billions flow into Large Language Models, and the public debate about technology has often narrowed to a debate about AI. Yet the question that shapes our society is older and larger: who controls the software which influences our lives — and with it, our communication, our devices, our infrastructure, or our public administrations?
The FSFE works to empower users to control technology and thereby decentralise power in our society. Software freedom, the right for everyone to use, study, share and improve software, decides whether technology keeps concentrating power, or if technology empowers citizens, companies, and governments to act autonomously.
I will present a vision for a society in control of its technology, the FSFE's strategy, and tactics that already work: public administrations releasing code under "Public Money? Public Code!", router freedom and device neutrality, and a next generation that grows up knowing why control over technology matters. You will leave knowing what you yourself can do, as individual, without a company or an organisation, or as public administration.
Matthias Kirschner is President of the Free Software Foundation Europe. His starting point is that software now reaches into every part of our lives, and that this technology has to empower society, not restrict it. Since 2004 he has worked with organisations, companies and governments on the rights Free Software gives them — to use, understand, adapt and share software — and on what those rights mean for freedom of speech, freedom of the press and privacy.
1 · Ground
Alexander Pilz — Syslab, Munich
Fifteen years inside an EU agency: what makes a software partnership last
European institutions commit to their platforms for decades, while procurement runs in cycles of a few years. Whoever maintains the platform becomes part of how the institution works, and replacing them is slow and expensive. The hard question at procurement time is whether the partnership will still be healthy in year fifteen, and standard tenders barely test for it.
Syslab has run OiRA, the workplace risk-assessment platform of EU-OSHA, the European Agency for Safety and Health at Work, since 2011. Alexander Pilz uses those fifteen years to examine what makes a software partnership survive: a commercial model that rewards staying rather than re-pitching at every contract cycle, and a partner close enough to the institution to push back when a request would damage the platform. The talk closes with concrete questions an institution can ask during procurement to tell a durable partner from one optimised for winning the next tender.
You take away
-
A durability test for procurement
questions that show whether a candidate partner's commercial model rewards staying with the institution or re-pitching at every contract cycle.
-
Critical pushback as a selection criterion
why a partner who sometimes contradicts you serves your platform better than one who always says yes, and why that quality rarely survives a sales-driven relationship.
-
A fifteen-year reference case
OiRA at EU-OSHA, in use across member states since 2006, as a concrete European example to take back home.
-
Where AI fits
why an institution's decisions about AI depend on the quality of the partnership that maintains its platform.
2 · Possibility
Jens Klein — Klein & Partner
Torben Baumgartner - more dimensions GmbH
AI removes implementation bottlenecks and team boundaries, but makes architecture, testing, and security judgement more important—not less.
In 2024 a Plone core developer quoted a customer for image infrastructure the community had wanted since 2020: a few hundred hours, a five-figure sum. It was not commissioned — the idea was fine, the price was not. It is now open source and in production, carrying the shared web platform of Austria's architecture institutions.
His son, an AI integration engineer, dissolved a handoff between two teams at an Austrian software company. The backend team is retiring legacy. The company is hiring.
The bottleneck was never typing — it was boundaries, and what an organisation does with the space they leave is the whole story. What did not fall: architecture, testing and security judgement.
-
How far up the ladder you actually have to climb
prompting, context, fine-tuning, training — the three conditions that decide it, and a support desk that automated the easy half and kept everyone.
-
A Kubernetes operator in Go, a transcoder in Rust — by someone who writes neither
what happens to architecture decisions once your team's skill inventory stops deciding them for you.
-
Where the multiplier meets zero
the same tool that multiplied a maintainer of two decades would not have created one — and what it costs, in discipline, at either end of a career.
-
The upgrade you kept deferring
twelve institutions stuck on an old release because migrating was never worth the price — now moved, with a web archive back to 2002 intact. The price changed, not the platform.
3 · Application
Stefano Marchetti — RedTurtle, Ferrara
Software reuse as a sovereignty practice: Plone across Italian public administrations
Italian regional governments, municipalities, and local health authorities increasingly run on a shared ecosystem of publicly maintained Plone-based solutions, aligned with the national AgID design system. An administration adopting one starts from the experience of others rather than from a blank page — and improvements flow back to the shared solution and the wider ecosystem.
-
A reuse model based on shared public-sector experience
how Italian administrations can start from solutions already tested and evolved by other public bodies, rather than from a blank page.
-
What AgID and Designers Italia compliance buys you institutionally
beyond the tick-box, as a working procurement discipline other European jurisdictions can read.
-
Transparency as a foundation for sovereignty
why open, inspectable, and reusable Plone-based solutions make compliance, maintenance, and future evolution easier to govern.
-
A contribution path between local needs and shared value
how specific customisations can serve one administration, enrich the common solution, and create benefits for other administrations and for the wider Plone ecosystem.
-
A European pattern for public digital services
how a shared ecosystem of open-source solutions can support sovereignty, interoperability, and sustainable collaboration across administrations.
4 · Affirmation
Jörg Zell — Interaktiv, Kerpen
Sovereign AI in practice — an open-source, on-premise chatbot for student advisory at the University of Bonn
A working answer to the question every regulated institution is asking: an open-source AI chatbot for student advisory, built with the University of Bonn's Computing Centre on open-weight language models deployed on-premise. Retrieval-Augmented Generation runs against curated institutional sources, paragraph-level citation makes responses traceable, and predefined fallbacks escalate to human advisors. The finding worth carrying home: the constraints of on-premise deployment and curated grounding produced more reliable, institutionally aligned advice.
-
A working sovereign-AI architecture, fully named
open-weight LLMs + on-premise deployment + RAG against curated institutional sources + paragraph-level citation + predefined human-escalation fallback - what each piece does and why each was chosen against the cloud-hosted default.
-
The four implementation challenges that decide whether the project ships
data readiness, topical-boundary enforcement, RAG-pipeline architecture decisions, and adversarial-input handling - what each one cost in this case and how an institution should budget for them.
-
A reference case for institutional buyers considering the same path
a German public university running this, with publishable evaluation findings to point procurement at.
5 · Cold water
Guido Stevens — Quaive, Maastricht
In no hurry: why Quaive saw predictive AI coming in 2013 and still has not shipped it
Quaive's 2013 vision document, Systems of Intent, described predictive software that reads user context and acts before the user asks. Thirteen years later that capability is cheap and widely available, and Quaive still has not built it into the product. This talk explains why the pace of AI integration is a deliberate choice, and what that choice commits a product owner to say in public during the current AI wave.
For institutions, the productive question is no longer whether to use AI. It is which capabilities to integrate, on whose terms, with what off-switch, and which to keep out of the platform on principle. Guido Stevens shows how a product that has held this position for thirteen years answers those questions, and how an institution can put the same questions to its own platforms and vendors.
-
Pace as a decision
how to treat the speed of AI adoption as a choice the institution makes, rather than a default absorbed from its vendors.
-
Four questions for any AI integration
what comes in, on whose terms, with what off-switch, and what stays out on principle.
-
Two positions to avoid
demanding full autonomy from the technology market, and treating dependence on it as inevitable.
-
A tested example
thirteen years of product decisions at Quaive, from the 2013 vision document to today, showing how the position holds up in a shipping product.
6 · Balanced uplift
Timo Stollenwerk — kitconcept, Bonn
How a contributor-led open-source platform decides what it becomes — Plone roadmap and AI, in public
For an institution committing to a platform on a decade-plus horizon, the decision-making about where the platform is going is something they need to be able to read. Plone's roadmap is public: provider firms invest in the modernisation work and publish what they build, contributors release-manage in public, and new directions — like the MCP server for AI integration — are offered to the community for ratification rather than announced.
-
A roadmap-as-procurement-criterion reading
what reading a platform's public governance gets an institution that reading a vendor's roadmap does not.
-
One concrete AI direction in motion
the MCP server, PLIP #4213, the repo move to plone/plone-mcp, and what "offered for ratification, not announced as direction" actually looks like.
-
The contribution-and-ratification flow
how work moves from one provider firm to community-owned, and where the institutional audience can read it as it happens.
-
An honest line on what does not ship in core
and why the slot does not pretend otherwise.
7 · Landing
Joël Lambillotte — iMio, Wallonia
Sovereignty on paper, sovereignty in production: how Wallonia's municipalities built their AI roadmap inside EU rules
iMio is a public IT cooperative serving 460 municipalities in Wallonia, Belgium, running a dozen SaaS platforms — from permit management to council deliberation — and generative AI tools built for civil servants and citizens. "Digital sovereignty" is easy to invoke and hard to operationalise, especially once AI enters the stack.
Joël Lambillotte walks through how iMio turned sovereignty from a political talking point into a set of concrete, auditable decisions: which EU regulations actually constrain a municipal IT cooperative — GDPR, the AI Act's obligations for public-sector deployers, public procurement law — and how those constraints shaped where AI models run, what data leaves iMio's control and under what jurisdiction, how vendor lock-in risk was weighed against delivery speed, and where iMio chose to build rather than buy. iMio's AI projects Omnia Chat and Omnia Lex serve as the case studies, with the tradeoffs made in public: what sovereignty cost in time and complexity, and what it didn't.
-
The regulations that actually constrain a public-sector deployer
GDPR, the AI Act's obligations for public-sector deployers, and public procurement law — which of them bind a municipal IT cooperative in practice, and how each shaped a real decision.
-
Build-or-buy with the reasoning shown
how vendor lock-in risk was weighed against delivery speed, and where iMio chose to build rather than buy.
-
Two AI case studies in production
Omnia Chat and Omnia Lex — where the models run, what data leaves iMio's control, and under what jurisdiction.
-
What sovereignty cost, and what it didn't
the time and complexity accounted for openly, against the choices that came at no cost.
-
A working checklist
for public-sector users making the same calls under the same regulatory pressure.
Ω · Closing conversation
All speakers — and the room
The day closes with a panel discussion: every speaker on stage and the floor open to the audience. Not a summary slide — a working conversation that reads the day's evidence together, and where you can put your own sovereignty and AI questions to people who have already faced them in production.
What you will take home
You should leave with a working toolkit — enough to detect, quantify, and act on the concrete sovereignty and AI questions waiting on your desk.
- A decision framework you can apply to vendors, platforms, and dependencies — including the questions to ask before signing and the exits to keep open after.
- A practical checklist for AI initiatives covering value, risk, governance, and accountability, usable in the next steering meeting.
- Examples from public institutions and enterprises that have already worked through these questions in production, including the trade-offs they accepted.
- Next steps you can explain internally — without jargon, without a vendor in the room, and without requiring prior Plone knowledge from the people you brief.
Who this day is for
The day is built for people who carry the weight of digital decisions in organisations that cannot afford to start over every three years: heads of IT in public-sector and regulated organisations, digital strategy and procurement leads, innovation and AI-governance roles, and the universities, agencies, foundations, and research organisations that plan in decades while vendors plan in funding rounds.
If you carry the technical argument but not the budget, bring the person who does. The day is built to be followed without prior Plone knowledge, and the conversations across the table are part of what you are buying.
Practical details
- Day: Friday, 25 September 2026.
- Setting: part of Plone Conference 2026, Hotel Van der Valk Maastricht.
- Language: English.
- Prior knowledge: none required — built for decision makers.
- Format: seven talks of 25 minutes in one arc, opened by an independent keynote and closed by a shared conversation. Lunch is planned alongside the programme.
- Ticket: €180 including 21% Dutch VAT. A Friday one-day ticket at the same price also includes the Business Track. For group bookings or an invoice rather than a card payment, write to [email protected].