Munich Goes Open Source Again. This Time It Has Backup.

Munich commits to open-source software procurement for municipal infrastructure

Munich's new ruling coalition has signed a coalition agreement making open-source software the default for all municipal procurement. The move revives the city's long-running battle against proprietary lock-in, this time backed by a broader European sovereignty push that makes a relapse far less likely.

The LiMux Precedent and the Reversal

Munich is no stranger to this fight. The city began adopting LiMux, its own Ubuntu-based Linux distribution, in 2006. By 2017, roughly 14,800 municipal desktops were running Linux. The project was one of the most ambitious public-sector open-source migrations in Europe.

Then came the reversal. In 2017, the city council voted to return to Windows across all municipal equipment. The stated reasons were compatibility problems, user dissatisfaction, and the perceived complexity of maintaining a custom distribution. Microsoft opened a German headquarters in Munich the same year. Whether coincidence or consequence, the message was clear: even a city with a working Linux deployment could be pulled back.

What Changed: Public Money, Public Code

The new coalition agreement is not a return to LiMux. It is a structural commitment built on a different principle. The strategy is based on "Public Money, Public Code", the campaign originated by the Free Software Foundation Europe, which states that software financed with tax revenue must be made available to the public.

This reframes the decision. The city is no longer arguing that open source is better software. It is arguing that proprietary software procured with public funds is a misuse of those funds when an open alternative exists. The burden of proof has flipped. Choosing a closed, foreign-owned platform now requires justification, not the other way around.

The municipality is also upgrading its Open-Source Program Office (OSPO), originally launched in 2024, to build IT infrastructure based on open interfaces and manufacturer-independent standards. The goal is explicit: infrastructure free from the constraints of proprietary providers.

The European Context

Munich does not act in isolation. The coalition agreement cites digital sovereignty as a core objective, and the timing is not accidental. Relations with the United States have deteriorated under the Trump administration, and the strategic risk of depending on American technology vendors has moved from theoretical to operational.

Three developments frame the decision:

Development	Date	Implication
Germany mandates open document formats for public sector	March 2026	Microsoft Word excluded from government workflows
Schleswig-Holstein completes 80% migration off Microsoft	2025-2026	Proof that large-scale migration is viable
France and Switzerland announce plans to eliminate US tech dependencies	Early 2026	Sovereignty now a multi-state commitment, not a national experiment

The German federal government's March 2026 decision to require open document formats effectively bans Microsoft Word from public-sector document exchange. Schleswig-Holstein has already demonstrated that 30,000 government workstations can be migrated off Microsoft with measurable cost savings. France's DINUM directive requires every ministry to deliver plans for eliminating extra-European dependencies by autumn 2026. Switzerland's EMBAG law mandates open-source as the default for all federal software procurement.

Europe's desktop migration away from Microsoft is well underway. Munich's decision confirms that the momentum has reached the municipal level, and that the 2017 reversal was a detour, not a destination.

The Cloud and AI Layer

The coalition agreement focuses on desktop software and document formats, but the sovereignty logic does not stop at the operating system. The same risks that make Microsoft Office a liability at the application layer make American AI providers a liability at the inference layer.

Under GDPR Article 45, transfers of personal data to third countries require an adequacy decision. The Schrems II (C-311/18) ruling established that US surveillance law does not provide equivalent protection to EU law. Every prompt sent to an American AI provider is a data transfer that falls under this framework.

The US CLOUD Act allows American law enforcement to compel US-headquartered companies to hand over data regardless of where it is stored. A European municipality sending constituent data, internal communications, or policy drafts through an American AI API has no legal guarantee that this data will not be accessed by a foreign government. The ICC's Chief Prosecutor already lost access to his Microsoft email account under US sanctions. The mechanism is proven, not speculative.

For Munich, which has now declared that public money should produce public code, the next question is whether public data should flow through foreign infrastructure.

The Compliance Check for AI Infrastructure

Engineering teams in EU municipalities - and in any organisation subject to GDPR and DORA - should evaluate AI inference providers against the same criteria Munich is applying to its desktop software:

Jurisdiction. Every provider in the inference chain must be incorporated in the EU and subject to EU law. A US-incorporated company with EU data centres is still subject to the CLOUD Act. The full subprocessor list must be published and auditable.
Data retention. If prompts and completions are never stored by any provider, the CLOUD Act exposure disappears at the source. Zero Data Retention is the technical equivalent of the open-source principle: if nothing is stored, nothing can be compelled.
No single-vendor lock-in. Munich is building on open interfaces and manufacturer-independent standards specifically to avoid repeating the Microsoft dependency. AI infrastructure needs the same approach. Multi-provider fallback routing means one provider's outage or policy change does not bring down the pipeline.
Standard APIs. EMBAG and Munich's coalition agreement both emphasise open standards. An OpenAI-compatible API that works with existing SDKs reduces switching costs and preserves the ability to change providers without rewriting integrations. See the API documentation for the drop-in replacement pattern.
Transparent procurement. Munich's OSPO exists to make software procurement accountable. AI inference should meet the same standard. Prepaid credits, usage-based billing, and no long-term contracts mean the city pays for what it uses and retains the freedom to switch.

Why This Time Is Different

The 2017 reversal happened because the case for open source was primarily technical. LiMux was a custom distribution that required maintenance overhead, and the city lacked the political and legal infrastructure to sustain the migration when pressure mounted.

The 2026 commitment is backed by law (open format mandates, EMBAG-equivalent principles), by precedent (Schleswig-Holstein, France, Switzerland), and by a deteriorating geopolitical relationship that makes US vendor dependency a documented strategic risk rather than a compliance footnote. Munich is also not building a custom Linux distribution this time. It is establishing a procurement principle: open by default, proprietary by exception.

That principle scales. It applies to operating systems, document formats, cloud infrastructure, and AI inference. The city that pioneered LiMux and then abandoned it is now positioning itself to lead again, with the legal and political framework to make it stick.