Bulgaria passes law requiring all custom software written for government to be open-source
Less than two years after my presentation titled “Open source for the government”, and almost exactly one year after I became advisor to the deputy prime minister of Bulgaria …
Context & Ripple Effects
Bulgaria's law lands in the middle of a fast-moving wave of state open-source mandates: India ordered its entire public sector onto open source in 2015, and just months before this law the US circulated a draft policy requiring federally developed code to be shareable across agencies. What distinguishes Bulgaria is scope — it doesn't stop at deploying open source, it forces any custom software written for government to be published as such.
The authorship detail matters for reading the story: the law traces directly to an advisor inside the deputy prime minister's office who pitched 'open source for the government' less than two years earlier, making this a case study in how quickly an internal advocacy idea can become binding procurement law in a small EU member state.
First-order effects
- Every vendor bidding on Bulgarian government software contracts must now price in handing over source code, shifting their revenue model from licensing proprietary builds to paid development and maintenance of code the state owns outright.
- Government agencies gain audit rights over everything custom-built for them, which is pointed given Bulgaria's own record — including hackers stealing millions of taxpayers' financial records.
Second-order effects
- Proprietary government-software vendors lose their moat in the Bulgarian market and must compete on implementation quality against local integrators who can inspect, reuse, and extend the published codebase.
- Other EU member states get a working legal template from a peer country, lowering the political cost of copying it — much as India's mandate normalized the approach for Bulgaria and the US draft.
Third-order effects
- If the India–US-draft–Bulgaria sequence holds, publicly funded code becomes treated as a public asset by default across jurisdictions, pressuring the commercial government-IT market toward services and support rather than license fees.
- Mandatory disclosure also changes the security calculus for state systems: code can be independently audited by anyone, which cuts both ways for a country with Bulgaria's history as both a malware origin point and a breach victim.
The trend: Governments are progressing from merely running open source to mandating that code they pay for be open by default, with each national law making the next easier to pass.