Digital sovereignty means the freedom to switch – our takeaways from the Smart Country Convention 2026

On Wednesday, 14 October, I took an early train from Dresden to Berlin for the Smart Country Convention (SCCON). Organised by Bitkom and Messe Berlin, it is Germany’s leading event for the digital transformation of government and public administration – and therefore highly relevant for us, since our customers are mainly municipalities, engineering firms and research institutions.

This year SCCON broke every record: more than 30,000 participants, over 650 exhibitors and around 1,400 sessions on seven stages over three days. Despite all the variety, three topics ran through almost every hall and every stage: open source, digital sovereignty and artificial intelligence. For us these are not trends but the foundations of our products. Below I summarise my key takeaways – and how we approach each topic at Cyface.

Open source: from political wish to procurement practice

Open source often has a hard time in the business world. Usually this comes down to a misunderstanding: “open” is confused with “free of charge”. But open primarily means that the source code can be inspected and reused. Professional development, operation and support still cost money – and they are worth it.

A particular highlight for me was the talk “Open source wanted | proprietary procured?” by Timo König (Solution Lead Sovereign Digital Solutions, Bechtle AG). Using Thuringia as an example, he showed how a political goal becomes everyday practice: section 4 of the Thuringian procurement act anchors open-source software in public procurement, a cross-departmental working group (AGOSS) has been evaluating use cases since 2022, and the Thuringian administration cloud has been running on open components such as OpenStack, Nextcloud, OpenTalk, Ceph and KVM since March 2025.

From our perspective, three reasons in particular speak for open software in the public sector:

• Auditability: Open code can be checked by independent parties for functionality, quality and security. Admittedly, attackers can find vulnerabilities more easily too – but in our experience the benefits clearly outweigh this. With closed software, flaws often go unnoticed for a long time, and nobody on the outside notices when data leaks or a gap opens up in the security architecture.
• Independent development: When the source code is open, an administration can hand maintenance and further development to other service providers – for example if a supplier lacks capacity or quality declines.
• Reuse: Tools developed once can be shared between administrations. This cuts costs and multiplies the benefit. It is no coincidence that SCCON speakers kept calling for a “culture of reuse”.

How we do it at Cyface

The core of our software is open source. Our mobile SDK for Android and iOS, which integrates data capture into any app, is freely available on GitHub – and has been used in the STADTRADELN cycling campaign for more than eight years by over one million users per year. For our customers this means full transparency and no dependency on a contract with us: the software can keep running even if our cooperation ends. And because we hold all copyrights, we can provide any component under a commercial licence via dual licensing whenever that suits a project better.

Digital sovereignty: not autarky, but the freedom to switch

In view of global crises and geopolitical tensions, many administrations want to become less dependent on individual, often non-European suppliers. The topic was correspondingly prominent at SCCON: the solutions sought and presented were above all those that work without the big US cloud providers and involve only German or at least European companies. João Rui Ferreira, Secretary of State for the Economy of this year’s partner country Portugal, also stressed when opening the second day that Europe’s success will be measured by how much technology is developed and deployed on its own continent.

For me, however, the most fitting definition again came from Timo König: “Digital sovereignty does not mean autarky, but controlled dependency and a real ability to switch.” The point is not to build everything yourself – it is to be able to switch at any time, without losing data and without operations grinding to a halt.

Particularly practical: König showed how sovereignty can be assessed concretely in tenders. As food for thought, he proposed a weighting in which functional requirements account for only 30 %. The rest is distributed across open source and reuse, data portability, interoperability, security and resilience, exit capability, operability and total cost of ownership over the life cycle. His roadmap: make dependencies transparent in 2026, introduce binding criteria in 2027, pool demand and set up open source program offices in 2028 – so that by 2030 critical services remain operational even in the event of a change of supplier, price shocks or supply-chain problems.

The sovereignty check: how does Cyface measure up?

We measured our own offering against exactly these criteria. Feel free to use the table as a checklist for your next tender:

Our guiding principle is already on our homepage: No lock-in. No data hoarding. No black box. Many providers of condition surveys ultimately sell you only an analysis and keep the raw data for themselves. We merely manage your data – you stay in control, right up to publishing it as open data.

Artificial intelligence: value over hype

Of course, AI was everywhere at SCCON. Many exhibitors offered chatbots and “AI agents” for public administration. The demand is real: according to a Bitkom survey from September 2026 (in German), 57 % of German companies with 20 or more employees now use AI, up from 36 % a year earlier. At the same time, 66 % of the companies using AI name data protection as a hurdle – more often than any other barrier.

But caution is advised. The clearest view of the topic came from a talk by Daniel Manzke (Head of Engineering, IntraFind) at his company’s booth, with the programmatic title “A prompt in a multi-turn chat is not an agent!” Manzke spoke of “agent washing”: the label has outrun the technology. Gartner estimates that only around 130 of the thousands of vendors marketing “agentic AI” actually offer real agents, and that more than 40 % of agentic AI projects will be cancelled by the end of 2027 – due to rising costs, unclear value and weak risk controls. These are predictions, not measured outcomes, but the direction is clear.

I found his five-level spectrum of things that get called “agent” very helpful: chat assistant, tool-using assistant (e.g. document search), workflow, agent and multi-agent system. Only from level four onwards does the model plan, act and decide when it is done. His rule of thumb: chat plus tools plus memory is an assistant. It only becomes an agent when the model chooses its own next step.

Manzke illustrated what this can look like in public administration using 500 submissions on a draft law: ingesting, extracting and synthesising run as a workflow fixed in code with every step traced, followed by human review. Only a small monitor agent decides on its own which late submissions need re-analysis – and even it needs human approval for every change.

His takeaways: start with workflows, because most value today comes from governed workflows with human review. Use multi-agent systems only where roughly 15 times the token cost pays off. And build the foundation first: grounded data, sovereignty, logging and oversight. Or in his words: “The model is the cheap part.”

How we do it at Cyface

We would sign that last sentence immediately. The real value lies in good, carefully collected data – and with us, that data belongs to the customer. We use AI only where we can clearly demonstrate its value, and we develop our models ourselves – GDPR-compliant and based on our own data. Two examples from our practice show how different the answer can be:

• Surface analysis – deliberately without AI: We calculate the surface quality of cycle paths from vibration data using classical signal processing. We did test AI methods for this – but they did not deliver better results. So we stick with the proven, fully traceable method.
• Image analysis – with AI: For evaluating camera images, on the other hand, AI is the right tool. In the DiGuRaL project in Leipzig we trained our own model that recognises asphalt, kerbs, paving and road markings. Here too, most of the work went not into the model but into the data: 1,800 images from regular operations, annotated by hand by our team. Together with the City of Leipzig we secured data protection on the basis of a comprehensive expert opinion; anonymisation methods from Leipzig University are integrated directly into our app.

On request, we also support you in building your own AI models based on the data you have collected – including an honest assessment of whether AI is worthwhile for your use case at all.

Conclusion: good times for open solutions

SCCON 2026 made it clear: the public sector wants open source, it wants sovereignty – and it will increasingly demand both in tenders. Anyone capturing infrastructure data today should therefore already make sure that data, software and know-how are not locked in with a single supplier.

That is exactly what we built Cyface for. We capture the condition of your cycling network with ordinary smartphones – with your existing fleet, through a citizen campaign or via your own app. You receive an objective condition map as a basis for maintenance planning, budgeting and funding applications. And the data belongs to you.

And for those already planning ahead: the next Smart Country Convention takes place in Berlin from 5 to 7 October 2027. See you there!