Public Money, Public Code

This legal framework aims to establish guiding principles for the governance of software funded with public resources, recognizing the central role that digital systems currently play in service delivery, administrative decision-making, and the organization of the State.

There is a growing dependence of public institutions on information systems developed and controlled by private entities, often under proprietary regimes, with significant limitations in terms of transparency, auditability, reuse, and operational continuity. This dependence may create risks of technological lock-in, loss of institutional autonomy, and reduced capacity for democratic scrutiny over critical public administration systems.

In this context, it is necessary to affirm the principle that software funded with public money should be treated as public digital infrastructure, ensuring its availability as open source, its auditability, and its potential for reuse by different public entities.

This proposal is inspired by established international initiatives in the field of free software in the public sector, namely the European initiative “Public Money? Public Code!”, promoted by the Free Software Foundation Europe (FSFE), its open letter addressed to European governments, and the work of the National Association for Free Software (ANSOL).

Definitions

For the purposes of this framework, free and open-source software (FOSS / FLOSS) is defined as software made available under a license that guarantees the right to use, study, modify, and redistribute the source code, including full access to it in all versions funded with public resources.

“Right to Fork” is understood as the right of any public or authorized entity to copy, modify, and operate independently digital systems funded with public resources, allowing for parallel implementations of the same systems.

“Institutional smart contracts” are defined as digital systems that execute administrative rules automatically, based on predefined criteria, in a deterministic, auditable, and verifiable manner.

Article 1 — Purpose and Scope

This framework establishes the principles applicable to the development, funding, acquisition, and use of software financed with public funds, defining its status as essential public infrastructure.

Applicable legal framework: Public Procurement Code (approved by Decree-Law No. 18/2008), Directive 2014/24/EU on public procurement, and Articles 266 and 267 of the Constitution of the Portuguese Republic.

Article 2 — Legal Nature of Public Software

All software funded, wholly or partially, by public funds is classified as public digital infrastructure. Software may not be treated solely as a procurement product or service, and is subject to enhanced obligations of transparency, auditability, and reuse.

Applicable legal framework: Public Procurement Code, Article 266 of the Constitution of the Portuguese Republic, and Directive 2014/24/EU.

Article 3 — Mandatory Licensing

All software funded with public funds must be made available under a free and open-source software license. The source code must be fully accessible to the public, guaranteeing rights of use, study, modification, and redistribution.

Applicable legal framework: Directive (EU) 2019/1024 on open data and the reuse of public sector information, and Regulation (EU) 2016/679 (GDPR).

Article 4 — Public Code Infrastructure

A centralized public repository system for state-funded software shall be established. This system ensures the preservation, versioning, and public access to code developed with public funds.

Reuse of solutions among public entities should be promoted whenever technically feasible.

Applicable legal framework: Regulation (EU) No. 910/2014 (eIDAS), Directive 2014/24/EU, and archival provisions under the Code of Administrative Procedure.

Article 5 — Reuse and Digital Public Procurement

Public entities must prioritize the reuse of existing software funded with public resources before acquiring or developing new solutions. Public procurement of software must include clauses ensuring code availability in accordance with Article 3.

Applicable legal framework: Public Procurement Code, Directive 2014/24/EU, and Directive (EU) 2019/1024.

Article 6 — Operational Independence and Right to Fork

The possibility of independent implementation of public systems must be ensured, in accordance with the “Right to Fork” concept. No entity may hold exclusive or irremovable control over digital systems essential to public service delivery. The technical and legal feasibility of independent versions of public systems must be guaranteed.

Applicable legal framework: Articles 266 and 267 of the Constitution of the Portuguese Republic, Directive (EU) 2022/2555 (NIS2), and principles of continuity of public service.

Article 7 — Rule-Based Systems and Institutional Smart Contracts

Digital systems used for the automatic execution of administrative rules must be defined in a deterministic and verifiable manner. These systems must be fully auditable regarding their operational logic and decision-making criteria. Non-transparent changes to execution logic without public and auditable records are not permitted.

Applicable legal framework: Article 22 of the GDPR, Code of Administrative Procedure, and eIDAS 2 Regulation.

Article 8 — Funding and Maintenance

Specific budget allocations must be ensured for the maintenance, security, auditing, and continuous improvement of public software. Public funding must guarantee the long-term sustainability of the free software ecosystem in the public sector.

Applicable legal framework: State Budget Law, Budgetary Framework Law, and Directive (EU) 2022/2555 (NIS2).

Article 9 — Prohibition of Exclusive Dependence

Exclusive dependence on proprietary software, non-reproducible services, or closed interfaces in critical public sector systems is not permitted. The capacity for independent operation of essential systems must be ensured.

Applicable legal framework: Directive 2014/24/EU and Public Procurement Code.

Article 10 — Exceptions

Exceptions to the established principles may only be permitted in duly justified cases, namely for reasons of national security. Such exceptions must be time-limited, proportionate, and subject to independent oversight.

Applicable legal framework: Article 272 of the Constitution of the Portuguese Republic, Internal Security Law, and Directive (EU) 2022/2555 (NIS2).

Final Provision

This framework aims to ensure the State’s digital sovereignty, guaranteeing that technological infrastructure funded with public resources remains open, auditable, reusable, and under democratic control, thereby ensuring transparency and the continuity of public services in the digital age.

LINK DO PETITION: https://peticaopublica.com/pview.aspx?pi=PT130818