Digital sovereignty is written in PHP, and the UK just made it fundable

Run this:

curl -s https://www.gov.wales/procurement-act-2023-guidance-assessing-competitive-tenders-html \
  | grep -i 'name="generator"'

Drupal 11. The Welsh Government’s technical guidance on how to score a public tender is served to you by a PHP application, and if you follow that guidance to the letter you cannot award a single evaluation point to the people who maintain it.

Sebastian Bergmann laid out the general case on the PHP Foundation blog at the start of September. Germany spending 108 million euro to move federal websites onto TYPO3. 770 Drupal sites at the European Commission, carrying 700 million visits a year. GovCMS in Australia, 370 sites across 115 agencies. Nextcloud in the German federal cloud at roughly 300,000 users. Against that, the Foundation took 730,534 dollars in total contributions in 2025, ran about 139,000 dollars in the red, and pays thirteen contracted engineers to maintain the language underneath all of it.

Go and read it. I am not going to re-argue the asymmetry, because he already did and with better numbers than I have. What I want to fix is that the argument stops at the Channel.

The proposals are written against the wrong statute

The piece closes with three procurement changes, borrowed from Tiffany Farriss at Drupal4Gov EU. Twenty percent of evaluation points for verified open source contribution, scored as a criterion under MEAT. A slice of contract value ring-fenced for upstream maintenance of the components the delivery depends on, her estimate being 2 to 5 percent. Non-sensitive code contributed back within 30 days.

Good proposals. Written for a legal framework this country stopped using on 24 February 2025.

That is the day the Procurement Act 2023 commenced, and section 19 replaced the most economically advantageous tender with the most advantageous tender. Every procurement newsletter in Britain wrote up the deleted word as a revolution. It is not, and I would rather tell you that than sell you something. The Welsh guidance is blunt about it: the change is not a change in policy, it exists to reinforce for buyers that price does not have to take precedence. Authorities could already weight quality over cost under the old regulations. Most of them just did not.

The change that matters sits two paragraphs earlier in that same guidance, and I have not seen anyone write it up.

Regulation 67(1) of the Public Contracts Regulations 2015 required award criteria to be assessed from the point of view of the contracting authority. The Act drops it. The guidance says what the deletion is for in as many words: benefits of a contract that flow to service users or other stakeholders, rather than to the buying authority itself, may now be explicitly factored in.

There goes the obstacle. Try scoring a supplier on patches sent back to PHP under the old rules and you lose, because the patch does not benefit the council. It benefits every other council, and Wikipedia, and a bank in Osaka. Point of view of the contracting authority is precisely the test that argument fails. It is not the test any more.

What a criterion has to survive

Section 23 has not gone soft, and this is where enthusiasm for a sovereignty criterion dies if you are sloppy. Criteria must relate to the subject matter of the contract, be sufficiently clear, measurable and specific, comply with the rules on technical specifications, and be a proportionate means of assessing tenders given the nature, complexity and cost of what is being bought. The Act gives you no list of permitted criteria, which is the good news. Anything goes as long as it clears those four.

“Supplier demonstrates commitment to open source” clears none of them. Not measurable, not specific, and only vaguely connected to a contract for a planning portal.

This is the version I would put in a tender:

Upstream maintenance. Tenders will be scored on committed contribution to the maintained components on which the delivered service depends, evidenced by merged contributions or funding agreements with the maintaining organisation, and reported quarterly against the dependency manifest of the delivered service.

The dependency manifest is the load-bearing bit. Your composer.lock is the subject matter of the contract. It is measurable down to the package, it is specific, and it is proportionate in a way no generic pledge ever is, because it scales with what you actually depend on instead of with how much a supplier enjoys talking about community.

It also puts PHP in scope without naming PHP once, which I think is the only way this ever gets adopted. An authority buying a CMS should not need an opinion about a programming language. It needs to accept that the thing at the bottom of its lock file has maintainers, and that maintainers have rent.

I would score it at 10 percent, not 20. Farriss said 20 and I understand the reasoning, you open high. But the first authority that tries this is going to defend it to a procurement lawyer who has never heard of any of this in their life, and 10 percent of the quality score survives that meeting. Twenty invites a challenge, and a challenge that lands sets the whole idea back five years. I would rather have a boring precedent than an ambitious case study.

We built the mechanism and then made it optional

LocalGov Drupal is the nearest thing we have to the German story, and in some ways it is the better one. Over 50 councils across the UK and Ireland on one shared publishing platform. Their own figure for a new council website is up to 80 percent cheaper. The community explicitly asks councils to fix bugs upstream instead of patching their own site, which is more discipline than most commercial engineering orgs manage.

Now look at how it is funded. A voluntary subscription, sliding scale on population and budget, starting at £1,000 and capped at £10,000 for the largest councils.

Voluntary. Capped at ten grand.

A county council can save several hundred thousand pounds on a build and the ceiling on giving back is £10,000, if it feels like it that year. I do not read that cap as timidity. It is what you write down when you are asking for money that has no budget line anywhere in local government and you are afraid of scaring people off before they say yes. That is Bergmann’s asymmetry, in sterling, in our own back yard.

And none of it reaches PHP. It reaches the LocalGov Drupal team, who depend on Drupal, who depend on PHP, and the money thins out at every hop.

The standard already says contribute

Service Standard point 12 is make new source code open. Point 13 is use and contribute to open standards, common components and patterns. Contribute is right there in the text. Teams get assessed against these, and teams have failed assessments for not publishing code.

There is no matching line in any budget. A team passes point 13 by using GOV.UK Frontend and never sending a patch anywhere, because contribution has no cost attached and no cost means no plan. We have had the policy for years. What we have never had is the invoice line that makes it operable, and you cannot assess your way to something you did not pay for.

What I would do next week

Bidding public sector work: put the line item in before anyone asks you for it. Price it, name the packages, and put the number in the commercial response rather than burying it in social value where an evaluator will read it as marketing. You will be the only bidder who did, and under a MAT assessment that is not a disadvantage.

Sitting on the buying side: take that paragraph and drop it into your next tender at 10 percent of quality. You need no permission, no policy change, and no working group. Section 23 allows it already, and section 12 arguably pushes you towards it, since maximising public benefit is one of the objectives you have to have regard to throughout.

Maintaining a package a public body depends on: the thing that makes any of this work is being payable. An authority cannot raise a purchase order against “the maintainers”. No legal entity and no invoice address means the criterion scores zero for the supplier who wanted to give you money.

The German consortium bid, won, and is getting paid to move hundreds of federal sites onto a PHP application. The Swiss parliament held that up in the chamber as the example to copy. Nobody in that chain had to love PHP for it to work. They had to write it into a contract.