CodeSupply open call (2026-11Y)

CodeSupply open call (managed by NLnet) funds small-to-medium R&D projects that improve software supply chain security, software metadata, open data access, and open source licensing and compliance. Total budget for the open calls is €400,000 with typical grants of €5,000–50,000 (maximum lifetime cap per third party €60,000) for projects expected to run 1–12 months. The call is open to individuals and organisations with a clear European dimension and requires all scientific outcomes to be open access and any novel software or hardware to be released under a recognised free and open source licence. The call opened 3 September 2026 and the single-stage submission deadline is 3 November 2026 at 12:00 Brussels time via NLnet's proposal portal.

What it funds

Competitive small-to-medium R&D grants to develop open source tools, datasets and integrations that improve software package metadata, supply chain security, provenance and license compliance. Activities supported include research, open source software/hardware development, security audits, testing, documentation, standardisation, usability work, packaging and community events.

Funding envelope:Total budget reserved for open calls: €400,000. Individual awards: typically €5,000 to €50,000 for a first grant; maximum per proposal normally €60,000 over the programme lifetime.

Who can apply

Open to anyone worldwide including private individuals, researchers, SMEs, non-profits and other organisations. EU-supported funds require a clear European dimension and preference for applicants from Horizon Europe eligible countries. Projects must publish results as open access and release code/hardware under recognised free/open source licences.

Key dates and duration

Selection and evaluation

Proposals scored on a 7-point scale across technical merit (30%), strategic relevance to the Open Internet Stack and CodeSupply goals (40%), and value for money (30%). Weighted score must exceed 5.0/7 to progress. Two-stage review with an independent review committee.

How to apply

Submit proposals through NLnet’s form. Keep main application concise (equivalent of two pages). Applicants must disclose any use of generative AI and follow NLnet’s GenAI policy where applicable NLnet proposal page ¹.

1. 1Activities must align with CodeSupply objectives: publish comprehensive software metadata; enable democratic access to datasets; build a foundational, extensible framework.
2. 2All deliverables must be open access and under recognised free/open source licences.
3. 3First-time proposals may request up to €50,000; exceptional or follow-up grants can be higher up to programme limits.

Footnotes

1. 1Full call text, guide for applicants and FAQ available at the CodeSupply page hosted by NLnet: nlnet.nl and application form: nlnet.nl.

Core facts

Opportunity title:CodeSupply open call (2026-11Y). Call context: CodeSupply is funded under Horizon Europe (Grant agreement No. 101298846) as part of HORIZON-CL4 (Drive the evolution of the internet towards open and interoperable Web 4.0 and Virtual Worlds: building blocks in priority areas). Managing grant handler and contact for submissions: NLnet Foundation via nlnet.nl. Opening date: 03 September 2026. Submission deadline (single-stage): 03 November 2026, 12:00 Brussels time (CET). Expected duration of funded projects: 1 to 12 months (flexible). Total programme budget reserved for these open calls: €400,000. Typical individual grant size for first grants: €5,000 to €50,000. Maximum allowed per single proposal in practice: €60,000 lifetime cap per third party across the programme, with a first proposal allowed up to €50,000 and additional conditions for higher amounts as described below.

Primary objective:Support small to medium R&D contributions that publish open software package metadata and otherwise materially advance CodeSupply goals: publish current/correct/comprehensive software metadata; establish scalable democratic access to datasets; create a foundational extensible framework for future datasets and iterations.

Who can apply and eligible applicant types

Open eligibility:anyone may apply, including private individuals and organisations of any type, provided the proposal demonstrates a clear European dimension and primarily targets research and development. Explicit eligible applicant types include but are not limited to startups, SMEs, large enterprises, universities, research institutes, nonprofits, NGOs, public sector bodies, consortia of individuals or organisations, and individuals acting as third parties. Projects from organisations that are part of the CodeSupply consortium or NLnet staff are excluded from applying to avoid conflict of interest. Applicants should follow NLnet application guidance and supply required declarations. Proposals must be submitted in English and be concise (main application no longer than the equivalent of two pages in the NLnet submission form).

Funding type and nature of support

This is a grants programme (cascade/sub-granting funding managed by NLnet). Beneficiaries receive monetary support (donations/grants) to carry out R&D tasks. The grants are intended as donations administered by NLnet foundation and are paid under favourable tax conditions as charitable gifts where applicable. In addition to money, NLnet offers non-financial practical support services to grantees in some programmes (for example accessibility scans, security audits, packaging and standards guidance), but the open call itself primarily awards cash grants.

Consortium requirement and application type

Application model:single-stage open call for individual projects. No mandatory multi-partner consortium is required; single applicants (individuals or single legal entities) may apply. Consortium proposals are allowed but not required. Submission method: applicants must apply through NLnet's online proposal portal at nlnet.nl and follow the call-specific guide for applicants and FAQ. Calls are described as recurring/continuous until the overall programme budget is allocated, but this specific deadline is single-stage and with a cut-off on 03 November 2026 12:00 CET.

Geographic eligibility (beneficiary scope)

Programme requires a clear European dimension and primarily targets applicants from Horizon Europe eligible countries (EU Member States and associated countries). NLnet guidance states applicants should (mostly) be from Horizon Europe-eligible countries. The call is funded by the European Commission and intended to serve European public interest objectives; applicants should ensure they meet eligibility rules described on the NLnet call page and CodeSupply guide for applicants NLnet CodeSupply guide ¹.

Target sectors and topics

Primary thematic focus:software supply chain security, open source software ecosystems, open data for software package metadata, cybersecurity, software provenance, regulatory and open source license compliance, and interoperability within an Open Internet Stack. Technical activities supported cover software engineering, security audits, metadata aggregation and curation, packaging and deployability, standards participation, documentation and education, validation studies, and prototype development relevant to federated, digitally sovereign metadata catalogues.

Project maturity and expected activities

Acceptable project stages:research, development, validation, demonstration and early-stage deployment. Projects should have an R&D focus. Deliverables must be open access and software/hardware must be released under recognised free and open source licences. Projects typically are short (1 to 12 months) and oriented toward practical contributions that can be integrated into CodeSupply or complementary Open Internet Stack initiatives (for example integrations, tooling, metadata pipelines, UX improvements, interoperability adapters).

Eligible activities (detailed)

1. 1Scientific research directly relevant to software package metadata and supply chain security.
2. 2Design and development of free/libre open source software and open hardware.
3. 3Validation studies, constructive inquiry into existing or novel technical solutions.
4. 4Software engineering for new usage areas, quality improvements and packaging for deployability.
5. 5Formal security proofs, security audits, software testing setup and CI design.
6. 6Documentation and educational materials for researchers, developers and end users.
7. 7Standardisation activities including standards body membership fees (if cost-effective and relevant).
8. 8User requirements analysis, usability and inclusive design work.
9. 9Participation in technical community events (admission, travel and subsistence costs).
10. 10Project management and reasonable out-of-pocket infrastructure costs essential to execution.
11. 11Other activities adhering to robust software development and deployment practices as judged relevant by reviewers.

Evaluation process and scoring

Two-stage assessment process with initial eligibility knock-out followed by scoring and an interactive second stage for clarification and improvement. Scoring uses a 7-point scale across three weighted criteria: technical merit (30% weight), strategic relevance to the Open Internet Stack and expected contribution to CodeSupply goals (40% weight), and overall value for money (30% weight). Projects need a weighted total above 5.0 out of 7 to pass to the second stage and to be considered for funding. The second stage includes reviewer questions and may require clarifications; reviewers may request budget adjustments or minor plan modifications. A final independent review committee validates selections. At least two independent reviewers validate each shortlisted project and the committee checks eligibility and frugality.

Selection thresholds and outcome:Threshold to progress: weighted score > 5.0/7. Final ranking and funding depend on remaining budget and strategic potential; projects scoring below the cut-off are informed promptly.

Funding amount and limits

Per-call total budget:€400,000 (reserved for CodeSupply open calls). Individual grant amounts: typically between €5,000 and €50,000 for first grants. Boundary conditions: a first proposal may request up to €50,000. The programme allows a maximum of €60,000 to be granted to a single third party across the lifetime of CodeSupply. Projects above €50,000 should normally be preceded by smaller projects previously completed under CodeSupply (or equivalent) demonstrating public deliverables, WCAG compliance where applicable, and satisfactory handling of any independent security audits. Projects larger than €50,000 may be subject to an independent security audit and payment might be conditioned on audit outcomes. The exact grant amount is determined by NLnet/CodeSupply based on projected costs, eligible expenses and value for money; amounts can be adjusted during the MoU negotiation.

Co-funding and eligible costs

Co-funding is not explicitly mandated as a strict requirement in the call text; the awarded amount is set to what is necessary to deliver project objectives and is adjusted for ineligible costs. Applicants must provide a realistic budget breakdown and justify rates; reviewers evaluate value for money. NLnet may reduce or adjust requested budgets for costs judged ineligible or excessive. The final breakdown and eligible cost items are formalised in the Memorandum of Understanding (MoU) between NLnet and grantee.

AI usage policy and disclosure

Strict policy on generative AI:NLnet discourages AI-generated proposals. Any use of GenAI in the application must be disclosed and accompanied by a full prompt provenance log. For project execution, use of GenAI is permitted only with transparency, provenance logging, and compliance with FLOS licensing and copyright requirements. Purely AI-generated outputs (without substantial human intellectual contribution) are not eligible for payment as deliverables. Generated content must be marked as such in project outputs and documentation. Full policy details are provided by NLnet and apply both to proposals and funded projects NLnet GenAI policy ¹.

Application form structure and templates (how to prepare your submission)

Applications are submitted through NLnet's online form at nlnet.nl. The submission form solicits concise plain-text answers in English. Key sections to prepare and include: which fund you apply for; project website(s)/repositories; short summary of proposed project and expected results (max 1000 characters); requested amount (€5,000 to €50,000 for first grants) and a detailed budget breakdown; task list with time/effort estimates and applied hourly/daily/monthly rates; comparison with existing work and novelty/added value; expected technical challenges; ecosystem and stakeholder engagement plan; applicant/team credentials and relevant track record; prior or current funding sources if any; attachments optional (spreadsheets, diagrams, endorsements). The form includes explicit fields for AI disclosure (did you use GenAI?). Applicants are encouraged to keep proposals short and to the point, and to include public repository links and proof-of-concept artifacts where available.

1. 1Project summary (short text, 1000 characters).
2. 2Requested funding amount and budget breakdown (detailed expense categories and rates).
3. 3Task list and time allocation per task; hourly/daily/monthly rates used.
4. 4Comparison with related projects and differentiation (max 4000 characters).
5. 5Technical risks and mitigation (max 4000 characters).
6. 6Ecosystem engagement and main users (max 2000 characters).
7. 7Team qualifications and relevant experience (max 2000 characters).
8. 8Other funding sources (max 1000 characters).
9. 9Optional attachments: supplementary materials up to 50 MB in multiple formats.
10. 10GenAI disclosure and prompt log if GenAI used.

Application stages and timeline

Two principal review stages:1) Eligibility screening and scoring based on application text (knock-out criteria apply); 2) Interactive second stage for shortlisted proposals with clarifying questions and potential plan adjustments followed by re-scoring and ranking. An independent review committee performs final validation. Typical number of application stages: 2. Expected response timing: applicants not passing the first stage are informed promptly to seek other funding; shortlisted applicants participate in the interactive phase and then receive final decision depending on ranking and remaining budget. Memorandum of Understanding negotiation and signature follows selection for each awarded project.

Success rate and competition:No explicit success rate is published. Selection depends on proposal quality, strategic relevance, scoring above the 5.0/7 threshold, and remaining programme budget. Given total reserved amount €400,000 and typical grant size €5,000–50,000, funding rounds will support multiple small/medium projects; applicants should expect competitive selection and prepare concise, high-value proposals.

Reporting, deliverables and open access requirements

All scientific outputs must be published as open access. All software and hardware developed under the grants must be published in their entirety under a recognised free and open source license (FLOS). Projects that use GenAI must ensure outputs can be published under FLOS and provide provenance information. Deliverables, code, documentation and datasets are expected to be publicly accessible to allow reuse and integration into CodeSupply and the Open Internet Stack. Outcomes may be subject to independent verification and, for larger projects, security audits which may influence payment milestones.

Conflict of interest and reviewer independence

Reviewing is performed by NLnet professional staff and an independent review committee of unpaid experts. NLnet and consortium members are excluded from applying; NLnet staff and committee members must declare conflicts of interest and are excluded from related decisions. The process includes multiple independent checks to ensure fairness and frugality. Contributors who are volunteers or members of not-for-profits connected to consortium partners are not automatically excluded, provided no direct conflict exists and independence is maintained.

Practical next steps to apply

1. 1Read the CodeSupply main call page and Guide for Applicants on NLnet: nlnet.nl ¹.
2. 2Prepare a concise proposal in English, structured to follow the NLnet online form fields (summary, budget breakdown, tasks, rates, comparisons, risks, ecosystem, team).
3. 3Ensure deliverables will be released under recognised FLOS licences and that you can comply with GenAI disclosure if applicable.
4. 4Collect public repositories, proof-of-concept artefacts, and references to substantiate technical claims.
5. 5Submit via NLnet's proposal portal at nlnet.nl before 03 November 2026 12:00 CET.

Mentioned countries and geographic references

No specific list of countries is given in the call text. The programme expects applicants to have a clear European dimension and be mostly from Horizon Europe eligible countries (EU Member States and Horizon-associated countries). The call is EU-funded and administered by NLnet, a Netherlands-based foundation; submission deadline times are given in Brussels time/CET.

Summary: What is this opportunity about and who should apply?

CodeSupply open call (2026-11Y) is a targeted small-to-medium R&D grant programme funded under Horizon Europe and managed by NLnet foundation. It seeks concise, practical proposals that produce open, reusable outputs addressing software package metadata, software supply chain security, software provenance, licensing and compliance, and related tooling and processes that feed into a federated, digitally sovereign CodeSupply data catalog and the broader Open Internet Stack. Grants typically range from €5,000 to €50,000 for first projects, with strict open-source and open-access requirements and a maximum lifetime cap per third party of €60,000. Anyone (individuals or organisations) with a clear European dimension and an R&D-focused plan may apply via NLnet's online submission system. The evaluation uses a two-stage process with quantitative scoring on technical merit, strategic relevance and value for money; proposals must score above 5.0/7 (weighted) to proceed. Applicants should prepare a short, evidence-backed proposal, a clear budget breakdown, disclose any GenAI use with a prompt log, and commit to releasing results under recognised free/open licences. This call is part of a larger Open Internet Stack effort to build interoperable, trustworthy, and open foundational internet technologies.

Footnotes

1. 1NLnet CodeSupply main call, Guide for Applicants and GenAI policy pages: nlnet.nl and nlnet.nl and nlnet.nl. These pages contain full application instructions, the Guide for Applicants PDF and the generative AI disclosure requirements referenced in this summary.

This is a cascade funding open call under the CodeSupply programme, run by NLnet, to support small to medium size research and development projects that improve software supply chain security through better software metadata, open data access, and open source licensing and compliance support.[1][3]

What the opportunity supports

CodeSupply focuses on open data about software packages and on federated software metadata, including origin and licensing information, security vulnerabilities, and quality metrics, with the goal of strengthening software supply chain management and supporting security, regulatory, and open source compliance needs.[1][3][4]

The programme has three stated objectives:publish current, correct, and comprehensive software metadata; establish a scalable and sustainable mechanism for democratic access to data sets; and create a foundational framework for future iterations, enhancements, and new data sets.[3][4]

Funding range:The call seeks proposals between 5000 and €50000, with later scale up possible in other NLnet programmes if a project proves successful.[1][2]

Timing:The first call opened on 3 September 2026 and the deadline is 3 November 2026 at 12:00 Brussels time; participation is expected to last 1 to 12 months.[1][3]

Who can apply

The call is open to anyone, including individuals, informal groups, and organisations of any type, and a legal entity is not required at the application stage.[3][4][6]

Applicants should present a clear European dimension, and if proposals are otherwise equal, applicants based in the EU or in Horizon Europe associated countries receive priority.[4][6]

The eligibility information also states that young people below the legal age of consent in their country of origin may apply at submission stage without prior guardian consent, although consent will be needed for later negotiations.[4]

Eligible activities

• Scientific research and constructive inquiry into existing or novel technical solutions.[4]
• Design and development of free and open source software and open hardware, including software engineering, security proofs, security audits, testing, and continuous integration.[4]
• Documentation for researchers, developers, and users, standardisation work, user requirements analysis, usability and inclusive design, packaging, and other deployability measures.[4]
• Participation in hackathons, IETF, W3C, RIPE, FOSDEM, and similar events, including admission fees, travel, and subsistence costs, as well as project management and essential infrastructure costs.[4]

Selection and application requirements

Proposals should be complete and concise, with the main application limited to the equivalent of two pages, should fit the topic closely, should have research and development as the primary objective, and should be submitted through the NLnet proposal process after reviewing the call page and applicant guide.[1][2][3][4]

The programme uses a 7 point scoring scale with three weighted criteria:technical merit at 30 percent, strategic relevance to the Open Internet Stack and expected contribution to CodeSupply at 40 percent, and overall value for money at 30 percent.[3][4]

Projects need a total weighted score above 5.0 out of 7 to be selected.[3][4]

The call also states that AI generated proposals are generally not welcome, and any submission involving AI must provide a full prompt log and clearly mark all generated content.[3][4]

Funding conditions and obligations

All scientific outcomes must be published as open access, and any novel software or hardware created under the grant must be released in full under a recognised free and open source license.[1][3][4]

The available material does not publish a co funding percentage or reimbursement rate, so applicants should treat this as a direct grant call governed by the stated amount ranges and eligibility rules.[1][2][3]

The broader CodeSupply programme is expected to run with recurring open calls until the budget is allocated, and successful projects may be able to scale further in other NLnet programmes such as Restack.[1][2][6][8]

The main call page and the guide for applicants contain the fuller call text, FAQ, and proposal instructions¹.[1][2]

Footnotes

1. 1Official programme resources are available at CodeSupply main call page and CodeSupply guide for applicants.[1][2]