CodeSupply open call (2027-01Y)

CodeSupply open call 2027-01Y administered by NLnet funds free and open source components that improve software supply chain security, with a call budget shown as €300,000 and individual first-proposal requests expected between €5,000 and €50,000 (maximum lifetime support €60,000 per third party). The single-stage submission deadline is 03 February 2027 at 12:00 Brussels time and projects should run 1–12 months with milestone-based payments. Applicants may be individuals or organisations but must demonstrate a strong European dimension, typically by directing at least 60 percent of funds to contributors in Horizon Europe eligible countries. All project results must be released under recognised free or open source licences and the call prohibits generative AI for proposal writing and restricts AI-generated deliverables, with evaluation based on technical excellence, relevance/impact and cost effectiveness.

What is funded

Scope

Grants for development of free and open source software and related R&D that extend CodeSupply's federated software package metadata platform (origin, licensing, vulnerabilities, quality metrics) and contribute to the Open Internet Stack.

Assessment is competitive and performed in two stages with external review; criteria emphasise technical excellence, relevance/impact and cost effectiveness. Milestone-based payments; grants are not paid up front.

Footnotes

1. 1Full call text, eligibility rules, guide for applicants and FAQ are available from the CodeSupply pages: CodeSupply main page and the NLnet proposal form NLnet propose.

Who can apply and what is eligible

Application, submission and evaluation process

Key administrative and eligibility constraints

Finance, budgets and eligible amounts

Assessment criteria and scoring

Applications are evaluated using weighted criteria. Initial weighted scoring must exceed a threshold to progress. Reviewers can request clarifications and propose minor changes during the second stage, and independent reviewers validate final selections.

Application form structure and guidance — fields to prepare

The NLnet proposal form is concise. Prepare the following information in English and plain text before starting the online form to keep the process fast.

Project maturity and sector

Geographic scope and mentioned countries

Number of stages, success rates, co-funding and other constraints

Templates and application form structure (short checklist)

The NLnet form fields printed in the guidance should be prepared in plaintext and pasted into the online form. Recommended structure and lengths are provided (character limits in guidance). The form is intentionally light-weight and geared to fast submission. Applicants should include a short project summary, a clear budget and milestone plan, and concise answers to ecosystem, technical challenge, and team qualification prompts.

Risk management, conflicts of interest and audit

How to prepare a competitive proposal

Useful links and references

Primary information, guidance and the application form are hosted by NLnet. Applicants should read the CodeSupply Guide for Applicants and NLnet's Generative AI policy before starting a proposal CodeSupply guide NLnet propose. Official call listing on the EU Funding & Tenders Portal is available; see the CodeSupply call entry for grant agreement references and programme details EU call listing.

This document summarises the CodeSupply open call for proposals and extracts eligibility, financial, procedural and technical details from the NLnet and EU call pages. For full and authoritative rules, eligibility lists, country lists and the latest deadlines consult the NLnet CodeSupply pages and the EU Funding & Tenders Portal. See the NLnet proposal entry point and guide for applicants before submitting 1.

Footnotes

1. 1NLnet proposal form and guide for applicants contain the application form fields and detailed guidance. Start your application at nlnet.nl and read the guide at nlnet.nl.

Executive summary

CodeSupply is an EU supported cascade funding opportunity for independent researchers, developers and organisations developing free and open source components that improve software supply chain security. Projects should contribute practical technology, data, integrations, standards, infrastructure, security capabilities, documentation or usability improvements related to comprehensive and trustworthy software package metadata. The call is designed to support auxiliary projects that strengthen the CodeSupply ecosystem and the wider Open Internet Stack. 1

The call record identifies a total available budget of €300,000, project requests between €5,000 and €50,000, and an expected participation period of 1 to 12 months with flexibility. The deadline is 03 February 2027 at 12:00 Brussels time. 2

This is a competitive sub-granting call rather than a conventional Horizon Europe collaborative project call. Applications are submitted through the NLnet proposal system, not directly through the European Commission Funding and Tenders Portal. 3

Opportunity profile

Key facts

What the funding is about

CodeSupply aggregates, curates and distributes software metadata from authoritative sources across programming ecosystems and software types. The metadata may cover software origin, licensing, vulnerabilities, quality indicators and related information needed to assess and manage software supply chain risks. The intended model is federated, digitally sovereign and openly accessible, allowing users to obtain reliable data without dependence on a single proprietary provider. 4

The call seeks additional free and open source components that deliver concrete value around this infrastructure. Proposals may address the core metadata system directly or provide complementary tools and capabilities that improve adoption, interoperability, security, maintainability and practical usefulness.

The principal policy and technology objectives are:

Who can apply

The call is open to individuals, informal collectives, associations, not-for-profit entities, SMEs, companies, research and technical groups, and other formal or informal organisations. Applicants do not need to be a university, research institute or established legal entity. A person may apply individually, and members of a project may be paid directly by NLnet where this is agreed. 5

There is no general categorical exclusion based on applicant type. However, applicants must demonstrate a strong European dimension. The normal route is to have contributors from Horizon Europe eligible countries receive at least 60 percent of the project funding. A project being useful to Europe by itself is not sufficient if the people carrying out the work do not meet the relevant geographic criterion. Exceptional proposals from outside the eligible geographic area may be considered where the proposer has unique technical expertise. 6

Applicants under the legal age may submit initially, but guardian consent may be required before further negotiations or grant contracting. Applicants may use an alias during parts of the process, although identity information will be required for compliance purposes if a project is selected.

The following parties are generally excluded because of conflict of interest safeguards:

Unpaid involvement in wider non-profit, academic, standards or open source communities does not automatically create an exclusion, provided the applicable independence and conflict of interest conditions are respected.

Eligible activities

Eligible work must have a clear link to CodeSupply and be cost effective. The work should have research and development as its primary objective and should produce a concrete contribution to the open internet stack.

Examples of potentially relevant proposals

Funding amount and funding rate

The call description requests between €5,000 and €50,000 per first proposal. The programme guide states that a first proposal may request up to €50,000. The maximum cumulative amount available to one third party over the lifetime of CodeSupply is €60,000, and the maximum amount per proposal is also €60,000. Therefore, an applicant should not assume that a first application can exceed €50,000. 7

The funding is not described as a percentage reimbursement scheme. No standard EU co-financing rate is specified. NLnet determines the amount necessary to achieve the agreed objectives, taking account of projected costs, expected value, cost effectiveness and any costs considered ineligible. The final amount is recorded in a Memorandum of Understanding between NLnet and the selected grantee.

The grant is described as a donation made by a recognised public benefit organisation. Applicants should nevertheless obtain their own tax and accounting advice because the treatment of donations, grants and direct payments can vary according to the applicant's jurisdiction and legal status.

Projects above €50,000 are subject to additional conditions. A larger proposal must normally be preceded by one or more successfully completed smaller projects under CodeSupply or an equivalent programme. Earlier deliverables must have been made publicly available under recognised open or free licences, accessibility requirements must have been addressed, and any required security audit issues must have been satisfactorily handled.

Budget expectations

The application should provide a clear breakdown of how the requested amount will be used, the tasks to be completed, the effort or time allocated to each task, and the hourly, daily or monthly rate applied. The budget should be proportionate to the deliverables and should demonstrate value for money.

The call does not indicate a general overhead or indirect cost percentage. Costs that are not necessary for the proposed objectives, are insufficiently justified or are considered ineligible may be removed from the proposed grant. Applicants should avoid presenting a broad institutional budget and instead link each cost to a defined technical task or milestone.

Project duration and payment

The expected participation period is 1 to 12 months and is flexible. The proposal should define a realistic sequence of activities and measurable milestones that can be completed within the agreed period. Projects should be structured so that useful results are delivered progressively rather than only at the end.

The grant is not paid entirely in advance. The project is divided into milestones, with an amount allocated to each milestone. After a milestone is completed, the grantee submits a payment request and evidence of the result before proceeding to the next milestone. 8

The final milestone plan, payment conditions, deliverables and reporting expectations will be set out in the Memorandum of Understanding. The exact payment schedule should therefore be treated as a contracting matter rather than a fixed call-wide rule.

Open source, licensing and accessibility requirements

All project results must be made available under recognised free or open source licences. Software and hardware developed through the project are expected to be released in their entirety under an appropriate recognised licence. Scientific results must be published through open access where applicable. Proprietary outputs that are not meaningfully connected to the open source contribution should not be treated as the funded result. 9

Applicants should select licences that permit reuse, redistribution, modification and further development, while checking compatibility with upstream dependencies and any relevant patent or trademark constraints. Existing proprietary technology may remain outside the funded scope only where the funded component is relevant, independently releasable and not dependent on proprietary restrictions that undermine its open use.

The programme also expects delivered software artefacts to address accessibility, including WCAG compliance where applicable. Applicants should include accessibility requirements, testing and remediation in the technical plan, especially for web interfaces, documentation and user-facing tools.

Generative artificial intelligence conditions

NLnet's policy prohibits the use of generative AI when writing the proposal or answering interactive evaluation questions, including generating ideas, restructuring, shortening or translating proposal text. There is an accessibility exception for applicants who rely on AI based assistive technology, but this use must be disclosed. 10

Within the funded project, generative AI may not be used to produce project artefacts such as source code, designs or documentation. Read-only use, such as checking code for possible security issues, may be permitted if the human contributors create the fixes and remain responsible for the results. Known use of generative AI must be disclosed at project level, and significant AI generated code in an existing or planned codebase must be reported.

AI usage costs are not eligible. Applicants should establish a clear contributor policy, maintain provenance information and ensure that every contributor understands and can explain the technical decisions and outputs for which they are responsible.

Application requirements

Applications are submitted through the NLnet proposal form in English. The application is intended to be concise and self-contained. Attachments are not normally required, although supplementary files may be supplied within the stated file size limit where they materially support the proposal.

Applicants should prepare the following information:

The proposal should identify concrete outputs, acceptance criteria, users, dependencies, upstream projects and maintenance arrangements. A strong submission should also explain how the result will remain useful after the grant ends and how it will be adopted by relevant open source, standards, public sector or commercial communities.

Evaluation and selection

The process includes an initial eligibility and quality assessment, a second stage involving clarification and possible refinement, and an external review by an independent committee. Proposals failing mandatory eligibility conditions are rejected without substantive scoring.

The initial scoring weights are:

The weighted score must exceed 5.0 out of 7 to pass to the next stage. In the second stage, reviewers may ask questions, request evidence, propose minor improvements and examine issues such as differentiation from existing projects, technical risks, standards, upstream collaboration, sustainability and the reasonableness of proposed rates.

The revised proposal may receive a new rating. If the revised plan scores lower than the original, the original rating may be retained. Projects are ranked against the quality of the round and the remaining budget. The final selection is independently checked by reviewers from the internet, open source, academic and public sectors, with at least two committee members reviewing each project for eligibility.

Application and assessment timetable

The application process is expected to take approximately three to five months from the call deadline. Applicants should plan for possible clarification questions and should not assume that submission automatically authorises project expenditure.

The call is single stage from the applicant's perspective, but the internal assessment has two substantive evaluation stages followed by independent review. A project that cannot provide requested clarifications or an adjusted plan within the allocated time may be moved to a subsequent call.

Key risks and conditions for applicants

Recommended proposal strategy

Overall assessment

CodeSupply is a strong fit for independent technical teams that can deliver a small, clearly scoped and openly licensed contribution to software supply chain security. It is particularly relevant to developers working on package ecosystems, metadata quality, vulnerability and licence information, data federation, open standards, security assurance, developer tooling, interoperable APIs and accessible user interfaces.

The opportunity is less suitable for proprietary product development, general organisational research without a concrete technical output, activities that cannot be released openly, or proposals whose principal purpose is commercial deployment rather than open research and development. The strongest applications will combine a technically credible deliverable with evidence of ecosystem demand, European participation, practical adoption potential and excellent value for money.

Official information sources

The specific call record, NLnet CodeSupply page, applicant guide, eligibility page, frequently asked questions and generative AI policy should be read together before submission. The call record supplied for this analysis is controlling for the 2027-01Y deadline, call budget and participation period. 11

Footnotes

1. 1Official CodeSupply programme description and objectives: CodeSupply programme page; European Commission call record: EU Funding and Tenders Portal
2. 2The opportunity metadata and European Commission portal record supplied for this analysis state an opening date of 03 November 2026, a deadline of 03 February 2027 at 12:00 Brussels time, total available funding of €300,000 and expected participation of 1 to 12 months.
3. 3Submission guidance: NLnet proposal form
4. 4CodeSupply describes its purpose as aggregating and curating software package metadata covering origin, licensing, vulnerabilities and quality metrics, and making the resulting data openly available: CodeSupply programme page
5. 5Applicant categories and legal entity requirements: CodeSupply FAQ
6. 6European dimension and eligibility requirements: CodeSupply eligibility information
7. 7Funding ceilings and lifetime limit: CodeSupply Guide for Applicants
8. 8Milestone based payment information: CodeSupply FAQ
9. 9Open licensing and open access requirements: CodeSupply Guide for Applicants
10. 10Generative AI requirements: NLnet Generative AI policy
11. 11Supporting official pages: CodeSupply Guide for Applicants, CodeSupply eligibility, CodeSupply FAQ, EU Funding and Tenders Portal