Document Foundation urges EU to ditch Excel lock-in for cybersecurity law consultation
- Reference: 1772733028
- News link: https://www.theregister.co.uk/2026/03/05/document_foundation_excel/
- Source link:
The nonprofit behind LibreOffice says the Commission's request for stakeholder input, [2]published this week , requires responses to be submitted using a template available only as an .xlsx spreadsheet, a format that is controlled by Microsoft and typically edited using Excel or compatible tools.
For an institution that has spent years promoting open standards, digital sovereignty, and reduced reliance on proprietary technology, that choice sends the wrong signal, the foundation argues.
[3]
In [4]a blog post and open letter , the group says the approach creates what it calls a "structural bias" in the consultation process. Anyone wishing to provide structured feedback on the CRA guidance must use a format tied to a single vendor's ecosystem, which risks disadvantaging organizations that operate entirely on open source tools or open document standards, it adds.
[5]
[6]
"Requiring participants to use this format as the sole vehicle for structured data entry effectively conditions participation in a public consultation on the availability or willingness to use software produced by a single supplier," the letter reads.
The Foundation says the Commission could easily provide the same template in an open format alongside the proprietary one – most obviously the Open Document Format (.ods), an ISO-standard used by LibreOffice and other open source office suites.
[7]
This matters, the Foundation says, because the consultation process is supposed to be open to citizens, public bodies, and organizations across Europe, including those that have deliberately adopted open source software in line with EU policy recommendations.
Brussels has repeatedly pushed those very ideas. EU guidance has long nudged public bodies toward open standards and away from vendor lock-in, and the bloc's open source strategy is meant to cut reliance on proprietary platforms. Even the Cyber Resilience Act itself is framed around reducing the risks of opaque technology stacks.
[8]LibreOffice adds voice to 'ditch Windows for Linux' campaign
[9]Farewell WordPad, we hardly knew ye
[10]BOFH : Darn Windows 7. It's totally why we need a £1k graphics card for a business computer
[11]A certain millennial turned 30 recently: Welcome to middle age, Microsoft Excel v2
The Document Foundation says asking stakeholders to comment on CRA guidance using a proprietary spreadsheet format undermines the message.
"The Commission's credibility on digital sovereignty, open standards, and vendor-independent infrastructure is undermined … each time its own processes rely exclusively on proprietary formats," the group writes.
The Foundation is now urging other free and open source software projects and advocates to sign a joint letter asking the Commission to provide consultation templates in both proprietary and open formats going forward, or ideally supplement them with a web-based form.
[12]
The group's fix is straightforward enough: release the template in both .xlsx and ODF and let people choose what works. If Brussels can't manage that, its crusade against vendor lock-in may end up derailed by a spreadsheet. ®
Get our [13]Tech Resources
[1] https://www.theregister.com/2023/12/04/infosec_in_brief/
[2] https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16959-Draft-Commission-guidance-on-the-Cyber-Resilience-Act_en
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/publicsector&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aaoLEz6bEVXH9gHcNHkV6AAAAo4&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://blog.documentfoundation.org/blog/2026/03/05/cra-guidances/
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/publicsector&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aaoLEz6bEVXH9gHcNHkV6AAAAo4&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/publicsector&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aaoLEz6bEVXH9gHcNHkV6AAAAo4&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/publicsector&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aaoLEz6bEVXH9gHcNHkV6AAAAo4&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2025/06/16/libreoffice_ditch_windows/
[9] https://www.theregister.com/2023/09/04/microsoft_deprecates_wordpad/
[10] https://www.theregister.com/2020/02/07/bofh_2020_episode_3/
[11] https://www.theregister.com/2017/11/24/microsoft_excel_30_years_old/
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/publicsector&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aaoLEz6bEVXH9gHcNHkV6AAAAo4&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[13] https://whitepapers.theregister.com/
Re: OOXML is also an open and ISO standard
I assume that the spreadsheet is one that OpenOffice will read and that respondents can use OO to create their submissions. (I think we'd be hearing much more from them if that weren't the case.)
So, yeah, this is a storm in a tea-cup.
Re: OOXML is also an open and ISO standard
OpenOffice itself can read but not write XLSX (I just checked) – the EU did provide financial support for OOXML but the Document Foundation didn't backport to OpenOffice as it was supposed to… So LibreOffice has had write support for a while, though it also has some fairly embarassing bugs. But there are alternatives such as OnlyOffice or Softmaker.
My real problem is the whole idea of using a spreadsheet for this in the first place, it's just asking for problems, of which broken files are probably the least of their worries.
Re: OOXML is also an open and ISO standard
The one which is impossible to implement as it says things to the effect of "do this like in the previous version of office" without actually defining how that was done, which was only accepted due to Microsoft rigging the voting process back when?
https://www.theregister.com/2007/08/29/microsoft_ooxml_sweeden_rigged_vote/
Re: OOXML is also an open and ISO standard
I'm well aware of the history and don't really like the format – you can find issues submitted by me to the ISO Working Group – but the specification is just as "open" as ODF and it can be implemented if you can be bothered to read it.
Re: OOXML is also an open and ISO standard
Unless the pro-forma spreadsheet has embedded macros, the unspecified parts of the specification are irrelevant.
I would go further
>> release the template in both .xlsx and ODF and let people choose what works.
I would not release it in xlsx format. I would exclude feedback delivered as an Excel spreadsheet.
Why does this need to be a spreadsheet at all?
Re: I would go further
I would not release it in xlsx format. I would exclude feedback delivered as an Excel spreadsheet.
Isn't the whole point of software freedom that we should all be able to run whatever we like on our computers? Who made you the God of what I can use?
Oh. Just saw the username. Carry on.
Re: I would go further
If you want me to open your document, you shouldn't impose your software requirements on me.
You can use whatever you like. Don't impose your software choices on me.
EU should regulate formats/requirements for public participation
Public participation should not depend on having proprietary software.
This should absolutely be subject to regulation.
I can see this applying more often to browser requirements.
Who else remembers the old days when eGovernment would demand Internet Exploder?
Guess
Let me guess, brown envelopes are already in the post.
FFS
The only thing that surprises me here is the apparently calm way the ODF have pointed out the issue. Instead of “Oi - idiots - WTF are you doing?’
It’s embarrassing. Really
"Requiring participants to use this format as the sole vehicle for structured data entry effectively conditions participation in a public consultation on the availability or willingness to use software produced by a single supplier," the letter reads.
Bollocks. I have just downloaded the feedback spreadsheet. It opened flawlessly in LibreOffice.
Using libreoffice under fedora i have written xls and xlsx files. The master document is odf. It is a viable process.
It is a bad look prioritising microsoft excel formats. For goodness sake say you will accept odf files.
> It is a bad look prioritising microsoft excel formats. For goodness sake say you will accept odf files.
Bingo. The sin here is that a public-facing public employee lacked the digital literacy to know to make this inclusive and cross-platform. That should be a priority for public servants.
We see it all the time in required browsers, required OSes, or the latest noxious platform assumption: that everyone has a smartphone connected to the Google or Apple app stores (and is willing to click install).
Nobody thought this assumption was a problem. That's where culture change and regulation are required.
OOXML is NOT a standard format
OOXML has been recognized by ISO as a standard format, but has never been implemented according to the description provided to ISO for the standardization, and over the years has got even worse in term of distance between the description and the actual implementation. Because of this, OOXML is a proprietary document format, built to prevent interoperability, and at the moment is the main lock-in tools used by Microsoft and their lock-in partners such as OnlyOffice and WPS Office.
I totally agree on the fact that a spreadsheet is not the appropriate tool to provide a feedback about a document which provides guidance about a law, but the issue here is that the EU COmmission - as many other organizations - is backing Microsoft lock-in strategy, and is not protecting EU citizens against surveillance capitalism champions. It is totally unacceptable to have to fight for our rights of EU citizens, which are in theory protected by the EU laws. Unfortunately, EU politicians listen too much to Big Tech lobby efforts, and not enough to EU citizens. This should stop immediately.
OOXML is also an open and ISO standard
ISO 29500-1 FWIW
This is needless politicking by the Document Foundation