The headline
Collabora dropped version 26.04 of CODE (that's Collabora Online Development Edition, for the uninitiated) on June 25th, and if you're a security or compliance analyst who's been quietly hoping there'd be a credible on-prem alternative to Microsoft 365 that doesn't ship with AI whispering in your documents, this one's worth a look. The AI integration is there — but it's off by default, and you have to explicitly opt in through File > Options or the server-side admin panel. That matters more than most release notes let on.
CODE is a rolling preview of Collabora Online (COOL), the company's production-grade web office suite. It runs on your own server, integrates with Nextcloud and similar file-sync platforms, and keeps document processing entirely within your infrastructure. For teams bound by GDPR, HIPAA, or just plain paranoia about where their data lives, that's not a nice-to-have. It's the whole point.
What's actually new in 26.04
The Writer word processor picked up Markdown support — yes, that's been in LibreOffice 26.2 since March, and Collabora's tracking it closely because the codebases share substantial DNA. Writer also now offers a multi-page view, which sounds minor until you're reviewing 40-page contracts and wish you could see page 3 and page 17 at the same time.
Track Changes got a meaningful bump: comment handling is improved, and comments can now be exported to PDF alongside the main content. If you've ever tried to get a clean audit trail out of collaborative editing, you know that's genuinely useful.
The Navigator sidebar now has integrated search. The Formatting sidebar has an inline preview. Small things, but they're the kind of small things that determine whether a team actually adopts an office suite or just tolerates it until the next procurement cycle.
Calc: spreadsheets that don't punish you
The spreadsheet engine got the heaviest lift. Per-user views mean different people can work in the same workbook without stepping on each other's toes — important for shared financial models or compliance dashboards. Formula error handling is smarter, which sounds like marketing copy until you've spent a Tuesday debugging a cascading #VALUE! error across three hundred cells.
Pivot tables now support calculated values. Colored tabs help with organization in large workbooks. JSON import got better, which matters more than you'd think if your team pulls data from APIs and dumps it into spreadsheets (and let's be honest, they do). New modern spreadsheet functions and smarter drop-down lists round out the changes.
Ribbons, accessibility, and the stuff that doesn't make headlines
All components got ribbon reorganization to optimize screen space. That's a real win for anyone working on a laptop with 13 inches of horizontal real estate.
Accessibility improvements include more descriptive control names, dialog box tab descriptions, and expanded keyboard controls. These help users with disabilities, sure — but power users will also appreciate the faster navigation. It's one of those improvements where everyone wins.
The AI question: why "off by default" is a security feature
Here's where I actually care. Collabora confirmed that AI assistance isn't present in the product unless you actively enable it through File > Options or server-side settings. They cited the EU's proposed Cloud and AI Development Act (CADA) as context — which makes sense, because that legislation is going to make organizations think very carefully about where AI processing happens and what data flows to third-party models.
Think about this from a compliance perspective: if your organization is processing sensitive documents — legal contracts, healthcare records, financial data — and an AI feature sends text to a third-party inference endpoint, you've just created a data exfiltration vector whether you meant to or not. Making AI opt-in, with the toggle clearly in user and admin hands, is the right call.
It also means your security team can evaluate whether to enable it without forcing a org-wide decision. Pilot with one department. Watch what happens. Then decide.
The Document Foundation's LibreOffice Online and the newly minted Euro-Office (a fork of ONLYOFFICE backed by Nextcloud and Ionos) are both racing to add AI features too. The question isn't whether AI will be in every office suite within a year — it's who gets to decide when it turns on. Collabora's answer so far is: the customer, not the vendor.
The cloud security incident response angle
Let me be direct: this release doesn't fix a vulnerability or patch a CVE. But it does illustrate something that shows up in incident response playbooks with annoying regularity — the tension between feature velocity and security posture.
CODE runs on-premise. That means:
- Document processing stays within your network boundary
- No dependency on a SaaS provider's availability or policy changes
- You control the TLS configuration, reverse proxy setup, and access controls
- Integration with your existing identity provider (via WOPI protocol) keeps authentication in-house
The Register's Liam Proven noted that European organizations are actively replacing Microsoft 365 fleets following the re-election of Donald Trump and the resulting surge in digital sovereignty interest. Schleswig-Holstein already made the switch. The French government opted for La Suite. Nextcloud and Ionos announced Euro-Office in April.
For security teams, the implication is straightforward: every organization moving to an on-prem office suite needs to treat it like any other server deployment. Harden the reverse proxy. Rotate certificates via Let's Encrypt or your internal CA. Monitor coolwsd logs through systemd journal. Set up proper access controls. The software is FOSS, but "free" doesn't mean "unattended."
And if you do enable AI? That's a new external dependency. Your incident response playbook needs to account for it — what happens if the AI endpoint goes down mid-session? What data did documents touch before you disabled it? Who has admin access to the AI configuration?
The messy ecosystem nobody's cleaning up
I'll be honest: the open-source office suite landscape is a mess right now, and it's going to stay that way for a while.
The Document Foundation maintains LibreOffice (desktop) and has revived LibreOffice Online. Collabora builds COOL/CODE on a heavily overlapping codebase — they used to do most of the LibreOffice development work before the Foundation purged Collabora contributors. Euro-Office is a fork of ONLYOFFICE that Nextcloud and Ionos backed, which ONLYOFFICE found deeply offensive and responded to by suspending their partnership and tightening license terms in version 9.4.
The Document Foundation isn't happy about Euro-Office either, largely because it prioritizes OOXML over ODF. Liam Proven pushed back hard on this in the forum comments, arguing that insisting on ODF-only interoperability is a "noble correct morally-right choice, but still a mistake" when the goal is actually getting organizations off Microsoft.
Here's what this means for you as a security analyst: pick your office suite based on your compliance requirements and deployment model, not ecosystem loyalty. Verify that it can read and write the file formats your partners use. Check the license terms — ONLYOFFICE's recent move to stricter licensing is a cautionary tale for anyone building derivative products. And assume the landscape will keep shifting over the next 18 months.
The good news? All these tools can read each other's documents. The messy politics don't actually block interoperability, even if they make procurement committees nervous.
What to watch next
CODE is a preview channel, so what ships in 26.04 will land in the next production release of Collabora Online within weeks. The Document Foundation's LibreOffice Online is still finding its footing after the revival. Euro-Office shipped version 1.0 and is iterating fast.
For security teams, the key things to track:
- Whether Collabora publishes a CVE response process for COOL (they should, and they likely do — check their security page)
- How the EU's CADA legislation shapes AI feature defaults across all three suites
- Whether government procurement frameworks start specifying on-prem office suite requirements, which would accelerate adoption regardless of which vendor wins
- The ONLYOFFICE licensing situation — if it forces more forks or fragmentation, that's a maintenance headache for anyone evaluating these tools
CODE 26.04 is free to test via Docker or Linux packages, and Collabora's documentation for on-premise deployment is thorough. If your organization is evaluating alternatives to cloud-hosted office suites for compliance or sovereignty reasons, this is a real option — not a hobby project.
Source: The Register — Collabora releases CODE 26.04 as rivalry between FOSS cloudy office suites heats up by Liam Proven, published June 25, 2026. Additional context from Collabora Online product page and The Register community discussion.