TL;DR — Submit to CfgMgmtCamp 2027 tonight (23:59 Europe/Brussels), because it is in Ghent and it is the only thing closing today [1]. Then VisugXL and EuroSTAR 2027 on 30 September, and clear the rest of October. Across seven topic areas 22 distinct calls verify as open — 16 with a firm deadline, 6 open but undated or rolling. The date, not the topic, is what limits you.
The calendar is the binding constraint, not the subject matter. All seven angles independently landed on the same shape: the 2026 CFP cycle closed between March and August, and the 2027 wave has not opened. Security lost its whole circuit in that window — Black Hat EU, BruCON, DeepSec, Hacktivity, SEC-T, hack.lu, Nullcon Berlin and OWASP Global AppSec EU all closed before September, leaving exactly two open calls. The .NET circuit is the same story: Techorama BE/NL, NDC London, NDC Oslo, DDC Cologne, BASTA! and Update Conference Prague are all shut. Widening from April’s BE/FR/NL/DE to all of Europe added reach but not much volume — the trough is continental.
Three deadline clusters carry everything. Tonight: CfgMgmtCamp Ghent [1]. 30 September: VisugXL [2] and EuroSTAR 2027 [3]. Then a three-week October run — Web Rebels 3 Oct [4], .NET Conf Community Days 6 Oct [5], 40C3 Hamburg 9 Oct [6], KubeCon EU 2027 11 Oct [7], ML Prague workshops 15 Oct [8], NDC Security Oslo and the three CNCF co-located days 18 Oct [9] [10], .NET Conference Milan 24 Oct [11], PHPBenelux 31 Oct [12]. After that the next real date is DDD Europe on 16 January 2027 [13].
AI is both the most-wanted and the explicitly-banned topic. NDC Security names “Securing AI”, “Agentic AI” and “Secure AI-assisted development” as topics it wants [14]; DDD Europe asks for AI-assisted-DDD angles like ubiquitous language with AI and RAG against bounded contexts [13]; PHPBenelux runs an “AI & Agentic Workflows” track [12]. Meanwhile Web Rebels — the best-compensated open frontend call, travel and accommodation covered — states plainly “please no AI related talks” [4]. The same deck is a headline submission at one venue and an auto-reject at another.
Almost nothing pays. Only three open calls cover travel and lodging: NDC Security Oslo [9], DDD Europe 2027 — which also covers professional childcare [13] — and Web Rebels [4]. PHPBenelux reimburses travel and hotel [12]. Everywhere else a free ticket is the whole offer.
Two structural notes for the next sweep. PaperCall.io shut down on 31 August 2026, which is why GitNation’s flagships (React Summit, React Advanced, React Day Berlin, JSNation) read as missing rather than closed — they are mid-migration, and the frontend angle should be re-run in November. And the geography advice inverts this month: the two nearest events, CfgMgmtCamp in Ghent and VisugXL fifty minutes away, are also the two closing first.
The gap nobody filled: across 25+ security venues checked, there is still no dedicated European AI-security conference with an open CFP — the AI-security talk has to travel inside a general developer or hacker track.