🤖 EU AI & Sovereignty
12 September 2026
This week’s EU AI & Sovereignty update. Today Europe’s cyber resilience regime goes live, the age-verification fight escalates, and reality catches up with the sovereignty rhetoric.
cybersecurity
🔥 HOOG
EU vulnerability reporting duty is now in force
Since 11 September, manufacturers of products with digital components — IoT, firewalls, software, games, libraries — must report actively exploited vulnerabilities and severe incidents: an early warning within 24 hours, a full report within 72 hours, plus a mandatory final report 14 days after the patch. Responsibility sits squarely with the manufacturer, including for older products already on the market. Researchers had warned the duty could be abused for surveillance purposes.
Commissie
📌 MEDIUM
State of the Union 2026: “Delivering Europe’s independence”
The Commission is framing Wednesday’s State of the Union address — 16 September, 9:00 CEST — explicitly around delivering Europe’s independence. It is the umbrella document for the coming EU sovereignty agenda on industry, defence and digital autonomy. Watch this space: the speech itself lands next week.
lidstaten
🔥 HOOG
Netherlands and Spain push for an EU-wide minimum social media age
State Secretary Aerdts (Digital Economy) sent Brussels a joint proposal with Spain: one European rulebook with as few national exceptions as possible, EU-level supervision, and “effective and privacy-friendly” age verification that only checks the age threshold. It aligns with Von der Leyen’s earlier plan for a social media age limit.
regulering
📌 MEDIUM
Macron asks Brussels for a Europe-wide social media ban under 15
After a French bill was struck down by the Constitutional Council, Macron is trying his luck in Brussels: in a letter to Von der Leyen he argues for a blanket ban under 15. That clashes with the Commission’s graduated approach — restricted access under 13, gradual easing afterwards. Two speeds of European digital policy in one week.
privacy
📌 MEDIUM
EDRi: the EU age-verification app is the end of the free internet
Europe’s digital rights movement warns that the Commission’s age-verification app only makes linkability “harder” rather than guaranteeing it away, does not mandate Zero Knowledge Proofs, and does not require national apps to be open source. Once the infrastructure exists, privacy promises can be withdrawn — with identity requirements on social media as the real risk.
technology
📌 MEDIUM
Strict exploit reporting reshapes the EU market
Neowin covers the same CRA duty from a market perspective: Brussels is forcing strict exploit reporting for anything entering the European market. The act sets essential cybersecurity requirements for products with digital elements, with the Dutch NCSC acting as the national reporting desk. For non-EU vendors, compliance becomes an entry condition rather than a nice-to-have.
soevereiniteit
🔥 HOOG
Digital sovereignty sounds great until you try ditching your suppliers
Capgemini surveyed 1,300 executives: 59% call full digital sovereignty unrealistic, 86% have significant exposure to foreign-controlled supply chains, and only 14% have full visibility into their dependencies. 36% would need more than a year to replace a critical supplier; 10% have no alternative at all. European respondents mostly embrace “resilient interdependence” instead — a sobering reality check for the sovereignty rhetoric.
cloud
📌 MEDIUM
Switzerland tests a FOSS escape route from Microsoft 365
The Swiss government is running its own open-source push to break free from American cloud apps — a concrete European example of digital sovereignty in practice. It follows earlier signals that European organisations fear a US “tech kill switch” but have no exit plan. Switzerland shows what an actual migration path looks like.
defensie
📌 MEDIUM
Commission approves €6.1 billion for Ukraine, including drones and electronic warfare
Brussels signed off on an additional €6.1 billion for Ukrainian defence procurement, covering air and missile defence, drones and electronic warfare. At the first board meeting of the EU-Ukraine Drone Alliance — with 400+ applications — commissioner Kubilius stressed the strategic value of fast, cheap European defence innovation. Defence and tech sovereignty are merging into one agenda.
investeringen
📌 MEDIUM
Digital euro: MEPs ready to negotiate reduced dependence on non-EU providers
The European Parliament backed opening negotiations with the Council on the digital euro proposal, which should give citizens a safe way to reduce dependence on non-EU payment providers. A monetary complement to the broader sovereignty story: payment infrastructure is tech dependency too, and Europe is treating it as such.
📈 Key Trends
- • Enforcement over ambition: the CRA reporting duty is the first EU digital law to hit real obligations — regulation moves from paper to deadlines.
- • Age verification is the new battleground: member states, France and the Commission all want limits, but on different terms — and civil rights groups warn the infrastructure outlives the promises.
- • Sovereignty meets supply chain reality: the rhetoric is maximal, the exit options are minimal — most organisations cannot leave their critical vendors within a year.
- • FOSS as exit strategy: Switzerland testing an open-source route out of Microsoft 365 is the concrete template others lack.
- • Defence, money and tech converge: drones for Ukraine and the digital euro are both framed as independence from non-EU providers.
Wat vond je van dit bericht?
