🤖 EU AI & Sovereignty Top 10
Monday 2 November 2026
Europe spent two years writing rules. This week’s file is about market access: who may sell, who may buy, and under which conditions. Below the ten items that actually carry news value, picked from 273 collected articles across two runs of our own RSS aggregator, with three paywalled sources explicitly marked. A note on overlap: six of the ten items were already reported in the editions of 30 and 31 October and 1 November — they are inside today’s news window, but the genuinely new reporting is items 2, 8, 9 and 10.
legislation
🔥 HOOG
Draft Quantum Act: Brussels picks competitiveness over regulation
POLITICO has a draft of the Quantum Act, due in November: a law meant to pull EU member states together to catch up with the US and China in quantum computing. It leans on industrial support instead of rulemaking — an explicit correction to the AI Act playbook. Governments would have to buy quantum technology from EU firms or from strategic-partner countries, and a "Quantum Europe Framework Initiative" has to tackle fragmentation. The number that carries the urgency: Europe holds plenty of quantum patents but attracts only 5% of global private funding in the field.
cloud
📌 MEDIUM
Cloud providers push back on CAIDA’s sovereignty criteria
Both European and US cloud providers object to parts of the requirements in the Cloud and AI Development Act, the EU’s follow-up to its cloud and data-centre ambitions. European players named in the article metadata include IONOS and OVHcloud; Nvidia and CCIA Europe are cited as players. Only the headline and teaser are public — the precise criteria sit behind a paywall and are not verifiable here. What matters politically: the sovereignty test is now being written by the same companies that will have to pass it.
energy
🔥 HOOG
Ireland becomes the test case in the data-centre backlash
Since lifting its de facto moratorium, Ireland requires new data centres to supply their own power and to source 80% of demand from new renewable projects within six years. Data centres accounted for nearly a quarter of Irish electricity consumption last year — roughly as much as all households combined — and Ireland has three times the capacity per 100,000 inhabitants of number two, the Netherlands. The Commission is watching: Commissioner Ribera wants tech firms to invest in clean energy, and the upcoming EU efficiency standards for data centres will be tested here first.
space
📌 MEDIUM
EU Space Act: German demands tighten access for US companies
The latest compromise on the EU Space Act is being shaped by German demands and tightens the conditions under which US companies get access to the EU market. This is the space leg of the same sovereignty push as CAIDA and Chips Act 2.0: European industrial policy that ties market access to European presence. Berlin is using its weight where it has an industry to protect, not where the rules are easiest.
funding
📌 MEDIUM
€560 million for European SpaceTech via EIB and Deutsche Bank
The European Investment Bank and Deutsche Bank are mobilising €560 million together for European space startups, meant to move technology to market and strengthen independent European space capability. It is one of the few concrete financing instruments in this week’s sovereignty file that actually lands as money rather than as text. Compare that with the regulatory track: access rules take years, a credit line is signed in a quarter.
platforms
📌 MEDIUM
UK regulator probes Meta’s AI terms after publisher outcry
The UK competition authority is looking at whether the change to Meta’s general terms amounts to unfair trading conditions, after publishers protested about their content being used for AI. It is the British version of the European fight over AI training and copyright, and the outcome can feed back into EU enforcement. Whoever defines "unfair" here effectively writes the licence for the next decade of model training.
security
🔥 HOOG
Backdoor in an official Claude Code extension reached thousands of users
Attackers managed to trojanise an official Anthropic extension for Claude Code through the Cursor Marketplace; version 2.1.313 installed a persistent SSH backdoor and stayed online for almost twelve hours. Anthropic points to a "malicious actor" and a targeted supply-chain attack. For European organisations rolling out AI coding tools broadly, this is the concrete proof that the plugin market is an attack surface — exactly what CAIDA and the Cyber Resilience Act want to govern in the AI toolchain.
security
🔥 HOOG
VOLTA infostealer uses Claude, Gemini and Kimi to rank victims by monetary value
The Windows infostealer VOLTA-AUTODOXER collects passwords, cookies, crypto wallets and SSH and cloud keys, and builds an "evidence bundle" from them: geolocation, employer, Slack workspaces, author metadata. That bundle goes through OpenRouter to an LLM — Claude Opus 4.6 by default, falling back to Kimi K2 and Gemini 2.5 Flash — which decides which victims are worth the most. This is the first widely documented case where the LLM is not the attack surface but the prioritisation layer of a criminal operation.
ai governance
📌 MEDIUM
OpenAI to train on previously off-limits Daybreak Blue cyber data from 29 November
From 29 November, OpenAI will use data from Daybreak Blue sessions — its Trusted Access programme — for model training, while that data previously stayed out of training, including for users who had switched off "improve the model". After criticism OpenAI promised a separate opt-out. The case hits the EU line directly: this is exactly the kind of data decision over which the AI Act, DSA transparency duties and the coming cloud legislation claim a say.
digital rights
📌 MEDIUM
Dutch government warns of privacy risks in the EU Kids Act
The Hague thinks the EU Kids Act leans too heavily on parents and could widen inequalities between children, according to a government note seen by Rapporteur. Not an AI file in the narrow sense, but the digital-rights side of the same sovereignty discussion: who decides which data about minors may flow. For the Netherlands it is also a familiar argument — the same tension as the national debate over age verification.
📈 Key Trends
- • Regulation is out, procurement is in — the Quantum Act buys European instead of prescribing conduct.
- • Sovereignty criteria are being written by the companies that must meet them (CAIDA), which slows the file down.
- • Energy, not compute, is the binding constraint: Ireland’s 80% renewables rule is the template.
- • The tooling layer is the weakest link — an official AI coding extension as supply-chain entry point.
- • Criminal operations are already using frontier LLMs as a prioritisation layer, not as a target.
Wat vond je van dit bericht?
