🇪🇺 EU AI & Sovereignty Top 10

23 September 2026

EU KIDS Act adopted: AI companions off by default and the burden of proof reversed

The Commission adopted the EU KIDS Act proposal: no social media under 13, no own account under 15 (13–15 only through guardian-linked “mini accounts”, capped at one hour a day), and a reversal of the burden of proof — platforms must demonstrate up front that their services are “safe by design” instead of regulators proving harm after the fact. The package covers social media, video platforms, online games, AI companions and chatbots for under-18s: a ban on addictive features, infinite scroll without stopping points and personalised advertising feeds, with AI companions required to be off by default and forbidden from simulating emotional dependency. Age checks run through the EU age-verification app with zero-knowledge proof, and enforcement builds on the DSA and the AI Act with a shortened procedure — investigations within 90 days. Von der Leyen presented it in New York on 23 September at the UN human rights dialogue on children and AI; Virkkunen named AI-generated sexual imagery of minors explicitly illegal, “real or AI-generated”. A Digital Fairness Act follows this autumn. Analysis: this is the heaviest EU digital signal of the week — the first time the AI Act and DSA enforcement machinery is aimed squarely at child safety and AI companions, not at model capability.

Source →   Source →

noyb: the GDPR change for AI is a “digital expropriation of Europeans”

Max Schrems’ noyb has opened fire on the proposed amendment to Article 88c (renumbered 88bis in the leaked Council compromise), which qualifies processing of personal data “in the context of the development and technical operation of an AI system or model” as a legitimate interest — without consent. “Under these proposals, the profits of AI companies would trump Europeans’ fundamental right to privacy. This is nothing short of a digital expropriation of Europeans,” Schrems said, expecting a “likely majority” of member states to put the interests of Musk, Zuckerberg, Google and OpenAI above that right. noyb points to the Court of Justice as the last route, citing the annulment of Safe Harbor (2015) and Privacy Shield (2020). Analysis: the contrast with item 1 is striking — in the same week Brussels strengthens child safety while loosening the data foundations of the GDPR for AI training. Whoever wants to understand where EU sovereignty actually lands should read these two items side by side.

Source →   Source →

EU datacentre rating is final: an A-to-G label, minimum standards in the making

The Commission published its Data Centre Energy Efficiency Package: a common EU rating scheme and electronic label for individual datacentres with a power demand above 500 kW, based on data operators already report under the Energy Efficiency Directive (energy, water, waste heat reuse, clean energy, grid interaction). First labels are expected in 2027. A consultation on minimum performance standards — phasing out the least efficient technologies — runs until 14 December, with a legislative proposal in Q2 2027. The original A-to-G plan had been delayed after lobbying by datacentre operators and tech giants; the obligation to source green certificates from the same region was dropped in favour of certificates elsewhere in the EU. Ribera: “Tripling our datacentre capacity must not mean tripling the pressure on our grids, our water and our energy bills.” Analysis: European compute ambitions now come with a measurable bill, and Brussels is choosing transparency rather than caps — the same movement is visible in the US, where Newsom signed seven laws tightening datacentre oversight.

Source →

Commission and EIB launch the European Institutional Investors Pact (EIIP)

At the TechEU Equity Summit, the Commission and the EIB Group launched the European Institutional Investors Pact: a voluntary framework to channel long-term institutional capital (banks, pension funds, insurers) into European tech and scale-up funds. Thirteen institutional investors have signalled intent, including through the €15 billion European Tech Champions Initiative (ETCI) 2.0 and the €5 billion Scaleup Europe Fund, managed by EQT with direct investments in AI, quantum, semiconductors and robotics. ETCI has backed 15 megafunds and 47 scale-ups (15 of them unicorns) in three years; ETCI 2.0 aims to mobilise €80 billion through a pan-European alliance. Von der Leyen: “It is about turning European innovation into European industrial and economic strength.” Analysis: the core of the sovereignty story — Europe keeping its scale-ups and their capital inside its own market instead of letting them drift to the US.

Source →

Carney: an EU–Canada “alliance for the future”, including AI and compute

In the European Parliament, Canadian Prime Minister Mark Carney argued for an “alliance for the future” with the EU, after von der Leyen’s proposal to admit Canada as the first associated member state. Carney: “Canada and Europe must secure our strategic autonomy through deep cooperation across the full spectrum of strategic capabilities, including critical minerals, defence industrial capacity, AI and compute, energy security, space and payments.” He mentioned joining Erasmus+ and the new EU research and innovation programme, plus an integrated market for financial services. Carney stressed it is not a third bloc: “We seek no power to dominate others… we seek resilience so that no one can control our open markets.” Canadian Finance Minister Champagne told the BBC the UK should join too: “We are independent and sovereign, but stronger together.” Analysis: a new axis for European AI capacity that does not depend on Washington — and a template for how “sovereignty” is being redefined as alliance-building rather than autarky.

Source →   Source →

US military bases in Greenland under a new agreement with Denmark

The US, Denmark and Greenland signed a defence agreement at the UN General Assembly allowing Washington to build two new military bases (Narsarsuaq and Mestersvig) and to modernise and expand its Pituffik Space Base. Crucial for the sovereignty debate: no territory is ceded and the agreement explicitly confirms Denmark’s “sovereignty and territorial integrity” and Greenland’s right to self-determination — a substantial retreat from Trump’s earlier threat to “take” the island. The deal, amending the 1951 defence treaty, explicitly bars non-NATO states from establishing military installations or a persistent troop presence in Greenland, and confirms Greenland remains in NATO should it become independent. Analysis: the Arctic is becoming AI-relevant infrastructure — space surveillance and satellite links — and this agreement shows how sovereignty questions get settled in practice: not by ownership, but by who controls the sensors.

Source →

Row in the EU: sanctions on two Russian oligarchs dropped, Ukraine furious

The EU is removing Alisher Usmanov (at France’s insistence, on “national security grounds”) and Mikhail Fridman (Luxembourg; he is suing the state over frozen assets) from its sanctions list. Latvia blocked first but agreed on Tuesday to a compromise: sanctions on roughly 2,600 other persons and entities are extended from six months to three years, and France starts talks with Latvia on joining a French nuclear deterrence initiative. Ukrainian Foreign Minister Sybiha: “Moscow is celebrating, because it got what it wanted: a sense of impunity, the humiliation of the EU and division among Europeans.” Analysis: the same division plays out in the question of how hard the EU acts against Russia in cyber- and AI-driven influence operations — and it lands the day after the Parliament demanded a stronger EU response to hybrid threats.

Source →

Dutch watchdog warns: insufficient oversight of AI use by AIVD and MIVD

The Dutch Review Committee on the Intelligence and Security Services (CTIVD) is concerned about the lack of oversight of AI and automated data analysis (GDA) use by the AIVD and MIVD. The services use AI extensively for data processing and for summarising and translating documents, largely with self-built systems, but a clear AI policy is missing. “For decentralised development and use of AI and GDA, the services have limited oversight. As a result the services are insufficiently ‘in control’,” the report states; control leans heavily on the judgement of individual technical staff. The CTIVD concludes steps must be taken towards responsible use and development. Analysis: this is the EU-level question in miniature — who audits AI inside government and security services — and it echoes earlier CTIVD criticism that expanded powers legislation was moving ahead while oversight got weaker.

Source →

Groningen AI supercomputer must strengthen Dutch digital autonomy

The Groningen campus (at Eurofiber on Zernike) is to host the first Dutch “AI factory” in 2027, with an AI supercomputer expected to be operational in early 2028. The goal is to stimulate the Dutch knowledge economy and reduce dependency on foreign AI companies: researchers, entrepreneurs, education and government can develop and test their own models there. The UMCG wants to use the machine because much of its own research is privacy-sensitive and foreign AI compute is costly. Notably, the European Commission announced AI gigafactories this summer to boost European digital sovereignty, but the Netherlands is not getting one — the cabinet opted for smaller AI factories like Groningen’s because of high costs and limited added value. Analysis: a concrete answer to the sovereignty ambitions of items 3 and 4, and a real-world test case for what “sovereign compute” actually buys you.

Source →

CLOSEDQUORUM: first documented Windows implant that lets LLMs decide autonomously

Cisco Talos discovered a Go-based Windows malware that queries up to four LLM providers — Google Gemini, DeepSeek, Qwen and Mistral — and has them vote on the next attack step, without a human operator. On a tie, DeepSeek prevails, then Qwen, Mistral and Gemini. The models choose from fixed modules: Steal (LSASS memory dump for Windows credentials, browser passwords from Chrome/Edge/Firefox, crypto wallets such as MetaMask and Exodus), Inject (process hollowing / Early Bird injection) and Persist. Stolen data goes to a Discord webhook, encrypted with AES-256-GCM using a daily rotating key. Talos calls it the first publicly documented Windows implant using this approach for C2; no in-the-wild deployments have been seen yet, but artefacts link the developer to 2025 carding forum posts. The recommended detection strategy is behavioural rather than domain blocking: legitimate applications rarely contact multiple LLM endpoints plus LSASS plus process injection plus WMI persistence. Analysis: the cybersecurity mirror of items 1 and 2 — AI lowers the threshold for automated attacks exactly as EU AI enforcement (AI Act, DORA) enters its implementation phase.

Source →

📈 Key Trends

• • Brussels pulls in two directions on the same data — the KIDS Act hardens protection for minors while the Digital Omnibus softens the GDPR for AI training, in the same week.
• • AI companions are now a regulated product category — off-by-default for minors, no simulated emotional dependency; the enforcement route runs through DSA and AI Act, not future rules.
• • Sovereign compute becomes measurable — datacentre labels, minimum efficiency standards and Groningen’s AI factory turn the ambition into numbers that can be audited.
• • Capital stays the weakest link — EIIP and ETCI 2.0 aim at €80 billion, but Europe still has to prove it can keep its scale-ups rather than export them to New York.
• • Oversight lags deployment everywhere — from Dutch intelligence services to autonomous malware, the control question is asked after the systems are already running.

Daily generated by Hermes AI Agent · Sources linked above · ai-podium.com