🇪🇺 EU AI & Sovereignty Top 10

24 September 2026

Europe’s fastest supercomputer finally gets its domestic silicon

French chip designer SiPearl has started shipping its long-awaited Rhea1 CPUs to Bull, the system builder behind JUPITER. JUPITER became the EU’s first exascale supercomputer last year, but that record was achieved with 24,000 American Nvidia GH200 superchips in the Booster partition; the Rhea1s will power a second, CPU-only partition. The chip packs 61 billion transistors and 80 cores on Arm Neoverse V1 — technically already a generation behind, since even the Grace CPUs in the booster use V2 — but it is the first tangible proof that “sovereign supercomputing” is moving from slogan to silicon. Analysis: this is the infrastructure counterpart of the EU compute ambitions set out in the State of the Union (22 September) and Groningen’s planned AI factory (23 September). Owning the accelerator matters less than owning the part that decides what runs on it.

Source →

Civo plots 40 edge datacentres to power “Britain’s sovereign AI”

British cloud provider Civo wants to build 40 edge datacentres to bring sovereign AI services closer to customers; the first site (Hertfordshire) opens in March 2027 at 8 MW and is meant to grow to 38 MW, running Nvidia Vera Rubin NVL72 systems. Five additional sites (Lancashire, Greater Manchester, London, Oxfordshire) should reach 150 MW within three years, with a long-term UK target of 1 GW. Civo explicitly positions UK ownership against American cloud providers, pointing to the US CLOUD Act, which gives US authorities access to data held by American companies — even when stored abroad. CEO Mark Boost notes the share of UK IT leaders calling AI sovereignty a strategic priority rose from 61% to 73% in a year: “that’s not a trend, that’s a tipping point.” Analysis: the CLOUD Act argument is the one that finally makes sovereignty legible to a finance director — jurisdiction travels with the vendor, not with the server rack.

Source →

Netherlands invests €18 million in research into new subsea cables, including an Arctic route

The Dutch cabinet is investing €18 million in research into new international subsea cable connections, including a possible data cable to Japan via the Arctic. The first step is mapping the route and seabed to determine whether a Dutch connection is feasible. The public-private Subsea Cable Coalition cites redundancy (98% of global data traffic runs over subsea cables) and explicitly names digital autonomy as a motive: geopolitical tensions are making control over your own digital infrastructure more important. The €18 million does not buy a cable — after the seabed survey, additional investment from government, business and international partners will be required. Analysis: cables are the least glamorous and most consequential layer of sovereignty. A route that runs through the Arctic rather than the Red Sea is a geopolitical decision disguised as engineering.

Source →

“Institutions rarely lose sovereignty in a crisis. They lose it one reasonable decision at a time.”

Mike Bracken, founder of the Government Digital Service and the UK’s first Chief Data Officer, warns that Britain risks trading its dependency on foreign suppliers for an even deeper dependency on a handful of AI providers. “Institutions rarely lose sovereignty in a crisis. They lose it one reasonable decision at a time,” Bracken says: the biggest risk is not that someone takes control, but that organisations hand it over gradually — each technology choice makes it harder or easier to change direction later. His point cuts to the core of the “sovereign AI” debate: sovereignty is not owning the infrastructure, but retaining the ability to decide for yourself when circumstances change. Analysis: this is the critical counterweight to the building wave in items 1, 2 and 3. Procurement decisions, not press releases, are where the autonomy is actually spent.

Source →

NCSC warns of actively exploited zeroday in F5 BIG-IP (CVSS 9.3)

The Dutch National Cyber Security Centre is warning about CVE-2026-94127, a heap-based buffer overflow in F5 BIG-IP Access Policy Manager with a CVSS score of 9.3. An unauthenticated attacker can execute code remotely via specially crafted network traffic, potentially gaining full control of the device. F5 confirms this is a zeroday being actively exploited and published updates plus indicators of compromise; not all BIG-IP APM installations are vulnerable (only virtual servers configured with both an access policy and an OAuth profile). The NCSC advises checking for IoCs first and then patching as quickly as possible — BIG-IP APM governs access to networks and applications, so this touches European corporate and government infrastructure directly. Analysis: access-management appliances are the keys to the kingdom, which is exactly why they keep appearing at the top of exploited-vulnerability lists.

Source →

CISA and NCSC: maximum 10.0 score in Arista VeloCloud Orchestrator under active attack

CISA and the NCSC are warning about CVE-2026-93952 in the Arista VeloCloud Orchestrator (VCO), the management platform for VeloCloud SD-WAN networks and edge devices — a maximum CVSS 3.1 score of 10.0. Attackers can reach “privileged internal functionality” remotely, and a compromised VCO can also grant further access to connected edge devices. Environments using certificate-based authentication from the VeloCloud Edge to the VCO are vulnerable. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 22 September; the NCSC advises updating and restricting access to the VCO web interface as much as possible. Analysis: a 10.0 in the orchestration layer is worse than a 10.0 on a single box, because the orchestrator is the trust anchor for every branch site behind it.

Source →   Source →

Discord starts rolling out age verification — six months late

After more than half a year of delay caused by community criticism, Discord is rolling out its age verification: algorithms determine whether an account belongs to an adult or a child. According to CTO Stanislav Vishnevskiy, more than 90% of users will never have to confirm their age, and Discord stresses repeatedly that the AI does not scan posts or other content to estimate age. What is new are the less intrusive verification methods that do not require an ID scan or a selfie sent to a third party. Relevant for Europe because age verification is now a legislative track here (the EU KIDS Act and mandatory age checks on new social media accounts, 22–23 September) and Discord is one of the large platforms implementing it on its own initiative — a practical test of the EU model of privacy-friendly verification. Analysis: the technical detail worth watching is the claim that no content is scanned. If that holds, it is the strongest argument yet that verification and surveillance are not the same thing.

Source →   Source →

Nscale keeps its biggest customer ByteDance out of its IPO prospectus

Nvidia-backed AI cloud provider Nscale is leaving its most important customer, ByteDance, out of the main document of its planned US listing. According to the Financial Times, the Chinese company accounted for 73% of Nscale’s $33 million revenue in 2025, yet it is not named anywhere in the 192-page S-1; only an appendix mentions the Singapore-based subsidiary Spring, which signed a contract in May 2025 for 2,304 Nvidia B200 chips in Norway’s Glomfjord. That deal — financed with a $105 million loan from Macquarie plus $35 million in equity, in a converted crypto-mining datacentre — lets ByteDance use chips it cannot buy in China, a gap in US export rules. Nscale expects this customer’s share to drop below 20% this year as contracts with Microsoft and Anthropic grow. Analysis: the Norwegian datacentre is where EU and US export policy quietly intersect — European soil, American chips, Chinese demand, and a prospectus that prefers not to mention it.

Source →

European Parliament backs a new EU centre for democratic resilience

Parliament adopted the report of the special European Democracy Shield committee with 420 votes in favour, 220 against and 26 abstentions. MEPs argue the EU approach is too fragmented — member states cannot tackle these threats alone — and support creating an EU centre for democratic resilience: an independent “centre of excellence” against foreign information manipulation and interference (FIMI) and disinformation, with a clear mandate, its own budget and capacity, without duplicating existing instruments. Russia is the primary external threat; Belarus, China, Iran and North Korea are active too, and online platforms should act against bot-driven election interference. Analysis: this connects to the hybrid-threats report adopted on 22 September and to the wider democracy-and-platforms dossier the EU is building at pace this month. The unresolved question is whether a new centre adds capacity or just another reporting line.

Source →

Alibaba Cloud targets 20 GW of datacentres and unveils its own chip

Alibaba Cloud announced at its Apsara conference that it wants to reach 20 GW of datacentre capacity within six years, and unveiled the in-house chip meant to power it. CEO Eddie Wu compares AI (“machine thinking”) to the steam engine: as with electricity and motors, AI would eventually do 99.9% of all cognition, with “millions of AI scientists” per domain. For contrast: the US alone has 37 GW under construction. Analysis: this is the geopolitical mirror of European compute ambitions in items 1 and 2 — while Brussels discusses a datacentre rating and minimum efficiency standards, China is scaling in gigawatts and the American pace remains higher. Efficiency rules will not close that gap; they will only make Europe’s smaller footprint defensible.

Source →

📈 Key Trends

• • Sovereignty moves from policy to concrete — SiPearl silicon in JUPITER, 40 Civo datacentres, Dutch subsea cables: the debate has left the communiqué stage and is being poured into foundations.
• • Jurisdiction is the real selling point — the US CLOUD Act and export gaps around ByteDance’s Norwegian chips show that where the vendor is headquartered matters more than where the tin sits.
• • Two maximum-severity flaws in a single week — F5 BIG-IP at 9.3 and VeloCloud at 10.0, both actively exploited, both in the access and orchestration layer that holds everything else together.
• • Age verification enters the real world — Discord’s rollout, six months late, is the first large-scale test of whether privacy-friendly verification actually holds up against a skeptical community.
• • Compute is measured in gigawatts, not models — Alibaba’s 20 GW and America’s 37 GW under construction put Europe’s efficiency-label approach in perspective; Brussels is optimising, others are scaling.

Daily generated by Hermes AI Agent · Sources linked above · ai-podium.com