Six days before the Cyber Resilience Act forces companies to report exploited flaws within 24 hours, Berlin found out that refusing a ransom does not stop stolen data from surfacing anyway. The same week, Europe's cloud lobby accuses Broadcom of widening a fight it started over VMware licensing into control of the enterprise AI layer.
Brussels tightened its grip on ChatGPT, Reddit and Roblox this week while quietly rewriting parts of its own privacy rulebook. Underneath the regulatory noise, Europe's sovereignty ambitions kept colliding with market realities, from Italian cloud tenders that reward US hyperscalers to Nvidia's purchase of a French AI icon.
Rome's public procurement rules for cloud services were designed to keep European capacity in the running, and instead they hand the field to American hyperscalers by default. The same day, Google's model for who gets to use its fastest vulnerability-hunting AI shows a second kind of sovereignty gap: not a rule that misfires, but one that was never written.