Digital Sovereignty's Hard Sell, Smart Glasses and the AI Act Rollout

The week's sharpest sovereignty story did not come out of Brussels. It came from Ecosia, the Berlin-based search engine, which will drop the French AI firm Mistral and turn instead to Chinese open-source models because it judges them better, Xataka reported. Mistral was founded precisely to give Europe a competitor to American and Chinese giants, and a company that itself stands for a European tech alternative has now decided that, for its product, the European option is not good enough.

Politics told a more loyal story. Germany's Digital Ministry denied reports that it was withdrawing from a strategic AI project with SAP and Mistral AI, according to Heise. The cooperation rests on a non-binding letter of intent that explored sovereign European AI solutions and the modernisation of public administration. Denials and letters of intent keep the idea alive; they do not settle whether European models win the procurement decisions that follow.

Sovereignty signed in a letter of intent still has to be won in the market.

The hardware layer offered both progress and a warning. France's SiPearl launched Rhea1, its first EU-developed server processor, which powers HPE servers and the Jupiter supercomputer, Heise reported. At the other end of the supply chain, Dutch chip equipment maker ASML faces AI-driven demand that its planned supply for 2027 and 2028 cannot meet, judging by customer forecasts. A senior ASML executive noted that the company sold nothing to European customers last quarter, Silicon Republic reported, an awkward detail for a continent whose Chips Act is meant to bring production home. In quantum computing, Spain's Qilimanjaro Quantum Tech raised a €19.6 million Series A led by Indra, with backing from a Spanish public entity under the Ministry for Digital Transformation.

Meanwhile, the largest American players kept extending their reach into European research. Google DeepMind and Google Cloud will give 200 European scientists direct access to frontier AI models plus $3 million in compute credits, Tech.eu reported, and NVIDIA is stepping up its investment in British and French startups and launching collaborations in Sweden and Spain, according to EU-Startups. Such programmes help European scientists today, and they also tie the next generation of research to infrastructure that Europe does not own.

On privacy, Europe's regulators were busy and visibly so. The European Data Protection Board issued a statement on smart glasses, devices with cameras and microphones that netzpolitik.org said the watchdogs consider a high risk to fundamental rights and freedoms, with a call for clearer labelling of devices that film and record. The substantive point, as Agenda Digitale explained, is who carries the burden: manufacturers and AI providers are responsible under the GDPR for the images captured, and they cannot hand their transparency obligations to the people wearing the glasses. Purely personal use stays exempt.

Enforcement ran on several tracks at once, and the tracks are worth keeping apart. Norway's Data Protection Authority fined Microsoft-owned adtech firm Xandr €8.6 million for processing sensitive data of Grindr users, including sexual orientation, without valid consent, treating Xandr as a joint controller. Italy's authority fined Wind Tre €16.7 million over unlawful telemarketing in which customers had contracts activated without consent. France's CNIL, by contrast, closed an injunction against Google after the company changed its account creation process and the way Gmail displays ads, while the Dutch Autoriteit Persoonsgegevens is investigating two organisations over cookie banners that make refusal difficult. Two fines, one closed case and one new inquiry: the GDPR is being enforced, but at very different stages.

Not every signal pointed towards stronger oversight. Baden-Württemberg's finance minister proposed cutting the state data protection authority's staff by 40 percent despite new tasks, a plan Heise said could conflict with the GDPR's requirement that authorities have adequate resources. In Brussels, noyb analysed more than 1,000 amendments tabled by MEPs on the Digital Omnibus, the reform that aims to change core GDPR and ePrivacy rules, and ranked lawmakers by whether they side with user rights or with Big Tech interests.

The third thread was the EU AI Act leaving the drafting room. Italy's Decree 179/2026 takes effect on 23 October and empowers national authorities to oversee AI systems, which means companies must document how they deploy AI and prepare for audits, Agenda Digitale reported. The same outlet noted that the decree provides AI training paths for schools, public administration and professionals but none dedicated to businesses. Ireland's AI Office is advancing a regulatory sandbox and AI literacy initiatives to help companies with EU AI Act compliance, backed by an extra €2.3 million, Silicon Republic reported, while the deadline for national sandboxes has been pushed back to August 2027. The Netherlands published a practical guide for public bodies on assessing the risks of AI-powered software updates, and the European Commission opened a consultation on copyright that covers AI, piracy and artist compensation, with input due by 3 November 2026.

Underneath all of this sits the question of capital, and whether European companies can grow without leaving. European startups raised €21.45 billion in the second quarter, the best quarter in four years, according to EU-Startups. Yet campaigners warned that the EU Inc company framework, meant to make scaling across the single market easier, is being stripped of key provisions, Tech.eu reported. The exit route remains largely transatlantic: The Recursive described US buyers increasingly targeting European startups, and London's Sequence was acquired by Intuit for a reported $200 million. There were counterexamples. French AI firm Wiremind took its first external funding, €35 million, after 12 years of profitable bootstrapping, and Dublin's LearnUpon secured €44.5 million from Claret Capital Partners, a European growth debt fund backed by the Ireland Strategic Investment Fund.

Digital identity, finally, moved from strategy to statute in Germany. The Bundestag passed the Digital Identity Act, clearing the way for the "d-you" wallet to launch on 2 January 2027, initially with ID functions only, netzpolitik.org reported. A Commission study, meanwhile, examined the harder question for the EU Digital Identity Wallet: who will pay for issuing, managing and verifying it.

Taken together, the week showed a Europe that writes rules with growing confidence and enforces them with uneven means, while the question of who builds and buys its technology is still decided case by case, sometimes against the European option.