Platform Crackdowns, Sovereign Clouds and a Funding Pullback

The European Commission spent the week reminding the industry that the Digital Services Act still has teeth. ChatGPT, Reddit and Roblox were designated Very Large Online Platforms, with ChatGPT additionally classified as a very large online search engine, a label that pulls it into the same systemic risk obligations as Google Search. The three services now have until January 2027 to comply. The designation happened to land in the same week as the Commission president's State of the Union address, the annual moment when Brussels sets its digital priorities for the year ahead.

The rest of the regulatory picture was messier. The EU AI Act amendment inside the Digital Omnibus package moved forward, pushing back compliance dates for high-risk AI systems, but a parallel proposal to redefine what counts as personal data under the GDPR ran into resistance during interinstitutional talks. Brussels is trying to simplify AI compliance and loosen a core privacy definition in the same package, and only one half is going smoothly.

Simplifying one rulebook is testing the limits of another.

Competition enforcement cut both ways too. Opera lost its case to have Microsoft Edge labelled a gatekeeper under the Digital Markets Act, with the General Court finding the browser was not an important enough gateway to qualify, a ruling that narrows how far the DMA reaches into desktop software. Meanwhile the Commission opened an information-gathering probe into Oracle's cloud licensing practices, following a similar inquiry into SAP, a sign that scrutiny of enterprise software vendors is becoming routine rather than exceptional.

Sovereignty ambitions ran into their own contradictions. The Netherlands published a draft design for its sovereign government cloud, a concrete step toward the kind of public infrastructure independence Brussels keeps calling for. In Italy, the opposite dynamic is playing out: procurement rules written to protect local providers instead favour US hyperscalers, because qualification requirements reward the economies of scale only the largest incumbents can meet, locking out local cloud federations such as EduStorage even though they are technically ready to compete. The intention and the outcome are pulling in opposite directions.

Private capital told a similar story. Zurich-based xorlab raised 5 million euros to expand a sovereign email security platform built explicitly to reduce reliance on US-controlled infrastructure. Days later, Nvidia confirmed its 12.93 billion dollar acquisition of Hugging Face, the French-founded AI model repository that has become one of open-source AI's central hubs. A French-founded sovereignty champion just changed hands to the world's dominant chipmaker, a reminder that building sovereign-minded companies and keeping them European-owned are two different challenges.

Data protection enforcement kept moving regardless of the definitional debate in Brussels. Austria's Supreme Court found that credit agency CRIF had illegally collected data in violation of the GDPR's purpose limitation principle, a ruling that strengthens noyb's pending class action. Ireland's Data Protection Commission fined the Health Service Executive 645,000 euros over unsecured paper medical records, and France's CNIL fined Hôpital Privé de la Loire 500,000 euros after a breach exposed health information belonging to more than 524,000 patients. The Dutch data protection authority took the opposite tack, releasing free compliance templates to help small businesses meet their GDPR obligations without a legal team. And with the EUDI Wallet due to launch by December 2026, Agenda Digitale flagged that its architecture still raises open questions about metadata handling under the very rules regulators are actively enforcing elsewhere.

Capital markets, meanwhile, told two stories depending on the lens. Tech.eu's weekly recap counted just over 475 million euros invested across more than 35 deals as the week opened. Days later, a separate report put the wider picture in perspective: European tech funding fell 63 percent in August to 3.2 billion euros across 165 deals, part of a broader dealmaking slowdown across the continent. Even so, the money that did move kept flowing toward strategically sensitive sectors. German spacetech HyImpulse secured over 50 million euros to scale sovereign launch capability ahead of upcoming missions. INLEAP Photonics raised 20 million euros to expand its laser-based counter-drone systems for European defence and critical infrastructure customers. Finnish company Creoir landed seed funding to commercialise voice AI built for defence systems. And Spain's iPronics raised 107.6 million euros for AI data centre optical networking, in a round that included Nvidia itself, a deal that sits somewhere between European deep tech success and dependency on the same chipmaker reshaping the sovereignty conversation elsewhere this week.

Europe keeps writing the rules for sovereignty faster than it can build the ownership behind it.

Taken together, the week captures where Europe's digital sovereignty project actually stands. The legal machinery built from the DSA, the DMA, the AI Act and the GDPR is active and enforced, sometimes against dominant US platforms and sometimes against European hospitals and agencies that fail their own obligations. But sovereignty over infrastructure and ownership remains far harder to legislate than sovereignty over rules. A Dutch government cloud design and a Zurich-based email security round point one way; an Italian tender structure and a Nvidia acquisition point the other. Neither cancels the other out, and that tension looks set to define the months ahead.