The Week in European Digital: AI Oversight Hardens, Sovereign Compute Scales Up and Payments Break From Visa

For most of this year, European digital policy has read like a list of dates on a calendar: rules passed, deadlines set, obligations promised. This week several of those dates finally arrived. The European Commission confirmed it will start enforcing the EU AI Act's transparency requirements from 2 August, meaning AI systems must tell users they are talking to a machine and deepfakes must be labelled as such. The Dutch data protection authority, the Autoriteit Persoonsgegevens, framed the same deadline as a simple promise to consumers: after 2 August, it should be clearer whether what you are looking at is AI-generated or real.

Enforcement is also gaining a face at national level. Germany's Bundesnetzagentur has been handed new powers as the country's market surveillance authority under the AI Act, meaning it now fields complaints and polices compliance directly, rather than the rules sitting purely as legal text in Brussels. Taken together, the AI Act stopped being a future obligation this week and became a present one.

The rules that reshaped social media are now reaching for the chatbots themselves.

The Digital Services Act is expanding in the same direction. Multiple outlets reported that the Commission is preparing to designate ChatGPT and Roblox as Very Large Online Platforms, the DSA's strictest category, after both services passed the 45-million-monthly-user threshold inside the EU. It is worth being precise about where things stand: a Commission spokesperson called the designation "definitely possible", not a done deal, so this is a live process rather than a finished one. If it goes ahead, a generative AI product and a gaming platform would for the first time face the same accountability and transparency duties as Facebook or YouTube, extending a regime built for social media into conversational AI.

Behind the regulation sits a parallel push to build European capacity rather than only police American and Chinese providers. The Commission opened bidding for up to seven AI "gigafactories", backing the tender with roughly €10.5 billion of EU money and aiming to unlock more than €30 billion in total investment once co-funding is added, explicitly to reduce reliance on US computing infrastructure for frontier AI training. On the public-sector side, the Netherlands, Denmark, Belgium and Luxembourg launched EuropAI, a joint project to build sovereign generative AI tools for government use, from digital assistants to legal-process support, so administrations have an alternative to routing citizen data through ChatGPT or comparable non-EU services.

That same instinct showed up lower down the stack. German states have been moving off Microsoft SharePoint toward open-source alternatives, and Ireland has halted a roughly €1 billion Microsoft deal while it weighs open-source options of its own; The Register also noted Airbus shifting sensitive data onto European cloud providers. None of this amounts to Microsoft losing Europe, but it is digital sovereignty being practised as a procurement decision rather than only argued as a policy position. Venture capital is following a similar logic: Milan's Beelzebub raised €3 million for AI-powered cyber defence aimed at NIS2-regulated firms, Sofia's Tiger Technology took in €8.7 million for hybrid cloud data infrastructure, Eindhoven's Keiron secured €20.7 million to fix a costly bottleneck in electronics manufacturing, and UK-German defence startup Agon raised $30 million, with backing from European VC Lakestar, to build AI training environments for drone defence. Different sectors, same underlying bet on European capability.

Consumers got their own small piece of that autonomy story. Lidl's German stores began accepting Wero, the bank-backed European payment scheme designed to let shoppers pay directly from their accounts without routing through Visa or Mastercard, giving the initiative its most visible retail foothold yet. On 31 July the EU's right-to-repair directive took effect, requiring manufacturers to make devices repairable even after the warranty has expired, and new rules mandating electric-vehicle charging points at least every 60 kilometres on major roads, alongside hydrogen refuelling, moved from legislation into infrastructure planning.

Not every rule is landing as intended, though. Consumer group BEUC used the charging-infrastructure moment to point out that pricing at public EV chargers remains opaque and payment options limited, despite the Alternative Fuels Infrastructure Regulation already being in force, and is pushing the Commission to close those gaps rather than declare the job done. Privacy group noyb filed a fresh GDPR complaint, this time against dictionary site dict.cc, arguing that offering "informed" consent to 1,741 tracking partners through a single click cannot meet the law's standard, a reminder that basic consent-banner compliance issues are still unresolved eight years after GDPR took effect.

Brussels' enforcement muscle showed similarly mixed results. Record euro-denominated fines under the Digital Markets Act, including Google's €890 million penalty, sound severe in isolation but amount to only 0.25% of that company's revenue, underlining how large the gap still is between headline numbers and actual financial pressure on the biggest platforms. Elsewhere the Commission's newer Foreign Subsidies Regulation had more visible teeth as a gatekeeping tool: it cleared the $55 billion Saudi-led buyout of Electronic Arts, showing the EU is now routinely screening foreign state money in major tech and gaming deals rather than letting such acquisitions pass unexamined.

The throughline for the week is less about new legislation than about existing legislation finally being used. The AI Act moved from statute to active enforcement, the DSA's reach is being tested against AI products themselves, gigafactories and EuropAI turned sovereignty rhetoric into procurement, and Wero, right to repair and EV charging rules reached ordinary consumers directly. What the BEUC and noyb interventions add is a check on the enthusiasm: passing a rule and enforcing it well enough to change behaviour are still two different things, and this week supplied evidence of both.