The Week in European Digital: The AI Act Arrives, Enforcement Lags Behind and Capital Chases Sovereignty

The European Union's AI Act entered into force this week, and with it came the world's most comprehensive attempt yet to regulate artificial intelligence by risk rather than by technology. AI Business reported that the law now bans a narrow set of unacceptable AI practices outright while layering escalating obligations onto high-risk systems — a structure meant to protect fundamental rights without freezing innovation in place.

Heise Online's commentary on the rollout argued that Brussels' methodical, risk-tiered approach is an underestimated strength rather than a bureaucratic burden: if it works, the EU AI Act could become the reference model other jurisdictions borrow from, much as GDPR did for data protection a decade ago. That is a bet on regulatory patience paying off in global influence — and it is one the rest of this week's news put under real pressure.

Two stories complicated the picture. Heise also reported that registrations under the NIS2 cybersecurity directive — mandatory for operators of critical infrastructure — are running far below what Brussels expected, with officials openly puzzling over why. And EDRI detailed the latest turn in the long-running Chat Control saga: MEPs sent what the group called a strong signal against mass surveillance by rejecting broad scanning powers, yet under the rules still in force, large platforms can keep scanning private messages regardless of that vote.

A law can enter into force in a day; getting an entire continent's infrastructure operators to register for it takes longer.

Read together, the AI Act's launch and the NIS2 shortfall make the same point from opposite directions: Europe's digital rulebook keeps growing more ambitious, but the gap between what Brussels legislates and what actually happens on the ground — inside companies, inside Parliament's own follow-through — has not closed at the same pace.

Not every enforcement story ran the same way. The Verge Policy reported that Apple is building iPhone-to-Windows copy-paste functionality specifically in response to an EU interoperability request under the Digital Markets Act, opening its Universal Clipboard to a competitor's platform for the first time. It is a small feature, but a concrete one: a single request under a several-years-old law changing how one of the world's largest platforms behaves, in Europe, this quarter.

Financial infrastructure had its own quiet development. netzpolitik.org reported that the European Central Bank will run a practical pilot of the digital euro next year with real central bankers testing the system's usability and scalability, though questions remain about whether it will support offline payments — a capability that matters for resilience as much as convenience. It is a reminder that digital sovereignty is not only about AI models or chips; it is also about who controls the plumbing of everyday payments.

Capital, meanwhile, kept flowing toward the parts of the stack Europe considers strategic. Silicon Republic reported that the EU's five-billion-euro Scaleup Europe Fund has started backing companies, with Paris-based Mistral AI and Germany's The Exploration Company among the first recipients — an explicit bet on keeping later-stage growth capital, and the intellectual property that comes with it, on the continent. Tech.eu covered a separate milestone pointing the same way: UK chip startup Olix closed a $312 million round, one of the largest of the week across more than thirty European funding deals, underlining how central semiconductors have become to the sovereignty conversation. Smaller rounds told a similar story — Spanish firm FuVeX raised €3 million for dual-use drone technology serving both civilian inspection and defence use cases, while Zürich's Exclaim Robotics exited stealth with €4.29 million to build robots that maintain AI data centres, addressing a technician shortage in infrastructure Europe is racing to build out.

None of this week's individual stories settles whether Europe's regulatory ambition and its industrial buildout are moving at the same speed. But taken together, they sketch where the pressure points sit: a landmark AI law now needs the follow-through that NIS2 has so far lacked, older privacy fights are not as settled as a single vote suggests, and the money is already betting on chips, drones and data-centre robotics as the physical layer under any sovereignty claim. The AI Act got the headlines this week. Whether it gets the compliance NIS2 didn't is next week's more interesting question.