Testing someone else's AI is not digital sovereignty

Checking someone else's homework is not the same as doing it yourself. The EU's cybersecurity agency ENISA has finally won hands-on access to test Anthropic's Mythos 5 and OpenAI's GPT-6 Astra, as Silicon Republic and The Next Web both report, the EU AI Act's systemic-risk powers now pointed at two of the most closely watched frontier models operating in Europe. The access followed months of negotiation, and it lets Brussels assess a cybersecurity risk before it surfaces rather than after a journalist finds it, which is exactly the gap this column flagged a week ago when Article 55's incident reporting duty met a live OpenAI case.

But testing a model is not building one. Aleph Alpha, the German lab that markets itself as a sovereign alternative to both Anthropic and OpenAI, is not what ENISA is examining here; Mythos 5 and GPT-6 Astra are. The AI Act gives Brussels a say over both models. It does not give Brussels either one. A report out the same day names that arrangement outright: large European organisations, The Register finds, increasingly call full digital sovereignty unrealistic and describe what they actually practice as ‘resilient interdependence’, staying reliant on outside providers while making sure no single failure can take down critical operations.

Oversight, not ownership.

Money moved at both ends of the market too, at very different scale. Bending Spoons, the Milanese acquirer that has spent years buying up struggling digital brands, agreed to pay 1.7 billion euros for the AI workspace Miro, one of the largest European tech acquisitions to close this year. The same day, Antler published research on 760 unicorn founders that found the opposite story sitting underneath the record late-stage rounds: an early-stage funding pipeline in genuine crisis.

The gap shows up in the day's own numbers. Milan's Bynario, a cybersecurity startup whose AI research exposed real flaws in Apple's macOS Screen Sharing, closed its pre-seed round at 2.1 million euros. That is a bit over a tenth of one percent of what Bending Spoons is paying for Miro this week. Late-stage capital in Europe is not scarce. What a young company can raise before it has anything worth acquiring, still is.

Consumers…

Germany's EUDI Wallet has a new name. Berlin's implementation of the EU's digital identity wallet now goes by ‘D-You’, as Heise reports, with the government hoping banks, insurers and public agencies build real uses for it beyond a passport in your pocket. A rename settles none of the wallet's open questions, but it does mean the project is entering the phase where ordinary residents are actually asked to install something.

Separately, a civil society coalition has written to EU lawmakers asking them to replace cookie banners with an automated browser signal, binding on every site rather than optional, as part of the Digital Omnibus package, noyb reports. Industry has pushed back on this idea before. This time the ask is a legal requirement, not a voluntary standard.

Businesses…

Founders and investors want the promised ‘EU Inc’ corporate status finished without further dilution. TechCrunch reports that European founders and VCs are pushing lawmakers to finalise a single, digital-native corporate form that would let a company incorporate once and operate across the bloc, rather than nurse 27 sets of local paperwork. Tech.eu frames the same stakes from the Brussels side: with roughly 100 days left before the file is settled, tech leaders are warning that stripping out the more ambitious features, a genuinely common framework chief among them, would defeat the point of writing a new statute at all. A watered-down EU Inc solves the branding problem and leaves the actual fragmentation in place.

Government…

The Cyber Resilience Act's mandatory vulnerability reporting duty, flagged in this column six days early, takes effect from 11 September. Manufacturers of digital products will have to report actively exploited vulnerabilities and serious incidents within 24 hours, routed through ENISA's new Single Reporting Platform to national CSIRTs, Agenda Digitale reports. The deadline itself is not news to readers of this column. What is worth watching now is whether the platform produces usable threat intelligence, or just a compliance log nobody reads before the next Berlin-style leak forces the question again.

Further today

• Arlequin AI secures €28M to scale topological neural network technology · Tech.eu
• Improbable backs AI business messaging app Bolter with $10M · Tech.eu
• Belgian AI startup IVEX raises €5M for AI-powered automotive safety testing · EU-Startups
• German AI Lab Grubel Raises €3 Million for Legal Case Adaptation Systems · EU-Startups
• Euro-Office for Business Networks: Changes for Firms and Small Businesses · Agenda Digitale
• Nscale dominates UK datacenter investment, securing two-thirds of equity funding · The Register
• Zeiss ditches greenfield SAP S/4HANA migration · The Register
• CNIL Publishes Part 2 of 'L'Agence Privacy' Comic to Educate on Cybercrime · CNIL
• noyb Files Injunction Against SCHUFA Over Shadow Database · noyb.eu
• Europe's space sovereignty needs more than scale, say industry leaders · EU-Startups

Sources

• ENISA's access to test Anthropic's Mythos 5 for cybersecurity risk · Silicon Republic
• ENISA testing both Mythos 5 and GPT-6 Astra under the AI Act's systemic-risk rules · The Next Web
• Why large European organisations now call full sovereignty unrealistic and prefer resilient interdependence · The Register
• Bending Spoons' 1.7 billion euro agreement to acquire Miro · EU-Startups
• Antler's research on the early-stage funding crisis behind Europe's unicorn boom · Tech.eu
• Bynario's 2.1 million euro pre-seed after its AI exposed Apple vulnerabilities · EU-Startups
• Germany's EUDI Wallet renamed D-You · Heise Online
• Civil society's push for EU-mandated automated privacy signals to replace cookie banners · noyb.eu
• European founders and VCs urging lawmakers to finalise EU Inc without dilution · TechCrunch Europe
• Tech leaders warning against watering down the EU Inc reform · Tech.eu
• The Cyber Resilience Act's mandatory vulnerability reporting taking effect on 11 September · Agenda Digitale