Apple's DMA Reckoning, AI Act Teeth and Sovereignty Capital

Brussels spent much of the past week proving that Europe's digital rulebook has teeth, not just ink. Apple bent under enforcement pressure from two directions at once, national AI Act implementations began drawing their first serious internal criticism, and data protection regulators kept testing where anonymization actually ends. Underneath all of it, investors kept betting that Europe's answer to dependency on foreign AI infrastructure is worth funding.

The clearest sign of that shift came from Cupertino. Apple confirmed it will cut App Store commissions for European developers from October, allowing third-party payment options and lowering standard commissions from 30 percent to between 15 and 26 percent, Silicon Republic reported. The changes follow a 500 million euro fine and months of wrangling over what Digital Markets Act compliance actually requires, as Agenda Digitale detailed. Separately, Germany's Federal Cartel Office ordered Apple to stop designing its App Tracking Transparency prompts in a way that steered users toward Apple's own apps and away from competitors, The Verge reported, a reminder that Apple's European headaches now run on two parallel tracks: Commission-led DMA enforcement and national competition law cases.

The EU AI Act moved from paper to practice this week too. In Italy, a revised implementing decree adjusted the rules around facial recognition after pushback from the country's privacy watchdog and the European Commission, Agenda Digitale reported. In the Netherlands, the data protection authority confirmed that organizations deploying high-risk AI systems will need to complete a fundamental rights impact assessment from December 2027; the authority itself frames this as a Dutch measure rather than a direct EU requirement, one designed in the spirit of the incoming AI Act rather than mandated by it. And EU-Startups counted ten European compliance startups building governance and audit tools now that the Act's enforcement powers are active for AI systems, evidence that the law has become a market opportunity in its own right, not just a compliance burden.

Not everyone is convinced the rollout is going smoothly. Niedersachsen's data protection commissioner sharply criticized Germany's national AI Act implementation law, according to Heise Online, warning that it centralizes market surveillance in a way that could sideline regional data protection authorities and endanger both fundamental rights protection and digital sovereignty, with a constitutional review reportedly under consideration. The critique lands at an interesting moment: Agenda Digitale also reported that OpenAI has slowed development of its frontier models and suspended reinforcement learning work to strengthen safety controls after incidents with advanced systems, illustrating a divergence the article frames explicitly, with Europe leaning toward preventive regulation and public oversight of strategic AI while the United States leans toward technological leadership through industry collaboration.

Legislating AI is the easy part; deciding who enforces it is where sovereignty gets contested.

Privacy regulators, meanwhile, kept pushing on where anonymization actually starts and stops in an AI-saturated data economy. The European Data Protection Board issued clarified criteria for when data counts as properly anonymized under GDPR, pointing to factors including the nature of the data, who can access it, how easily it can be re-linked to a person, and the cost and technology needed to do so, Agenda Digitale reported, stressing that verification has to happen case by case. That question is not academic. In Germany, Tübingen-based BinDoc is suing the Baden-Württemberg data protection authority over an order to provide information about whether the millions of hospital records it holds are genuinely anonymized or remain personal health data under GDPR, Heise Online reported. And in the Netherlands, the data protection authority urged Twitch users to switch off a default-enabled setting that shares facial and voice data with Amazon for AI training, warning of misuse risk.

Money kept following the sovereignty argument too. Danish AI infrastructure startup Velatir raised 5 million euros built explicitly around European-owned infrastructure, positioning itself against dependency on US hyperscalers, Tech.eu reported. In London, Callosum secured a 100 million dollar seed round led by Atomico to tackle AI compute bottlenecks, backed by the UK's Sovereign AI Fund and the government's AI hardware plan, according to Sifted. Ireland formed a semiconductor advisory council, chaired by a former Intel executive, specifically to guide the country's engagement with the EU Chips Act, Silicon Republic reported. And in France, Tech.eu tallied more than 2.5 billion euros raised by the country's leading tech companies in the first half of 2026, led by AI, space and fintech, with Eutelsat and Mistral AI among the largest raises.

Europe is not just legislating digital sovereignty this week, it is starting to fund it.

Individually these are separate stories: a platform fine, a set of compliance deadlines, a batch of funding rounds. Together they describe a continent trying to write and enforce its own digital rules while also building the infrastructure meant to run on them. Whether regulation and capital end up reinforcing each other or pulling in different directions looks likely to be next year's story rather than this one.