Europe’s complex network of overlapping regulations is hitting startup founders hard and holding back business, according to a new research by startup support organization DutchBasecamp.

Some 79% of tech founders claim they've been hit by regulatory friction over the last year, according to the The Realities of Scaling in Europe report, which was launched in partnership with the Computer & Communications Industry Association (CCIA).

More than half (58%) said they'd delayed entering another EU market, 45% have paused or canceled features, and 44% have experienced delayed or lost deals.

As negotiations on the Digital Omnibus continue, the CCIA warned that many meaningful simplification measures could fall by the wayside, which has the potential to further compound challenges faced by startups.

Some member states are resisting a proposal allowing businesses to report a cybersecurity incident once, rather than separately under seven overlapping frameworks.

Meanwhile, a fix that would establish legitimate interest as a legal basis for responsible AI training has been stripped out.

While postponing certain deadlines has provided some breathing room, many simplifications have been rejected, leaving developers with limited implementation time while essential codes, guidance, and standards are still missing.

“We warned from the start that the Commission’s proposals to simplify the patchwork of EU tech and digital rules were only the bare minimum. Instead of going further, Parliament and Council are now weakening, rejecting, or delaying even the most basic fixes," said Daniel Friedlaender, senior vice president and head of CCIA Europe.

“Europe’s innovators have shown remarkable patience in navigating today’s regulatory maze, but that patience is running out. EU institutions and member states need to wake up: 2026 must bring real improvements for tech companies. Europe knows the problems. If we refuse to fix them, we can’t be surprised if our founders look outside the EU for success.”

Growing regulatory friction

Nearly a quarter of survey respondents said they'd spent more than 30% of their budgets on compliance costs, while 24% are considering or have already relocated their headquarters due to regulation.

In January, the European Investment Bank, with the European Commission, found that roughly one-in-ten EU scale-ups have relocated abroad, with around 85% of those moving to the United States.

The Commission’s Joint Research Center put the headquarters-relocation rate for venture-backed startups at between 3.3% and 4.3%, ten times the rate for comparable non-VC-backed firms.

More than half of founders said they'd steered clear of an EU country because of regulatory concerns, and only 21% said they'd seen no material impact from EU or national rules.

"Europe is already losing tech founders, products, and growth," said Masha Moisseyeva, managing director of DutchBasecamp.

"When 45% of those surveyed have paused or cancelled features, 58% have delayed entering another EU market, and 44% have lost or delayed deals in a single year, the urgent need for regulatory simplification is no longer a theoretical debate about EU competitiveness. The damage is happening now.”

Regulatory confusion is rife

Much of the cost, the researchers found, comes not from compliance itself but from not knowing what compliance will require.

Indeed, founders often cite uncertainty surrounding future EU AI Act obligations before any requirement has formally bound them.

“Founders are not asking the EU to lower its standards. They are asking for clear, workable rules they can rely on across the Single Market," said Moisseyeva.

"Instead, uncertainty and overlapping obligations are dictating what they build, who they serve, and how fast they grow.”

FOLLOW US ON SOCIAL MEDIA

Amazon has hit back at EU lawmakers after the European Commission signalled its intent to designate the hyperscaler as a “gatekeeper” under the Digital Markets Act (DMA).

In a statement on 25 June, the Commission noted that Amazon Web Services (AWS) and Microsoft “hold an entrenched and durable position” in the EU cloud computing sector, with both potentially harming competition across the region.

AWS and Microsoft have already been designated as gatekeepers in other business areas, and with cloud computing, lawmakers are equally concerned the duo could stifle competition.

“Their cloud computing services AWS and Azure have achieved significant turnover, and their operational capacity and investments seem to have significantly outpaced those of competitors,” the Commission said.

“They both have vast and entrenched user bases and appear to benefit from lock-in effects and high switching costs, in addition to a large ecosystem.”

The Commission also highlighted competition concerns regarding the influence of AI services on the broader market, noting that both firms’ AI tools have “become a decisive factor in cloud procurement”.

“Whilst AI is significantly increasing the demand for cloud-related services, AWS and Azure appear to retain a large proportion of this increased demand within their respective ecosystems.”

While the Commission noted that this is a “preliminary view”, the statement follows a seven month investigation into the influence of both companies.

If designated under the legislation, lawmakers could impose a series of obligations on both companies, such as the introduction of new interoperability and data portability features.

Teresa Ribera, the EU’s executive vice president for Clean, Just, and Competitive Transition, said both companies will have the opportunity to respond before “final decisions are taken”.

AWS hits back at EU claims

AWS has contested the claims made by the European Commission, with a spokesperson suggesting the preliminary findings “disregard the breadth of cloud services available to European customers”.

The spokesperson added that designation under the legislation could risk “deterring future European investment and innovation”.

“AWS faces healthy competition and customers across Europe have more choice, lower prices, and greater flexibility than ever before,” the spokesperson said.

“The EU already has comprehensive cloud regulation through the Data Act, and adding another heavy layer of overlapping regulation under the DMA undermines European competitiveness and access to cutting-edge information technology.”

AWS said it intends to work closely with the Commission to “reach the right outcome for customers”.

Long-running competition concerns

The move by the Commission comes as relations between US-based tech giants and the EU grow increasingly tense.

European regulators have made repeated attempts to limit the influence of US firms across the region, having been locked in a series of battles with Microsoft over its dominance in the productivity software market.

Geopolitical tensions, however, are adding fuel to the fire on this front, particularly with regard to data sovereignty.

Critics argue that European organizations have become over reliant on US technology services, prompting calls to seek alternative, home-grown options.

Earlier this month, the Commission unveiled the technological sovereignty package, a series of measures aimed at strengthening digital sovereignty capabilities across the EU - spanning areas such as AI, cloud computing, and semiconductor manufacturing.

Speaking at the time, Ursula von der Leyen, president of the European Commission, said the package comes in direct response to concerns about overreliance on foreign technology services.

“We cannot afford to depend on others for the technologies that keep our hospitals running, our energy grids stable, and our services secure,” she said.

FOLLOW US ON SOCIAL MEDIA

Changes made to the EU AI Act last week have been welcomed by industry stakeholders, but the move doesn’t mean enterprises can take their eye off the ball on AI governance.

Last week, a provisional agreement was reached between the European Parliament and EU Council on the Omnibus VII legislative package. This includes proposals which aim to simplify the union’s legislative landscape.

Under the deal, significant changes to the EU AI Act will be implemented, including a revised compliance timeline for AI systems deemed “high-risk” under the legislation, as well as extended exemptions for small-to-medium sized enterprises.

As part of the delayed high-risk rules, new application dates will be 2 December 2027 for stand-alone AI systems, and 2 August 2028 for high-risk AI systems embedded in products, according to the EU Council.

Similarly, agreement reinstates provider obligations to register AI systems in the EU database for high-risk systems.

Elsewhere, the provisional agreement also postpones the deadline for the implementation of AI regulatory sandboxes at a national level until 2 August 2027.

Henna Virkkunen, executive vice president for tech sovereignty, security, and democracy at the European Commission, said the changes will help streamline implementation of the legislation.

“Our businesses and citizens want two things from AI rules. They want to be able to innovate and feel safe,” she said.

“Today’s agreement does both. With simpler and innovation-friendly rules, we make it easier to innovate without lowering the bar on safety. We are also making sure the tools supporting EU companies for a smooth implementation of the AI Act are ready.

“Meaningful changes” to the EU AI Act

The changes made to the legislation have been welcomed by industry stakeholders as a positive step toward streamlined implementation.

Mark Weir, regional director for the UK & Ireland at Check Point Software, said the alterations represent a “meaningful evolution in EU AI governance” that balances stronger protections alongside a practical approach to compliance.

“By harmonizing implementation across member states and reducing overlapping administrative obligations, the legislation removes genuine friction for organizations operating across Europe,” he said.

“Without clear guidance, even well-intentioned organisations struggle to translate broad principles into consistent practice,” Weir added.

“This closes a gap that has caused real uncertainty in the market. Taken together, these changes point toward a regulatory framework that is not just ambitious, but workable."

Weir noted that provider registration requirements are also a welcome move, and one that will give European legislators “real enforceability” over the EU’s digital sovereignty plans.

Levent Ergin, chief strategist for agentic AI, regulatory compliance, and sustainability at Informatica, echoed Weir’s comments but noted that the changes “shouldn’t detract from the need for better AI governance”.

“Businesses still need to ensure the data feeding their AI systems is governed, explainable, and built on trusted data foundations,” he said.

“Compliance is only part of the enabler of safe AI. Stronger governance, human oversight, and trusted context will ultimately determine which businesses can scale AI confidently and which struggle to move beyond experimentation.”

Looking ahead, the European Parliament and EU Council must not formally adopt the agreement.

FOLLOW US ON SOCIAL MEDIA

European policymakers are increasingly concerned about digital sovereignty, calling for the development of a technology ecosystem that's less dependent on big US tech firms.

At workspace platform Wire’s recent European Digital Sovereignty Summit in Brussels, MEPs, industry leaders, and digital experts called for the creation of a digital ecosystem reflecting what they described as European – rather than US – business values: democracy, transparency, and interoperability.

“Reducing reliance on foreign tech infrastructure is key to protecting democratic stability and data sovereignty, particularly given geopolitical risks," said Wire CEO Benjamin Schilz.

"Open source, interoperability and transparent standards are essential to build trust, avoid vendor lock-in, and strengthen resilience.”

Participants highlighted the risks of concentrated browser ownership, reliance on foreign cloud providers, and governance vulnerabilities within major platforms.

Notably, however, sovereignty must not mean isolation: Europe should remain open and globally engaged but anchored in its own standards and safeguards.

Jean-Phillipe Scherer, head of EU/NATO Public Affairs for Defence and Space at Airbus, called for a broader mindset shift through more European leadership and education.

“Individual priorities, rather than national sovereignty, are the greater barrier to European cooperation,” he said.

There were calls for practical reforms, stronger alignment across AI, semiconductor and cybersecurity policy, and for simplification within a deeper single market.

Strained relations create uncertainty

The unpredictability of the Trump administration in the US has intensified calls for European digital sovereignty, with figures including European Commission President Ursula von der Leyen and former head of the European Central Bank Mario Draghi, calling for action.

Just last week, the European Council proposed new regulations aiming to reduce dependence on US firms. This includes new proposals to “simplify the EU’s digital legislative framework and the implementation of harmonized rules on AI”.

“Streamlining the AI rules is essential for ensuring the EU’s digital sovereignty," said Marilena Raouna, deputy minister for European affairs of the Republic of Cyprus.

"The proposal will bring greater legal certainty, make the rules more proportionate and ensure more harmonised implementation across member states."

In the UK, calls are growing for a stronger focus on digital sovereignty, with industry stakeholders harboring significant concerns on transatlantic overreliance.

A survey of over 1,000 UK IT leaders from Civo last year found that more than 60% believed the UK government should cut its use of US cloud services.

Key concerns included exposing the country’s digital economy to significant risks with regard to data security, and the impact providers have on the domestic cloud industry.

The Atlantic Council recently warned that Trump’s close connections with leading tech executives means that the US administration’s combative posture toward European tech regulation is likely to continue causing friction.

"Whether a continued focus by the Trump administration on Europe’s digital rules will create an even stronger push in Europe for an exclusive form of digital sovereignty is not yet evident," commented fellows Frances Burwell and Kenneth Propp.

"What is clear is that without some guidelines, such as those offered in the conclusions to this report, the European Union and United States might find that their differences regarding digital sovereignty and digital rules make creating and maintaining an open transatlantic digital marketplace much more challenging."

Big tech is acting

Aware of the issue, US tech firms are making efforts to calm European business concerns, particularly with the launch of dedicated sovereign cloud services,

Amazon Web Services (AWS), Microsoft, and Google Cloud have all made moves on this front. Yet despite proactive efforts, lingering doubts still persist.

As these companies are subject to the US Cloud Act, which allows US law enforcement to demand access to data – even when that’s stored outside the US – European industry stakeholders continue to voice concerns.

Last year, Microsoft president Brad Smith claimed the tech giant would take the US government to court if forced to comply with data requests by the US administration.

FOLLOW US ON SOCIAL MEDIA

Sumo Logic is expanding its EMEA footprint with planned availability of its AI-powered security solutions on the AWS European Sovereign Cloud and Swiss Data Center region.

The move aims to bolster support for European organizations' data privacy, sovereignty, resiliency, and security needs as they push ahead with digital and AI strategies.

Sumo Logic said the expansion will enable businesses to deploy its security analytics and SIEM capabilities while keeping data in-country or within designated time zones as demand for sovereign cloud services grows.

According to research from IDC, 63% of organizations are now more likely to adopt sovereign cloud services due to recent geopolitical events, with spending tipped to reach more than $400 million by 2029.

Despite the growing market, Eric Avery, global head of infrastructure and data at Sumo Logic, said strict data sovereignty regulations are creating barriers for many organizations – particularly across regulated sectors such as healthcare, finance, and the public sector.

“Previously, enterprises in highly regulated industries have been limited in their choice of cloud security solutions while meeting compliance requirements like Switzerland’s FADP,” he explained.

“Sumo Logic's innovations around SIEM and agentic AI, combined with AWS' European Sovereign Cloud infrastructure, provides the ideal response.”

AWS sovereign cloud and Swiss expansion

Under the expansion, Sumo Logic’s Intelligent Security Operations platform will be made available for deployments on the AWS European Sovereign Cloud to help customers operate cloud workloads in an independently governed environment while using Sumo Logic to log, track, and secure deployments.

The security vendor also confirmed plans to roll out its platform in Switzerland in an effort to better support customers that require faster in-country data processing in line with the Swiss Federal Act on Data Protection (FADP), as well as GDPR obligations.

By expanding its footprint to the AWS Swiss Data Center, Sumo Logic said organizations operating within Swiss borders will be able to leverage its agentic AI-driven log analytics and advanced SIEM capabilities to boost compliance, while benefitting from a faster, low-latency environment.

“We deliver reliable security operations that help organizations stay secure and compliant while running services locally with the performance and scale they need,” Avery added.

FOLLOW US ON SOCIAL MEDIA

The European Union (EU) has put €700 million into NanoIC, the largest of five pilot lines designated under the EU Chips Act.

The Act includes five lines – Fames, Apecs, WBG, PixEurope and NanoIC - aimed at bringing chip technology "from the lab to the fab". The aim is to strengthen the position of European players in the global semiconductor market, reducing the current reliance on Asian and US supply chains.

NanoIC has now pulled in a total of €2.5 billion in investment, with €700 million from national and regional governments and the rest from ASML and other industry partners.

In a statement confirming the move, the European Commission said NanoIC will accelerate the development of next-generation semiconductor technology for use in AI, autonomous vehicles, healthcare, and 6G mobile technology.

It's the first European facility to deploy the most advanced Extreme Ultraviolet lithography machine. This allows the design and manufacture of chips using technology beyond two nanometers – a big step forward for the European semiconductor manufacturing industry.

NanoIC is built on the principle of open access, with startups, researchers, SMBs and large organizations all able to use the facilities.

The project is based at the Interuniversity Centre for Microelectronics in Leuven, Belgium, and is supported by partners including Tyndall National Institute in Ireland, French research organization CEA-Leti, and Germany's Fraunhofer-Gesellschaft.

The site includes a new 2,000 square meters expansion of the existing cleanroom, bringing it up to more than 12,000 square meters. Construction will begin soon to create an extra 4,000 square meter cleanroom.

It will house a best-in-class toolset, including ASML’s next-generation High NA EUV scanner, which is scheduled to arrive in the middle of next month. Over the next five years, the NanoIC pilot line will integrate more than a hundred new tools, distributed across imec and its partner sites.

"By providing access to cutting-edge semiconductor technologies, the NanoIC pilot line will play a crucial role in strengthening Europe’s industrial fabric in the AI era, and ensuring a climate of economic growth, security, and prosperity for decades to come,” said Luc Van den hove, CEO of imec, which is hosting the project.

The pilot lines come four years after the Chips Act was first announced in 2022. Last month, EU member states officially endorsed a Semiconductor Declaration calling for the Act to be strengthened though a Chips Act 2.0.

“We don't have the luxury of being the biggest or the strongest, but we do have the choice to be the best,” said Matthias Diependaele, Flemish minister-president. “With the NanoIC pilot line, Europe is making that choice a reality: for technological excellence and strategic independence."

Fames, a pilot line aimed at advancing ultra-low-power semiconductors in Europe, launched late last month, covering advanced FD-SOI nodes, embedded non-volatile memories, RF passives, 3D integration and power management.

FOLLOW US ON SOCIAL MEDIA

European Trade groups have hit out at the EU’s proposed Digital Networks Act (DNA) amid concerns the legislation could favor “outdated telecom monopolies”.

The European Commission (EC) set out its proposals for the legislation this week, which aims to modernize, simplify, and harmonize regional rules on connectivity networks.

The Act introduces mandatory national transition plans to phase out copper networks and transition to advanced networks between 2030 and 2035.

Meanwhile, the hope is that by cutting red tape, it will encourage operators to invest in rolling out advanced fiber and mobile networks, and that this will in turn attract investment in AI and the cloud.

"High-performance resilient digital infrastructure is essential in strengthening Europe’s leadership in innovation, competitiveness and digital sovereignty," sad Henna Virkkunen, executive vice-president for tech sovereignty, security and democracy.

"Advanced and accessible connectivity will allow start-ups to harness the potential of AI, enable doctors to care for patients remotely, quickly and safely. Our goal is a digital environment where new technologies are readily available, affordable, and grounded in fair trustworthy rules that benefit people."

Key rules under the Digital Networks Act

Under the proposals, companies will only have to register in one EU country to provide services across the union. There will be incentives for pan-European satellite communication services through an EU-level, as opposed to national level.

The Act will also make national spectrum authorization more consistent by giving operators longer spectrum licenses and by making licenses renewable by default.

This, lawmakers said, will ensure that all available spectrum is being used by imposing a "use it or share it" rule on operators.

Similarly, this will also see the introduction of a voluntary cooperation mechanism between connectivity providers and other players, such as content application and cloud providers.

Opposition is mounting

The proposals have drawn fire from the Computer & Communications Industry Association (CCIA Europe). The Act's voluntary cooperation and dispute management scheme, it said, are unnecessary, as online service providers and telecom operators already cooperate.

The new mechanism would leave the door open for legislative amendments or rulings by national regulatory authorities that could turn it into a binding IP dispute-resolution system, the trade group warned.

That would effectively resurrect widely-rejected network fees, allowing dominant telecoms operators to extract unjustified revenues from popular online services.

“This is not a ‘voluntary conciliation’ procedure, but one that will create new disputes. It risks harming every part of Europe’s connectivity ecosystem," said CCIA Europe’s senior policy manager, connectivity and competition, Maria Teresa Stecher.

“The DNA could have been a real opportunity to simplify EU rules and boost competitiveness. Instead, the Commission now risks doing the opposite – favoring the interests of outdated telecom monopolies over European consumers, innovative online services, and better connectivity. This is not simplification, it is a step backwards.”

The GSM Association (GSMA), a lobby group for the mobile communications industry, echoed the CCIA's concerns over the conciliation process, airing a few additional concerns of its own.

Chief among these are concerns that this will add a new layer of complexity for providers and that aspects of the legislation stem from the "largely outdated" ePrivacy Directive.

"A key priority for the Commission over the past 12 months has been ‘simplification’," it said.

"But we now face the prospect of even more sector-specific rules, additional administrative bodies and reporting obligations, and the retention of unnecessary, redundant or duplicative elements including consumer protection and rules stemming from a largely outdated ePrivacy Directive. This is not simplification, it is complexification."

The proposal will now be presented to the European Parliament and Council for approval.

FOLLOW US ON SOCIAL MEDIA

The European Commission (EC) has renewed a pair of rules that will allow data to continue flowing between the European Economic Area and the UK.

The adequacy decisions were agreed after the UK left the EU via "Brexit" in 2020 on the grounds that the UK legal framework for data protections were as good as those in Europe.

While that was welcome news for British companies dependent on the flow of data, the former government still complained that the decision should have been taken before the official Brexit withdrawal date.

That agreement ran out in June 2025, but was given a technical extension of six months to give the EC time to consider the impact of changes brought in via Labour's Data (Use and Access) Act.

This loosened up some data controls for research and charitable fundraising, while requiring companies to have a data protection complaints procedure.

The aim, said then technology secretary Peter Kyle, was to enable the government to make use of the "goldmine of data" it holds for policing, admin and more.

In particular, the EC was considering the impact of those changes on the General Data Protection Regulation (GDPR) and the Law Enforcement Directive.

Six-year renewal

Now, the EC has announced that the adequacy decisions have been given another six years until 2031, with the possibility of renewal again, with the Commission and European Data Protection Board reviewing the system and any changes in four years.

"The decisions ensure that personal data can continue flowing freely and safely between the European Economic Area (EEA) and the United Kingdom, as the UK legal framework contains data protection safeguards that are essentially equivalent to those provided by the EU," the EC said in a statement.

The renewal means data will be able to continue to flow between the UK and Europe, avoiding serious disruption for businesses if that were to stop.

Adequacy agreements

The EC's first adequacy decision with a non-EU country following the introduction of GDPR was with Japan, coming into force in 2019, though the European body had similar agreements in place for other countries including Canada before the regulation was introduced.

Other countries with adequacy decisions in place include the US, Switzerland, Argentina, and Korea.

"The European Commission has the competence to determine, on the basis of the General Data Protection Regulation, whether a country or international organisation outside the EU ensures an adequate level of data protection," the EC explained.

"Following this, the Commission might initiate the process for the adoption of an adequacy decision, which allows the free flow of personal data from the EU and the European Economic Area (EEA) to a third country or international organisation without further obstacles."

For the UK renewal, a wide range of opinions were sought. "The adoption of the renewal decisions follows the European Data Protection Board's opinion and the Member States' green light in the so-called comitology procedure," the EC said in a statement, referring to a system that enables the EC to implement rules under the review of national representatives from member states.

The UK adequacy agreement was approved despite the changes introduced by the Data (Use and Access) Act introduced by the Labour government – which were more limited than a data overhaul initially planned by the last Conservative government that may not have been seen in such a positive light by the EC and member states.

FOLLOW US ON SOCIAL MEDIA

MEPs are calling on the European Commission to establish more robust rules on the use of algorithms in recruitment and staff management amidst concerns over privacy and discrimination.

According to recent EU research, 42% of EU workers are currently subject to algorithmic management in the workplace, a figure expected to rise to 55.5% within the next five years.

There's already legislation on artificial intelligence and data protection at EU level, including the EU AI Act and GDPR, while rules focusing more specifically on the use of AI at work are laid out in the Platform Work Directive.

However, the EU lawmakers believe that more specific legislation is required. It has now proposed a series of recommendations aimed at ensuring that the use of automated monitoring and decision-making systems in the workplace is transparent, fair, and safe.

The main thrust of the proposals is that there must be human oversight of all decisions taken or supported by algorithmic management systems.

Workers should have the right to request explanations of any decisions taken or supported by such systems - and, if a worker believes his or her rights to have been infringed, they should have the right to ask for a review.

If successful, the system in question could be modified or discontinued.

Decisions on the offer or termination of employment, the renewal or non-renewal of a contract, changes in pay, or disciplinary action should always be taken by a human and be subject to human review.

"This topic affects both employers and 200 million workers in the EU. A human-centered approach is key, and the rights, safety, and dignity of employers and employees must be strictly respected," said MEP Andrzej Buła.

"This sends a strong signal: Europe can combine competitiveness with social responsibility. It can support innovative enterprises without sacrificing high standards and employee protection."

Cracking down on ‘algorithmic management’

A key focus of the crackdown centers on the fact that workers should be informed about how algorithmic management systems impact working conditions, when they're used to take automated decisions, what type of data they collect or process, and how human oversight is ensured.

MEPs believe workers should be consulted when these systems are used to make decisions affecting pay, evaluation, task allocation or working time.

Similarly, the use of these systems should respect wellbeing and not put workers' safety or physical or mental health at risk.

To protect workers’ privacy and data, the proposed rules would ban the processing of data relating to the emotional, psychological or neurological states of employees, as well as their private communications or geolocation outside working hours.

Elsewhere, the guidelines aim to limit the use of employee data while off-duty, as well as the use of data relating to freedom of association and collective bargaining.

There were 451 votes in favour of the recommendations and 45 against, with 153 abstentions. The European Commission now has three months to respond, by either informing Parliament on the steps it plans to take, or by giving reasons for a refusal.

FOLLOW US ON SOCIAL MEDIA

The European Union wants AI to be made in Europe – and it's chucking more than €1 billion into the pot to help make it happen.

The EU's European Commission unveiled two plans to boost homegrown AI innovation. The first is the Apply AI Strategy, which aims to speed up the use of AI in key industries as well as the public sector, and the AI in Science Strategy, which focuses on AI in research and science.

"I want the future of AI to be made in Europe," said Ursula von der Leyen, President of the European Commission, in a statement. "Because when AI is used, we can find smarter, faster, and more affordable solutions."

She added, "AI adoption needs to be widespread, and with these strategies, we will help speed up the process. Putting AI first also means putting safety first. We will drive this 'AI first' mindset across all our key sectors, from robotics to healthcare, energy, and automotive."

The Apply AI and AI in Science strategies follow plans from earlier this year that aimed to reduce regulatory burdens and costs for AI companies.

AI for Europe

Such plans are seen as a way to balance the dominance of the US and China when it comes to AI and other future-looking technologies, and give Europe its own " digital sovereignty" in terms of infrastructure and R&D.

"Europe is well-positioned to become an AI continent," said Henna Virkkunen, Executive Vice-President for Tech Sovereignty, Security, and Democracy, in a statement. "With the Apply AI Strategy, we will help our companies and key sectors, from manufacturing to healthcare and the public sector, use AI to deliver real benefits for EU citizens, reinforce our competitiveness, and strengthen our technological sovereignty."

That follows efforts by US companies to build infrastructure in Europe, with a push towards sovereign clouds and the ability to keep data in Europe.

What is the Apply AI Strategy?

This aspect of the EU's plans looks to encourage adoption of AI, in particular among smaller and medium-sized companies across key industries, including healthcare, pharmaceuticals, energy, mobility, manufacturing, construction, agri-food, defence, communications, and culture, as well as the public sector.

"It encourages an AI-first policy, so more companies consider AI as a part of the solution to tackle challenges, while taking into careful consideration the benefits and the risks of the technology," the EC said in a statement.

To help, the EC is "mobilising" €1 billion for "concrete measures" including setting up AI-powered healthcare screen centres, building agentic AI for manufacturing and other industries, and developing frontier models.

The aim isn't just to boost industry, however. "The strategy will help boost EU capabilities to unlock societal benefits, from enabling more accurate healthcare diagnoses to enhancing the efficiency and accessibility of public services," the EC added.

What is the AI in Science Strategy?

The aim with this side of the EC's plan is to set up Europe as a centre for AI-driven scientific innovation.

At the core is a virtual institute to coordinate the use of AI in science, as well as AI resources, known as the Resource for AI Science in Europe (RAISE).

The EC is also investing €58 million to help train and retain AI talent, encouraging them to "Choose Europe", with a further €600 million from funding body Horizon Europe dedicated to infrastructure. The EC said it hopes to double Horizon Europe's annual spend on AI to €3 billion.

"But this is not only about money," said Ekaterina Zaharieva, Commissioner for Startups, Research and Innovation, in a statement. "It is about building a European way for AI in science: open, collaborative, interdisciplinary, and responsible; where AI serves science, and science serves society."

She added: "With this strategy, Europe is making a purposeful choice to empower scientists, nurture talent and safeguard our sovereignty."

A host of key provisions in the EU Data Act will come into effect on 12 September, and there’s a lot for businesses to unpack.

The regulation came into force on 11 January 2024 and while a grace period has been running to ensure implementation, rules under the legislation will be applicable across the European Union (EU) from here onward.

At its core, the EU Data Act will introduce sweeping changes with regard to how data from connected devices and cloud services is accessed, managed, and shared across the union. This includes new rules on data access, service portability for organizations, and contractual fairness.

The potential long-term impact of the legislation cannot be understated, according to Soniya Bopache, VP and general manager for data compliance at Arctera.

“The EU Data Act has the potential to foster a more competitive and equitable data economy – largely thanks to its provisions on data access, fair contractual terms, and cloud switching,” she said.

“For businesses governed by the Act, this isn’t just a matter of compliance, it’s an opportunity to build a more transparent, efficient, and innovative digital ecosystem.”

So what can businesses expect with the EU Data Act?

What industries fall under the EU Data Act?

The legislation applies to a broad range of sectors, spanning areas such as manufacturing, cloud computing, transport, and consumer goods.

Moreover, it’s not limited to the private sector, with public sector organizations also expected to benefit from the legislation, according to Peter Grimmond, VP and head of technology at Cohesity.

“The EU Data Act has huge potential to deliver acceleration of both public and private sector innovation, through increased data democratization and access,” he said.

“For all enterprise and public sector organisations that have a robust, compliant, data classification processes already in place, the act will create an environment of collaboration and innovation where innovation can thrive without compromising corporate resilience or individual rights”

Data Access and Transparency

Data access and transparency is a key focus of the legislation, according to official EU materials on the Act.

Fundamentally, the regulations are designed to “enhance the EU’s data economy and foster a competitive data market” by making data more accessible and usable.

The move comes in the wake of an explosion of connected devices across the union in recent years. These IoT products collect vast volumes of data, which the legislation aims to capitalize on for reuse across the region.

To achieve this, new rules under the act will give users of connected devices - including businesses and individuals - greater control over the data they produce.

Similarly, the Act also includes rules on how enterprises can share data with other businesses. According to Grimmond, this aspect of the legislation could deliver positive long-term benefits for both businesses and consumers alike.

“It will speed the ability for data to be shared from more devices across more organisations, and opens the door for the development of new products, services, and ways of doing business,” he explained.

“Crucially, it does this without undermining the robust privacy standards that are the EU’s hallmark regulatory framework: building on GDPR’s global standard for privacy and aligning with DORA’s focus on digital operational resilience.”

Cloud service flexibility

As mentioned, another core aspect of the legislation centers around data portability, particularly with regard to cloud services. The Act aims to provide enterprises more flexibility in how they engage with cloud providers and, crucially, switching or opting for multiple options.

This aspect of the legislation comes in direct response to growing calls for a more fluid and competitive cloud computing industry in the EU, with enterprises having contended with “vendor lock-in” for several years now.

Running parallel to this frustration has been the rise of multi-cloud and hybrid cloud strategies, whereby enterprises host data on multiple providers, or through a combination of on-prem and cloud-based services.

Yet businesses with one particular cloud provider aiming to switch to another have faced significant costs transferring data. These “egress fees” have become a recurring point of contention and even prompted legal action against major industry providers.

With this in mind, the EU Data Act includes measures that ensure customers can switch from one data processing service to another in a more efficient manner.

Notably, the Act doesn’t specifically rule out vendors charging fees for data transfers. However, it obliges cloud providers to pass on these costs to the customer rather than charging excessive payments.

Some providers have taken steps to adhere to the new legislation. Google Cloud, for example, recently announced it would waive data transfer fees for customers switching to another provider.

MORE FROM ITPRO

• DORA and why resilience (once again) matters to the board
• Everything you need to know about the NIS2 Directive
• What businesses need to know about the General-Purpose AI Code of Practice

The second major enforcement deadline for the EU AI Act is approaching, meaning big tech firms will face a greater degree of scrutiny over AI model safety.

From August 2nd, new governance rules for general-purpose AI (GPAI) models will be introduced through a voluntary Code of Practice.

The deadline represents the second major enforcement date for the landmark legislation this year, following on from a February deadline which focused primarily on prohibited use cases.

Enza Iannopollo, VP principal analyst at Forrester, said that while the onus will be placed on providers, enterprise end-users will also likely feel the impact of the new rules.

“Whilst the first regulatory milestone on 2nd February focused on requirements, including those on prohibited use cases, this second deadline expands accountability and enforcement as it introduces critical provisions regarding general-purpose AI (GPAI) models,” she explained.

“Providers of generative AI models are directly responsible for meeting these new rules, however it’s worth noting that any company using genAI models and systems — those directly purchased from genAI providers or embedded in other technologies — will feel the impact of these requirements on their value chain and on their third-party risk management practices.” 

What the GPAI code of practice means for businesses

The GPAI code of practice will enforce more robust guardrails for training AI models, according to EU lawmakers, and is based on three key pillars.

This includes greater transparency, meaning AI model providers are required to document and disclose training processes and share information on models with regulators.

Safety and security are a key focus of the code, again focusing on whether GPAI models pose risks to the public or enterprises. Under the new rules, providers are required to assess and document potential harms and take appropriate action to reduce any risks.

Dirk Schrader, resident CISO (EMEA) and VP of security research at Netwrix, said security considerations in the act are welcomed and help create a more aligned approach to AI-related security risks.

“One of the most significant anticipated successes of the Act is the standardization of AI security across the European Union, creating a harmonized, EU-wide security baseline,” he said.

“A key strength of the proposed regulations is their emphasis on a security-by-design ethos, mandating a lifecycle approach that integrates security considerations from the outset and throughout an AI system's operational life.”

Security considerations do raise questions over compliance, however. Simply put, there isn’t a solid baseline for enterprises to work from with regard to AI-related security risks at this stage.

“The Act is the first major law to call out protections against data poisoning, model poisoning, adversarial examples, confidentiality attacks, and model flaws,” he said.

“The real compliance burden will be determined by technical specifications that don't yet exist, as these will define the practical meaning of 'appropriate level of cybersecurity' and may evolve rapidly as AI threats mature.”

Elsewhere, rules pertaining to copyright are also outlined in the code of practice, and this has been a major point of contention in recent months. For example, under the code, signatories must ensure training data is sourced lawfully.

A host of major tech companies have agreed to the code of practice, most recently Google and OpenAI. Some, however, have taken a harder stance.

Earlier this month, Meta revealed it won’t sign up for the code of practice amid what it described as concerns over “legal uncertainties”.

In a LinkedIn post clarifying the company’s stance on the code, Meta’s chief global affairs officer Joel Kaplan said the code will introduce measures which “go far beyond the scope of the AI Act”.

"Europe is heading down the wrong path on AI. We have carefully reviewed the European Commission’s Code of Practice for general-purpose AI (GPAI) models and Meta won’t be signing it," he said.

The risks of non-compliance

Organizations that fail to comply with the EU AI Act face serious repercussions, and while the new code of practice is voluntary, Iannopollo said it’s crucial that enterprises operating in the region pay close attention to the enforcement deadline.

“Like it or not, the EU AI Act will contribute to shape AI risk management and AI governance practices of most global companies,” she said. “Its requirements may not be perfect, but they are the only binding set of rules on AI with global reach, and it represents the only realistic option of trustworthy AI and responsible innovation.

“It’s crucial that companies operating AI technology in the EU, or using AI-generated insights within the EU market, pay attention to this enforcement milestone.”

The EU AI Act contains “significant fines” for non-compliance, including up to 7% of a company’s global turnover. Iannopollo noted that not all the authorities responsible for enforcement are up and running yet, but others are, including the EU AI Office.

“Companies, make no mistake: there will be action in the next few months,” she said.

MORE FROM ITPRO

• The EU just shelved its AI liability directive
• How the EU AI Act compares to other international regulatory approaches
• Everything you need to know about the EU AI Act

Meta has said it won't sign up for the EU's code of practice for providers of general-purpose AI models, citing concerns over "legal uncertainties".

The voluntary guidelines form part of the EU AI Act, due to come into force next month. They ask companies to, amongst other things, refrain from training AI on pirated materials and comply with requests from content creators to omit their work from training data.

As part of the rules, providers are also required to issue regular updates on AI tools and services.

While the code is voluntary, the EU has said that AI providers who don't sign up will be expected to demonstrate compliance by other means, and might face more regulatory scrutiny.

Meta has hit back at lawmakers, however, accusing the EU of overreach.

"Europe is heading down the wrong path on AI. We have carefully reviewed the European Commission’s Code of Practice for general-purpose AI (GPAI) models and Meta won’t be signing it," wrote chief global affairs officer Joel Kaplan in a post on LinkedIn.

"This Code introduces a number of legal uncertainties for model developers, as well as measures which go far beyond the scope of the AI Act."

Meta has history with the EU

Meta has been complaining about the AI Act for a while. Last summer, Mark Zuckerberg and Spotify CEO Daniel Ek issued a joint statement saying that "Europe’s risk-averse, complex regulation could prevent it from capitalizing on the big bets that can translate into big rewards."

The tech giant has support from US president Donald Trump on the issue, who has called for the AI Act to be paused - although the EU appears to be standing firm.

Henna Virkkunen, the European Commission vice-president responsible for tech sovereignty, recently said lawmakers are "very committed to our rules when it comes to the digital world".

Earlier this month, companies including Google, Meta, Airbus, BNP Paribas, and TotalEnergies called for a two-year delay in implementation, claiming that as it stands, the AI Act will stifle innovation.

"Businesses and policymakers across Europe have spoken out against this regulation. Earlier this month, over 40 of Europe’s largest businesses signed a letter calling for the Commission to ‘Stop the Clock’ in its implementation," said Kaplan.

"We share concerns raised by these businesses that this over-reach will throttle the development and deployment of frontier AI models in Europe, and stunt European companies looking to build businesses on top of them."

OpenAI and Mistral have already signed the code - although the latter has voiced concerns about the impact of the legislation.

"Compliance with the Code and the AI Act’s risk based framework must be as simple and streamlined as possible for the homegrown start-ups and smaller businesses that will be the future leaders of Europe’s AI-first economy," said OpenAI in a statement.

"We have advocated⁠ for greater simplification and harmonization to support these next generation companies and will continue to back their concerns, as they are key to AI of, by and for Europe."

MORE FROM ITPRO

• The UK government is working with Meta to create an AI engineering dream team
• Meta faces new ‘open washing’ accusations with AI whitepaper
• Meta is working on a 5GW data center to supercharge AI infrastructure

Oracle has announced plans to invest $3 billion in Germany and the Netherlands as the cloud computing giant continues its European infrastructure push.

Over the next five years, the firm will invest $2 billion to expand its Oracle Cloud Infrastructure (OCI) footprint in Germany, with a big increase in AI infrastructure capacity in the Oracle Cloud Frankfurt region in particular.

In a statement outlining the plans, Thorsten Herrmann, senior vice president and Germany country leader at Oracle, said the move is aimed at helping organizations across the country “accelerate their AI and cloud journeys”.

“In addition, we’re supporting the federal government’s objective of strengthening Germany as a hub for AI investment and innovation in Europe,” Herrmann added.

The investment will also help Oracle meet demand for sovereign cloud and AI services in the German public sector and other industries, including the manufacturing, automotive, renewable energy, scientific research, and healthcare sectors.

As part of the move, Oracle confirmed startups and investors across Germany will be given access to infrastructure for AI training and inference, as well as multi-cloud options.

"We are pleased about increasing investments, both from Germany and internationally, and expressly welcome this investment," said Karsten Wildberger, federal minister for digital transformation and government modernization.

"It strengthens our digital infrastructure and enables companies and public authorities to benefit from state-of-the-art AI and cloud technologies."

Meanwhile, in the Netherlands, Oracle is planning to invest $1 billion over the same timespan to meet growing demand for AI and cloud services. This will see the company significantly expand AI infrastructure capacity in the Oracle Cloud Amsterdam region.

The plan is to target organizations in key local industries such as financial services, logistics, life sciences, and energy.

Oracle is all in on European expansion

These latest investment announcements come amid a big push across the region, which the hyperscaler views as a market ripe with opportunities.

Earlier this year, Oracle unveiled plans to invest $5 billion in the UK, significantly expanding its OCI footprint across the country.

A similar $1 billion investment in Spain last year was also announced, with a keen focus on supporting the country’s financial services sector.

Larry Ellison, CTO and chairman of Oracle, has been highly vocal about Oracle's plans across Europe in recent years, identifying it as a key market for the company amidst the growing demand for sovereign cloud services.

Speaking last year, Ellison said he expects every country to have its own sovereign cloud setup, noting at the time that the company was in negotiations with a number of national governments.

Enterprise appetite for sovereign cloud options has surged across Europe, largely in response to stringent regulatory requirements on data protection.

Speaking to ITPro last year, senior Forrester analyst said sovereign cloud options are now the “bare minimum” expected from customers in the region - and providers have pivoted hard to expand options on this front.

Alongside Oracle, a host of industry competitors including Google, Microsoft, and AWS have been rushing to launch their own sovereign cloud services.

MORE FROM ITPRO

• Turns out OpenAI is the customer behind Oracle's mysterious $30 billion cloud deal
• Partnerships are Oracle's key to success in the "multi-cloud era"
• AI agent announcements are a dime a dozen right now – here’s what Oracle thinks it’s doing differently

Apple is pushing back against new app store rules imposed by the European Commission (EC), claiming the EU body has taken changes and a €500 million (£430m) fine too far.

The EC levied the fine in April, arguing Apple was in breach of anti-steering obligations in the EU Digital Markets Act (DMA). That refers to Apple's long-running ban on alternative app stores and rules that stop developers from telling users about discounts or other offers outside of the Apple platform.

Apple previously took a cut of up to 30% on sales inside apps and has been locked in a war of words over the practice with developers.

The tech giant complied with the app store rule changes last month in order to avoid additional fines that could reach 5% of its average revenue globally.

That included a wider range of commission rates up to 13%, alongside user acquisition fees, with the costs dependent on what marketing support the developer wants in the App Store as well as technical aspects such as automatic updates.

Developers will also be able to promote alternative ways of purchasing services outside the app, though Apple would charge a commission on sales advertised via apps in its App Store.

Apple is baffled, the EC is standing firm

Key to Apple’s argument, and appeal, is that the company claims this new system is "confusing" to business users.

"Today we filed our appeal because we believe the European Commission’s decision – and their unprecedented fine – go far beyond what the law requires," said Apple in a statement.

"As our appeal will show, the EC is mandating how we run our store and forcing business terms which are confusing for developers and bad for users."

Apple has yet to reply to a request for comment from ITPro.

The Commission, meanwhile, is standing by its decision. In a statement responding to the appeal, it said: "We stand ready to defend our decisions in court.”

The EC previously said that Apple shouldn't charge developers for the right to "steer" customers, suggesting that a commission on sales promoted in-app wouldn't meet requirements.

Political battle

A legal expert told The Guardian that Apple may be employing delay tactics.

"The blunt truth is that it is worth spending a few million on legal fees in order to disrupt and delay the development of a more open app ecosystem, which is a market that is worth many billions a year to Apple," Tom Smith, a competition lawyer at Geradin Partners, told the publication.

The app store quarrel isn't the only ongoing battle between the EU and tech companies. In April, Meta was hit with a €200m fine for charging users to get rid of ads, while last year Apple was fined €1.8bn over music streaming competition.

The appeal comes ahead of US President Donald Trump's 9 July deadline to settle a trade deal with the EU or risk 50% tariffs. The Trump administration has repeatedly said the EU is targeting US tech companies in retaliation for trade disruption and other political concerns, with Trump trade advisor Peter Navarro calling it "lawfare".

EU action against tech giants stretches back well before even the first Trump administration, with a €497 million fine against Microsoft in 2004 over Windows Media Player bundling that was later increased to €899 million for non-compliance.

That was followed by cases against Intel in 2009, an investigation against Google on search that began in 2010, and investigations into taxes that pulled in Apple and Amazon beginning in 2014.

That said, things have accelerated since 2017 with a €2.42bn fine against Google over price comparison shopping services. In subsequent years, EU lawmakers imposed a €4.34bn for Android and €1.49bn over AdSense, with other cases targeting Apple, Amazon and Meta in recent years.

MORE FROM ITPRO

• Apple throws cold water on the potential of AI reasoning
• Apple is offering rewards of up to $1 million to find critical flaws in its private AI cloud systems
• Apple: Our AI data was gathered responsibly

The European Commission is making €145.5 million available to help small and medium-sized enterprises and public bodies to boost their cybersecurity, with specific help for hospitals and healthcare providers.

It's launched two calls for proposals. The first is part of the Digital Europe Programme, with a budget of €55 million, €30 million of which will go to enhance the cybersecurity of hospitals and healthcare providers.

€15 million will go to post-quantum Public Key Infrastructures, meanwhile, with €10 million allocated to enhance the Network Connectivity Center (NCC) Networks.

The plan is to help organizations detect, monitor, and respond to cyber threats, particularly ransomware. The aim is to have identified the key ransomware strains targeting healthcare by the end of this year, and to set up a ransomware recovery subscription service by 2026.

"This will boost the resilience of the European healthcare system, especially in the current geopolitical context, aligning with the EU action plan on cybersecurity in hospitals and healthcare," said the Commission.

The fund will be used for pilot projects including national or regional hospital clusters, healthcare systems, professional associations, and cybersecurity service providers.

These could include, for example, the creation of security operation centers offering real-time monitoring, threat detection, and rapid incident response, as well as the use of cybersecurity tools including Security Information and Event Management (SIEM) platforms, threat intelligence, and automated response capabilities.

The second call, forming part of the Horizon Europe Programme, has a budget of around €90.5 million. It will, said the Commission, support the use and development of generative AI for cybersecurity applications and new advanced tools and processes for operational cybersecurity, along with privacy-enhancing technologies and post-quantum cryptography.

Of this, €40 million will go to generative AI for cybersecurity applications, €23.55 million on new tools and processes for operational cybersecurity, and €11 on privacy enhancing technologies.

Security evaluations of Post-Quantum Cryptography (PQC) primitives will get €4 million, with €6 million for the security of implementations of PQC algorithms and another €6 million for the integration of PQC) algorithms into high-level protocols.

Proposals for the first call can be submitted until 7 October here, with the second here, open until 12 November.

According to the Commission, in 2023 alone, EU countries reported 309 significant cybersecurity incidents targeting the healthcare sector -- more than any other critical sector. And the call for healthcare cybersecurity proposals follows an EU action plan launched earlier this year.

"Digital technologies and health data-driven solutions have opened unparalleled opportunities in healthcare. They enable precision medicine, real-time patient monitoring, and seamless communication between healthcare providers across borders," said Olivér Várhelyi, commissioner for health and animal Welfare.

"But digitalization is only as strong as the trust it inspires and resilient from cyberattacks. Patients must feel confident that their most sensitive information is secure. Healthcare professionals must have faith in the systems they use daily to save lives."

The European Commission has issued its first penalties under the EU Digital Markets Act (DMA), fining Apple €500 million and Meta €200m and requiring both to make changes to how they operate.

The DMA came into effect in 2023 and was created to regulate competition in the digital economy, in part by reining in abuse of power by larger platforms.

Apple was found to be in breach of "anti-steering obligations" over restrictions that ban apps from informing customers of offers outside the App Store, which the EC said limited customer choice.

The Commission has ordered Apple to remove that restriction, and the tech giant plans to appeal the fine.

Meta, meanwhile, was fined for its introduction of a model that would force users to pay for an ad-free service or consent to their data being used for advertising.

The Commission said that fell foul of an obligation under the DMA to give consumers the choice of a service that uses less of their personal data.

Apple and Meta respond

Both companies made it clear they disagreed with the fines. In a statement, Apple hit out at the Commission, suggesting the penalties show it is “unfairly targeting” the company.

The tech giant said the decisions are “bad for the privacy and security of our users, bad for products, and force us to give away our technology for free”.

"We have spent hundreds of thousands of engineering hours and made dozens of changes to comply with this law, none of which our users have asked for,” the statement added.

“Despite countless meetings, the Commission continues to move the goal posts every step of the way. We will appeal and continue engaging with the Commission in service of our European customers.”

Meta offered harsher criticism in its response, accusing the EC of treating US businesses unfairly.

"The European Commission is attempting to handicap successful American businesses while allowing Chinese and European companies to operate under different standards," Meta's Chief Global Affairs Officer, Joel Kaplan, said in a statement.

"This isn’t just about a fine; the Commission forcing us to change our business model effectively imposes a multi-billion-dollar tariff on Meta while requiring us to offer an inferior service," he added. "And by unfairly restricting personalized advertising the European Commission is also hurting European businesses and economies."

A ‘strong and clear’ message from the EU

Despite the complaints, Teresa Ribera, Executive Vice-President for a Clean, Just and Competitive Transition, said in a statement the fines send a "strong and clear message" to digital companies, adding that the legislation is a crucial tool to ensuring fair markets.

"Apple and Meta have fallen short of compliance with the DMA by implementing measures that reinforce the dependence of business users and consumers on their platforms," Ribera said. "As a result, we have taken firm but balanced enforcement action against both companies, based on clear and predictable rules."

"All companies operating in the EU must follow our laws and respect European values,” she added.

That reference to European values reflects geopolitical turmoil between the US and the rest of the world, according to Joe Jones, director of research and insights at IAPP.

"The fines land at a time of heightened scrutiny by the current US Administration on the application of EU laws to US companies," Jones said.

"The EU Digital Markets Act was even name-checked in an Executive Order issued by President Trump last February as facing scrutiny as part of the Administration’s work to “defend American companies and innovators from overseas extortion,” he added.

"Open questions include not only how will addressed companies respond to EU regulatory enforcement but how will overseas governments, including and especially the US, respond. The U.S. Administration has declared it will consider responsive actions like tariffs to combat certain foreign government policies levied against US companies."

Beyond the fines

As Meta noted, there's more to the decision than fines. Indeed, despite the seemingly large figures, the fines were much smaller than the EU could have levied, as high as 10% of their global annual turnover. Last year, Meta's earnings topped $165 billion and Apple's was $391 billion.

In a statement, the EC said that developers using Apple's App Store should be able to tell customers about alternative offers outside that store, such as discounted subscription offers. The EC added that Apple had failed to give a reason why such restrictions are "necessary and proportionate."

Beyond the fine, the EC has ordered Apple to remove such restrictions and not introduce similar restrictions in the future.

The EC also closed an investigation into Apple's tactic of not allowing its own pre-installed apps to be removed from its devices, such as its Safari web browser.

Following a "constructive dialogue", Apple made it easier to select a new default browser on iPhones, uninstall several Apple pre-installed apps, and change default settings for other tools such as keyboards and translation.

Alongside those two investigations, the EC also issued preliminary findings on Apple banning third-party app stores and requiring users to download apps via the official App Store.

The EC said that its preliminary view is that Apple isn't complying with the DMA by disincentivising developers from offering apps elsewhere via a new fee, the Core Technology fee, while also introducing strict eligibility requirements.

Apple can now respond to those findings ahead of a final ruling.

For Meta, it has been fined under DMA rules that mean "gatekeepers" must get user consent for combining personal data between services, and still offer an equivalent alternative service for any who refuse to consent.

This decision refers to Meta's "consent or pay" advertising model that was introduced in November 2023, which gave Facebook and Instagram users the option of consenting to their data being combined for personalized advertising or paying a subscription to opt out and receive an ad-free service.

The EC said that model didn't offer enough of an alternative service for those who opted out. A year later, Meta offered a new version that included a tier that used less personal data to display ads.

This particular fine applies only to the period up to November 2024 when those changes came into effect, as the regulator is still considering the changes.

Alongside the advertising data ruling, the EC also announced that Facebook Marketplace was small enough that it should no longer be designated under the DMA.

MORE FROM ITPRO

• How the EU AI Act compares to other international regulatory approaches
• DORA and why resilience (once again) matters to the board
• The fractured regulatory landscape tech companies face in 2025

Former Google CEO Eric Schmidt has hit out at EU AI regulation, suggesting overburdening rules put European companies at an inherent disadvantage compared to global counterparts.

Speaking on the BBC Radio 4Today program, Schmidt said a combination of factors are hampering AI innovation in the region, including restrictive regulation and the natural “structure” of European markets.

Reflecting on his time at Google, Schmidt said he worked for “at least 10 years to try to get Europe up to the bar”, noting that lucrative talent pools on both the continent and in the UK give enterprises a prime opportunity to compete.

Regulatory barriers, however, are preventing the region from making any headway in the global AI race.

“The system doesn't work, right? They can't build big enough companies. The markets are not integrated. Partly it's just the structure of Europe, but it’s also that Brussels, in addition to promising uniform markets, also regulates in a particularly strong way,” he said.

“The result of this is that the AI revolution, which is the most important revolution in my opinion since electricity, is not going to be invented in Europe, and that's to Europe's disservice,” Schmidt added.

“Europe could do it, but it's chosen not to do it, and I'm really quite brutal on this.”

Fair game in the US AI market

The situation is quite different across the Atlantic, Schmidt noted. The US’ approach to AI development stands in stark contrast to the European market, with lawmakers and enterprises alike engaged in a rabid race to the top.

With the Trump administration now in place in Washington DC, Schmidt pointed to a sense of burgeoning optimism among leading enterprises in the AI space, many of whom have invested billions of dollars thus far and intend to ramp up spending in the year ahead.

So far this year, Meta, AWS, Microsoft, and Google have all outlined plans to accelerate capital expenditure – and a key factor in this will be expanding AI infrastructure. Meta, for example, expected to spend upwards of $60 billion this year, marking a significant increase from $39 billion in 2024.

“When I looked at the swearing in with my friends behind the president I thought, ‘wow, we have arrived’ - and that doesn’t necessarily mean that we are going to be unregulated,” he said.

“It means the inverse in my view,” he added. “Everyone, starting with you, are watching what we're doing, which I view as a good thing.”

This doesn’t mean that the US will pursue a ‘Wild West’ approach to AI development, however. Instead, providing enterprises the regulatory flexibility to develop AI models and adopting a gentler approach is the ideal situation.

“The truth is that AI and the future is largely going to be built by private companies,” Schmidt said.

“It has to do with the incentives and the money, where the talent is, and how the world works, they're not going to be built in the equivalent of a Manhattan Project.”

Schmidt noted that it’s “really important that governments understand what we’re doing and keep their eye on us”.

“We’re not arguing that we should unilaterally be able to do things without oversight,” he added.

Schmidt has been highly vocal on the potential dangers posed by unchecked AI development in recent months, warning that systems could be used by bad actors for nefarious purposes ranging from biological warfare to cyber crime.

Britain has an opportunity to differentiate itself

While discussions over the potential barriers to AI innovation in Europe continue, Schmidt did point to the UK’s opportunity, suggesting it can differentiate itself from European counterparts.

The UK joined the US in refusing to sign an international agreement on sustainable AI development at this week’s global summit in Paris, prompting suggestions an ‘Atlantic rift’ is opening up on the topic of AI.

This decision was based on concerns that the declaration lacked 'practical clarity', officials said, particularly on the issue of global governance and national security.

The UK’s approach to AI has deviated from that in Europe, and the current government has made clear it hopes to position itself as a global leader on this front by attracting international investment and building out infrastructure.

Notably, Schmidt said the UK has success stories to champion that will stand it in good stead.

“So some credit to Britain,” he said. “Much of the path to general intelligence was pioneered in King’s Cross in a building occupied by a subsidiary of Google called DeepMind by - now a Nobel Prize winner - Demis Hassabis.”

“What they have done is so extraordinary it should be a point of national pride,” Schmidt added. “It may be the most important thing that Britain has done in the last five years, in my opinion.”

Schmidt further hailed the government’s apparent pursuit US-style regulation, which involves consultation and close collaborative ties with industry.

“It looks to me like the pairing of the US and the UK is a winning strategy,” he said. “And it looks to me like the Europeans, because of Brussels, are being held behind.”

MORE FROM ITPRO

• Salesforce thinks the UK is ready to lead the next wave of AI
• Why the UK needs to look inward on AI legislation
• Google says UK needs policy step change to embrace its AI potential

The European Commission has shelved plans to impose civil liability rules on enterprises using harmful AI systems in a move critics have described as a “strategic mistake”.

First proposed in 2022, the AI Liability Directive aimed to overhaul existing rules on harmful AI systems and protect consumers.

However, the publication of the Commission’s final work program shows plans to introduce the rules will now be scrapped, noting that “no foreseeable agreement” has been reached by lawmakers.

The documents add that the Commission will “assess whether another proposal should be tabled or another type of approach should be chosen”.

The move comes in the wake of the AI Action Summit, held in Paris, which saw industry stakeholders come together to discuss the future of AI innovation both across the European Union (EU) and globally.

During the summit, US vice president JD Vance voiced concerns over the EU’s supposed heavy handed regulatory approach to the technology. Vance urged European enterprises and lawmakers to view the “new frontier of AI with optimism and not trepidation”.

“We want to embark on the AI revolution before us with the spirit of openness and collaboration, but to create that kind of trust we need international regulatory regimes that foster creation," he told attendees.

The liability directive was originally tabled alongside the EU AI Act, but has since taken a backseat amid the push to impose the landmark legislation.

Some EU lawmakers have voiced their disapproval,. According to reports from Euronews, Axel Voss, the EU Parliament’s lead representative for developing liability rules, described the move as a “strategic mistake”.

Voss told the publication the decision will lead to “legal uncertainty, corporate power imbalances, and a Wild West approach to AI liability that only benefits big tech”.

"The reality now is that AI liability will be dictated by a fragmented patchwork of 27 different national legal systems, suffocating European AI startups and SMEs,” he added.

Liability directive move could “clean up” patchwork AI regulation

Peter van der Putten, director of Pegasystems’ AI Lab and assistant professor at Leiden University, said that while the move may raise consumer protection concerns, the “impact may be relative” given new regulations such as the EU AI Act.

“The idea was that if a customer, citizen or business was claiming to have suffered harm, they wouldn’t have to prove in-depth causality between the AI system and the damage caused,” he explained.

“This would be more on the public or private organization operating the AI system (and/or underlying vendors).”

Ultimately, consumers and entities will still be protected against AI-related harms through the legislation, he noted, and the decision to shelve the proposals will create a more aligned regulatory environment.

“So whilst it is tempting to frame this all as a move towards less consumer protection in the global AI rat race, it can also just be seen as a sensible move to clean up the patchwork of AI regulation a bit, and not incite all kinds of litigation that in the end could either be resolved by existing regulation, or would likely not have been successful for claimants anyway,” van der Putten said.

Betting on a blended approach

The decision to withdraw from the AI Liability Directive is being read by critics as the EU retreating on consumer protection in the face of AI companies.

While the EU AI Act contains protections for citizens and measures to monitor and control the harms of AI model deployment, it does not provide a direct route for consumers making claims against AI developers for damages such as algorithmic bias.

The AI Liability Directive was specifically designed to set out such a route, establishing concrete law on civil liability relating to AI and assisting consumers in making claims.

Timing is everything when it comes to the optics of a decision like this. In dropping the AI Liability Directive just one day after JD Vance’s warning that “excessive regulation” could kill AI innovation, the Commission could invite unwanted suggestions that it’s moving in lock-step with US approaches on AI.

But there’s every indication that rather than a reactive decision, this is more of a pragmatic move by the EU to maintain a handle on the AI sector. If it doesn’t keep its seat at the table by supporting EU-based AI developers and attracting investments from US tech giants, the EU Commission could lose any leverage it has over AI safety altogether.

The EU isn’t naïve and Vance’s statements on AI regulation wouldn’t have come as a surprise to anyone at the Paris Summit. As EU member states like France move to make the most of their established AI talent and the Commission gets more ambitious with its backing for AI infrastructure via its InvestAI initiative, there will be more pragmatic decisions to come.

Attracting US investment, alongside home-grown talent, will be a necessity for the time being.

For the EU Commission’s part, it has stated that it saw “no foreseeable agreement” on the terms of the directive, adding “the Commission will assess whether another proposal should be tabled or another type of approach should be chosen”.

As yet, an alternative approach has not been officially put forward.

Ultimately, the EU may have made the bet that any reduced consumer power in the short term can be balanced out by regional success at AI advancement. If it can carve out a space for innovative AI that doesn’t infringe on inviolable rights, it could beat the US at its own game.

But it still has significant ground to make up, especially in comparison to the US and China.

MORE FROM ITPRO

• A big enforcement deadline for the EU AI Act just passed
• Why regulatory uncertainty is holding back AI adoption
• AI is going to be a legal nightmare for years to come

The UK and US have refused to sign an international agreement on inclusive and sustainable AI at this week's global summit in Paris.

The UK said its decision was based on concerns that the declaration lacked 'practical clarity' on global governance and didn't address issues of national security.

Meanwhile, US vice president JD Vance told delegates to the summit that over-regulation of AI could hold the industry back.

"The Trump administration believes that AI will have countless revolutionary applications in economic innovation, job creation, national security, health care, free expression and beyond, and to restrict its development now will not only unfairly benefit incumbents in this space, it would mean paralyzing one of the most promising technologies we have seen in generations," he said.

Vance's speech was very much in line with the Trump policy of 'America First'. He beat the drum for the US AI industry, and issued a warning to nations aiming to restrict its power.

"The Trump administration is troubled by reports that some foreign governments are considering tightening screws on US tech companies with international footprints," he said.

"America cannot and will not accept that, and we think it's a terrible mistake."

Vance's stance has been widely criticized by rights groups.

Alexandra Reeve Givens, CEO of the Center for Democracy and Technology (CDT), said that for AI to benefit both nations and individuals, robust safeguards and accountability must be implemented.

"When AI is being used to determine who gets a job, who gets a loan, who gets access to government services, the stakes are too high to shrug off the risks."

Meanwhile, Dr Andrew Bolster, senior research and development manager for data science at Black Duck, warned that the lack of transatlantic agreement might leave organizations deploying AI with a tricky course to steer.

"This growing Atlantic AI rift is a wake-up call for any organization looking to deploy or operate global AI solutions," he said.

"The regulatory landscape is not as settled as it may seem, and while alignment to existing principles such as GDPR, the California Consumer Privacy Act (CCPA) - and its amendment, the California Privacy Rights Act (CPRA) - or Australia’s Privacy Act may stand you in good stead, that is no guarantee of continued operations."

61 nations still signed the AI agreement

Despite the UK and US’ disapproval, the agreement was signed by 61 other countries, including Canada, Japan, India ,and China, as well as European nations.

They pledged to focus on ensuring that AI is 'open, inclusive, transparent, ethical, safe, secure and trustworthy'.

The agreement also stresses the importance of strengthening international coordination in AI governance and preventing market monopolization, along with working to keep AI sustainable.

During the summit, European Commission president Ursula von der Leyen announced a €200 billion plan to advance AI research and infrastructure across the bloc.

InvestAI will finance four AI gigafactories across the EU focused on training models for complex applications such as medicine and science.

"This unique public-private partnership, akin to a CERN for AI, will enable all our scientists and companies – not just the biggest – to develop the most advanced very large models needed to make Europe an AI continent," she said.

MORE FROM ITPRO

• A big enforcement deadline for the EU AI Act just passed
• How the EU AI Act compares to other international legislation
• Looking to use DeepSeek R1 in the EU? Maybe think again

The popular AI model DeepSeek R1 may contain inherent flaws that make it incompatible with the EU AI Act, according to new research.

DeepSeek R1 took the tech industry by storm in early January, offering an open source option for performance comparable to OpenAI’s o1 at a fraction of the cost.

But the model’s outputs may contain vulnerabilities that jeopardize its rollout in the EU. Using a new framework known as COMPL-AI, researchers analyzed both DeepSeek R1 models: one distilled from Meta’s Llama 3.1 and the other from Alibaba’s Qwen 2.5.

The framework was created by researchers at ETH Zurich, the Institute for Computer Science, Artificial Intelligence and Technology (INSAIT), and LatticeFlow AI. It aims to evaluate models on a range of factors such as transparency, risk, bias, and cybersecurity readiness, measured against the requirements of the EU AI Act.

In a test of whether the model could be hijacked with jailbreaks and prompt injection attacks, both DeepSeek models scored the lowest of all models benchmarked by COMPL-AI. DeepSeek R1 Distill Llama 8B scored just 0.15 for the hijacking and prompt leakage out of a possible 1.0, compared to 0.43 for Llama 2 70B and 0.84 for Claude 3 Opus.

This could put it in jeopardy with Article 15, paragraph 5 of the EU AI Act, which states: “High-risk AI systems shall be resilient against attempts by unauthorized third parties to alter their use, outputs or performance by exploiting system vulnerabilities”.

The analysis comes after similar research into DeepSeek jailbreaking techniques conducted by Cisco, which found the model was susceptible to prompts intended to produce malicious outputs 100% of the time.

In other areas, the models outperformed some of the most popular open and proprietary LLMs. The model was found to consistently deny it was human, a feat not achieved by GPT-4 or the baseline version of Qwen.

Tested with HumanEval, a widely-used benchmark for assessing an LLM’s code generation capabilities, DeepSeek also outperformed other open source models. DeepSeek R1 Qwen 14B scored 0.71 versus Llama 2 70b’s 0.31, exceeded in COMPL-AI’s leaderboard only by GPT-3.5 (0.76), GPT-4 (0.84) and Claude 3 Opus (0.85).

"As corporate AI governance requirements tighten, enterprises need to bridge internal AI governance and external compliance with technical evaluations to assess risks and ensure their AI systems can be safely deployed for commercial use," said Dr. Petar Tsankov, co-founder and CEO at LatticeFlow AI.

"Our evaluation of DeepSeek models underscores a growing challenge: while progress has been made in improving capabilities and reducing inference costs, one cannot ignore critical gaps in key areas that directly impact business risks – cybersecurity, bias, and censorship. With COMPL-AI, we commit to serving society and businesses with a comprehensive, technical, transparent approach to assessing and mitigating AI risks."

COMPL-AI is not formally associated with the EU Commission, nor able to provide an official third-party analysis of the EU AI Act. Companies looking to adopt DeepSeek or other models into their tech stack will still need to follow best practices for implementing generative AI.

Leaders may also look into hiring for roles such as chief AI officers and data ethicists, alongside the establishment of sovereign cloud clusters to ensure data used for AI within the EU is compliant with regional laws.

A new alliance with a budget of €37.4 million is working on a European alternative to OpenAI’s ChatGPT and DeepSeek’s R1.

OpenEuroLLM is a consortium of 20 leading European research institutions, companies, and EuroHPC centers hoping to develop a family of high-performance, multilingual, large language foundation models for commercial, industrial, and public service applications.

The aim is to create a home-grown rival to models from foreign tech firms, trained specifically on European data.

"The transparent and compliant open-source models will democratize access to high-quality AI technologies and strengthen the ability of European companies to compete on a global market and public organizations to produce impactful public services,” the consortium said.

"The OpenEuroLLM project is aligned with the imperative to improve Europe’s competitiveness and digital sovereignty."

The consortium will work with open source and open science communities such as LAION, open-sci and OpenML, along with additional experts in the field.

Models, software, data, and evaluation will be fully open, researchers said, and can be fine-tuned and instruction-tuned for specific industries or public sector bodies.

Additionally, the model will be trained in 35 languages.

The project will be co-led by computational linguist Jan Hajič of Czechia's Charles University and Peter Sarlin, co-founder of Finland's Silo AI - Europe's largest private AI lab, which was acquired last year by AMD for $665 million.

It also includes a dozen European universities, along with Germany's Aleph Alpha Research and ellamind, France's LightOn, and Spain's Prompsit Language Engineering.

Also participating are four EuropHPC centers: the Barcelona Supercomputing Center in Spain, Cineca Interuniversity Consortium in Italy, CSC - IT Center for Science in Finland, and the Netherlands' SURF.

"The OpenEuroLLM project stands as a testament to Europe’s ability to lead in AI innovation while adhering to principles of openness, trust, and fairness," said the Eindhoven University of Technology in a statement.

"By involving research institutions, industry leaders, and EuroHPC centers, the initiative ensures a broad and inclusive approach to AI development."

The European Commission has backed OpenEuroLLM to the tune of €37.4 million, with €20.6 million coming from the Digital Europe Programme.

The consortium is supported by the Strategic Technologies for Europe Platform (STEP), aimed at raising and steering funding to increase European investment into critical technology projects.

"Europe has the talent and resources necessary to take a leading position in this global AI competition," said Laurent Daudet, co-CEO and co-founder of LightOn.

"To transform these efforts into a real strategic lever, Europe must not only capitalize on the AI Act, a true catalyst for innovation towards trustworthy AI, but also support a coordinated approach from its leaders. This is now possible thanks to the OpenEuroLLM consortium."

The first of a number of enforcement actions for the EU AI Act have officially come into effect, and experts have warned firms should accelerate preparations for the next batch of deadlines.

Passed in March last year, the first elements of the EU’s landmark legislation came into effect on the 2nd February 2025, bringing with it a series of rules and regulations that AI developers and deployers must adhere to.

The EU AI Act employs a risk-based approach to assessing the potential impact of AI systems, designating them as being minimal, limited, or high-risk. High-risk systems, for example, are those defined as posing a potential threat to life, human rights, or financial livelihood.

These particular systems are in the crosshairs following the introduction of the new rules this month.

Speaking to ITPro ahead of the deadline, Enza Iannopollo, principal analyst at Forrester, said lawmakers specifically chose to target the most dangerous AI use cases with the first round of rules.

“Requirements enforced on this deadline focus on AI use-cases the EU considers pose the greatest risk to core Union values and fundamental rights, due to their potential negative impacts,” Iannopollo said.

“These rules are those related to prohibited AI use-cases, along with requirements related to AI literacy. Organizations that violate these rules could face severe fines — up to 7% of their global turnover — so it’s crucial that requirements are met effectively,” she added.

Iannopollo noted that fines will not be issued immediately, however, as details about sanctions are still a work-in-progress and the authorities in charge of enforcement are still not in place.

While there may not be any big fines in the headlines in the next few months, Iannopollo said this is still an important milestone.

Tim Roberts, UK country co-leader at AlixPartners, said the first set of compliance obligations will act similarly to GDPR, mainly in that they will apply to any organization doing business with AI models in Europe.

With this in mind, it’s critical that companies are aware of these first batch of rules, even if they are not EU-based.

“Naturally, this also reignites the debate about striking the right balance between innovation and regulation. But instead of seeing them as opposing forces, it’s more useful to think of them as two things we need to get right in parallel … because regulation can be a facilitator of innovation - not a blocker,” Roberts said.

“The speed at which AI is advancing has caused discomfort for some consumers, but strong safeguards can build trust and create a thriving (and fairer) environment for greater business innovation.

“The EU AI Act is an important first step in this journey, and its success will depend on how well it is applied and how well it evolves, with the end goal being smarter regulation that drives businesses to continue pushing boundaries for the benefit of all.”

EU AI Act: Firms should tighten up risk assessments

Due to the global reach of the Act and the fact that requirements span the entire AI value chain, Iannopollo said enterprises must ensure they adhere to the regulation.

“The EU AI Act will have a significant impact on AI governance globally. With these regulations, the EU has established the ‘de facto’ standard for trustworthy AI and AI risk management,” she added.

To prepare for the rules, enterprises are advised to begin refining risk assessment practices to ensure they’ve classified AI use cases in line with the designated risk categories contained in the Act.

Systems that would fall within the ‘prohibited’ category need to be switched off immediately.

“Finally, they need to be prepared for the next key deadline on 2nd August. By this date, the enforcement machine and sanctions will be in better shape, and authorities will be much more likely to sanction firms that are not compliant. In other words, this is when we will see a lot more action.”

The European Commission has announced a series of new measures aimed at providing support for AI startups and small businesses across the EU. 

The AI Innovation package builds on a pledge made by Commission president Ursula von der Leyen in September last year that European AI startups would be given access to the bloc's supercomputers to train trustworthy AI models.

It involves amending the EuroHPC Regulation to set up what the Commission is calling ‘AI Factories’ to acquire, upgrade, and operate AI-dedicated supercomputers to handle machine learning and the training of large general purpose AI models.

A 'large number' of public and private users, including startups and SMEs, will be given access to the scheme, the Commission said, and supported in algorithmic development, testing evaluation, and validation of large-scale AI models.

"You need computing power to develop AI. A lot of it. So we want to give SMEs and startups privileged access to the network of European supercomputers," said Margrethe Vestager, executive vice president of the European Commission.

"We are committed to innovation of AI and innovation with AI. And we will do our best to build a thriving AI ecosystem in Europe."

A dedicated AI Office will be set up to handle the development and coordination of AI policy at European level, officials said, as well as to supervise the implementation and enforcement of the EU AI Act.

Meanwhile, financial support from the Commission will be provided through Horizon Europe and the Digital Europe programme in a package that lawmakers said will offer an additional boost of public and private investment of around €4 billion until 2027.

There are also plans for education, training, skilling, and reskilling programs, as well as venture capital or equity support. The Commission said it also aims to speed up the development and deployment of Common European Data Spaces for the AI community.

Finally, there's a new GenAI4EU initiative, aimed at supporting the development of novel use cases and emerging applications in robotics, health, biotech, manufacturing, mobility, climate, and virtual worlds.

"Today, we announce the launch of AI Factories, bringing together the ‘raw materials’ for AI: computing power, data, algorithms and talent," said Thierry Breton, commissioner for internal markets.

"They will serve as a one-stop shop for Europe’s AI start-ups, enabling them to develop the most advanced AI models and industrial applications. We are making Europe the best place in the world for trustworthy AI."

The support for EU-based AI startups follows a period of intense criticism of the union’s flagship EU AI Act, which industry stakeholders and critics both warned could have an adverse effect on the broader European AI industry.

Last year, tech policy group DigitalEurope said that the legislation risked “regulating AI startups out of existence”. 

The group warned that strict new rules around the development and deployment of AI could prevent companies in the union from competing with global counterparts, particularly in the US.

Additional support for European digital infrastructure

The Commission said it will also establish two European Digital Infrastructure Consortiums (EDICs) as part of the scheme. 

The first of these, the Alliance for Language Technologies, is aimed at developing a common European infrastructure in language technologies to address the shortage of European language data for the training of AI solutions.

Meanwhile, CitiVERSE will apply state-of-the-art AI tools to develop Local Digital Twins for Smart Communities, helping cities simulate and optimize processes from traffic management to waste management.

Changes made to the EU’s Cyber Resilience Act (CRA) have been welcomed by open source developers, who believe the updated legislation will be less deleterious to the ecosystem than its previous iterations.

The amended version of the CRA was published on 20 December 2023 and includes clarifications reducing the scope of the regulation, as well as a ‘light-touch and tailor-made regulatory regime’ for open source developers.

Thierry Carrez, general manager of the Open Infrastructure Foundation, said changes made to the CRA highlight the success of the pressure applied to the EU by open source advocates.

“It’s clear from reading the CRA version published on 20 December that the engagement of many open source advocacy groups — including the OpenInfra Foundation — has led to multiple clarifications regarding the openly developed open source model.”

Carrez said open source advocates are hopeful these clarifications will reduce the negative impact the CRA will have on open source software, which represents more than 70% of software used in European digital products.

"We’re cautiously optimistic that those clarifications will reduce the risk of CRA having global chilling effects around open source development and participation.”

He added, however, that open source community bodies will continue to lobby the EU in upcoming public discussions of the legislation.

“We will continue to be proactive and urgent in our advocacy for open source as CRA implementation plans and timelines are determined. In the near term, we’ll be participating in discussions at the EU Open Source Policy Summit and FOSDEM.”

The Cyber Resilience Act has been a minefield for open source devs

According to Carrez, this new legislation is not as threatening as the heavy handed approach previous iterations of the Act included since it was first unveiled in September 2022.

The legislation was intended to boost cyber security and add further protections to digital products like Internet of Things (IoT) devices that have caused a dramatic expansion in attack surfaces.

In addition, the CRA placed new obligations on open source developers to ensure any software developed for commercial products conforms to new rules by submitting documentation, risk assessments, and post-release security requirements.

These requirements were deemed overly demanding by industry experts who signed an open letter in April 2023 outlining their concerns to the European Parliament.  

“If the CRA is, in fact, implemented as written, it will have a chilling effect on open source software development as a global endeavor, with the net effect of undermining the EU’s own expressed goals for innovation, digital sovereignty, and future prosperity.”

This public outcry was successful in pushing the EU into amending the CRA so that some of the most severe restrictions placed on open source developers will be relaxed.

Some of the amendments made by the EU included tightening the definition of what constitutes commercial activity so that funding essential project support functions without the intention to profit is exempt. 

A clearer distinction between the development and supply phases was also implemented, whereby the regulation comes into effect when software is made available on the market in the course of commercial activity.

Another example involves a separate definition for Foundations that are now considered “open-source software stewards” and subject to a ‘light-touch and tailor-made regulatory regime’.

Apple is set to make fundamental changes to its App Store in the EU to comply with the European Commission’s Digital Markets Act (DMA), but some experts are worried these changes could have serious negative security implications.

The DMA will introduce a mandate on Apple, and other designated ‘gatekeepers’ to start letting users install third-party app stores and sideload apps onto their devices, aiming to increase competition on online platforms. 

Security specialists are concerned this decision will open up another attack vector for threat actors, however, and potentially result in a flood of dangerous applications being downloaded.

Jamie Moles, senior technical manager at ExtraHop, told ITPro the DMA could have unintended consequences for security of online platforms by removing the operator’s ability to freely moderate the software being distributed.

“It [the DMA] would increase the overall risks to the platform because it creates an entirely new attack vector,” he said. 

“The requirements for an app to appear on the app store are, in part, designed to protect the security of the system and comply with Apple’s own privacy policy. If you remove the ability to directly audit the programs being distributed to the platform, then it is inevitable that there will be more security risks.”

For example, Moles highlighted a recent example of security flaws in the Epic Games Store, which could be accessible on iOS under the new DMA stipulations.

“The Epic Games Store (EGS), a platform that could be added to iOS if the courts rule in Epic Games’s favor, had issues with privacy upon release. EGS was deriving contacts from other games stores by directly accessing files stored locally by a competing app store, Steam, rather than using a more secure API link”, Moles commented.

“Epic Games apologized but has not changed the method by which it syncs contacts with Steam contacts. This is a security risk created by a company with good intentions, so the potential downsides for a company with bad intentions are huge.”

How will Apple respond to these changes?

Moles said he expects the changes to the Apple App Store to be limited to the EU region, as opposed to the regulation prompting a universal policy shift from the tech giant like it did with the mandated USB-C connectors for iPhones.

“Another app store is a software change, and Apple already has different software configurations for different regions. In October, Apple required an Internet Content Provider license for apps to appear on the Chinese version of the app store, so the precedent is there for each region to have its app store configured for different regulatory environments.”

Apple could introduce a series of permission layers on iOS to protect the majority of its users from inadvertently accessing unaudited marketplaces or sideloading malicious applications, Moles suggested. 

Another measure Apple could use to mitigate the risks associated with this shift could be to force unverified apps to be opened in a dedicated software environment to minimize its access to the device's files and other applications.

Moles added that Apple could implement a similar approach to its policy on aftermarket hardware components, such as batteries or screens.

“Imagine when downloading or booting one of these applications, several layers of warning notifications for each permission being granted to the software will appear on screen”,  he explained.

“The implementation would be similar to those in place for apps already, but likely in more explicit terms. Installing and sideloading could result in voiding warranty for devices, something Apple already does with aftermarket batteries and screens.”

Balance is needed to prevent monopolies and limit security risks

The DMA was first tabled in 2022 to address the significant advantage big tech companies have over smaller competitors in the industry by limiting the control these companies have over how business is conducted on their platforms.

The regulation is targeted at preventing gatekeepers from using their privileged position as platform operators to promote their own products or services above those of their competitors. 

On the subject of whether this act will produce a net benefit for consumers in the long run, Moles said, overall, the EU’s tech regulation in recent years has been warranted and in the interest of business and consumers alike, but it needs to be careful it isn’t creating more problems than it solves with the DMA.

“Most of the EU regulation in the tech space has been a good thing. The USB-C requirements are, by and large, to the benefit of consumers and GDPR, and as annoying as cookie notices can be, they set important protections on user data” Moles told ITPro.

“However, while well intentioned, this particular change exposes users to far more risk with less obvious reward. Preventing large tech monopolies is essentially a good idea, but one that has to balance the challenges of creating and operating a platform of iOS’s size.”

EU member states have reached a common position on the planned Cyber Solidarity Act, aimed at making Europe more resilient and reactive in the face of cyber threats.

The aim of the draft legislation is to support the detection and awareness of significant or large-scale cyber security threats and incidents, to bolster preparedness, and to protect critical infrastructure and essential services such as hospitals and public utilities. 

It's also intended to boost cooperation between member states in the event of a union-wide security incident and improve coordinated crisis management and response capabilities.

EU lawmakers hailed the announcement as a vital piece of legislation that will create a more robust security landscape for member states and organizations across the union.

"Today’s agreement is another step to improve cyber resilience in Europe," said José Luis Escrivá, Spanish minister for digital transformation.

"It will certainly strengthen EU’s and member states’ capabilities to prepare, prevent, respond, and recover from large-scale cyber threats and attacks in a more efficient and effective manner."

Cyber Solidarity Act looks to ‘shield’ EU from threats

A major feature of the draft legislation is the creation of a 'European cyber shield', a pan-European infrastructure composed of national and cross-border security operations centers (SOCs) across the EU.

These will use artificial intelligence (AI) and advanced data analytics to detect and share warnings on cyber threats and incidents across borders. There are also plans for the creation of a cyber emergency mechanism to increase preparedness and enhance incident response capabilities.

This will include testing entities in highly critical sectors, such as healthcare, transport, and energy, to probe for potential vulnerabilities based on common risk scenarios, lawmakers said.

Similarly, a new EU ‘cyber security reserve’ will be set up consisting of incident response services from trusted private sector providers, all of which pre-contracted so they're ready to intervene at the request of a member state or EU institution, body, or agency.

There are also plans for a mutual financial assistance fund aimed at enabling member states to offer financial aid to others in the event of a serious security incident.

As part of the legislation, new mechanisms will be introduced to conduct reviews and assessments of large-scale cyber security incidents after they have taken place.

ENISA, the EU’s cyber security agency, will play a key role in supporting this aspect of the legislation, lawmakers said.

At the request of the European Commission or of national authorities, the security agency will conduct reviews of certain incidents and deliver reports to relevant governmental departments.

Cyber Solidarity Act changes align with NIS2

The new common position introduces a few, mostly minor, changes to the draft legislation. In particular, it clarifies terminology and adapts the text to member states’ specificities, particularly around the SOCs and the cyber shield.

Meanwhile, definitions have been modified and aligned with other legislation, such as the recently-revised Network and Information Security Directive (NIS2).

ENISA’s role has also been reinforced and clarified throughout the text, and improvements have been introduced around procurement, funding, information sharing, and the incident review mechanism.

The next step in the process is for the incoming presidency to start negotiating with the European Parliament on a final version of the proposed legislation.

The EU risks making the US a hostile environment for European tech firms with its Digital Markets Act (DMA), according to industry experts.

Tech leaders have voiced their concerns that stringent regulations from the EU may lead to US tech companies using their influence to increase the cost of doing business for European organizations in the US.

This comes after a group of US lawmakers signed a letter to President Biden arguing the DMA will unfairly target US tech firms.

Speaking to ITPro, CEO at OpenUK Amanda Brock said the reaction from lawmakers in the US was understandable but it was also no stranger to ‘long-arm regulations’.

“When looking at the letter, it’s hardly surprising that the EU’s long arm reach is frustrating US regulators, though then again the US has pushed a long-arm regulatory reach across the globe for many years,” she said. 

Brock added she feels the EU’s ‘waterfall approach’ to legislation is outdated and incongruent with the new digital landscape.

“The question the EU needs to ask themselves is will this approach really allow a tech sector to flourish? 

“Its waterfall approach to legislation – extremely prescriptive, detailed, and often paternalistic is one that might have worked in tech 25-30 years ago but which doesn’t reflect the way our digital economy works – which is agile and flexible. Somehow legislators need to move to this.” 

European tech firms could face frosty reception in US

Dr Ilia Kolochenko, chief architect at ImmuniWeb and adjunct professor of cyber security and cyber law at Capitol Technology University, told ITPro the EU’s regulatory approach is not perfect, but argued it is preferable to the ‘Byzantine’ regulatory framework in the US.

“While it’s true that technology regulation in the EU – spanning from the mature GDPR to novel AI Act – is not 100% perfect, it’s still better than the convoluted patchwork of state legislation on privacy and data protection matters in the US, which are only partially addressed by pretty obsolete US federal laws and regulations.”

Kolochenko noted the two regions’ approaches to tech regulation are “innately incompatible’. 

The result of this incompatibility, Kolochenko fears, will be a punitive response from the US.

“US tech companies and other industries concerned by the extensive and arguably harsh EU regulations will probably lobby for a legislative response to make European companies pay a high price for doing business on American soil,” he said. 

“This outcome will be highly undesirable and counterproductive for both the US and EU. The ideal solution would be to find a middle ground approach to sustainably regulate innovation and technology that would peacefully coexist on both sides of the Atlantic.”

How will the Digital Markets Act affect US tech firms?

The Chamber of Progress, a US-based technology industry trade group, has hit out at EU legislation, including the Digital Services Act and Digital Markets Act, arguing that the latter will force companies to limit their products at the expense of foreign competitors. 

The lobby group has called on the Biden administration to provide greater support for US-based firms, who it suggested could be put at a significant disadvantage in European markets. 

“By imposing rules on their services but not those of foreign competitors, the DMA would effectively mandate top US firms offer products to consumers that are less secure, less useful, and less innovative than rival products from foreign tech companies”.

The DMA will designate five US tech majors including Alphabet, Amazon, Apple, Meta, and Microsoft, as ‘gatekeeper’ service providers, who will be subject to stricter requirements to open up their messaging platforms.

Claims the DMA is not specifically targeting non-US firms are not strictly accurate, as the Chinese tech company Bytedance, owner of video hosting service TikTok, is also included on the European Commission’s list of designated service providers. 

French startup Mistral AI has rapidly emerged as one of Europe’s leading AI industry darlings, having recently secured a $415 million Series A funding round. 

With the funding propelling the company’s value to around $2 billion, this raises the question of whether Mistral AI can truly position itself as Europe’s equivalent to OpenAI, which it has been keen to impress in recent months.

In the wake of the funding round, co-founder and CEO Arthur Mensch specifically targeted the goal of “creating a European champion” in the generative AI space. A bold statement given the monumental task that European companies often face in competing with US hyperscaler-backed giants.

However, at present everything points toward this goal being very much within the company’s grasp. Mistral’s foundations, its backers, and its approach to generative AI could be a key differentiator for the firm in a post-AI Act environment.

The French startup was co-founded by former members of Google DeepMind and Meta, and its rise to prominence has been impressive so far.

Within just a month of launching, it raised $112 million in seed funding and boasts some serious VCs and industry heavyweights as notable backers.

Andreessen Horowitz led the recent Series A funding scoop while firms such as Salesforce, General Catalyst, and BNP Paribas all participated in the round.

What sets the company apart from contemporaries across the pond is that its objectives center around creating an “open, responsible, and decentralized approach” to generative AI, according to Mensch.

In September, the company unveiled its first large language model, dubbed ‘Mistral 7B’.

The 7.3 billion parameter model doesn’t quite match the performance capabilities of GPT-4, or Anthropic’s Claude 2 models. But it does outperform both of Meta’s Llama 2 13B and 34B models across a range of benchmarks.

The decision to make this model publicly available could prove a master stroke. This open source approach to LLM access has proven popular so far this year, most notably with the release of Meta’s Llama 2 model.

In an announcement coinciding with the a16z investment raise, the Parisian tech firm also launched its Mixtral 8x7B model, which has been released publicly under the Apache 2.0 license.

This most certainly appears to be Mistral’s attempt to contend with platforms such as ChatGPT or Google Bard.

Maybe Mistral AI needs a patron

Mistral AI’s success so far paints a promising picture for its future prospects. But what it boasts in dynamism it may lack in industry backers at present. 

A quick glance across the Atlantic and one can’t help but think it has a significant uphill battle if it’s to truly contend with OpenAI or Anthropic, for example. Both are backed by a number of industry heavyweights, and the funding pouring into these firms over 2023 has been astounding to say the least.

Microsoft has backed OpenAI to the tune of around $13 billion, with $10 billion of that coming in 2023 alone. Anthropic, meanwhile, boasts AWS and Google as key backers as the pair look to the startup to bridge gaps with Microsoft.

AWS announced plans to invest up to $4 billion in Anthropic in September as part of a deal to make AWS its primary cloud provider. That was followed by $1.5 billion in funding from Google on top of an original $500 million investment earlier in the year.

With cash like this pouring into US-based firms, the prospects don’t look quite so promising.

Cost might be the game changer

Companies embracing generative AI have quickly realized that it’s a costly affair. 

Research earlier this year from CCS Insight predicted a “cold shower” for generative AI in 2024 due to skyrocketing costs.

Mistral’s open source approach, however, does offer benefits. These models are typically cheaper to deploy compared to proprietary models such as ChatGPT or Claude.

In its Series A announcement this week, a16z specifically highlighted the fact that open source approaches enable developers to build “cheaper, faster, and safer software infrastructure”.

But does Mistral AI really offer this? Its model benchmarks appear to meet expectations due to the fact it uses a “router network” to streamline processes.

Mixtral, for example, has around 45B total parameters but only uses 12B parameters per token, according to the firm. This means that the model “processes input and generates output at the same speed and for the same cost as a 12B model”.

“This technique increases the number of parameters of a model while controlling cost and latency, as the model only uses a fraction of the total set of parameters per token,” the firm said in a blog post.

EU AI regulation could hamstring Mistral AI

Mistral AI represents one of the standout companies in the sector for the whole EU. While the lawmakers across the EU have finally come to an agreement on the AI Act, much is left to be debated. 

France, Germany, and Italy caused friction in the EU in November as the countries signed an agreement on voluntary AI regulation, specifically relating to foundation models.

Lawmakers from the countries have expressed their doubts about the impact of the EU AI Act on the innovation landscape within Europe, with the former French secretary for the digital economy Cédric O having warned that undue bureaucracy arising from the EU AI Act could kill Mistral AI entirely.

For the moment, the firm sits at the eye of the storm in Europe. There are some standout nations, with France and Germany standing guard over Mistral and the German startup Aleph Alpha, respectively. But unlike its American counterparts, this period of calm could be short-lived.

It’s likely that Mistral will have to continue to comply with future agreements around AI regulation in the EU.

There’s no question that the EU’s risk-based approach comes with benefits to consumer privacy, and many in the sector have praised it for its cautious approach to a technology that, unchecked, could entrench societal biases or put the data of EU citizens at risk. 

The problem is that firms playing fair by these rules will still have to compete with US firms with first-mover advantage such as OpenAI and Anthropic, who face a comparatively lax regulatory environment.

Through firms like Mistral AI, the EU’s arguments that the AI Act doesn’t unfairly inhibit AI innovation could be put to the test – the region’s sovereign AI sector hangs in the balance.

The EU has approved state aid of up to €1.2 billion for a cloud and edge computing project across Europe in a bid to compete more effectively with the US.

The scheme, called IPCEI Next Generation Cloud Infrastructure and Services (IPCEI CIS), has been backed by France, Germany, Hungary, Italy, the Netherlands, Poland, and Spain, and is aimed at creating the first interoperable and openly accessible European data processing ecosystem.

Nineteen companies, including several SMBs, will be involved, helping to develop data processing capabilities, along with software and data sharing tools to enable federated, energy-efficient and trustworthy cloud and edge distributed data processing technologies.

Companies involved in the project include Atos, Orange, Deutsche Telekom, Siemens, Telecom Italia and Telefonica Espana.

Commissioner Didier Reynders, head of the EU’s competition policy, said the scheme aims to drive “highly ambitious research” to bolster support for EU-based companies.

"This Important Project of Common European Interest is the first one in the cloud and edge computing domain. The participating member states provide up to €1.2 billion in public funding, expected to unlock an additional €1.4 billion in private investments," he said.

"The IPCEI will provide for highly ambitious research, necessary to enable the uptake of innovative data processing applications and services for European businesses, public administrations, and citizens."

The plan is to develop open source software that will allow for real-time and low-latency services, EU lawmakers said, with individual projects covering the entire cloud edge continuum, from the basic software layer to sector-specific applications.

There will be several areas of focus. The first, Cloud Edge Continuum Infrastructure, looks to update existing technology to work with new applications, including developing open source software to help cloud service edge nodes from various providers interoperate.

There are also plans to develop open source software that enables businesses to form their own private clouds by pooling resources from various data centers.

Advanced Smart Data Processing Tools and Services covers cross-industry cloud and edge services, along with AI models that can process text and multimedia in various languages and provide platforms to simplify developing AI applications.

And finally, Advanced Applications are aimed at using these technologies in specific fields such as the energy, health, and maritime sectors.

One company to receive funding is Italy's Tiscali, which says it will be setting up a lab to develop specific large language models for each European language.

Deutsche Telecom, meanwhile, will be working on a common European cloud and edge cloud infrastructure.

"Edge Cloud represents the next frontier in telecommunications and digital infrastructure," said managing director, business customers, Klaus Werner. "With the support of the German government and European partners, we're not just exploring this frontier; we want to shape and define it."

The project is expected to create around 1,000 jobs, initially for data scientists and AI specialists, with another 5,000 or so coming during the commercialization phase.

If projects receiving a large amount of aid turn out to be very successful, generating extra net revenues, a claw-back mechanism means that the companies will return part of the cash.

R&D and the first industrial deployment phase will last until 2031, with the first result, an open-source reference infrastructure, due around the end of 2027.

Key questions over the scope and extent of the EU AI Act still remain unanswered and could create uncertainty among businesses, according to legal experts. 

David Dumont, partner at Hunton Andrews Kurth, said there are several elements around which no common ground has yet been established as EU lawmakers approach a critical juncture in negotiations.

In particular, rules pertaining to the development and use of foundation models and AI-related harms have not been agreed upon, which could create confusion for businesses and hamper innovation.

“AI presents challenging legal questions and there are still key elements on which the Council and the European Parliament have not found common ground,” he said. “Such as the rules around foundational models and prohibited AI uses.”

Dumont warned that given the critical stage of negotiations, if no agreement is reached on certain aspects of the legislation, the bill is unlikely to pass before next year’s European elections, representing a significant setback in the union’s attempts to push through the sweeping regulations.

“December 6th is a key date for the EU AI Act as it is the last political trialogue negotiation that is currently scheduled for the EU AI Act,” he said. “If the EU legislative bodies do not succeed in reaching an agreement at this meeting, it will likely be difficult to pass the EU AI Act before next year’s European Parliament elections.”

“This would cause a significant delay and possibly result in the EU losing its first mover advantage in regulating AI. “

EU AI Act could “stifle innovation”

Industry stakeholders have repeatedly hit out at EU lawmakers over the proposed legislation, with some arguing the bill could stifle innovation unless it delivers a balanced regulatory approach to artificial intelligence. 

Particular concerns have been raised that the proposals could impede smaller enterprises and academics from conducting vital research into the technology.

Naveen Rao, VP of generative AI at Databricks, warned that reactionary legal efforts to combat AI risks could risk “overregulating AI” and harming European efforts to drive AI innovation.

“Any new regulation must not be at the cost of stifling smaller startups and academic researchers from being able to do their work and research”, he said. “The more we understand these models, the more we can share ideas on how to safely shape a future with AI.”

His comments follow similar concerns regarding the potential impact on smaller firms in recent weeks. In November, tech policy group DigitalEurope said EU-based startups could be “regulated out of existence” due to the legislation.

Rao further warned that the EU must avoid a “rigid, one-size-fits-all approach” to AI regulation and instead focus on a more flexible framework that enables innovation while balancing potential risks.

“I believe it will be critical for regulators to clearly mark the distinction between AI developers and AI deployers,” he said. “The developer creates the original AI, the deployer puts it into use.”

This distinction between AI development and deployment has become a political flashpoint in recent weeks amidst member state concerns over the scope of the EU AI Act and its potential impact on individual tech ecosystems.

In October, France, Germany, and Italy, three of the EU’s leading economies, published a joint paper pledging their support for “mandatory self regulation” of foundation models through the creation of voluntary codes of conduct.

The joint paper specifically called on EU lawmakers to distinguish between regulating the use of AI tools in society and the regulation of AI technologies themselves.

Speaking to Reuters at the time, German digital affairs minister Volker Wissing said lawmakers need to “regulate the applications and not the technology” if European economies are to compete on a global scale.

The EU AI Act has been a repeated source of controversy

The EU AI Act has been a source of controversy in the global technology industry in recent months over claims that the regulations could negatively impact European tech ecosystems. 

The act itself aims to curb the potential risks and harms associated with generative AI, such as misinformation, bias, and its use by cyber criminals to wage sophisticated attacks against enterprises.

Under the act, lawmakers will categorize models based on their risk factor. This ranges from ‘minimal’ to ‘unacceptable’ and ‘high risk’, and takes into account the potential for AI models to cause harm to both individuals and broader society.

Rao emphasized that “AI models on their own” are not necessarily ‘high risk’, but noted that developers do have a responsibility to curtail potential harms.

“AI models on their own are not “high risk”, and in fact, hold the potential to bring much good,” he said. “However, there will always be those who use new technology irresponsibly, or actively pursue nefarious intent.”

“That is not to say that developers have no responsibility. They should carry out risk assessment and mitigation, for instance, as well as clear documentation around data sources, impact assessments around possible bias, and so on.”

EU AI Act may harm open source industry

Stringent rules placed on open source developers through the EU AI Act have also been a key flashpoint throughout the legislative process so far in 2023. 

Open source advocates have repeatedly warned that the regulations will harm innovation in the European open source ecosystem.

A key focus has centered around whether research and testing of AI models could be interpreted as “commercial activity” under the legislation, and therefore subject to stricter rules.

In July, a consortium of companies including GitHub, Hugging Face, and Creative Commons called for greater flexibility on the testing of open source AI models.

The group called for EU lawmakers to include more concise definitions of AI components, as well as more leeway for open source AI research.

Open source developers have been granted a reprieve after European lawmakers reached an agreement on the terms of the Cyber Resilience Act (CRA). 

An agreement between the EU Parliament and European Council was struck on Thursday 30 November that will fast-track the legislation to its final approval stage.

Under the CRA, more robust cyber security and resilience rules will require organizations to adhere to minimum standards to protect digital products, such as IoT devices.

Terms outlined in the regulation will force software and hardware manufacturers to adhere to a 24-hour disclosure rule for security vulnerabilities and provide a minimum five-year guaranteed patch support for products.

Once introduced, organizations operating in the EU will be required to implement changes to their security practices to comply with the regulation. Those who fail to meet standards within the allocated time frame could be fined up to 2.% of annual turnover. 

Last-minute changes to the CRA mean stringent rules around open source software development will be somewhat relaxed, preventing fears over the bill’s potentially negative impact on the European ecosystem.

In its current iteration, the CRA will not specifically target open source software developers with stringent rules, according to EU lawmakers.

“In order not to hamper innovation or research, free and open source software developed or supplied outside the course of a commercial activity should not be covered by this regulation,” the CRA states.

“This is in particular the case for software, including its source code and modified versions, that is openly shared and freely accessible, usable, modifiable and redistributable.”

Nicola Danti, lead member of the European Parliament, said talks between the EU Parliament and Council will strike an adequate balance between robust regulation and flexibility for the open source ecosystem. 

“We have ensured support for micro and small enterprises and better involvement of stakeholders, and addressed the concerns of the open source community, while keeping an ambitious European dimension," he said.

"Only together will we be able to tackle successfully the cybersecurity emergency that awaits us in the coming years.”

Open source fears over the Cyber Resilience Act

The CRA has been the source of recurring political flashpoints in recent months, with open source figures across the EU voicing serious concerns over its heavy-handed approach to open source development.

In April, a host of industry bodies criticized the CRA, suggesting that the introduction of the legislation would harm innovation across the open source ecosystem across the union.

A key concern highlighted in this first pushback centered around proposals that would make developers liable for software vulnerabilities. Critics argued that the requirements would have a “chilling effect” on the industry.

In July, open source advocates once again hit out at the legislation ahead of a crunch vote in the European Parliament, arguing that the CRA represented a “death knell” for open source development in Europe.

The EU’s unwavering position throughout this period was a source of extreme frustration by members of the community, some of whom suggested that lawmakers were purposefully ignoring legitimate concerns.

Three-quarters of UK organizations have yet to complete preparations for the EU’s Network and Information Security Directive (NIS2), according to a new study. 

With just one year to go until the deadline for implementation, a majority of UK organizations are yet to fully address and compensate for the five key compliance requirements outlined in the new regulations, SailPoint found. 

The new rules are an updated version of previous NIS regulations, introduced by the EU in 2018. 

NIS2 essentially aims to build on the previous regulations and implement more robust cyber security and resilience standards among EU organizations, as well as more stringent reporting measures in the event of a security incident. 

Under the updated regulations, all public and private entities operating in the EU will be required to adhere to new standards. The regulations specifically target organizations working in critical infrastructure sectors, such as energy, finance, and healthcare. 

SailPoint’s study, based on a survey of 1,500 IT decision makers across the UK, France, and Germany, found that many UK firms have yet to even begin preparations for the new rules. 

Four in five (80%) revealed they still need to properly secure supply chains while three-quarters (76%) said they have yet to assess the efficiency of existing cyber security measures.

Three-quarters of organizations also need to add new risk management measures (74%), implement HR security (76%), or provide cyber security training to staff (72%). 

SailPoint warned that those who fail to comply with the new obligations could face harsh penalties. Organizations can face fines of up to €10 million for non-compliance, or the equivalent of 2% of their annual turnover. 

“With just one year to go, businesses must put their foot to the floor when it comes to NIS2 compliance and get ahead on their cyber preparation,” said Stephen Bradford, senior vice president for EMEA at SailPoint.

“The threat landscape has been growing in volume and sophistication over recent years meaning the stakes have never been higher. Operational downtime, reputational damage, customer loss, and system restoration that follow any breach can cause a real headache for businesses."

Bradford said the current lax approach among some UK organizations bears similarities to the months preceding the implementation of the EU’s General Data Protection Regulation (GDPR). 

He urged that businesses “must learn from GDPR” and use the next 12 months to ensure cyber resilience “is at the core of the business models” to avoid falling foul of the regulations. 

This is particularly important given certain aspects of the regulations pertaining to personal liability. 

Under the new rules, senior management could be held liable for cyber security failings and regulatory infringements if their organization does not comply with its obligations. 

The US-UK data bridge marks a major step toward easing the complexity of transatlantic data transfers, experts say. 

Coming into effect officially on October 12, the US-UK data bridge forms part of the EU-US Data Privacy Framework, which permits the flow of EU-based data to the United States under certain conditions. 

The framework was formally adopted by EU lawmakers in July 2023, and replaces the EU-US Privacy Shield, which was deemed invalid by the European Court of Justice in 2020 amidst data privacy concerns. 

In June 2023, the UK and US reached an agreement in principle to extend the Data Privacy Framework, creating the data bridge between the two countries.

Sarah Pearce, partner at the Hunton Andrews Kurth law firm, says the introduction of the data bridge will create a more flexible and streamlined business environment for organizations operating on both sides of the Atlantic. 

“It’s fair to say that the EU-US Data Privacy Framework – and the add-on UK-US data bridge – represent critical steps forward in easing the current complexity of transatlantic data transfers and should be heralded as a success,” she says. 

Charlie Bromley-Griffiths, corporate counsel at Conga, echoes Pearce’s comment, but warns that businesses will be forced to assign a greater focus to data management and protection from now on. 

“This sets the tone for the future of business. From here onwards, enterprises will need to be scrupulous with their data management and ensure they have the right measures in place to comply with the new regulations. 

“A lot has changed in the last year, with the Electronic Trade Documents Act, [Northern Ireland] Protocol data sharing agreement and the Schrems II legislation all coming into effect; organizations will need to review their data architecture and contract clauses with their customers and partners.”

The US-UK data bridge explained

The data bridge essentially permits the flow of UK data to another country without the need for further safeguards, according to the UK government. 

In this instance, the data bridge takes into account the level of protection provided by the recipient country – the US – and its handling of UK data.

The UK government is satisfied current US data protection and privacy regulations are adequate to support the data bridge, and that personal data will be protected to a level on-par with the Data Protection Act 2018.

“The US data bridge will ensure that high standards of protection for personal data are maintained when the data is sent to certified US organisations,” the government said in an explainer on the issue. “Any US company that elects to receive UK data under the data bridge will be required to maintain those standards.”

Initially, concerns around data protection and privacy practices in the US were a key stumbling block for EU regulators,  especially the potential use of data for surveillance purposes. 

Long-term, the UK government believes the establishment of the data bridge will unlock growth for businesses, enabling them to share information for research and support science and innovation in both the UK and US. 

US-UK data bridge: Lingering concerns

Pearce said that questions surrounding the data bridge still remain, particularly among privacy rights campaigners such as Max Schrems. 

The campaigner has argued that changes made to US data privacy rules to accommodate for the framework “do not address fundamental surveillance issues”, Pearce added. 

“It’s very likely that this type of criticism will provide ammunition to potential [legal] challenges, and we should expect that the courts will, again, be asked to assess whether the new safeguards are sufficient to be considered essentially equivalent to the safeguards in the EU and the UK,” she said. 

“Schrems has already publicly stated he will appeal the adequacy decision in respect of the framework,” Pearce added. “Whether such challenges will be successful, however, is another matter.”

New vulnerability disclosure requirements in the EU’s Cyber Resilience Act (CRA) could create unnecessary risks for consumers and businesses, security experts have warned.

In an open letter signed by senior figures at more than 50 organizations, experts said that aspects of Article 11 in the CRA are “counterproductive and will create new threats that undermine the security of digital products and the individuals who use them”.

Article 11 of the CRA will require software publishers to disclose unpatched vulnerabilities to the European Union Agency for Cybersecurity (ENISA) within 24 hours of exploitation. Information on vulnerabilities would then be passed on to various government agencies responsible for member state security. 

The requirement means that software providers will essentially feed known vulnerabilities into a “real-time database” containing information on unpatched flaws to provide agencies with an overview of ongoing or potential security issues. 

This move is part of an effort from EU lawmakers to speed up vulnerability disclosures, ensure greater transparency and accountability, and ultimately protect consumers. 

However, critics of the move argue this places organizations at heightened risk by having a repository of unmitigated vulnerabilities that could be targeted by threat actors. 

The open letter also suggests that the move could prompt a trend of “rushing the disclosure process”, which places greater strain on security practitioners and software providers and could result in botched patches.  

“Dozens of government agencies would have access to a real-time database of software with unmitigated vulnerabilities, without the ability to leverage them to protect the online environment and simultaneously creating a tempting target for malicious actors,” the letter reads.

“There are several risks associated with rushing the disclosure process and having a widespread knowledge of unmitigated vulnerabilities.”

The “risk of exposure to malicious actors” is a key concern highlighted in the open letter. 

The potential for breaches and exploitation of vulnerabilities recorded by government agencies aren’t merely a “theoretical threat” and could place organizations in the cross-hairs of threat actors while scrambling to issue patches, the letter adds.

“Breaches and the subsequent misuse of government held vulnerabilities are not a theoretical threat but have happened at some of the best protected entities in the world,” the letter reads.

“While the CRA does not require a full technical assessment to be disclosed, even the knowledge of a vulnerability's existence is sufficient for a skillful person to reconstruct it.”

Alex Rice, co-founder and CTO at HackerOne and a signatory of the open letter said the proposed reporting practices could create a “strong incentive” for threat actors to target specific government agencies. 

“HackerOne is an advocate for vulnerability disclosure, but that disclosure must be done responsibly and cannot open organizations to more cyber security risk,” he said. 

“Reporting highly sensitive data into only a handful of EU government agencies creates a strong incentive for bad actors to breach those hubs and acquire vulnerabilities to attack susceptible organizations — among a whole host of other risks.”

Article 11 “goes against reporting best practices”

Rice acknowledged that reporting obligations are necessary to ensure transparency and improve security, adding that the “intentions of the Cyber Resilience Act are great”. 

However, the proposed requirements “conflict with vulnerability reporting best practices” and as such should be amended. 

The open letter outlined a series of proposed revisions to Article 11 to accommodate factors such as severity of vulnerabilities and the likelihood of exploitation by threat actors.

This includes a recommendation that mandatory reporting requirements should be changed to within 72 hours of “effective mitigation” to prevent the risk of exploitation. 

“We support this obligation, but also advocate for a responsible and coordinated disclosure process that balances the need for transparency with the need for security,” the letter reads.

“We recommend that the CRA adopt a risk-based approach to vulnerability disclosure, taking into account factors such as the severity of the vulnerability, the availability of mitigations, the potential impact on users, and the likelihood of broader exploitation.”

Article 11 could have “chilling effect” on security researchers

Casey Ellis, founder and CTO at BugCrowd and signatory of the open letter, told ITPro that disclosure requirements could have a “chilling effect” on good faith security researchers and white hat hackers. 

The potential impact on security researchers was highlighted in the open letter, which warned that, in its current form, the Act could “prematurely interfere with the coordination and collaboration between software publishers and security researchers”. 

Tight deadlines for disclosure set by the CRA fail to recognize the time required to verify, test, and patch vulnerabilities before revealing them publicly, the letter argued. 

Ellis told ITPro that this aspect of the Act could create “friction” for security researchers and their willingness to engage in activities such as bug hunting. 

In addition, the requirements could complicate managing reports from the researchers community and make organizations less receptive to good-faith security research. 

“We’ve spent the past 10 years basically trying to remove friction and it’s been a struggle, so I think anything that comes in and re-introduces friction is a bad thing.” 

“People that hack in good faith are here to act as the internet’s immune system, and the internet, for the better part, has had an auto-immune deficiency that we’re now climbing out of.”

There’s a saying in security that criminals only have to get lucky once to count a success. This is as true in cyber security and data protection as it is anywhere else – organizations need to be on alert and ready to defend against a possible attack every minute of every hour of every day. There is, sadly, no respite.

Companies don’t have to face this challenge alone, though; governments, regulatory bodies and the wider security industry are increasingly collaborating to introduce best practice and legislation to help increase everyone’s security posture.

One example of this is the NIS2 Directive, which was created by the European Commission in January 2023 with the aim of boosting cyber security across the European Union. It expands on the existing NIS Directive to include new sectors and entities, improving the resilience and incident response capacities of public and private organizations alike. Members of the 27-nation bloc have until 17 October 2024 to transpose the directive into their own legislation and the UK government has also confirmed it plans to update its NIS regulations as well.

With so much to consider, ITPro, in association with Rubrik, bring you an informative webinar to offer you real-world guidance and insight.

Madeline Bennett, ITPro’s Contributing Editor will be joined by Richard Cassidy, Field CISO at Rubrik to:

• Help businesses understand more about the latest updates around the NIS2 EU Directive including what will – and won’t – be covered by it.
• Learn why we all need to take this new directive more seriously, starting now. 
• Explore how Rubrik's products can help organizations align it's compliance with EMEA regulations such as the NIS 2 Directive.

To hear all this and more, register for the webinar today.

The open source community is very much at a critical juncture amid a period of regulatory uncertainty in the EU, with new legislation posing a threat to the industry. 

This week, a consortium of companies including GitHub, Creative Commons, and Hugging Face published a policy paper aimed at EU regulators requesting greater support for open source AI development in the upcoming AI Act. 

The coalition outlined a series of suggestions for EU lawmakers in the paper, making a number of requests. These included more concise definitions of AI components and greater support and leeway for open source research into the development of AI models. 

A key focus here centers around whether research and testing of AI models will be interpreted as “commercial activity” and thus subject to stringent rules under the act. 

Under the proposed EU guidelines, real-world testing of AI systems will not be granted exemption from the regulations, which the companies argued could be inhibitive to innovation and prove costly for enterprises. 

Instead, the coalition suggested a change in language to accommodate for testing which is done “on a limited scale with sufficient documentation and transparency to users”. 

“Research and development (R&D) is crucial to the development of beneficial, trustworthy AI systems,” the paper reads. 

“The act should recognize that some real-world testing, including preliminary exploration of a model’s appropriateness to specific deployment conditions and allowing scrutiny and evaluation by relevant civil society organizations outside of the development chain, can be necessary and appropriate for R&D.”

Warranted criticism

The policy paper is by no means a scathing criticism of the AI Act, but does contain suggestions on how regulators and open source developers might foster a closer relationship that fuels innovation. 

However, the paper does warn that, based on its current iteration, the Act risks creating “impractical barriers” for contributors in the ecosystem. 

“The AI Act holds promise to set a global precedent in regulating AI to address its risks while encouraging innovation,” the paper reads. 

“By supporting the blossoming open ecosystem approach to AI, the regulation has an important opportunity to further this goal through increased transparency and collaboration between stakeholders.”

“Unfortunately, current proposals threaten to create impractical barriers to and disadvantages for contributors to this open ecosystem,” it added. 

Peter Chichon, senior policy manager at GitHub, one of the leading voices in this discussion with regulators, warned in a blog post that the act risks “chilling open source AI development” and undermining “responsible innovation” across the union. 

Long-running concerns

Given recent clashes between regulators and the community, the move from GitHub et al should be welcomed and provide food for thought among lawmakers in the EU who appear determined to stifle open source innovation. 

This isn’t the first time industry stakeholders have, justifiably, raised concerns about restrictive policies from the union. 

The Brookings think tank published a report criticizing the proposals in September last year warning that the act would seriously undermine open source AI development and harm developers. 

Similarly, earlier this month, Wikipedia founder Jimmy Wales and OpenUK chief executive Amanda Brock suggested that the act’s stringent rules for open source developers could harm broader European AI ambitions and enable the US to “outpace” Europe in the space. 

Speaking during a roundtable discussion, Brock described the act as “very prescriptive” and suggested that exemptions for open source development “don’t go far enough”. 

“It’s not going to work,” she said. 

With such strong pushback - and repeated pushback from industry figureheads - EU regulators could be faced with the prospect of curtailing worrisome aspects of the legislation. 

But will it work? History tells us otherwise. Ahead of GDPR implementation in 2018, EU lawmakers fought off a wave of complaints and concerns from the industry and continued to steam ahead with plans. 

The EU has already brushed off complaints from industry big-hitters such as OpenAI, whose CEO Sam Altman warned earlier this year that the company could be forced to ‘pull out of Europe’ due to aspects of the regulation. 

Altman’s comments were met with a fierce response from lawmakers and later prompted a u-turn from the chief executive in a debacle that highlighted the unwavering resolve of regulators. 

Clashing heads with regulators

This current call to action also bears similarities to other battles we’ve seen between the open source community and regulators in recent months. 

In April, 13 open source industry bodies penned an open letter to EU lawmakers voicing concerns over the Cyber Resilience Act (CRA), arguing that aspects of the legislation would harm the open source community across Europe. 

The letter, signed by Linux Foundation Europe, the Open Source Initiative (OSI), and the Eclipse Foundation, said the proposals would have a “chilling effect” on open source software due to rules that would leave developers liable for software vulnerabilities. 

More recently, critics once again reared their heads ahead of a crunch vote in the European Parliament on the cyber act, claiming that in its current form, the legislation represents a “death knell” for open source in Europe. 

Despite this, MEPs on the Industry Committee nonetheless voted to back the draft bill, with 61 votes to 1 and 10 abstentions. 

Once again, lawmakers in the EU proved their resolve and reaffirmed their apparent disregard for the concerns raised by members of the open source community. 

This all begs the question of whether the EU views the open source industry as a valuable player within the broader technology landscape. While regulations are being pushed to protect consumers and businesses alike, there is no denying that significant pressure is being placed on the open source community, which offers valuable economic benefits. 

Millions of businesses spanning all 27 member states rely on open source software in their day-to-day operations. The vital applications and platforms that represent the lifeblood of the European tech economy are maintained by a dedicated community of developers, who in the EU’s eyes it seems cannot be trusted. 

With the European Parliament voting to adopt its position on the AI Act in June, time is fast running out for the open source community to see any meaningful changes implemented by lawmakers. 

And if the EU’s approach to the Cyber Resilience Act is anything to go by, it’s likely that the industry will be ignored and have stifling changes imposed on it that harm developers and long-term innovation.

Critics of EU regulations have warned that developers may choose to “back out” of projects as a result of the potential penalties, threatening one of the most celebrated corners of the industry.

Gabriele Columbro, general manager for the Linux Foundation in Europe, told ITPro in April that this could become a reality as contributors seek to avoid being “slapped with lawsuits”. 

If this proves to be the case, then the open source community, which is already stretched and becoming increasingly burnt out, could enter a dark period - and that spells trouble for innovation in Europe, undoubtedly harming businesses. 

Wikipedia co-founder Jimmy Wales has warned that the EU risks being outpaced by the US on AI development because of the stringent legislative approach it’s adopting with the rapidly developing technology.

Referencing the EU’s approach with its proposed AI Act, he said it represented the ‘typical’ attitude taken by the Union whenever it wants to control a potentially harmful technology.

“The EU AI act is going to be a classic European attempt to regulate something that’s just going to completely leave Europe behind the US.”

Wales’ comments were made during a roundtable discussion at which Amanda Brock, CEO at OpenUK, was also present.

Brock agreed with Wales regarding the dramatic pace of change over recent months. She called for an agile approach to legislation that was flexible and could adapt as AI evolved.

With the Wikipedia co-founder in agreement, Brock warned that AI regulation in the EU would present issues, saying: “It’s very prescriptive, it’s very detailed, it’s going to be very hard to follow and the open-source exclusions don’t go far enough”.

“It’s not going to work,” she said.

What is the EU AI Act?

The purpose of the act is to regulate the use of AI in the EU. At a high level, it aims to ensure that AI systems in the EU are “safe, transparent, traceable, non-discriminatory and environmentally friendly”.

Significantly, the European Parliament also wants to ensure that AI systems are overseen by people rather than automation in order “to prevent harmful outcomes”. 

It also wishes to establish a technology-neutral, uniform definition for AI that has future applications.

The concern regarding the EU’s plans is around the inhibitive effect of regulation. 

Brock noted that existing regulations already concern the handling of data depending on the use case - citing healthcare and finance as examples - and said “the amount of regulation around AI itself should probably be quite light and minimal”.

While the UK is no longer part of the EU, the actions taken by the Union and the flow of AI venture capital are two points of concern.

The UK, AI, and open source

According to OpenUK’s report, the Organisation of Economic Cooperation and Development (OECD) - using data from GitHub - found that the UK was the third largest contributor to public AI projects, accounting for 4% in 2022. India was top at 23%, and the 27 EU member states and the USA accounted for 14% each.

So far in 2023, the UK has received $29.2 billion in venture capital investment for AI, an 8.8% increase over 2022. The US’s total so far of $461.4 billion, however, stands 20.7% over its 2022 figure. The numbers indicate the UK still has a way to go before it can truly declare itself a leader in global AI.

The report also examined attitudes towards AI and how it intersects with open source.

For example, although 40% of respondents to the State of Open Survey 2023 said that open source software offered a solution to concerns regarding AI ownership, 45% were neutral on the matter.

Transparency was seen as hugely important to respondents, with 85% of them saying that datasets used to train an AI should be included in the software bill of materials (SBOM), while only 2% disagreed.

Brock told ITPro she was concerned that AI was in a similar position to other key technologies developed over the last few decades. She said that unless action was taken to “open it up and democratize it” there was every chance it might end up in the hands of a few.

She said: “The fundamental decision to be made is a simple one”. 

“Will our government’s approach be one of control established through transparency and building trust engendered by openness, or will it be a decision to seek control by closing down innovation, thereby leaving the outputs of this most important of innovations, in a proprietary ‘black box’ without transparency?”

The EU’s proposed Cyber Resilience Act could spell disaster for the open source community, with critics describing the legislation as a ‘death knell’ for the industry. 

Brian Fox, CTO at Sonatype, said that in its current form, the act risks “severely undermining” open source projects across the union and poses a serious threat to security and sustainability in the ecosystem. 

Fox’s comments come ahead of a crucial EU vote on the future of the act on Wednesday, which could see developers held liable for software vulnerabilities. 

Critics are now calling for lawmakers to caution restraint and have urged MEPs to vote against the bill in its current draft. 

“In its current form, the Cyber Resilience Act risks being a death knell to open source, severely undermining both its security and sustainability,” he said. 

“If the current course isn’t changed before the upcoming vote, we are at risk of an open source software crisis in the EU, which would be catastrophic for our digital economy, innovation, and security.

“We are calling on EU citizens to implore their MEPs to vote against the Act and help fix this mess. It is now the eleventh hour in the race to save open source.”

Punishing open source developers

A focal point of the Cyber Resilience Act centers around liability for open source developers. In its current iteration, developers may be held accountable for vulnerabilities in software. 

Given that open source software is used by businesses across the Union, critics argue that potential penalties and compliance requirements could prompt contributors to back out of projects. And long-term, this could seriously harm the ecosystem. 

This aspect of the bill has led to a long-running dispute between the European open source community and legislators, Fox said, with back-and-forth discussions on the matter resulting in little change. 

Earlier this year, an open letter signed by several industry stakeholders, including the Linux Foundation Europe, warned that the bill would have a “chilling effect” on open-source development and the community. 

In April, Gabriele Columbro, general manager for the Linux Foundation in Europe, told ITPro that many contributors across Europe were worried they could be “slapped with lawsuits” and “decide not to put a project in the open” as a result.

Fox echoed this sentiment, suggesting that EU lawmakers have a “narrow outlook” on the benefits of open source and that they have been unwilling to compromise with the community in recent months. 

“It is hugely worrying that legislators are ignoring the industry’s voice,” he said. “The EU has approached the issue of software security with a narrow outlook and has failed to address the concerns raised”. 

Pro-innovation legislation

Fox specifically highlighted the US’ Cyber Security Strategy as an example of how legislators can work in closer alignment with the open source community. 

Unveiled in February, the sweeping security legislation excluded liability for open source developers and projects. At the time, this was welcomed by industry stakeholders and hailed as a pro-innovation approach. 

“This is in contrast to the attitude of the US government, which has consistently given the open source industry a voice in its cyber security initiatives. Some of us in the industry have been working for more than six months to try to prevent the impending open source disaster in the EU.”

The European Commission has adopted the adequacy decision for the EU-US Data Privacy Framework after years of talks, but experts have indicated it will struggle to uphold it in court.

In its decision announced on 10 July, the Commission found that the US upholds a level of protection comparable to that of the EU when it comes to the transfer of personal data. 

Companies that comply with the extensive requirements of the framework can access a streamlined path for transferring data from the EU to the US without the need for extra data protection measures.

The framework is likely to face legal action and be overturned, according to Nader Henein, research VP of privacy and data protection at Gartner.

“It takes one step closer to what the European Court of Justice needs, but it takes one where the Court of Justice needs it to take five, or ten steps,” Henein told ITPro.

“Maximilian Schrems already said he was going to do it, and if not him someone else will like the EFF or multiple privacy groups. What we’re telling our clients is two to five years, depending on who raises the request, when they raise it, and who they use.”

A potential legal challenge could move more swiftly if the individual complaint was made against a known entity such as Facebook, which was the subject of the Schrems II verdict that took down the old framework known as Privacy Shield.

Schrems has posted a series of tweets comparing the new adequacy agreement to Privacy Shield, and vowed to fight it in the courts.

Henein said businesses are being advised to use the next two years to set up plans that are not dependent on the EU-US Data Privacy Framework, and noted that many firms will be approaching suppliers to demand they protect against more expensive disruption.

The European Commission has stated the framework will be subjected to regular reviews, with a check that the US side of the framework is operating as intended expected within 12 months.

Unlike the EU, which has the GDPR, the US has no federal data protection scheme. It often leans on the fourth amendment, which protects US citizens from “unreasonable searches and seizures” as a precedent for the conduct of law enforcement, but this does not apply to EU citizens.

While the framework is in effect, compliant companies will be able to transfer data without the need for costly additional assessments, which could prove especially beneficial for cross-Atlantic collaboration.

“The EU-US Data Privacy Framework is a positive development in the mission to protect individuals and organizations on both sides of the Atlantic against cyber threats,” said Drew Bagley, VP and counsel, privacy and cyber policy at CrowdStrike.

“Modern IT infrastructure, cyber security, and privacy compliance programs are dependent upon global data flows.

“Data localization is not a substitute for data protection, and the new Framework stands in sharp contrast to some policy and certification proposals that mistakenly prioritize localizing data over protecting would-be victims from breaches. 

“This marks an opportunity to accelerate the G7’s Data Free Flow with Trust initiative and ensure defenders have the tools they need to defend against cyber attacks.”

From 2016 to 2020, transfers between the EU and US had been covered by the regulatory framework Privacy Shield. This worked as an adequacy agreement between the EU and US, with the US having promised to oversee the deletion of unneeded data.

In July 2020 the European Court of Justice invalidated Privacy Shield, having ruled that it was not compatible with the rights afforded to non-US citizens regarding surveillance and data collection in the name of national security.

The EU-US Data Privacy Framework seeks to address these concerns with new safeguards in place for EU citizens. 

President Biden signed an executive order in October 2022 which brought in new restrictions and measures of redress for intelligence service activities.

One of the foremost concerns with transferring EU data to the US has historically been that US intelligence services would be able to access and use sensitive data belonging to EU citizens.

Under the new agreement, intelligence entities will only be able to access data in a manner proportionate to protecting national security. 

Under the framework, EU citizens will also be given access to an impartial, independent mechanism for redress over the use of data by US intelligence agencies overseen by a new Data Protection Review Court (DPRC).

Complaints will be free to make, and citizens will not be required to produce evidence that their data was collected by an intelligence agency in order for the complaint to be looked into.

Ursula von der Leyen, President of the European Commission praised the “unprecedented commitments to establish the new framework” taken by the US.

But Henein argued that there is nowhere near enough transparency, and argued that as the surveillance redress process appears to happen behind closed doors it is unlikely to satisfy privacy concerns.

The Swedish Authority for Privacy Protection (IMY) has issued fines against companies over the use of Google Analytics.

Four companies were handed complaints alleging the transfer of personal data to the United States via Google Analytics, a tool for measuring and analyzing traffic on websites.

The fines issued to the four companies together exceeded $1.1 million after the IMY concluded that their practices violated recent EU privacy rulings.

Three of the four companies were ordered to stop using Google Analytics for web statistics, while one had recently stopped on its own initiative.

Coop, Tele2, Dagens Industrie, and CDON were audited by the authority, and while none had technical security measures deemed sufficient, it was Tele2 to which a 12 million SEK ($1.1 million) fine was issued. A 300,000 SEK ($27,700) fine was issued to CDON.

Coop and Dagens Industrie had taken some protective measures, and Tele2 had already stopped using the tool.

The action was taken following complaints from the organization None of Your Business (NYOB) and come in light of the Schrems II ruling by the Court of Justice of the European Union (CJEU).

In the 2020 Schrems II judgement, the CJEU declared the European Commission’s Privacy Shield decision invalid on account of what it called invasive US surveillance programs. 

The ruling effectively made the transfer of personal data on the basis of the Privacy Shield illegal.

It also stipulated stricter requirements for the transfer of personal data on the basis of standard contract clauses, granting a level of protection essentially equivalent to that guaranteed by the General Data Protection Regulation (GDPR).

In this case, the authority considered that the data transferred to the US via Google Analytics by the audited companies was personal data since it could be linked with other unique data transferred. 

“By the fact that IMY has decided on these cases at the same time, it is made clear what requirements are placed on technical security measures and other measures when transferring personal data to a third country, in this case the United States,” said Sandra Arvidsson, IMY’s legal advisor, who led the audits of the companies.

“These decisions have implications not only for these four companies, but can also provide guidance for other organizations that use Google Analytics.”

The audits themselves concern a version of Google Analytics from 14 August 2020.

A Google spokesperson said to ITPro: “Google Analytics helps publishers understand how well their sites and apps are working for their visitors – but not by identifying individuals or tracking them across the web”. 

“These organizations, not Google, control what data is collected with these tools, and how it is used. Google helps by providing a range of safeguards, controls, and resources for compliance."

Google and Microsoft - as well as other tech giants - have taken steps to reassure European users of data sovereignty and privacy in recent years.

At the beginning of 2023, Microsoft began the phased rollout of the EU Data Boundary for Microsoft Cloud, aimed at permitting customers to store and process data within the EU Data Boundary for Microsoft 365, Azure, Power Platform, and Dynamics 365 services.

In 2022, Google announced Sovereign Controls for Google Workspace to control, limit and monitor transfers of data to and from the EU. 

Google Analytics, however, continues to operate data centers globally - including the United States - but user IP addresses are anonymized depending on customer configuration. Its latest analytics product, Google Analytics 4, does not store IP addresses.

EU regulators have once again hit back at big tech criticism of regulatory changes in what marks the latest tit-for-tat battle ahead of the pending Data Act. 

Amid concerns the legislation could harm tech companies, Thierry Breton, European commissioner for internal markets, will say it’s expected to do the exact opposite. 

Lawmakers won’t shift their stance either despite the mounting opposition from big tech, according to the draft text of a speech set to be delivered in San Francisco this week. 

“Our European data strategy is to unlock a wealth of big data and set out how that data should be shared, stored, and processed. This will benefit all businesses – European, American, and others alike,” he is expected to say, and will add: “Assertiveness is not protectionism.”

Why tech companies are fighting the Data Act

The Data Act aims to prevent non-EU governments from accessing data processed by firms operating within the union. Rules outlined in the act will apply to both corporate and consumer data, and are applicable to a range of services and products, such as smart technologies and industrial machinery. 

Some US companies, however, warn the legislation could have a negative impact on international data transfers and create additional cost burdens for companies that operate across borders. 

US firms aren’t alone in leveling criticism. Last month, Siemens and SAP suggested the act could compromise “trade secrets” due to provisions requiring companies to collaborate with third parties to ensure regulatory compliance. 

In an open letter to Breton, EU antitrust chief Margrethe Vestager, and Commission president Ursula von der Leyen, German companies opposed to the act said it “risks undermining European competitiveness by mandating data sharing”. 

"Effectively, this could mean that EU companies will have to disclose data to third-country competitors, notably those not operating in Europe and against which the Data Act's safeguards would be ineffective," the letter read.

Pushing back against regulation

This criticism marks the latest in a long-running trend of big tech companies across the world pushing back against pending EU legislative changes.

Earlier this year, a number of industry stakeholders, most notably OpenAI, slammed the EU’s long-awaiting AI Act, branding it too restrictive and potentially inhibiting operations within the union. 

OpenAI CEO Sam Altman sparked controversy after suggesting the firm could be forced to “leave Europe” if the act was approved as it stood. While Altman swiftly reneged on the threat and clarified OpenAI’s commitment to Europe, the comments drew harsh criticism from Breton. 

Breton told Reuters at the time the AI rules are aimed specifically to safeguard the “security and well-being of our citizens” and insisted that changes “cannot be bargained”. He stressed the EU has been ahead of the curve in “designing a solid and balanced regulatory framework” in the interests of safety but also so Europe can “become a frontrunner in trustworth AI”.  

Data sovereignty rules in the EU have also been in the crosshairs for non-EU firms, with the cyber security labeling rules described as “discriminatory” against international firms in recent months. 

Big tech resistance is futile

Such pushback has a common theme: time and time again they fall flat. 

The first real acid test for this was prior to the implementation of GDPR, which received a significant degree of resistance from firms within the union and internationally. 

Similarly, cookie legislation and data-sharing rules in the wake of the Schrems cases, which saw companies such as Facebook hint they’d back out of the EU, fizzled out with a whimper. 

It appears tech companies haven’t learned their lesson. EU lawmakers are steadfast in their position and unrelenting in their attempts to implement regulations that benefit member states and citizens. 

For regulators to suddenly u-turn at the slightest hint of pushback would be disastrous from a political perspective. Companies, too, with even the slightest bone to pick would smell blood and pounce on future proposals. 

This raises questions over why organizations continue to try so hard to water down legislation. There are two differing tactics at play – playing tough and cozying up – both of which aim to temper potential regulatory crackdowns.

Altman’s hardline approach backfired. But around the same time Microsoft president Brad Smith outlined how the organization planned to develop a responsible framework for generative AI development. This approach showed a more measured approach that could curry favor with regulators. 

With the draft Data Act pending, organizations pushing back will likely find their criticism – which sometimes seems more like spitting out the dummy than offering constructive input – will come to no avail. 

Oracle has announced plans to launch its long-awaited sovereign cloud region for customers in the European Union (EU). 

The company said its new EU Sovereign Cloud will enable private and public sector organizations across the union to gain “more control over data privacy and sovereignty requirements”.

Described as one of the first cloud offerings specifically designed to address pending regulatory changes, the new cloud region will be located entirely within the EU, Oracle said. 

Similarly, the region will be supported by EU-based personnel and operated by separate legal entities within the union. 

As part of the move, sovereign cloud data centers will be located in Frankfurt and Madrid. 

The Frankfurt site will be operated by Equinix while Digital Reality is the host partner for the cloud region in Madrid.

Richard Smith, executive vice president for technology, EMEA, at Oracle, said the new region comes in direct response to a changing regulatory landscape in the union at present. 

"The European Union technology landscape has changed dramatically due to the growing importance of data protection and localization, leading to increased demand for sovereign cloud solutions that can securely host sensitive customer data and comply with regulations such as GDPR," he said. 

“Our goal is to meet customers wherever they are in their cloud journey and with Oracle EU Sovereign Cloud, customers in highly regulated industries, as well as those subject to certain country-specific legislation, can now accelerate their cloud strategies."

Data sovereignty focus

The new sovereign cloud region will operate under a “comprehensive” set of policies and governance that will support OCI’s existing capabilities, Oracle said. 

This will include a framework for data and operational sovereignty focused specifically on regulating how OCI stores and manages access to EU data, as well as how data access from non-EU entities is handled. 

“Oracle EU Sovereign Cloud is designed for data residency and security with an architecture that shares no infrastructure with Oracle's commercial regions in the EU and that has no backbone network connection to Oracle's other cloud regions,” the firm said. 

“Customer access to Oracle EU Sovereign Cloud is managed separately from access to Oracle Cloud's commercial regions.”

Pending EU regulations

The move from Oracle comes at a time when EU lawmakers are tightening their regulatory approach to data sovereignty. 

This has been a contentious talking point in recent months amid plans to implement more stringent rules for non-EU companies processing data within the union. 

In May, the European Union Agency for Cybersecurity (ENISA) revealed plans to introduce a ‘cyber security label’ that will be required for non-EU companies operating in the union. 

These proposals mean that major cloud providers such as Microsoft, Google, and AWS, would be required to enter into a “joint venture” with an EU-based firm for regulatory purposes.

This forms part of a wider regulatory crackdown via the EU certification scheme (EUCS), which aims to establish a union-wide certification regime for cloud providers and companies handling EU data.

Oracle isn’t alone in its sovereignty push, either. Earlier this month, IBM confirmed its own plans to open a dedicated quantum cloud data center and cloud region in Ehningen, Germany. 

IBM said the facility, which is the second of its kind for the firm, is designed specifically to “help clients continue to manage their European data regulation requirements”. 

The EU has progressed a key bill seeking to regulate the use of artificial intelligence (AI) to its latter stages, in another move that outpaces the UK’s AI efforts.

On 14 June, MEPs held a pivotal vote to move the AI Act closer to being signed into law across the region, which was passed by an overwhelming majority.

The Artificial Intelligence Act (‘AI Act’) is a wide-ranging series of controls for the implementation of AI technology, centered around a risk-based approach.

UK government officials have become more vocal on the issue of AI in recent weeks, but have not pushed forward any legislation to curb the use of the technology.

Under the EU’s measures, companies seeking to use AI would be required to provide transparency around data used to train models and to clearly label AI-generated content.

The draft bill sets out a framework for risk assessment of systems, with high-risk systems defined as those that pose a “high risk to the health and safety or fundamental rights of natural persons”.

Companies that develop these systems will be required to register them in an EU database for public oversight.

Those that do not comply with the requirements of the act could be hit with fines of up to 4% of their annual worldwide turnover, or €20 million ($21.6 million).

The Financial Times reported a senior British official as having described the EU’s regulation as “draconian”, and OpenAI’s CEO Sam Altman warned his company could leave the EU over the law before walking this threat back.

In contrast to the EU’s strict risk-based approach, the UK whitepaper is based on a framework of five ‘principles’ for AI:

• Safety, security, and robustness
• Appropriate transparency and explainability
• Fairness
• Accountability and governance
• Contestability and redress

It lays out no corresponding measures that could be taken against non-conforming companies, nor plans for statutory controls over AI.

The UK whitepaper specifically states that the government will not seek AI regulation on a statutory basis initially due to concerns that this could hinder innovation in the field.

Some in the industry have hailed this as a positive move for the UK AI landscape, as firms may be more willing to invest in the region if they believe it provides a better environment for profitable development.

“The key is to strike the balance between ensuring fairness and making AI possible to use and experiment with – which this pro-innovation approach supports,” said Iván de Prado Alonso, head of AI at Freepik Company.

“I expect a warm welcoming from technology vendors across the UK as the government encourages creating an AI-enabled nation.”

AI regulation: Clashing approaches to risk

As with the GDPR, firms seeking to operate within the EU will still need to abide by the AI Act, which could limit the extent to which AI firms feel the freedom that the UK government is at pains to provide.

Industry consultation indicated that small businesses could face great time and financial burdens by compliance requirements if regulators are “not proportionate and aligned in their regulation of AI”.

In place of initial legislation, existing regulators, such as Ofcom or the Digital Markets Unit, will be asked to implement controls in a way seen as proportionate.

Setting out the exact powers each regulator will have is likely to push the legislation well into the next parliament; the two years it has taken for the Competition and Markets Authority’s (CMA) Digital Markets Unit to get off the ground casts a shadow over these proposals.

The decentralized approach, based on an evolving framework and tending towards pro-innovation rather than caution, could also allow the UK to adapt to the changing state of the AI market more easily.

First proposed in April 2021, the AI Act has had to be rewritten many times to keep up with the developments in areas such as generative AI since its inception.

AI regulation: Banned technologies

The UK whitepaper acknowledged specific risks posed by generative AI and deepfakes, such as the potential for a criminal to generate false compromising images of an individual to damage their reputation, or for large language models (LLM) like ChatGPT to generate disinformation.

It did not go as far as providing risk guidelines with pre-defined uses or technologies in mind, and this could prove vital for its continued relevance as new technologies emerge.

The draft document for the AI Act, in comparison, includes a list of technologies deemed to carry an unacceptable risk, such as systems that could subliminally influence individuals or the use of AI for real-time biometrics tracking.

In this regard, it presents more of a complete overview for AI regulation than the UK whitepaper, which businesses can use to inform their business decisions going forward. 

The UK’s approach could give AI developers more freedom to try systems out; it has also left firms guessing when it comes to what regulations they may have to follow down the line. 

While outright bans on some uses of AI may be seen as restrictive, this is an example of the EU having delivered a clear answer to the ethical and regulatory questions that are being asked today while the UK is still in the consultation stage.

The conservative EPP Group sought to quash the biometrics ban through a last-minute amendment to the bill but failed to muster the votes necessary to have this passed. 

It remains to be seen whether the ban will stick, and the bill does reference “certain limited exceptions” for the technology that may leave the door open for use by EU nations.

Police use of real-time biometrics technology such as live facial recognition (LFR) has long been a point of controversy. 

In 2022 a University of Cambridge study called for the UK to ban the technology in public spaces, and cited instances of the Metropolitan Police Service (MPS) using LFR in which “minimum ethical and legal standards” were not met.

Human rights groups have strongly objected to the use of LFR in recent years, alleging that the technology will entrench racial biases and violate individual privacy to an unacceptable degree.

“With such a persistently inhospitable environment towards people fleeing wars and conflict or in search of a better life, it is vital that the European Parliament doesn’t dismiss the harms of racist AI systems,” said Mher Hakobyan, advocacy advisor on AI regulation at Amnesty International.

“Lawmakers must ban racist profiling and risk assessment systems, which label migrants and asylum seekers as ‘threats’; and forecasting technologies to predict border movements and deny people the right to asylum.”

A cross-party group of UK lawmakers called for CCTV devices from two Chinese companies to be banned in July 2022, due to alleged links with Uyghur internment camps and reported use of facial-recognition technology to detect Uyghur individuals.

During a trip to the US in June, UK Prime Minister Rishi Sunak attempted to distance the UK’s approach to AI from that of its closest neighbors.

Sunak has voiced ambitions for the UK to become a global leader in AI, and the newly announced Atlantic Declaration will see the UK and US work closely on AI safety.

The UK is also set to host the first international summit on AI safety later this year.

AI regulation: Common ground on sandboxes

Both the EU and UK approaches favor the adoption of trial environments, or ‘sandboxes’, for AI testing and deployment.

The UK whitepaper committed to providing businesses with a regulatory sandbox for AI, following a recommendation by Sir Patrick Vallance, a measure the EU has also promoted.

It is hoped that this will allow AI products and services to reach market faster, and highlight any hurdles to innovation, or emerging tools that deserve greater regulatory attention.

EU digital technology industry organization Digital Europe published a report based on results from nine European startups and SMEs. 

A key finding was that respondents supported sandboxes, and would favor a continuous sandboxing process in which to test products.

With lawmakers on both sides of the Atlantic circling the wagons, generative AI leaders look ready to commend themselves into the loving arms of regulators – or so they’d have us think. 

OpenAI CEO Sam Altman embarked on a whistlestop public relations tour of Europe last week, meeting with lawmakers and industry figures, and flying the flag for the organization amid heightened regulatory scrutiny. 

This tour saw him stop at Downing Street to meet with UK Prime Minister Rishi Sunak alongside several industry execs to discuss the acceleration of generative AI, how regulation may shape the evolution of the industry, and how AI itself may shape the future of industry. 

The tour bore similarities to a royal visit in many ways. Here, there, and everywhere and a whole lot of schmoozing, yet without the crowds, pomp, and lavish splendor. It was a case of  talking a good game and smiling for the cameras, giving the impression of an industry leader open to discussing the simmering undercurrent of concern over what generative AI means for the future. 

Toying with pulling the plug

While there’s no denying Altman has been willing to communicate on the issue of AI regulation – after all, he turned up to Congress last month – it’s part of a pattern of cosying up to regulators prior to crackdowns. 

At an event in London last Wednesday, Altman told attendees during a panel session the company could “leave Europe” if it were unable to meet regulatory requirements, describing pending proposals as ‘over-regulating’. 

“Either we’ll be able to solve those requirements or not,” Altman told attendees. “If we can comply, we will, and if we can’t, we’ll cease operating. We will try. But there are technical limits to what’s possible.”

This pungent whiff of absolutist, childish rhetoric was swiftly snuffed out by a u-turn on Friday in which Altman declared the firm was “excited to continue to operate here, and of course have no plans to leave”. 

A sigh of relief for many across Europe, no doubt. But the breakneck speed at which Altman was willing to threaten pulling out of Europe and then renege on the statement should raise concerns. Perhaps some industry leaders in the AI space just aren’t too keen on regulation – who would’ve thought?

Another regulatory Groundhog Day

We’ve seen this before. In 2020, Meta (then Facebook) spat the dummy out over a potential ban on sharing EU citizens’ data in the US due to privacy concerns. In a court filing, Facebook’s associate general counsel suggested enforcing a ban on trans-Atlantic data sharing would leave the company unable to operate.

“In the event that [Facebook] were subject to a complete suspension of the transfer of users’ data to the US,” Yvonne Cunnane wrote, “it is not clear how, in those circumstances, it could continue to provide the Facebook and Instagram services in the EU.”

Meta’s recent spats with EU regulators have also been halted by swift u-turns after bold declarations. Calling EU regulators’ bluff has, historically, been an abysmal tactic. And Altman’s recent outburst highlighted this perfectly, prompting a strongly-worded backlash from lawmakers in the union. 

Thierry Breton, European commissioner for internal markets, hit back at Altman’s comments, stating that rules on AI development “cannot be bargained”. 

“Let’s be clear, our rules are put in place for the security and well-being of our citizens and this cannot be bargained,” he told Reuters. 

“Europe has been ahead of the curve designing a solid and balanced regulatory framework for AI which tackles risks related to fundamental rights or safety, but also enables innovation for Europe to become a frontrunner in trustworthy AI.”

Talking the industry into the good books

Although aggressive in nature, Altman’s recent statements are an interesting tactic in the cat-and-mouse game innovators play with regulators. 

An outright crackdown from lawmakers would be disastrous and, frankly, counterproductive to the future of the industry. But if the industry keeps them talking and engaged for long enough, they may be able to temper the outcome and reduce the long-term hit. 

While Altman was wrapping up his Eurotrip, Microsoft president Brad Smith outlined the company’s future goals for AI governance, transparency, and responsible use. 

Detailing ‘five key principles’ to ensuring responsible AI development at the tech giant, Smith’s approach appears very much focused on currying favor with regulators on both sides of the Atlantic. 

“We are committed and determined as a company to develop and deploy AI in a safe and responsible way,” he wrote in a blog post. “We also recognize, however, that the guardrails needed for AI require a broadly shared sense of responsibility and should not be left to technology companies alone.”

A key talking point in this blog post was Smith’s calls to pursue “public-private partnerships to use AI as an effective tool to address the inevitable societal challenges that come with new technology”. 

Smith asserted the “key to success” moving forward will be to develop closer ties between government, “respected companies”, and NGOs to ensure transparency, regulation, and prevent misuse. A bold statement, and one that will likely be welcomed by regulators in both the US and EU. 

At the same time, however, acknowledging the “inevitable societal challenges” that will arise due to AI advances hardly fills one with confidence, and underlines how urgent proper regulations are.

AI innovators, it seems, have a choice; spit the dummy out and buckle in for a battle, or cozy up to regulators and hope the gamble pays off. Either way, the "move fast and break things" honeymoon period is over, and regulation is coming.

OpenAI chief executive Sam Altman has reneged on threats that the generative AI company could “leave Europe” due to an impending regulatory crackdown. 

Earlier this week at an event in London, Altman suggested the company may pull out of Europe if it could not comply with upcoming AI regulations being considered by EU lawmakers.

While participating in a panel discussion at University College London (UCL), Altman said the company will “try to comply” with the pending regulations. However, he later told Reuters that, in their current state, the proposals would amount to “over regulating”. 

“Either we’ll be able to solve those requirements or not,” Altman told attendees. “If we can comply, we will, and if we can’t, we’ll cease operating. We will try. But there are technical limits to what’s possible.”

The threat to back out of Europe sparked criticism from lawmakers across the union. Thierry Breton, European commissioner for internal markets, hit back at the comments, stating that rules on AI development “cannot be bargained”. 

“Let’s be clear, our rules are put in place for the security and well-being of our citizens and this cannot be bargained,” he told Reuters on Thursday. 

“Europe has been ahead of the curve designing a solid and balanced regulatory framework for AI which tackles risks related to fundamental rights or safety, but also enables innovation for Europe to become a frontrunner in trustworthy AI,” Breton added. 

The backlash appears to have prompted Altman to renege on his comments. In a tweet sent on 26 May, Altman confirmed the company has no plans to leave Europe. 

“Very productive week of conversations in Europe about how to best regulate AI,” he said. “We are excited to continue to operate here, and of course have no plans to leave.”

What prompted the pull-out threats?

The EU is currently working on a standardized set of rules to govern and regulate the development and use of generative AI technologies. 

Under the current proposals, the regulations would see OpenAI systems such as GPT-4 designated as “high risk”, meaning that it would be forced to comply with additional safety requirements. 

Other proposals would require companies such as OpenAI to disclose whether copyrighted materials have been used to train systems such as ChatGPT. 

These aspects of the regulations have sparked concern at OpenAI, with critics suggesting that it would severely inhibit innovation and cause significant long-term issues. 

The company has repeatedly argued that systems such as ChatGPT are not inherently high risk. 

New EU cloud security labeling proposals could force the three major cloud providers to overhaul their business practices in order to continue operating in the region, according to reports.

Draft documents, not yet officially presented to the public, in their current wording suggest providers will be required to engage in a joint venture with an EU-based firm. 

The documents add that non-EU operators, including US firms, will only receive a ‘minority stake’ in such ventures, which aim to improve security by providing an EU-based point-of-contact for regulatory purposes. 

Employees with access to EU data would also be required to undergo screening processes and be located within one of the EU’s 27 member states.

The documents, seen by Reuters, relate to the EU’s plans to introduce a cyber security label that will be required if a company, like Microsoft, Google Cloud, or AWS wishes to handle sensitive data in the EU.

The latest proposals put forward by the EU cyber security agency, ENISA, form part of the EU certification scheme (EUCS), which aims to establish a union-wide certification regime for cloud providers. 

This, ENISA has said, will “further improve the union’s internal market conditions for cloud services by enhancing and streamlining the services’ cyber security guarantees”. 

“The draft EUCS candidate scheme intends to harmonize the security of cloud services with EU regulations, international standards, industry best practices, as well as with existing certifications in EU member states,” ENISA said.

EU data sovereignty 

A key component within the draft documents centers around the requirement that cloud services must be operated and maintained within the EU. 

In addition, the document outlines requirements that customer data stored and processed in the EU will be subject exclusively to EU regulations and take precedence over non-EU laws. 

“Certified cloud services are operated only by companies based in the EU, with no entity from outside the EU having effective control over the CSP (cloud service provider), to mitigate the risk of non-EU interfering powers undermining EU regulations, norms and values,” the document reads.

“Undertakings whose registered head office or headquarters are not established in a member state of the EU shall not, directly or indirectly, solely or jointly, hold positive or negative effective control of the CSP applying for the certification of a cloud service,” it added.

The move could spark concern for non-EU cloud service providers - particularly the three major hyperscalers, all of which have a major stake in the union, according to Philip Brining, co-founder and director of Data Protection People. 

"The proposed cyber security labeling rules, which require non-EU cloud providers to establish joint ventures with EU-based firms, may present challenges for providers like Google, Microsoft, and Amazon amongst others,” he told ITPro. 

“Compliance with the requirements would involve significant restructuring and potential delays in obtaining the EU cybersecurity kite mark. These companies, with their extensive customer bases and data management responsibilities, could face a competitive disadvantage compared to EU counterparts.”

In March, industry stakeholders criticized the EU’s current approach to cloud regulation, noting that its proposals could prove highly inhibitive for non-EU operators. 

A report from the European Centre for International Political Economy (ECIPE) described the proposed certification scheme as “discriminatory” toward non-EU providers. 

A key point of contention highlighted by ECIPE was the requirement that non-EU cloud providers must register their head offices and global headquarters within the region. 

Gavin Millard, Deputy CTO at Tenable echoed Brining’s comments, noting that the current proposals could be highly inhibitive to non-EU-based providers due to the requirement to operate alongside a third party. 

“Whilst the protection of sensitive data from external entities should be paramount, the requirement to have an EU-based third party with a majority stake in the venture could be a ridiculously high barrier for the cloud services providers to do business in Europe,” he said. 

“It could be far more achievable and palatable to mandate and audit the siloing of sensitive data from non-EU employees of the cloud giants, than trying to force a potentially damaging commercial relationship with a third party.”

Millard added that while larger cloud providers could be impacted by the move, smaller organizations and software vendors may also be seriously affected. 

"The draft proposal could also greatly impact other software vendors and businesses, as they've built platforms to be cloud-specific, leveraging services only available on a particular provider,” he said.

“If providers based outside the EU can't provide a cloud platform deemed suitable, it's going to take a significant effort for companies doing business in the EU to reengineer their products to support the ‘EU Cloud’. Implementing could be a huge headache for both US and EU-based organizations, creating unnecessary friction by replacing one risk with another."

A new draft of EU artificial intelligence (AI) legislation could better protect business IP from being secretly scraped by AI firms, with developers facing new transparency obligations on copyrighted content.

The long-awaited AI Act could force developers to disclose when they collect and use copyrighted material to train large language models (LLMs). 

The aim is to protect firms from having information such as source code used without their permission.

In addition to protection from unauthorized uses of data, the bill would offer companies legal grounds to establish the degree to which AI firms they work with are using ethically sourced, non-copyrighted data.

This could save businesses from costly legal battles over the use of tools that, unbeknown to them, contain stolen intellectual property (IP). 

The bill is also expected to categorize AI models by their risk factor, from ‘minimal’ to ‘unacceptable’. 

It aims to provide clear criteria that organizations can use to assess whether an AI tool’s risks outweigh its use cases.

High-risk AI systems have been defined as those that present “significant risks to the health and safety or fundamental rights of persons”, such as live facial recognition, and will be subject to additional transparency obligations.

EU’s AI Act and wider industry data scraping

At present, many developers of large language models (LLMs), the algorithms behind generative AI, use a great deal of data harvested from the internet for training purposes. 

Lawmakers from across the EU’s political divide have come to a provisional agreement for the bill, which will now be pushed to the EU trilogue for further debate.

Previous drafts of the bill, first proposed in 2021, stated that transparency obligations “will not disproportionately affect the right to protection of intellectual property”.

The current bill states that non-compliant firms could face fines totaling up to 4% of their annual worldwide turnover, or €20 million ($22 million), whichever is higher.

Alistair Dent, chief strategy officer at data company Profusion, said that the requirement “raises the question of why AI should be treated differently from other platforms, such as social media or search engines”.

“These platforms index or use a huge amount of copyrighted material often without citation - should they be forced to adhere to the same standards as AI?” he added.

Examples of this can be found in historical examples of wide-scale data scraping. 

Earlier this year, Meta sued a ‘data scraping for hire’ firm Voyager Labs for its practices, alleging the firm had collected data on 600,000 Facebook users in a hidden campaign utilizing fake accounts.

Meta itself also attracted a €265 million ($291 million) fine for “unacceptable” data scraping from the Irish Data Protection Commission (DPC) in November 2022.

At present, firms face a confusing regulatory landscape over the permittance of data scraping. 

A case in the US last year, between hiQ Labs and LinkedIn, concluded that web scraping was not in violation of federal law.

However, the court was not convened to directly rule on the practice of web scraping, nor did it offer judgment on how the legality of the practice could be impacted by claims of IP theft.

The EU, in contrast, has protections against the use of data that could infringe on the rights of citizens such as for biometric identification, and has issued fines on the subject as seen with the Irish DPC’s decision on Meta.

Like GDPR, the EU’s AI Act is expected to have widespread implications for the market. 

Those firms looking to sell or deploy their models in the EU will have to comply with the terms of the bill, which will require a market-wide homogenized approach to risk and ethics criteria for AI products.

Researchers from the University of Oxford have created a tool called capAI, which they describe as “an independent, comparable, quantifiable, and accountable assessment of AI systems that conforms with the proposed AIA regulation”.

Within the paper, a proposal for internal review protocols is given as well as a suggestion that firms could provide stakeholders and customers with a scorecard for their AI system.

This could alleviate the concerns of some experts such as Dent.

"A risk-based approach, which seeks to categorize different uses of AI and then add rules based on the perceived 'risk' of the solution causing harm, has the drawback of being unable to anticipate how AI will develop and the impact new tools will have on society,” he stated.

“Put simply, if you can't know what form a new AI solution will take and how it will be used, it's very hard to predetermine what category it should go in and apply the compliance burden accordingly.

When you buy an Apple product, it can often feel like making a deal with the devil. On the one hand, you can be confident your new device will be slick, intuitive, and powerful. But on the other, you’re acquiescing to Apple’s locked-down ecosystem of apps and services. Want to run an unapproved app on your new iPhone? Forget it.

This is how it’s been since 2008 when the App Store first launched. Since then, apps have turned into an almost unfathomably lucrative business for Apple. In the year prior to Apple’s most recent financial statement, the store raked in a staggering $78 billion of services revenue, most of which is derived from the App Store.

If rumors are true, though, the gold rush could soon be coming to an end. According to well-connected business journalist Mark Gurman of Bloomberg News, developers are hard at work updating iOS so it can support third-party app stores and apps that have been “side-loaded” onto the device. Such a move would dramatically upend years of Apple’s uncompromising policy – and shake the foundations of the iPhone’s security model, too. 

The Digital Markets Act (DMA) spells trouble for big tech

The EU’s Digital Markets Act (DMA) was signed into law in September last year. This sprawling piece of legislation had been crafted with only one goal in mind.

“We've gone through several decades where a lot of these companies have been allowed to kind of grow globally unchecked,” says professor Vince Manzerolle, who studies the political economy of digital media at the University of Windsor in Canada. “This legislation is almost crafted to take down some of these big companies.”

When the DMA comes into force, many expect it’ll require Apple to allow third-party app stores on its devices. “If Apple is actually forced to comply with the letter of this new kind of legislation it will, I think, transform its operations in some fairly profound ways,” says Manzerolle. “Allowing sideloading and third-party app stores is a pretty significant change.”

One major point of contention between Apple and the EU is the 30% fee Apple charges for every transaction in the App Store – and most in-app purchases too. “I think the EU is just interested in lower prices and allowing more competition,” says Dr Kathryn McMahon, associate professor of competition law at Warwick University. “They say the 30% is an excessive fee. It's in no way related to the cost. It's also discriminatory because it's not charged across the board.”

Scrapping the ‘Apple Tax’

The fee – often referred to as the 'Apple Tax' – has long been unpopular with developers, as Apple imposes draconian rules on how apps can take payments. Under the current rules, all in-app purchases of digital goods must use Apple's own payment system.

Apps aren’t even allowed to signpost alternative payment methods, such as by linking users to a website. It means that, for example, you can download the Netflix app and log in – but if you want to sign up for a new account, you'll need to figure out how to do it yourself because the company doesn’t want to give Apple a cut of its revenue.

The option to use alternative app stores could be of huge benefit to developers across the board. “There are lots of rules and restrictions on what you can and can't do,” says Dr Greig Paul, an electrical engineer and security researcher at Strathclyde University. “You're playing in someone else's walled garden, so to speak.”

“If you give people the option to build apps [without approval], who knows what we will see?” he adds, arguing that it could ultimately be good for innovation if iPhone users could use a different way to download a web browser that hasn’t been forced to use Apple’s own web rendering engine, for example. “You might get the Firefox browser, using Firefox's engine on an iPhone, and that might push Safari to up its performance, or it might give you more extensions.”

Unpicking the iOS security concerns

Cracking open Apple’s app store monopoly could be good news for consumers, who would have more choice and control over the apps on their phones. But there could also be unintended consequences for iOS security.

“If you've been selling people on 'you don't need to think about security, you don't need to think about privacy', and then all of a sudden there are new [threats], maybe users are not prepared for that,” says Manzerolle. “I certainly think that's a possibility.”

Allowing other app stores or sideloading would put iOS policies broadly in line with Android, which has always been more open and flexible than Apple’s super-locked down operating system, but also more open to attack. “You're adding more complexity as you're opening up the platform,” said Manzerolle. “And there's all sorts of smart hackers and cyber criminals out there. They're probably looking for an opportunity to get into the Apple ecosystem and exploit people's trust in the platform.”

Will the EU’s measures backfire?

Of course, even if Apple does bend to the EU’s will, and alternative app stores do emerge on iOS, it doesn’t necessarily mean that consumers will follow. McMahon wonders if the EU could find itself in a similar position to the one it found itself in 2005 when it tried to rein in Microsoft’s ability to use Windows to push its own media playback software to consumers.

“Microsoft, as a result of the EU case, had to ship Windows without Windows Media Player,” says McMahon, who explains that when Microsoft later released a new version of Windows XP without Media Player alongside the bundled version, it died a lonely death.

“Nobody bought it. Nobody wanted to get it separately,” says McMahon. “The whole point of the antitrust case was to separate it out to allow much more competition in music browsers and streaming, but it didn't really have that effect. Because people just preferred [the bundle] and they just purchased the entire package.”

Will history repeat itself for iOS? Or will this be the beginning of a dramatic new era for the iPhone? If the rumors are true, we’re about to find out.

Microsoft has announced the staggered rollout of its long-awaited EU Data Boundary solution will begin in January 2023.

The solution is expected to roll out first to public sector and commercial customers and aims to allow businesses to store and process their customer's data within the European Union (EU).

First announced last year, the data boundary builds on Microsoft’s existing EU data storage commitments. The data residency solution means that customer data will only be processed and accessed from the jurisdiction in which it originates.

Microsoft said this was developed using extensive customer feedback over the last 18 months. Engineering work to support the implementation of the solution began shortly after the announcement in May 2021.

When introduced on 1 January, the change will apply to all core services, including Azure, Microsoft 365, Power BI, and Dynamics 365.

“Beginning on 1 January 2023, Microsoft will offer customers the ability to store and process their customer data within the EU Data Boundary for Microsoft 365, Azure, Power Platform, and Dynamics 365,” the company said in a statement.

“With this release, Microsoft expands on local storage and processing commitments, greatly reducing data flows out of Europe, and building on our industry-leading data residency solutions.”

In later phases of its rollout, Microsoft also outlined plans to expand the solution to include the storage and processing of “additional categories of personal data”, including data provided when receiving technical support.

At present, Microsoft provides cloud services to customers in nearly every country in the world. In Europe specifically, the company has opened – and is currently building – data centres in 17 data centre regions. The tech giant plans to build nine new additional regions in the coming years.

The rollout of the EU data boundary solution aims to support the regulatory requirements of customers across the EU and European Free Trade Association (EFTA), and follows long-running concerns over the flow of customer data across international boundaries.

Julie Brill, Microsoft’s chief privacy officer told Reuters the data boundary solution will “make our customers feel more confident” and enable them to have “clear conversations with regulators on where their data is being processed as well as stored”.

International data flows

Since the introduction of the GDPR in 2018, businesses globally have become increasingly concerned about the legality of international data flows, and operating across a wide variety of regulatory frameworks has presented challenges with regard to compliance.

The European Commission has been vocal in its intent to enforce regulatory requirements and is currently developing proposals to protect European user data during transferrals to the United States.

Similarly, in May 2021 the EU's data protection supervisor (EDPS) authority launched a probe into the European Commission’s use of Microsoft 365 products amid concerns over GDPR compliance.

Mike Kiersey, EMEA head of sales engineering at Boomi, told IT Pro that ensuring the seamless flow of data is critical to business operations globally. As such, support for organisations to ensure compliance is a welcomed move.

“Data movement is happening more often in real-time and it has become crucial to successful business operations,” he said. “Therefore, the ability to have iniquitous access to data at speed is key for providers.”

Caroline Carruthers, CEO and co-founder at data consultancy Carruthers and Jackson, warned that the introduction of the EU data boundary “fundamentally makes data flow less efficient” and will not fully prevent personal information from being accessed in different jurisdictions.

“Data does not respect geography, and attempting to ringfence it will never give 100% protection to customers,” she said.

“Putting up data boundaries and restricting free flow of data is a regressive step for wider data transformation. Instead of trying to pull up the castle moat on European data, governments and multinationals should be pushing for global data standards to ensure enhanced security does not stifle data innovation.“

Microsoft said its cloud services “already comply with or exceed EU requirements”, adding that the introduction of the new data boundary will provide future benefits for the public sector and commercial customers operating within the EU and EFTA, helping them to remain compliant.

In addition, as part of the rollout, the tech giant revealed plans to publish new data flow documentation to provide “transparent data insights” for customers whose services will be included in the boundary.