Brussels spent the week deciding what makes a supplier trustworthy, and produced more than one answer. European software companies, meanwhile, kept doing the practical version: owning their compute and their data. Seven stories for people who build and run software in Europe.
Parliament's cyber rapporteur wants suppliers judged on control, not flags
What happened On 8 October, Markéta Gregorová (Greens/EFA) presented her draft reports on the Cybersecurity Act 2 and the NIS2 revision to Parliament's industry committee. She backs the Commission's January proposal but would assess high-risk suppliers individually instead of starting from a list of risky third countries, and close loopholes through licensing, white-label products and intermediaries. Certification would be mandatory by default, risk assessments would extend to devices such as inverters, smart meters and home routers, and a single entry point would cover incident reports under NIS2, GDPR, DORA, eIDAS, the CER Directive and the CRA.
Take This is the fix last week's Oxygen Forensics case called for: a test that follows control through holding companies and resellers, not the registered address. The single reporting entry point is the most useful line for engineering teams; today one incident can mean four forms and four clocks. The risk is "by default": mandatory certification without enough accredited labs becomes a queue, and queues favour vendors big enough to wait.
Sources: Agence Europe · techUK
CADA heads the other way: reserved capacity for EU players
What happened According to press reports summarised by techUK, the draft opinion from Parliament rapporteur Sergey Lagodinsky (Greens) on the Cloud and AI Development Act would cut the proposal's four sovereignty levels to two, reserve at least 80% of new data-centre capacity in "acceleration zones" for EU players, and remove the route for vetting third-country providers. On 6 October, the Council Legal Service reportedly told national experts the act is compatible with WTO commitments if its "Buy European" provisions are adjusted. The lead committees' joint draft report is due on 1 December.
Take Two levels is a welcome simplification. But an 80% quota for "EU players" is a flag test, and removing the vetting route means no path for a provider to prove control rather than nationality. The same Parliament that wants Cybersecurity Act suppliers judged on behaviour could end up judging cloud suppliers on their passport.
The Digital Omnibus stalls over Data Act trade secrets
What happened EU ambassadors were due to adopt the Council's negotiating mandate on the Digital Omnibus, which amends the GDPR, ePrivacy rules and the Data Act, on 7 October. Under pressure from Germany and France, the item was downgraded to a discussion and the vote pushed back, reportedly to 11 October. Both want stronger trade-secret protection in the Data Act; Berlin wants protected data shared only with the holder's explicit agreement. The Irish Presidency's compromise would let data holders refuse to share if they show a significant risk of unlawful use or disclosure, especially to third-country entities.
Take The Data Act's promise to builders was simple: users can take their machine and product data to a third-party service. A trade-secret veto, plus a third-country refusal ground, hands the data holder the decision again, and incumbents will claim "significant risk" as routinely as they claim confidentiality today. If you're building on Data Act access rights, design for the veto now.
Sources: Agence Europe · techUK
Harmonised standards could finally become free
What happened On 6 October the Commission proposed a new Standardisation Regulation. It aims to cut the average time to develop a harmonised standard from six years to four, with binding deadlines, and make harmonised standards and standards referenced in EU law freely accessible, about 3,650 of the 27,000 in the catalogues, citing Court of Justice rulings that such standards form part of EU law. Parliament and Council now take it up.
Take The least glamorous proposal of the week may matter most to product teams. Under the CRA, the AI Act and the Machinery Regulation, conformity runs through harmonised standards that a small company currently has to buy before it can tell whether it complies. The catch is timing: this is a proposal, and the CRA standards are needed well before it can take effect.
Sources: European Commission · Lovguiden · techUK
Mistral Large 4: a trillion parameters on its own compute
What happened Mistral released a preview of Mistral Large 4, a 1-trillion-parameter multimodal model, on 6 October. It was trained entirely on Mistral's own compute, about 4,000 Nvidia GPUs, which the company says is two to three times less than its Chinese competitors use. For now it is available only through a guardrailed endpoint; Mistral plans to publish the weights about three weeks after safety testing. Benchmarks are still pending.
Take Owning the training cluster is the sovereignty claim that counts, more than any hosting badge. But hold the applause until the weights and the licence ship. A trillion-parameter open model is only useful to European teams that can afford to run it, and most will rent that capacity from a hyperscaler.
Source: TechCrunch
SAP and Personio buy the data layer
What happened SAP agreed to buy TechWolf, a Ghent company that maps employee skills from work data, in what TechWolf calls Belgium's largest acquisition of a venture-backed software company; the price is undisclosed. SAP says TechWolf's skills graph will ground its HR agents and cut their token costs. The same day, Personio announced it is acquiring Berlin's Circula, a spend-management platform used by more than 3,000 European mid-market firms, to run payroll, expenses and benefits as one system.
Take Both buyers are European, which keeps the value here. But note what SAP said it was buying: context for agents. The defensible asset in enterprise AI is not the model but the structured data it reasons over, and incumbents are buying it before startups can sell it to anyone else. If your product owns a clean graph of something, that's your moat and your price.
Ransomware reaches a T-Systems test system
What happened The SafePay ransomware group listed Deutsche Telekom's IT services arm T-Systems on its leak site and demanded talks within two days. Deutsche Telekom said it followed up on signs of SafePay activity in early September, found ransomware on a small test system, and isolated and cleaned it before significant damage. It says the affected data is mainly project slides and log files, with nothing sensitive.
Take The response sounds competent. The pattern is the lesson: test environments are where segmentation gets loose and real logs and customer slides pile up because nobody owns cleanup. Logs carry hostnames, usernames and sometimes tokens. Treat non-production as production for data and access, or keep real data out of it.
Source: Cybernews
Quick hits
- Funding European startups raised €15.8B in September, nearly five times August's total. Tech.eu
- UK–Germany launched an industrial tech corridor backed by Allianz, Bosch, RWE and Siemens; Quantexa is building a dedicated sovereign unit in Germany. Tech.eu
- Austria has a government bill before parliament that would allow fully automated administrative decisions with no human review of individual outcomes. EDRi / epicenter.works
- Nvidia defended its Linux Foundation-run Open Secure AI Alliance, which counts Mistral, Hugging Face and UiPath as members, saying hundreds of applicants await vetting. Tech.eu
- OllyGarden, which scores OpenTelemetry data quality, raised $4M with Datadog, Grafana Labs and Dash0 as strategic investors. Tech.eu
The thing nobody's saying
Last week the problem was procurement checking flags instead of control. This week Brussels answered with three different tests at once. Parliament's Cybersecurity Act rapporteur wants suppliers assessed individually, following control through white labels and intermediaries. The CADA rapporteur wants 80% of new capacity reserved for EU players and no route for outsiders to prove themselves. The Data Act compromise lets data holders refuse sharing on a third-country risk they assert themselves. Each test is defensible alone; together they mean a European SaaS vendor may have to prove trustworthiness three incompatible ways. Large incumbents can staff that. Startups will spend their seed round on paperwork instead.
To watch next week
Whether ambassadors finally agree the Digital Omnibus mandate, and what survives of the Data Act trade-secret compromise; the informal telecoms ministers' meeting in Limerick on 12–13 October, with the Digital Networks Act and subsea cables on the agenda; and whether Mistral publishes Large 4's weights and licence on schedule.
Facts link to their sources. Takes are the author's opinion.