Europe got a detailed estimate this week of what depending less on foreign cloud would cost. It also got a live demonstration, in spoiled food, of what dependence costs. Six stories for people who build and run software in Europe.
One night, about 700 supermarkets: the refrigeration hack
What happened Overnight from 11 to 12 October, attackers took over internet-reachable refrigeration controllers in French supermarkets and lengthened defrost cycles, pushing cabinet temperatures as high as 50°C. Five major chains confirmed they were hit; France's finance minister put the total at about 700 stores. CERT-FR's alert named Danfoss AK-SM and AK-SC controllers, then added Copeland and Dixell XWEB systems a day later. Danfoss says most affected units were older models, discontinued in 2016 or out of support since May 2021. Nobody has claimed it; the Paris prosecutor is investigating.
Why it matters Researchers had published flaws in these controllers months earlier. Censys saw exposed panels in France drop about 71% in three days, apparently unplugged rather than patched; elsewhere the count barely moved.
Take Supply-chain risk in its most physical form. The retailer owns the fridge, the manufacturer stopped patching it years ago, and a maintenance contractor holds the remote access, so each can call the exposure someone else's job. Les Mousquetaires has already said the supplier should file the complaint. The Cyber Resilience Act helps only at the edges: manufacturers must now report actively exploited flaws, but its update duties cover products placed on the market from December 2027, not a controller installed a decade ago. If you run infrastructure, list every device with a remote-maintenance path, its end-of-support date, and who holds the credentials.
Sources: SecurityWeek · The Hacker News · Censys · The Register
Big Tech puts a €115 billion price on the sovereign-cloud law
What happened Brussels think tank ECIPE, in a study commissioned by the CCIA (whose members include Amazon, Google and Meta), priced the top tiers of the Cloud and AI Development Act at €115B over 2027–2036 in its middle scenario: about €33B for the public sector and €80B for private companies, the latter only if the Commission extends the rules. Roughly 69% is migration and software rewriting, 30% higher cloud prices. The Commission's own upper estimate is €18B. The study puts no value on security or resilience and says it is not a full cost-benefit analysis.
Take Read the breakdown, not the headline. If seven-tenths of the cost of leaving is rewriting software, the study mostly measures lock-in, paid for by the companies that sell it. For engineers, that share is the part you control: every workload built on portable interfaces lowers your own number, whatever CADA ends up requiring.
openDesk gets its first commercial partners, and Berlin talks up the Deutschland-Stack
What happened ZenDiS, Germany's federal centre for digital sovereignty, named STACKIT (Schwarz Digits) the first "Approved Sovereign Service Provider" for its open-source office suite openDesk, with B1 Systems and Dachs IT approved as integrators. Pilots run now; production is planned for early 2027. At the Smart Country Convention on 16 October, Digital Minister Karsten Wildberger called open source essential to the planned Deutschland-Stack.
Take This is CADA's procurement lever working: a public buyer defines the product and creates a market European providers can sell into. The risk is concentration under a different flag. One approved cloud provider at launch, with a BSI C5 attestation as the entry ticket, favours whoever can already afford the audit. The partner list needs to grow before production starts.
Sources: STACKIT · ChannelPartner · Kommune21/move
Gartner expects four in five neoclouds to lose their independence by 2030
What happened Gartner forecast that more than 80% of neocloud providers will stop operating independently by 2030, and that over $3.5 trillion of AI infrastructure spending could face impairment by then because AI revenue won't cover planned capex. CoreWeave shares fell as much as 17% that day. A day later, Amsterdam-based Nebius said it had signed compute deals with several early-stage UK AI labs.
Take Europe's AI-cloud champions (Nebius, Nscale, Verda) sit squarely in the category Gartner is warning about. A GPU contract with a neocloud is a counterparty bet as much as a capacity purchase. Ask what happens to your data, reservations and pricing if the provider is acquired, keep pipelines portable, and use the Data Act's switching rules, which cover IaaS too, in your contracts.
Sources: Gartner · The Register · Tech.eu
The AI Act gets its first harmonised standard, and it's about process
What happened Implementing Decision (EU) 2026/2274, published in the Official Journal on 14 October, cites EN 18286:2026, the quality management system standard for AI Act purposes. Following it gives high-risk AI providers a presumption of conformity for the QMS requirements it covers, including Article 17. Those obligations now apply from December 2027 for Annex III systems.
Take Good news: a QMS is something you can build now, from processes you already run for ISO 9001 or 27001. ISO/IEC 42001 overlaps but gives no presumption of conformity, so don't treat it as a substitute. The catch: the first cited standard covers how you manage AI development, not how you prove a model is accurate, robust or secure. Those questions stay with your own documentation for now.
Sources: Nemko Digital · LNE-GMED · Reglog
EU Inc's founders say the version they fought for no longer exists
What happened On 15 October, the EU-INC campaign founders appealed to EU heads of government, arguing that negotiations have stripped out what made the pan-European company form worthwhile. Their five essentials: free choice of registration state, a common stock-option framework, one central digital registry, local labour law for employees, and access for all companies. The European trade union confederation wants the proposal strengthened or dropped. A day later, the European Council listed the 28th regime among this year's deliverables and asked for the roadmap files to be finished by year-end.
Take For builders, the registry matters most. One digital register with standard records would turn cross-border onboarding, KYC and tender checks into one integration instead of 27. Without it, EU Inc is just a 28th legal form to support. A year-end deadline is a reason to get it right, not to ship whatever is left.
Sources: Tech.eu · European Council conclusions
Quick hits
- Skeleton Technologies passed a $1B valuation with Siemens backing, mainly to fund US manufacturing and Silicon Valley R&D. Tech.eu
- Notebooksbilliger.de told customers that attackers took email addresses and possibly names, addresses and IBANs. Born's IT blog
- Femern Link Contractors, builder of the Fehmarn Belt tunnel, was hit by a cyberattack that stopped access cards and work vessels; work has partly resumed. Sjællandske Nyheder
- Digital Omnibus: ambassadors didn't take up the compromise on 11 October, and no new vote date had been set by mid-week. Agence Europe
- Salience Labs (UK) raised $125M to scale photonic chips for AI data centres. Tech.eu
The thing nobody's saying
The sovereignty number Europe argued about this week was the cost of leaving: €115 billion, with resilience valued at zero. The cost of staying arrived unbudgeted. Controllers left online years after support ended spoiled food in about 700 French supermarkets in one night; two Alsace stores reported €270,000 in losses. Gartner warned of more than $3.5 trillion in possible AI-infrastructure write-downs, in the category Europe's AI-cloud champions belong to. EU Inc's founders say the fix for 27 company regimes is being negotiated away, so founders keep paying for the status quo. Exit costs get modelled to the euro; dependency costs land on whoever is holding them. Until Europe books both, sovereignty debates will be won by whoever paid for the spreadsheet.
To watch next week
AWS plans to disconnect its European Sovereign Cloud from its global backbone for several hours on Saturday 24 October, and has promised to publish the results. Also watch whether CERT-FR or Danfoss names an entry point, and whether exposed controllers outside France start disappearing too. And whether the Irish presidency finds a date for the Omnibus vote.
Facts link to their sources. Takes are the author's opinion.