Our weekly picks of digital trust-related articles

Canada's new AI strategy treats AI as critical infrastructure and targets all layers of the sovereignty stack, from cloud infrastructure and semiconductor capacity to data ownership and talent development. Notably, the strategy includes support for SMEs as a key lever toward AI sovereignty. I'm eager to see what AI sovereignty will look like in five years for these 'middle power' countries - Canada, Japan, India and others - and what paths they will have taken to get there.

The EU's Technological Sovereignty Package represents a significant strategic development. It intends to establish Europe as a credible third force between the US and Chinese tech blocs, showcasing a clear ambition to develop the entire tech stack, from semiconductors to cloud computing, artificial intelligence and open-source software. This approach contrasts with Switzerland's slower decision-making processes. However, as always, success depends on mobilizing private capital and industry. Concrete funding and timelines, as well as talent and skills development, remain noticeably absent in the proposal.

Schon das alte Nachrichtendienstgesetz wurde von der DigiGes und anderen Organisationen als zu eingreifend für die Privatsphäre bezeichnet. Hinzu kommt, dass die bisherigen Lauschangriffe auf die Netzkommunikation durch den Schweizer Nachrichtendienst vom Bundesgericht als grundrechtswidrig festgestellt wurden. Jetzt soll eine überarbeitete Version mit noch mehr Abhörrechten Eingang ins Schweizer Recht finden - das ist sicher nicht förderlich für den Schutz unserer Privatsphäre.

Amongst all the big news, I really like blog posts like this - just a cryptographer finding an interesting oddity, deciding to dig into it, and sharing their findings with the rest of us, even if nothing big came of it.

The author resists both the hype that AI will replace software engineers and the reflex to dismiss it. Probably correct isn't good enough for professional software: errors compound across modules until correctness and trust collapse. His answer is pairing AI code generation with AI-assisted formal specification, verified by proof tools at every step. Trustworthy software must be provably correct, not just probably correct.

Il est intéressant de constater que l'union fait la force, y compris lorsqu'il s'agit de préserver des alternatives viables dans le monde des services numériques. Déposer une plainte contre une migration représente certes un effort considérable, mais dans ce cas précis, la démarche a porté ses fruits : la migration vers MS Office a dû être interrompue, et ce sont les logiciels libres, d'origine française, qui ont conservé leur place. Du moins pour l'instant…

A reality check for anyone assuming AI subscriptions will stay at today's prices — or get cheaper. Repricing is only a matter of time. But beyond the economics lies a sovereignty trap: cheap access accelerates dependency, erodes internal capability, and eliminates negotiating leverage before the real cost arrives. By then, workflows and data are already embedded in the infrastructure of a handful of US-based model providers. The question isn't 'can we afford this later' — it's 'did we ever consciously choose this dependency?

I find this interesting because it extends the debate about digital sovereignty beyond software and hardware to the scarce resource of satellite communication spectrum. The EU’s 20-year strategy clearly demonstrates its vision for autonomous, secure infrastructure, such as the IRIS² project. I hope this assertive yet justified strategy progresses without provoking retaliation from the US that would undermine Europe's efforts to build resilience.

The rise of powerful large language models (LLMs) such as Mythos and ChatGPT 5.5, alongside agentic AI systems like MDASH, has sparked concern in cybersecurity due to their ability to identify and exploit large numbers of zero-day vulnerabilities, prompting calls for significantly stronger IT defenses. This shift also presents an opportunity: by democratizing access to advanced cybersecurity expertise and enabling more consistent vulnerability screening, these tools could allow earlier detection and faster patching, potentially even before deployment. The flip side is that routine task automation may reduce demand for junior to mid-level cybersecurity roles.

This piece offers an optimistic path forward for AI governance. Rather than searching for consensus on abstract ethical principles, we can build on the public values that our societies have already agreed upon. The author also makes the important point that experimentation in AI governance will inevitably produce failures and that this is not only acceptable, but necessary.

In case you want to start a small project, but want to avoid the US or Chinese hyperscalers, here are some EU-owned solutions for you. I like this list, not because I want to promote these services, but rather because it shows that the EU is gaining traction on providing credible and competitive basic services. Now if we could just get some gigawatt GPU factories online for homegrown LLM training and inference, we'd really be in business.

Now even the pope chimes in on giving his ideas how to use LLMs in a responsible way. His name predecessor, Leo the XIII, had many things to say about responsible capitalism. Now is the time to set the agenda straight with regards to LLMs: the pope puts the human in the center again, asks for inclusion of the poorer nations, and to actually using this technology for the good of all. A very interesting read!

Whether you are in favour or against age checks, it is in no one's interest to undermine legitimate privacy and security tools. Instead of using the sledgehammer approach to enforce ill-conceived laws, governments should focus their efforts on providing privacy-friendly ways of passing age checks to boost the public's acceptance.

It's encouraging to see digital sovereignty discussions beginning to bear fruit, though much of that fruit is still unripe. The more closely the non-US community examines the issue, the more complex it becomes: 'sovereign' cloud computing means little if the underlying hardware is produced in the US or China. A server is not just one CPU and some memory, it has many CPUs, some with management engines that operate below the OS and cannot be disabled. I'm eager to see how the EU navigates this hardware-layer challenge. It will be a critical test of how far digital sovereignty can truly extend.

The global tech industry has concentrated the production of its most critical hardware on a single island, with almost zero redundancy. It is worth noting that a disruption would not necessarily require an invasion; a grey-zone coast guard quarantine could result in the immediate cessation of chip exports. The article also highlights the vulnerability of compliance: strict U.S. export bans can be circumvented through transshipment hubs such as Malaysia, undermining the effectiveness of enforcement measures.

Die neue Überwachungsverordnung VÜPF der Schweiz ist ein bisschen überarbeitet worden – aber offenbar nicht genug. Auch wenn ich das Bestehen von Geheimdiensten in manchen Situationen gutheisse, muss deren Arbeit und das Ausmass der Datenquellen verhältnismässig sein. In dieser neuen Verordnung ist das aber nicht gegeben, im Gegenteil: Ausländische Firmen werden gegenüber Schweizer Firmen bevorzugt, da sie dieser Verordnung nicht folgen müssen. So schaffen wir keine digitale Souveränität, sondern erhöhen unsere Abhängigkeit von den grossen Firmen sogar noch!

The article is a reminder that the real risk in gen AI is dependency, not just price. If a security team cannot predict the cost or availability of the AI service it depends on, it cannot fully govern that service. And when you cannot govern a tool you depend on, you have a sovereignty problem.

What makes Stanford HAI's AI Index valuable is its data-driven, long-term perspective, which provides a welcome antidote to sensationalist headlines. Key signals: AI capabilities are not plateauing, the US-China gap has closed, and responsible AI is not keeping pace with AI capability. As for Switzerland, it ranks #1 globally in AI talent per capita, yet startup investment lags behind that of global leaders.

This blog piece proposes an "inverse" version of Asimov's three laws of robotics. While the original laws were designed to protect humans from harm by robots, these inverse laws are designed to protect us from ourselves by providing guidance on how to interact responsibly with LLM-generated content. At a time when information has never been more abundant or accessible, the risk of uncritical consumption has never been greater.

This text is compelling because it confirms a core geopolitical truth that I often emphasise: digital sovereignty cannot exist without physical infrastructure. Remarkably, China has swiftly progressed from AI policy intent to fabrication plants, chips and deployment, initially for inference purposes, but already on a strategic scale. The export-clearance imbroglio also shows how regulation can be used as a form of industrial warfare. Above all, it shows China’s ability to coordinate at a state level. Let's hope Europe is able to catch up quickly, too.

Who watches the watchmen, indeed. The GDPR is, in principle, a useful tool for protecting the privacy of EU citizens, but only if it is enforced. Here, a user's complaint to a Data Protection Authority (DPA) was rejected - after five years of inaction! NOYB, Max Schrems' privacy rights organization, has now filed a lawsuit against the DPA. Better enforcement of tools like the GDPR is essential if we are serious about protecting people's privacy.

This is a very thorough description of a bug detected in a Zero Knowledge Proof (ZKP) library used by a blockchain. If you are interested in how modern ZKPs work, this article gives a condensed overview of what is happening in a ZKP, and what the security guarantees are. As always, the devil is in the details, and in this case, a missing verification allowed an attacker to prove anything they wanted. Which shows how fragile these systems are, and how important it is to have a thorough understanding before using them for security related tasks.

Talkspace has been using patients' therapy session data to train an AI chatbot, and undoubtedly, many of them have no idea. It is well documented that most users do not read terms of service closely enough to understand what they're actually consenting to. Even if they did, Talkspace's assurances that the data is "anonymized" are not the guarantee they sound like. Methods exist to re-identify anonymized data. This troubling story is a reminder that raising digital literacy across the board - in people, institutions, and decision-makers alike - is critical.

I think this take on the state of AI adoption is spot on. Since ChatGPT made its public debut, we've been promised large-scale transformation of the workplace and society at large. But a little over three years in, apart from very specific tasks, we're still unclear what this supposed revolution will actually look like, and should an AI bubble burst, the economic damage could be large. To mitigate these risks, we need a more clear-eyed view of the actual capabilities of these models and how to apply them in the workplace, not more advertising promises.