Our weekly picks of digital trust-related articles

Voilà qui est intéressant, mais guère surprenant : lorsque l'on s'appuie sur les intelligences artificielles, on perd peu à peu l'habitude de ce que l'on savait faire par soi-même. C'est probablement analogue au fait de ne plus être capable de marcher de longues distances quand on prend constamment la voiture ou le train. J'aurais bien aimé savoir si les utilisateurs et utilisatrices de l'IA en retirent par ailleurs d'autres bénéfices — ou si leur esprit critique s'émousse lui aussi, nous entraînant vers un monde où nous ne serions plus capables de distinguer ce qui nous aide de ce qui nous nuit.

This article serves as a reminder that the digital world relies entirely on physical infrastructure and its geopolitical importance. The proposed cable from Chile to Hong Kong became a test of how far the U.S. would go to curb China's telecommunications ambitions, with Washington blocking the project and encouraging Chile to choose Google's alternative. As Europe's sovereignty strategy unfolds, the warning is clear: controlling infrastructure is a form of raw geopolitical power. Similar diplomatic, economic or regulatory retaliation, such as tariffs, licensing, or access conditions, could easily target Europe next.

While I generally agree with this nuanced discussion about how use of 'AI' in a plethora of government processes is neither new nor necessarily bad, I think an important point that it only indirectly addresses is that we should avoid using these systems as a panacea for overrun and underfunded public services.

This piece is interesting for managers because it reframes sovereignty as a company-level operating challenge rather than a geopolitical abstraction. Instead of blacklisting vendors, a reactive and politically driven mistake, organizations must consider which services are critical and how to maintain them. Geopolitics has entered the boardroom, and the technical scope now explicitly encompasses cloud architecture, data flows, and vendor dependency mapping as direct instruments of sovereign risk management.

It is an oversimplification, but I find it useful to contrast two different approaches to AI sovereignty: China's public sector-led model versus the private sector-led approach exemplified by the US. What I find most striking is China's ability to advance a strategy that serves multiple goals simultaneously, from climate action to AI infrastructure, with impressive coordination and unified vision. That level of coherence makes me reflect on how steep the path to AI sovereignty is for a region like the EU, composed of 27 member states, each with their own strategic priorities.

A slightly morbid example of how you never know what your data might eventually be used for. Although this is not exactly a classical case of your privacy being violated, I have some doubts that everyone who enthusiastically chased cute virtual monsters in their neighborhood would also have volunteered to collect data to train military AI models.

We use Matrix, too, so this issue hits close to home for us. The timing is infortunate. Europe is actively working to reduce its digital dependency, and this incident has landed right in the middle of those efforts, ready to be weaponized by skeptics. However, the details matter. From what is currently known, neither the encryption nor the underlying infrastructure appears to have been compromised. At worst, this looks like a governance issue: a question of who can access which groups, and of insufficient user awareness about what should or shouldn't be shared in a public room. If credentials were misused through social engineering, that points to human and organizational factors, not a flaw in the technology itself.

I always enjoy Melanie Mitchell's insightful articles. Her latest article gives a tour of the most important findings on how 'intelligent' today's LLMs truly are. I particularly enjoyed her discussion on how the terms we choose to talk about these technologies not only determine how we perceive them, but even inform what kind of 'intelligence' we are looking for.

I'm very surprised this hasn't been more covered in the media: Microsoft handed over data belonging to the Dutch government to the US House of Representatives. In compliance with the US CLOUD Act, the emails, notes, and appointments of civil servants working on the Digital Service Act were expatriated to the US. The CLOUD Act is one of the main drivers pushing Europe towards more self-governed infrastructure, and this incident certainly illustrates why.

Canada's new AI strategy treats AI as critical infrastructure and targets all layers of the sovereignty stack, from cloud infrastructure and semiconductor capacity to data ownership and talent development. Notably, the strategy includes support for SMEs as a key lever toward AI sovereignty. I'm eager to see what AI sovereignty will look like in five years for these 'middle power' countries - Canada, Japan, India and others - and what paths they will have taken to get there.

The EU's Technological Sovereignty Package represents a significant strategic development. It intends to establish Europe as a credible third force between the US and Chinese tech blocs, showcasing a clear ambition to develop the entire tech stack, from semiconductors to cloud computing, artificial intelligence and open-source software. This approach contrasts with Switzerland's slower decision-making processes. However, as always, success depends on mobilizing private capital and industry. Concrete funding and timelines, as well as talent and skills development, remain noticeably absent in the proposal.

Schon das alte Nachrichtendienstgesetz wurde von der DigiGes und anderen Organisationen als zu eingreifend für die Privatsphäre bezeichnet. Hinzu kommt, dass die bisherigen Lauschangriffe auf die Netzkommunikation durch den Schweizer Nachrichtendienst vom Bundesgericht als grundrechtswidrig festgestellt wurden. Jetzt soll eine überarbeitete Version mit noch mehr Abhörrechten Eingang ins Schweizer Recht finden - das ist sicher nicht förderlich für den Schutz unserer Privatsphäre.

Amongst all the big news, I really like blog posts like this - just a cryptographer finding an interesting oddity, deciding to dig into it, and sharing their findings with the rest of us, even if nothing big came of it.

The author resists both the hype that AI will replace software engineers and the reflex to dismiss it. Probably correct isn't good enough for professional software: errors compound across modules until correctness and trust collapse. His answer is pairing AI code generation with AI-assisted formal specification, verified by proof tools at every step. Trustworthy software must be provably correct, not just probably correct.

Il est intéressant de constater que l'union fait la force, y compris lorsqu'il s'agit de préserver des alternatives viables dans le monde des services numériques. Déposer une plainte contre une migration représente certes un effort considérable, mais dans ce cas précis, la démarche a porté ses fruits : la migration vers MS Office a dû être interrompue, et ce sont les logiciels libres, d'origine française, qui ont conservé leur place. Du moins pour l'instant…

A reality check for anyone assuming AI subscriptions will stay at today's prices — or get cheaper. Repricing is only a matter of time. But beyond the economics lies a sovereignty trap: cheap access accelerates dependency, erodes internal capability, and eliminates negotiating leverage before the real cost arrives. By then, workflows and data are already embedded in the infrastructure of a handful of US-based model providers. The question isn't 'can we afford this later' — it's 'did we ever consciously choose this dependency?

I find this interesting because it extends the debate about digital sovereignty beyond software and hardware to the scarce resource of satellite communication spectrum. The EU’s 20-year strategy clearly demonstrates its vision for autonomous, secure infrastructure, such as the IRIS² project. I hope this assertive yet justified strategy progresses without provoking retaliation from the US that would undermine Europe's efforts to build resilience.

The rise of powerful large language models (LLMs) such as Mythos and ChatGPT 5.5, alongside agentic AI systems like MDASH, has sparked concern in cybersecurity due to their ability to identify and exploit large numbers of zero-day vulnerabilities, prompting calls for significantly stronger IT defenses. This shift also presents an opportunity: by democratizing access to advanced cybersecurity expertise and enabling more consistent vulnerability screening, these tools could allow earlier detection and faster patching, potentially even before deployment. The flip side is that routine task automation may reduce demand for junior to mid-level cybersecurity roles.

This piece offers an optimistic path forward for AI governance. Rather than searching for consensus on abstract ethical principles, we can build on the public values that our societies have already agreed upon. The author also makes the important point that experimentation in AI governance will inevitably produce failures and that this is not only acceptable, but necessary.

In case you want to start a small project, but want to avoid the US or Chinese hyperscalers, here are some EU-owned solutions for you. I like this list, not because I want to promote these services, but rather because it shows that the EU is gaining traction on providing credible and competitive basic services. Now if we could just get some gigawatt GPU factories online for homegrown LLM training and inference, we'd really be in business.

Now even the pope chimes in on giving his ideas how to use LLMs in a responsible way. His name predecessor, Leo the XIII, had many things to say about responsible capitalism. Now is the time to set the agenda straight with regards to LLMs: the pope puts the human in the center again, asks for inclusion of the poorer nations, and to actually using this technology for the good of all. A very interesting read!

Whether you are in favour or against age checks, it is in no one's interest to undermine legitimate privacy and security tools. Instead of using the sledgehammer approach to enforce ill-conceived laws, governments should focus their efforts on providing privacy-friendly ways of passing age checks to boost the public's acceptance.

It's encouraging to see digital sovereignty discussions beginning to bear fruit, though much of that fruit is still unripe. The more closely the non-US community examines the issue, the more complex it becomes: 'sovereign' cloud computing means little if the underlying hardware is produced in the US or China. A server is not just one CPU and some memory, it has many CPUs, some with management engines that operate below the OS and cannot be disabled. I'm eager to see how the EU navigates this hardware-layer challenge. It will be a critical test of how far digital sovereignty can truly extend.

The global tech industry has concentrated the production of its most critical hardware on a single island, with almost zero redundancy. It is worth noting that a disruption would not necessarily require an invasion; a grey-zone coast guard quarantine could result in the immediate cessation of chip exports. The article also highlights the vulnerability of compliance: strict U.S. export bans can be circumvented through transshipment hubs such as Malaysia, undermining the effectiveness of enforcement measures.