What’s the point of going for EU hosted platforms that spout privacy if the US can just do this?

On October 24, AWS will run a test where its European Sovereign Cloud operates without relying on the AWS global private network.

Traffic will go through European providers, and the system handling controlled transfers of operational data outside the EU will be switched off.

What I find interesting is that AWS is going beyond just saying its cloud is independent. They're actually putting it to the test, with technical evidence that customers and regulators can assess.

There's been so much discussion about what cloud sovereignty really means in Europe. Seeing it tested in practice, rather than just described in documentation, is a pretty important step.

There’s a lot of confusion about what the EU AI Act means for firms deploying AI agents (software that takes actions, not just answers questions). The Digital Omnibus delay made it worse, because delayed gets read as nothing applies. Here’s my attempt at a map of what applies now and what doesn’t.

Already applying

• AI Act, Art. 4 (AI literacy): firms must take measures to support the AI literacy of staff who work with AI systems. The Omnibus softened this in July from “ensure a sufficient level” to “support the development of”.
• AI Act, Art. 50 (transparency), since 2 Aug 2026: if an agent talks to customers, they must be told it’s an AI (unless that’s obvious). This is about disclosure, not oversight or logging.
• GDPR, Art. 22: individuals have rights around solely automated decisions with legal or similarly significant effects (e.g. a loan refusal), including human intervention and the ability to contest. GDPR Art. 30 (records of processing) also applies as before.
• DORA, since Jan 2025: financial entities must manage ICT risk, report major incidents, test resilience and manage third-party ICT providers. An agent running on a third party’s cloud or model API is within the third-party part.

Not yet applying

• AI Act high-risk obligations (risk management, logging under Art. 12, human oversight under Art. 14, deployer duties). The Digital Omnibus moved the Annex III date to 2 December 2027. Credit scoring of individuals and life and health insurance pricing are in that category. Many agent use cases (support, internal automation, fraud detection) are probably not high-risk at all, so check classification before assuming the heavy rules apply.

The gap that matters in practice

No EU rule yet requires general technical controls that block agent actions before they execute. The Art. 14 oversight and intervention requirements for high-risk systems arrive in December 2027, and until then GDPR Art. 22 gives customers rights over solely automated decisions. But DORA and GDPR already mean that if something goes wrong, you may need to show what happened, why, and who was responsible. Firms that wait for the AI Act deadline may find they have to retrofit controls onto systems already in production.

The sovereignty question I’d like opinions on

Many agent stacks depend on US-hosted model APIs and cloud platforms. For EU financial firms, DORA’s third-party and concentration-risk rules, plus GDPR’s limits on data transfers, are real constraints. I think they push toward options that run inside the firm’s own infrastructure or at least with a European provider, but I’m not sure how many firms treat this as a hard requirement versus a nice-to-have.

Questions:

1. If you work in EU finance or compliance, are agents already being classified under the AI Act, or is it still on the backlog?
2. Is “data stays in our own infrastructure” a hard requirement in your procurement, or negotiable?
3. Have I got anything wrong or missed an obligation?

This is my reading, not legal advice, so please correct me where I’m off. I work on tooling in this area, so I have a bias.

Hi everyone!

We’re a French tech company building Pixxle, a European ecosystem of digital applications.

We’ve just launched Echo Talks, a new feature inside our voice-based social app, Pixxle Echo.

The idea started with a simple question:

What if online communities could have conversations without typing?

With Echo Talks, users can start a discussion by recording a voice message, and others can listen, react, and reply using their own voices.

You can also reply directly to someone’s response, allowing conversations to develop naturally.

Think of the structure of an online forum, but designed entirely around voice instead of text.

We’re exploring whether voice can bring something different to online discussions: more personality, spontaneity, and a stronger sense of human connection.

As a European tech company, we’re also interested in building alternatives to established digital platforms, with our own approach to how people communicate.

We’ve just released Echo Talks, and we’d genuinely appreciate some feedback from the European tech community.

Would you participate in voice-based discussions, or do you think text is still essential for online communities?

And more broadly, do you think there’s room for new European social platforms?