In line with its previous initiatives, Europe has significantly strengthened its regulatory framework to govern sectors that have become highly strategic: artificial intelligence, cloud infrastructure, and cybersecurity. Here is an overview of the latest legislation passed in Brussels.  

Europe is regulating AI… but is taking its time

One year after officially taking effect, the European AI Act reached a new milestone this summer. Despite the delayed publication of the Code of Practice intended to help companies achieve compliance, so-called “general-purpose” AI models must now meet new requirements across the continent. These requirements focus in particular on the transparency of the training process for generative AI models: developers will be required to publish a “sufficiently detailed” summary of the data they have used.

Although the European Commission had taken a hard line at the start of the summer, it has since softened its stance. In response to criticism highlighting the potentially negative effects of this regulation, it is now proposing to postpone several measures as part of the digital package it presented in mid-November.

In particular, the requirements for so-called “high-risk” models would not take effect in August 2026, but in December 2027. A one-year grace period could also be granted before the mandatory implementation of labeling requirements for AI-generated content. These proposals still need to be approved by the European Council and the European Parliament, a step that is far from certain.

Brussels Wants to Promote European Clouds

In the cloud sector, the year 2025 was marked by a “shift in awareness,” Octave Klaba, the founder and CEO of OVHcloud, recently stated. This is evidenced by Brussels’ latest initiative: the “Cloud Sovereignty Framework.” This new framework aims to classify cloud offerings based on their level of sovereignty, according to eight criteria such as governance, the supply chain, and security. Brussels is encouraging public institutions across the continent to use this framework in their calls for proposals.

This measure comes as European platforms pledge to accelerate the rollout of the Gaia-X project, which aims to deploy an interoperable and secure infrastructure that meets European standards. In particular, they have committed to certifying up to 3,000 services that comply with Gaia-X specifications by the end of the year.

The hoped-for rise of European cloud services must also be supported by the Data Act, designed to remove the main barriers put in place by U.S. giants to discourage migration to other providers. Brussels has also just launched investigations to determine whether Amazon Web Services and Microsoft Azure, the two market leaders, should be subject to the European Digital Markets Act. Such a change would impose new requirements on them—particularly regarding interoperability—to the benefit of their competitors.

Europe Wants to Mandate Cybersecurity by Design

In terms of cybersecurity, Europe adopted the Cyber Resilience Act in late 2024. This new regulation, which will take effect in September 2026, will tighten the requirements imposed on manufacturers of connected products, software, and industrial equipment. Brussels’ goal is to mandate an approach that integrates cybersecurity requirements “by design”—that is, from the earliest stages of design.

This text will supplement two other pieces of European legislation that have already been adopted. First, the DORA (Digital Operational Resilience Act) directive, adopted in January, which must be transposed into national law. It imposes new obligations on financial institutions—such as banks and insurers—as well as their suppliers, aimed at reducing IT risks, particularly cyberattacks.

Passed three years ago but still awaiting implementing regulations in France, the NIS2 (Network and Information Systems) Directive calls for enhanced protection for operators of critical infrastructure—approximately 250 entities in France across the banking, healthcare, energy, food, and telecommunications sectors. The directive mandates detailed emergency plans, regular updates, and frequent security tests.