Collage-style illustration of two hands linking pinky fingers in a pinky promise against a cream paper-textured background. The hands are in black and white, with one wearing a red sleeve and the other a red sleeve with red nail polish. Decorative geometric shapes surround them: yellow circles, dark red rings, a grid pattern, parallel lines, and a cluster of navy dots.

Trust Issues Could Make or Break Agentic Commerce

The image shows a silhouette of a person, likely a woman, sitting on the floor in a dimly lit room. She is sitting near a large window with sunlight streaming in, creating a strong contrast between the light outside and the darker interior. The woman appears to be holding a phone or tablet, looking at the screen while leaning her arms on her knees. The overall mood of the image is reflective, perhaps suggesting a moment of contemplation or solitude. The setting seems to be indoors, with part of the room's furniture visible on the right-hand side.

Human Rights Experts Should Engage in Age Assurance Standards

The United Nations Office Geneva in the Palais des Nations. Shutterstock

The United Nations Office Geneva in the Palais des Nations. 

The World Doesn't Need Another UN AI Declaration. It Needs Architecture.

European officials release the “Tech Sovereignty Package” on June 3, 2026. Source

European officials release the “Tech Sovereignty Package” on June 3, 2026. 

Does Europe Really Have a Plan for Tech Sovereignty?

A neural network comes out of the top of an ivory tower, above a crowd of people's heads (shown in green to symbolise grass roots). Some of them are reaching up to try and take some control and pull the net down to them. Watercolour illustration.

How AI Keeps Europe Hooked on US Cloud

People hold signs in opposition of xAI's use of gas turbines at their facility during a meeting of the Memphis and Shelby County Air Pollution Control Board, Monday, Dec. 15, 2025, in Memphis, Tenn. (AP Photo/George Walker IV)

Inside SELC's Clean Air Case Against xAI in Memphis

The undying sun hangs in the sky, as people gather around signal towers, working through their digital devices.

Digital Nomads Across Time by Yutong Liu & Digit. 

Imagining Broadband Policy of, by, and for the People

An abstract background meant to depict pixel errors and glitches.

Nine Things Platforms Could Do Now to Help Blunt Political Violence in the United States

US Commerce Secretary Howard Lutnick listens to President Donald Trump’s speech during a news conference at the G7 summit, Wednesday, June 17, 2026, in Evian-les-Bains, France. (Jeanne Accorsini/SIPA via AP Images)

Commerce Eased Its Block on Anthropic's Mythos, But Major Questions Remain

(L-R) Congressional candidate Claire Valdez, Congressional candidate Brad Lander, Mayor Zohran Mamdani, and Congressional candidate Darializa Avila Chevalier raise their hands during the 'Our Team, Our Year' Get Out The Vote (GOTV) rally for local candidates ahead of this week's Primary Elections at the Kings Theatre in the Brooklyn borough of New York City, NY, June 18, 2026. (Photo by Anthony Behar/SipaUSA via AP Images)

Populist Candidates Need More Tech Policy—Reforming Tenant Screening Is A Good Start

The New UK Prime Minister Inherits a Social Media Ban. The Real Goal Is Safety by Design.

Tear gas surrounds federal law enforcement officers as they leave a scene after a shooting on Wednesday, Jan. 14, 2026, in Minneapolis. (AP Photo/John Locher, File)

Trump’s Crackdown on Dissent is Targeting Signal—and Zines

Split-screen image depicting contrast. On the left, a Rubik’s cube displays blue, red, and yellow sides, with a LinkedIn 'cr' AI-generation icon nearby. The background is divided between discarded electronic waste on a street and data centre cables, some connecting to the cube. On the right, the entire scene is repeated with inverted colors.

This is not a(i) game! by Laura Sofia Martinez Agudelo / 

When AI Agents Fail, People Ask the Wrong Question About Why

Harvard University graduates, top, celebrate during commencement exercises on the school's campus, Thursday, May 28, 2026, in Cambridge, Mass. (AP Photo/Steven Senne)

For Students, the Process of 'Becoming' is the Challenge No Chatbot Can Solve

Illustration of a person standing with their back facing the viewer, surrounded by large stylized eyes watching them from above. The person is in a spotlight formed by overlapping blue and gray geometric shapes, conveying a feeling of being observed or surveilled.

Who Really Controls Your Digital Likeness in the Age of AI Wearables? Not You.

Paper collage. A photograph of the Atomium in Brussels, cut into diagonal strips and reassembled over a grid of numbers.

Seeing More — Seeing Less by Anna Riepe & FARI / 

Google and Apple’s Anti-DMA Lobbying Strategy Goes All-in on Security and Privacy

A child holds up a smartphone, obscuring their face.

They Said I'd Feel Different About Free Speech as a Parent. They Were Wrong.

June 22, 2026—Andy Burnham with colleagues from the Parliamentary Labour Party in Westminster Hall at the Houses of Parliament in central London, as he returns to the House of Commons to take up his seat after winning the Makerfield by-election. (Yui Mok/Press Association via AP Images)

How Will Andy Burnham Handle Tech Policy as UK Prime Minister?

In this photo illustration, the Telegram logo is seen displayed on a smartphone screen with the Indian flag in the background. (Photo by Thomas Fuller / SOPA Images/Sipa USA)

India’s Telegram Ban Was Temporary. The Power Behind It Is Not.

The Anthropic logo is displayed on a smartphone screen placed on a reflective surface onto which a company branding illustration is projected on June 2, 2026. (Photo by Samuel Boivin/NurPhoto via AP)

Anthropic's Red Lines Are No Substitute for Public Law

is published in partnership with the AI Now Institute.

In our previous iteration of this series, we talked about European AI start-ups that operate at the application layer — and why betting on certain versions of applied AI may further entrench Europe’s dependency on a handful of United States firms.

The obvious counterexample to start-ups like the Swedish vibe-coding company Lovable is Germany’s DeepL. Launched in 2017, the company develops its own, proprietary models at a 

 rather than matching the training-data volume Google built up over years of web crawling. DeepL is more than a European AI success story — it 

has outperformed Google Translate in accuracy assessments

 — and it made GDPR compliance, along with processing customer data on its own servers in Germany and Iceland, a core part of its public narrative, and a main selling point for privacy and sovereignty-conscious users.

That was true until April 2026, when the Cologne-based company informed its paying customers that it was entering a partnership with Amazon Web Services (AWS) and would no longer process data exclusively on its own servers. This announcement was publicly 

 as a deliberate decision and, at least implicitly, as a betrayal of the company’s commitment to Europe.

From a strategic perspective, it might seem puzzling: Why would DeepL, a company that has made sovereignty its key selling point, end up partnering with AWS, one of the (perceived) three horsemen of Big Tech?

In this piece, we argue why European AI Sovereignty is intricately connected to its existing dependence on three US cloud providers: Amazon, Microsoft, and Google.

As a result, each of Europe's attempts to build its way out risks deepening the very dependence it aims to cure. By boosting demand for AI, especially at the frontier, it also boosts demand for proprietary models bundled with the dominant cloud providers. By building gigafactories, it trains models that then run on hyperscaler infrastructure. And by building its own compute for inference, it risks subsidizing capacity for the leading US AI firms, the only customers large enough to fill it.

Hyperscalers own the distribution channels

Contrary to public opinion, DeepL’s decision can be understood through the brutal, structural reality of a highly concentrated global AI stack: DeepL’s enterprise customers (think multinationals) want the same service everywhere. AWS operates globally and can provide low-latency, real-time performance that no European cloud providers can match. Especially as the company is 

 to real-time voice translation, the feasibility of serving AI models globally from a data center in Southern 

 has become unfeasible. For an ambitious company with an IPO lined up for this year, loading the balance sheet with debt to facilitate its own data center buildout in a historically tight market would likely have faced resistance. Lastly, given the business need to compete with Google Translate's ubiquitous presence, access to AWS's end user market and distribution channels likely drove the decision: Once DeepL is listed on AWS Marketplace, enterprises can acquire, deploy and manage DeepL directly within their existing AWS infrastructure through a trusted procurement platform.

All of these factors point to the pervasive monopolies of the global computational infrastructure that pull European companies into their orbits, rather than the companies’ commitment to Europe.

Europe's AI industrial strategy since 2025 has been built around expanding the continent’s ability to train frontier models: centralized, frontier-scale training capacity designed to train, post-train, and evaluate the most complex models. This requires highly specialized compute infrastructure, equipped with (often Nvidia’s) latest AI chips. This framing is politically convenient, as it enables the leveraging and pivoting of existing public high-performance computing clusters (EuroHPC) towards the AI race. Recent AI Factories and Gigafactories are descendants of these initiatives, now facing 

 due to emerging funding gaps, elusive demand and difficulties in governance.

But even if these questions were solved, a more serious problem looms – widespread AI adoption doesn't automatically generate demand for one-off gigantic training. It generates demand for serving inference: responding to individual user requests one at a time, as they arrive, with low latency and high availability, like a user typing into a chatbot and expecting an immediate answer. Inference also requires high-capacity (though not the latest) GPUs, but is a fundamentally different kind of infrastructure than training. It is distributed, elastic, close to users, rather than centralized and connected. This leads to what we have 

— the tendency to fixate on training runs that are conducted on public computational clusters while ignoring the private compute ecosystem in which those models will eventually live and produce value.

Why does mainstream demand for AI products benefit hyperscalers

Now, the obvious question for European policymakers is how to ensure that models run on European cloud infrastructure. There are three reasons why even a huge demand for AI inference doesn’t mean that this demand can (currently) benefit European providers.

Proprietary models on hyperscaler infrastructure

What is worth reiterating for a policy audience is that AI models come in two types, and the difference decides who is allowed to run them. With an open-weight model, the developer publishes the model itself for download, so anyone (i.e., a startup, a university, a European cloud provider) can run a copy on their own infrastructure. Alibaba’s Qwen, Meta's Llama and France's Mistral are open-weight. The most capable models remain proprietary: Anthropic's Claude, OpenAI's GPT, Google's Gemini, even as open-weight models like DeepSeek and Qwen have caught up with the frontier tier.

Proprietary model makers distribute their models on the cloud providers they depend on for capital and compute – Amazon AWS, Microsoft Azure, and Google Cloud – largely bypassing European providers. 

SAP’s “sovereign” OpenAI for Germany

, for instance, also runs on Microsoft’s Azure cloud. This is also due to the fact that AWS, Microsoft, and Google Cloud have struck circular spending partnerships with the largest AI labs, to give them discounted computing costs (in exchange for either guaranteed generous or ownership stakes). In a highly concentrated AI market, where most demand is for proprietary AI models, more AI adoption means more demand for models run on hyperscale infrastructure. This creates a feedback loop: the money and data received from run models can be used to train the next generation of models.

All this puts European cloud providers in a bind. As they are not able to offer proprietary frontier models, they're left serving open-weight models. However, the largest open-weight models are very expensive to run, as they require providers to reserve specialized GPUs for that workload alone. Europe's main cloud providers have started offering large open-weight AI models, but mostly older or compressed versions, and usually not the latest. The clearest case is IONOS, whose largest model, Llama 3.1 405B, last led the field in mid-2024. Scaleway is furthest ahead, offering a model that was near the frontier in late 2025. Across all of them, the genuine cutting-edge open models of 2026 are still largely unavailable. (Accurate at the time of publishing; these catalogs change quickly.)

The hyperscalers AWS, Google and Microsoft already own their GPU fleets, which they bought for training and running the proprietary models they serve to their enormous, existing and captured customer base. As a result, their risk of building inference capacity is low. In the worst case, the company can spend the compute on serving their internal needs. A European competitor has to build the fleet from scratch and carry the risk of it sitting idle until demand arrives.

That's the chicken-and-egg problem, and the reason every European cloud provider that offers AI as a service focuses on smaller and medium-sized open-weight models. The choice is constrained on two ends: open-weight because the frontier proprietary models simply aren't available to host on someone else's infrastructure, and smaller because such models have a far lighter memory footprint and can be served on fewer GPUs and other specialized chips needed for inference. All of this is shrinking the fleet you have to bet on before demand materializes. But at the same time, the lack of competitive models is seen as a problem.

No open weight demand, no frontier serving in Europe

There is simply no demand (yet) that justifies the investment required to serve frontier models at scale. This also explains why European initiatives that are designed to expand (public) compute for inference end up partnering with large AI companies as anchor clients, as Leevi and Boxi have written in the case of Italy’s Apto data center - the only data center investment currently in the infrastructure portfolio of the European Investment Fund (EIF)

The only private actor that currently has a strategic incentive to diversify inference compute in Europe (and globally) is Nvidia. Its problem is concentration: a handful of US firms account for the bulk of its data-center demand, and those same firms — Microsoft, Amazon, Google, Meta — have each developed their own chips, predominantly for inference serving, but increasingly also for frontier training. That is precisely why Nvidia has had a 

 a class of so-called neoclouds, AI-specialized compute providers, in Europe. Dutch 

 are notable examples, with Mistral's expansion into computing infrastructure as an emerging competitor in this space. Through investing in companies, providing priority access to the latest chips, and guaranteeing demand through binding purchase commitments known as offtake 

, Nvidia entrenches itself as the computational infrastructure and diversifies its buyer base. However, even many of these Nvidia-backstopped computing providers 

 suppliers of compute for the American tech in search of a sufficiently high demand for their expensive hardware.

What Europe gets wrong about AI and the cloud

The reality of the market clashes with three key assumptions behind Europe’s AI industrial policy strategy. From the 

, the focus has primarily been on (moderately funded) attempts at building compute for frontier model training and boosting AI adoption. This focus has been based on the following assumptions:

That investing in compute for frontier-model training and European model makers will automatically lead to less dependency on dominant firms;

That European AI companies can make a conscious choice to avoid US hyperscalers;

Perhaps, most importantly, that cloud is a generic capacity for which there is a generic demand and supply.

The last assumption in particular is a gaping hole in the proposed Cloud and AI Development Act (CADA), Europe’s latest legislative proposal aimed at tripling the continent’s cloud capacity, while ensuring a small fraction of public sector demand goes to European providers. But that ignores that there are different supply and demand logics behind different cloud services. European cloud providers vary widely: Germany’s Hetzner, for instance, is very competitive on price, with a strong developer following and dedicated GPU servers, but doesn’t offer an "AI-as-a-Service" (AIaaS) platform with pre-built APIs for models. France's Scaleway, for instance, runs a genuine managed-inference / model-as-a-service layer, not just GPU rental, yet still lacks AWS’s global scale and distribution channels.

Even its flagship customer, Mistral, is now building its own infrastructure with Nvidia support instead of scaling on Scaleway. Schwarz Digits, meanwhile, the digital arm of Schwarz Group, the retail conglomerate behind Lidl, wants to become a European hyperscaler.

Demand, too, is not only for raw compute and storage, but for the higher-level services bundled with them: the managed services, as well as the surrounding ecosystem and tooling. Increasingly, demand for cloud services includes demand for proprietary AI models. And much of this “demand” is much less of a fungible consumer choice than the result of contractual lock-ins and other practices currently under 

. As a result, even under the perfect interoperability conditions, switching may not always be feasible.

As we have seen in the response to DeepL’s choice to partner with AWS, there’s a tendency to misread a structural pull as a moral choice. No European provider could have offered what DeepL needed. But the conclusion to draw from this is not that AWS simply offers a better product. By controlling the distribution and the demand (as well as locking in existing consumers), the hyperscalers can shape the strategies of actors downstream.

Europe’s dependence on three US cloud providers is now widely understood in EU policy debates, and so is Europe’s dependence on a small number of US companies for access to large-scale AI models.

What remains much less understood is how cloud concentration and AI dependence relate to each other: By boosting generic demand for AI (especially at the frontier), Europe risks boosting demand for proprietary models that come bundled with dominant cloud providers. By building gigafactories, Europe risks training models that then run on hyperscaler infrastructure. And even by building European compute for inference, Europe risks subsidizing infrastructure for the leading US labs, the only customers with enough demand to fill it.

AI sovereignty is not separate from the existing cloud market dynamics Europe has failed to grapple with. It is intricately connected in ways that simply boosting supply and demand separately can’t solve.

It’s not all doom and gloom, but the reality of the AI market leaves policymakers with some uncomfortable choices. We will discuss these in the next piece of this series.

Somewhere in Geneva next month, a diplomat will declare that artificial intelligence must benefit all of humanity. That statement is easy to make — and nearly impossible to disagree with. The harder question, and the one that will define the United Nations’ first 

, is whether fine words this time produce the architecture to back them up — architecture built not only by the powerful, but also on the knowledge, participation and agency of the global majority.

Governments, civil society, researchers, private enterprises and technical experts will gather to discuss some of the most critical issues of our time. The timing is critical because frontier technology, including AI, is no longer an abstract technology policy issue. It is reshaping labor markets, public services, education, information ecosystems and the agency and cognitive abilities of people across diverse communities here in Asia.

The institutions currently shaping AI governance remain concentrated in a small number of wealthy countries, powerful companies and well-resourced research environments. For many countries in Asia and the Pacific, AI systems are arriving faster than the regulatory, technical and civic infrastructure needed to understand, evaluate or challenge them — and well before communities have built the resilience to absorb harms that are already forming. As our region’s policymakers simply try to keep pace with foreign AI technology, we’ve barely moved the needle on discussions around catastrophic and existential risk.

That is why the UN Dialogue remains critical for humanity. The UN is the only forum where every member country has an equal seat, and where civil society, affected communities and technical experts can press for governance that reflects more than the priorities of dominant markets, powerful governments and wealthy private interests.

But the Dialogue will only succeed if it becomes more than an annual convening bringing together the familiar, privileged voices. It must center the world’s majority and produce the architecture needed to turn shared principles into practical governance.

First, the Dialogue must be judged by follow-through, not participation alone. A successful first session should close with a limited and prioritized set of workstreams, named and regionally balanced stewards, a clear reporting cycle, and a formal route for stakeholder evidence to enter deliberations. In this vein, the 

Without these basic structures, the Dialogue risks becoming a symbolic event: widely attended, diplomatically discussed and generally ignored in substance. We don’t need another forum that produces de minimis consensus language while leaving each country to interpret it alone. It needs a recurring mechanism that helps stakeholders alongside governments identify what is working, where implementation is failing and what support is needed to close the gap.

Second, capacity-building must be treated as the foundation of AI governance, not as a secondary developmental concern. Safe, rights-respecting and accountable AI governance cannot be implemented without trained regulators, judges, parliamentarians, auditors, procurement officials, incident responders, researchers and civil society groups. Nor can it succeed without practical infrastructure: policy observatories, testing tools, audit pipelines, harm-mapping systems, language-specific evaluations and institutionalized routines.

This is especially urgent in Southeast Asia and across the Global Majority. AI systems are often designed in a few Northern jurisdictions (often with weak or absent regulatory safeguards) but deployed globally. When a regulator in our countries cannot evaluate a frontier model, a procurement office cannot assess algorithmic bias or a judge cannot adjudicate an automated decision, the result is not merely a local capacity gap with localized implications (that can be ignored by the privileged in the North). Rather, substantively it becomes a detection, response and remedy problem for everyone.

Capacity is also a matter of sovereignty. Governments that lack domestic expertise cannot negotiate confidently with frontier-model providers from an informed baseline. They may find lawmaking effectively outsourced to foreign consultants or corporate actors.

Third, the Dialogue must recognize Global Majority expertise and lived experience as governance knowledge. Too often, global AI debates are framed by commercial incentives and national-security concerns generated in a narrow set of institutions and geographies. Yes, these perspectives matter, but they are also incomplete. They can overlook harms that are harder to quantify: institutional degradation, weakening of community bonds, cultural and linguistic exclusion, exploitative labor practices, gendered abuse and erosion of public trust and information integrity.

People experiencing AI harms are not merely “stakeholders” to be consulted after policy options have been drafted. Workers whose tasks are being redesigned, women and girls targeted by AI-enabled abuse, children and other vulnerable people exposed to unsafe AI companions, migrants and gig workers, people with disabilities, gender and sexual minorities, low-income users and local-language researchers all hold knowledge that governance systems need in order to work.

Lastly, the Dialogue should create legitimate space to discuss catastrophic and existential risk. These risks should not be treated as speculative concerns reserved for a handful of wealthy governments, frontier labs or Northern research institutions. Compute is scaling rapidly, and evaluations already show AI systems completing increasingly long and complex tasks once requiring focused human expertise. The Dialogue can help ensure these questions are addressed transparently and inclusively so that we can define which capabilities require collective oversight, restraint and coordination.

The Dialogue should therefore change how AI governance knowledge is produced. Risk taxonomies should incorporate harms identified by affected communities and Global Majority researchers. Regional research and language-specific evaluation work should be commissioned and cited alongside work produced by frontier AI developers. Dialogue outputs should be reviewed not only for whether they consulted diverse groups, but for whether those groups’ knowledge actually shaped the conclusions – and improvement recommendations. And the Dialogue must create the space needed to have very serious conversations about catastrophic and existential risks in a way that private interests cannot dominate the narrative. Ultimately, the evolution of AI and frontier technology is a public interest issue and the tools that result should be treated as public goods.

The Dialogue should therefore establish a standing, regular and inclusive mechanism to surface and deliberate on catastrophic and frontier risks. This means a dedicated workstream with regionally balanced membership, a mandate to commission independent technical assessments and a formal process for Global Majority governments and researchers to shape the risk frameworks themselves, rather than inherit them from frontier labs or Northern institutions.

The UN Global Dialogue has a rare opportunity. It can help align AI governance around shared values: human agency, dignity, rights, accountability, environmental sustainability and equitable prosperity. It can advance pro-social AI. But these values will not implement themselves. They require institutions, evidence, resources and mechanisms that allow countries and communities to act.

The test for Geneva is not whether participants can agree that AI should benefit humanity — that bar is too low. It is whether the Dialogue produces the architecture to make that promise credible, and whether the communities with the most at stake helped design it.

The Dialogue's value will not be measured in declarations. It will be measured in what gets built afterward, by whom, and for whom. That is the standard the Global Majority should hold it to.

As more countries restrict social media for children, what is currently missing from the discussion is the hidden children’s rights and human rights cost of mandatory age assurance, the necessary enforcement mechanism.

On June 15, 2026, the United Kingdom became the 

 to announce age restrictions on social media platforms for children under the age of 16 as part of a 

 following the passing of Australia’s law in 2025. Different countries have chosen different ages at which to restrict access, different services for the restrictions to apply to (for example, extending to 

 in some cases as well) and different enforcement models, creating a global regulatory patchwork for platforms to respond to.

Age restriction laws are a blunt tool that can be seen as an expression of frustration by governments who believe that social media platforms are causing children untold harm. Despite strong 

 such as the UK Online Safety Act, the EU Digital Services Act and India’s IT Rules 2021, surveys of parents in 

 show that parents are still concerned about social media and support a ban. The social media sector globally is worth 

Underpinning all of these social media bans across the world are age assurance technologies which are needed to determine who is under the restricted age, and who is old enough to access the platforms. Age assurance is a bucket heading for a multitude of different kinds of technology, all of which vary in terms of accuracy, ease of circumvention and data processing requirements. Age assurance tools are also developed by tech companies, and the age assurance industry is predicted to be worth 

. Looking at the proliferation of recent laws around the world requiring age assurance measures to be put in place, it is not hard to imagine that figure increasing wildly.

All age assurance tools process data (including children’s data) to some degree, and are often underpinned by algorithms, and they all carry risks related to privacy, security, bias, discrimination and exclusion, for both children and the broader public. Under 

the UN Convention on the Rights of the Child

, which is one of the most ratified international human rights laws globally, children’s privacy (Article 16 CRC) can only be interfered with if the reason for doing so is provided by law, is intended to serve a legitimate purpose and is proportionate. Even then, the UN Committee on the Rights of the Child, in its 

General Comments No. 25 on children’s rights in relation to the digital environment

, makes it clear that the principle of data minimization must be respected, and the result must be in the best interests of the child.

Some recently enacted laws, for example in 

, set parameters for age assurance technologies, requiring them to be effective, non-discriminatory and ‘privacy-preserving.’ While it is too early to tell whether laws currently under development in other countries will set similar parameters, it is clear that such parameters are only effective if they are actually enforced by the relevant authorities. Where such parameters are missing, data protection law can serve as a minimum layer of protection. However, this heavily depends on the scope of the data protection law and the financial and human resources of relevant authorities to enforce these laws. Other countries, for example, 

, conflate age assurance with identity verification, stripping users of their anonymity and creating the potential for widespread online activity tracking and surveillance.

Widespread social media bans create a dangerous paradox. Such bans are introduced in part to protect children from surveillance capitalism's mechanics such as profiling, targeted advertising, and recommender systems. However, enforcing these bans requires an additional layer of extensive data collection with minimal safeguards actually implemented by regulators, potentially exposing users to increased government and private sector surveillance.

Age assurance companies increasingly market themselves as 'privacy-preserving,' while positioning themselves alongside child protection advocates. The 

Global Age Assurance Standards Conference

The world's leading experts on privacy-preserving, secure, reliable age assurance measures enabling a safer online experience for children”, 

featuring age assurance companies in a program alongside regulators and child protection specialists. In some countries, such as the 

, governments have produced guidance related to the requirements for age assurance tools to be accurate, fair, privacy-preserving, secure, and in line with data protection legislation. However, it is not clear whether there is any proactive enforcement of these guidelines, except for after the fact, where there is a 

 at an age assurance company. There is an urgent need for robust governance and regulatory oversight over age assurance, but this is not currently happening.

In the absence of proactive regulatory enforcement, 

 are becoming more important for age assurance vendors. Complying with them lets vendors demonstrate due diligence to customers and signal that they are meeting the state of the art in terms of technical requirements.

Technical standards have been part of the digital ecosystem since the internet began, and were originally pioneered by engineers to ensure consistency, conformity and interoperability across networks. In more recent years, many standards have become more like 

, incorporating social requirements related to human rights, equality and inclusion, as well as technical aspects. This presents both a risk and an opportunity: if experts in human rights and children’s rights are part of the drafting process of technical standards, then these rights can be integrated into the architecture of products such as age assurance tools and translated into practice for engineers. However, if such experts are left out of the process, then it is likely that rights-based language such as ‘privacy-preserving’ and ‘fairness’ will be used incorrectly and with the potential to cause harm. This form of ‘rights-washing’ is similar to ‘

,’ labeling a technology ‘privacy-preserving’ borrows the language of human rights to create the impression of compliance, without actually living up to any of the human rights standards.

The UN Office of the High Commissioner for Human Rights points out that historically, human rights considerations have only played 

a minor role in technical standard-setting processes

. Participants generally have engineering, computer science and natural science backgrounds, with an underrepresentation of human rights expertise or other fields, such as social sciences, constitutional law, ethics and risk management. Participants in standard-setting processes overall lack diversity in terms of thematic expertise, cultural, professional, institutional, socioeconomic backgrounds, geographical representation and gender.

Involving the required human rights and children’s rights experts in standards-making processes sounds simple, but in reality, having meaningful input into standards-making processes requires sustained input over a long period of time. First, it is necessary to join your national standards-making body, which sometimes carries a fee of more than $1,000 per year. Then there are meetings to attend, submissions to be made, and the whole process requires time, resources and stamina. All things that tend to be scarce within the human rights and children’s rights sector. Because technical standards are generally led by industry, the imbalance of power in this situation is stark, and as standards take on a 

 role in the tech sector, there is a real risk of regulatory capture.

While the first technical standard on age assurance, 

, was pioneered by the British Standards Institute, followed by the 

 standard in 2024, ISO is now dominating the global technical standards space on this topic, with 

ISO/IEC 27566-1:2025 Age Assurance Systems

 being the most advanced effort to create a global standard for age assurance. This is a three-part set of standards consisting of an overarching framework which has already been published, together with two more detailed standards which cover technical approaches, guidance for implementation and approaches to analysis or comparison. According to 

, there is potential for this standard to detail how age-assurance tools can be developed to ensure they are effective while also respecting broader human rights, and to set clear guidelines for the collection and use of training data in AI-driven age-assurance solutions, helping to reduce bias for child users.

The extent to which the final ISO standard incorporates comprehensive protections for children’s rights and human rights principles more broadly depends largely on who is part of the drafting process. So this is a call to action if you are with a digital rights organization or an individual human rights expert to get involved via your national standards-making body. And if you are a donor wondering where your funds might have a targeted and tangible impact, go fund some of these digital rights groups to get involved with their national standards-making bodies, especially those in the Global South who tend to be underrepresented in the development of ‘global’ standards.

We predict that technical standards are likely to be where the rubber hits the road when it comes to implementing human rights and children rights respecting age assurance tools. That is why this is important right now.

Once global standards on age assurance are finalized, whether by ISO or another standards-making body, the next step will be to ensure that 

 are equipped with the expertise to audit age assurance companies against the human rights and children’s rights requirements written into the standards. It is also important, of course, for experts in human rights and children’s rights to be part of any subsequent certification process to assess whether any specific age assurance tool meets the designated standard.

This does not, however, by any means let regulators off the hook. Technical standards should never be a replacement for robust regulations drafted by governments, along with detailed implementing regulations that incorporate constitutional and human rights laws.

appearing on Tech Policy Press in 2026. More from the series

The European Union has been entertaining the idea of sovereignty for almost two years now; years marked by intensified AI hype. “The tech industry moves fast; bureaucrats move slow”: a punchline that has lodged itself in the minds of public servants and politicians, as if speed determined the quality of their work. Meanwhile, the constant release of new models, astronomical investment announcements and, more recently, promises of trillion-dollar IPOs have reinforced the narrative of AI’s inevitability. The overhasty AI strategy pursued by US giants was misread in Brussels. As 

 has argued previously in this series, AI hype has increasingly permeated European policymaking by framing AI development as an urgent economic and geopolitical necessity, burying discussions like what type of technology should Europe develop, by whom and for what purposes.

The European Commission finally released its proposal to achieve tech sovereignty on June 3. Under the title “

Strengthening Europe’s Tech Sovereignty,

” on paper, the goal for the package is to secure the continent’s “ability to act independently in the digital world by developing and controlling key technologies, data, and infrastructure, while reducing reliance on non-EU providers.” In reality, the package tries—and fails—to kill three birds with the same stone: competitiveness, sustainability and sovereignty. While it may partially succeed in capturing some economic gains, it will do so at the cost of exacerbating Europe’s ecological footprint and further entrenching foreign control of its economy.

Contradictions populate the package. Its preference for open source, the vocation to share resources among member states and the idea to create a “European public sector Cloud Federation” point to the urgent need to decouple from 

. Still, the proposal falls short of addressing the public sector’s dependence and ultimately favors its expansion.

 (CADA) introduces a cloud computing sovereignty framework with four assurance levels. They can be read as degrees of sovereignty to be guaranteed by a cloud provider to be eligible for providing services to public bodies in the EU and its member states. Even the fourth assurance level, the strictest one, leaves space for cloud giants like Microsoft, Amazon and Google if they demonstrate that customer data, employees, infrastructure and control remain inside Europe. By ‘control’, the regulation means that the subsidiary operating in Europe is formally separated from the parent company and subsidiaries from other countries. The open window for Big Tech is the use of “control” instead of ownership. As long as a global corporation establishes subsidiaries that are fully controlled inside Europe, the fact that the subsidiary is at least partly owned by a foreign company does not prevent the European entity from being eligible provided that it complies with all the other location-related clauses. The cloud service provider must also guarantee the continuity of the service independently of any third-country request.

The Commission’s proposal does not prevent cloud providers from granting access to European data to foreign governments, either. Instead, Annex III on auditing criteria only requests evidence of “an up-to-date record of any request to access customer data, to disrupt service continuity or to degrade service quality from a third country or a legal entity established in a third country, containing at least the request and the response to the request.”

The “buy European” preference is thus interpreted as a matter of geography: buying AI and cloud services provided inside Europe regardless of the ultimate owner.

 published April 30, 2025, Microsoft Vice-Chair and President Brad Smith detailed his company’s European digital commitments. They all fit like hand in glove with the European Commission’s proposed package published over a year later.

By 2027, the company committed to have data center operations in 16 European countries, expanding its capacity by 40% in two years and assuring compliance with data localization requirements. By the time of the blog post, Microsoft’s cloud services were already provided to Europe from corporate entities headquartered in Europe. The post announced that these entities would be overseen by a European board of directors with only European nationals.

Government Requests for Customer Data Report

” annually, evidencing—in line with the CADA—that it keeps records of all the requests it receives. And to face potential requests to suspend a cloud service in Europe, 

 claimed to include legally binding commitments in every contract with the public sector in Europe to “promptly and vigorously contest such a measure using all legal avenues available, including by pursuing litigation in court.”

As a contingency plan, Microsoft promised to use its European partners. It will provide legal rights to companies like SAP and Orange to access back-up copies of its services’ code to ensure that they keep running. In any case, Smith insisted that “there is a strong consensus in Washington supporting the sustained flow of digital services from the United States to Europe.” Nothing to be surprised about here. Assuring that US companies continue expanding their businesses in such a significant market while making public administrations structurally dependent on US technology is fully aligned with the 

Smith’s post also emphasized that Microsoft is committed to open source, anticipating the tech sovereignty package’s preference. Smith explained that most of the over 1,800 AI models hosted on Microsoft’s infrastructure are open-source, including those from the European firm Mistral and other models hosted on Hugging Face. The proliferation of AI models is beneficial for cloud giants, among others, because the use of models on their infrastructure—be them open systems or not—is charged with processing fees that their customers pay every time they use a model.

The strong alignment between Microsoft’s digital commitments for Europe and the proposal made by the European Commission a year later casts doubt on the full independence of the latter. There is space to be suspicious. 

 succeeded in keeping confidential data centers’ consumption of electricity and water, thus concealing their environmental damage, in the Commission’s 2024 legislation.

Yet lobbying, just like AI hype, does not operate in a vacuum. Rather, it takes place within a landscape already shaped by technological dependence, procurement commitments and institutional path dependencies. Among EU member states’ procurement agreements, for a forthcoming project we have identified 3,609 contracts or memorandums of understanding signed by an EU member state with either Microsoft, Amazon or Google for a total value of €10.8 billion for the provision of AI or cloud technologies. Over two thirds of these are with Microsoft. In comparison, major Chinese tech firms only signed 144 such agreements. Procurement of AI and cloud has increased sharply since the pandemic, with the biggest growth in 2024 and 2025. At odds with claims to expand sovereignty, EU member states keep procuring frontier technologies from US giants. Far from addressing this dependence, the Commission’s proposal falls into Big Tech’s narrative.

In its 129 pages, the CADA uses the term sovereignty 72 times but only mentions the aim to reduce “reliance on” non-European cloud and AI services four times. The document plays with words to discursively advocate for sovereignty while accepting procurement from Big Tech’s European subsidiaries.

The overt promotion of AI can also be read throughout the document. The European Commission’s “AI first” principle, linked to the Digital Decade Policy Programme 2030, urges organizations to adopt AI, cloud services and big data so that at least 75% of EU enterprises use these technologies. The proposal’s broad promotion of AI for defense, self-driving vehicles and 

The CADA also mandates that every member state designates data center “acceleration zones” and embraces Big Tech’s techno-solutionist narrative by calling for innovations to make data centers more 

. Europe, the document goes, should at least triple its data center capacity by 2030.

Trusting that innovation will compensate for the ecological footprint of data centers and viewing AI as a key driver of economic growth are not neutral positions. They contribute to expanding Big Tech’s business on the continent while making the world increasingly dependent on American technologies. They are the perfect match to a tech sovereignty package that, as explained above, is compatible with increasing government procurement from Big Tech.

As people’s distrust of AI benefits grows and communities organize against data centers, Europe turns a blind eye and falls for the AI hype—a costly move for people and the planet that runs counter to the very motivation of the tech sovereignty package. If the European Commission truly wants Europe to “act independently in the digital world”, it should start by freeing itself from Big Tech’s epistemic capture.

A Meta sign at Meta Headquarters in Menlo Park, California, in January 2025.

Tech Workers Are Fighting Against Silicon Valley’s AI Push

Brazilian President Luiz Inacio Lula da Silva holds a cabinet meeting at Planalto presidential palace in Brasilia, Brazil, Wednesday, June 3, 2026. (AP Photo/Eraldo Peres)

Big Tech's Proxy War Against Brazil's New Platform Accountability Rules

Tech Policy Press - Technology and Democracy

Tech Policy Press is tracking laws and regulations, along with government investigations and litigation, that will shape the rules and accountability for tech companies.

Latest

Podcast

Recent

Our content delivered to your inbox

Thank you!

Around the globe