“If you have higher security standards for the larger models, market access for the smaller ones can become an insurmountable barrier.”

– German Federal Digital Minister Volker Wissing

Story of the week: The EU’s AI law might be entering what is (perhaps) its last act after nearly three years of roller-coaster policymaking. The Spanish presidency said it completed the discussion on the articles, the legal part of the text, before the Christmas break, with the Belgians restarting the finalisation of the recitals as of Monday. However, the bill is not out of the woods yet, and the opponents of the provisional agreement are getting organised. At the initiative of the German Digital Minister Volker Wissing, who made some strong statements to the press against the deal, the EU’s three largest countries aim to reach a common position on foundation models by the end of next week. However, it is still unclear if the intent is to disrupt everything or vent the idea to get concessions in the text. The question is how credible the worst-case scenario is.

Of the three countries, Italy seems the less likely to support such a dramatic decision. Rome joined Berlin and Paris following discussions on industrial cooperation in the context of the G7. Still, Italy does not have an industrial player that would justify such a move. Alessio Butti, the undersecretary for digital, won the internal battle over the file from the Economic Development Minister Adolfo Urso, who made the G7 commitments and is more of a hardliner. At the Telecom Council in December, Butti expressed a more flexible position, but Urso remains an influential figure in the Italian government. Meanwhile, the German government might also not be internally cohesive: while Wissing’s liberals are strong opponents of the foundation model rules, disavowing the agreement might be a reason for great embarrassment for the social democrats. At the same time, the German Greens seem to be split between the pro-business and more progressive areas of the party.

There is little doubt about where France stands on the matter, with President Emmanuel Macron taking the unusual step of commenting on the results of the trilogue. Still, Macron’s statements called for a regular regulation review to monitor its effect, implying the agreement will get through. What seems inevitable is that the trio (or duo, if Italy drops out) will have to recruit at least another country since a blocking minority requires a minimum of four member states. The most natural candidates would be Finland, Hungary and Poland, as they all expressed reservations about the provisional agreement at the COREPER debrief in December, saying they could not support the deal without seeing the text. However, it seems certain that opposing the agreement would require a great deal of political capital, considering the worldwide attention the AI Act has gathered in the past months, and that it would delay a law regulating a fast-moving market to a date to be seen.

Don’t miss: The Commission’s clash with X over the Digital Services Act has finally started as the EU executive opened a formal investigation over several alleged breaches. The move is no surprise to the most attentive observers since X has been dismantling its content moderation and safety structures since Elon Musk took over the company last year. The probe focuses on four areas: whether the platform has a sufficient content moderation capacity and an effective notice-and-action mechanism for illegal content, the effectiveness of Community Notes and other risk mitigation measures in addressing societal risks, especially in non-English languages, the way X provides access to researchers and if the ‘blue tick’ accounts are presented misleadingly to users. As Euractiv anticipated, X provided the easiest target for the Commission to show that the DSA has teeth. The other platforms will follow closely to see if the EU executive means business. Read more.

Also in this issue: 

• The Commission’s voluntary initiative to phase out cookies is entering its crunch time.
• Some French senators have criticised the government’s position on the AI Act and Cedric O’s conflict of interest.
• Vestager came back to resume her role as EU competition chief, and she might take a few pebbles from her shoes in the coming months.
• EU countries reached a general approach to the Cyber Solidarity Act.
• The Commission designated three porn websites as very large online platforms under the Digital Services Act.
• The Platform Workers Directive is stalling in the Council after the trilogue agreement was voted down.
• EU policymakers reached an agreement on the Media Freedom Act.

Before we start: If you just can’t get enough tech analysis, tune in on our weekly podcast.

Today's edition is powered by Google

Pledging principles reactions. On 19 December, the general assembly of the cookie pledge initiative met to discuss the draft pledging principles revealed by Euractiv. While civil society seems relatively optimistic about the wording, the private sector raised significant concerns regarding competition and economic viability. Some stakeholders called for removing the explicit reference to contextual advertising as the main alternative to ‘tracking-based advertising’, whilst publishers aimed to centralise user choices at the web browser level and include information on the business model. Another significant worry is that the lack of legal guidance could result in an organisation complying with the pledge but being in breach of the law. The consumer protection department is supposed to circulate an updated draft of the pledges integrating the EDPB comments in the coming days. Still, Euractiv understands the Commission has received many requests for clarification and modification. A final draft is scheduled for February, but several points still need clarification, such as whether there will be external audits to verify compliance. Following the final draft, the organisations that intend to sign the commitments will have bilateral discussions with the Commission, which aims to present the signatories at the European Consumer Summit on 18 April.

Cookie phase-out gets real. The much-anticipated new feature to turn off third-party cookies in the Google Chrome browser will be rolled out to 1% of the web browser’s users on Thursday. In the testing phase, it will be available to about 30 million people, with a full rollout expected later this year – users will be asked if they want to enable the feature. However, fewer cookies can mean less revenue for businesses which use their data to advertise online, strengthening Google’s gatekeeping position vis-à-vis advertisers. Chrome’s rivals, like Apple’s Safari or Mozilla Firefox, can block third-party cookies.

Some disgruntle in Paris. French senators criticised the government’s stance in the AI Act negotiations on 20 December, particularly a lack of copyright protection and the influence of a lobbyist with alleged conflicts of interests, former digital state secretary Cédric O. The accusations were vehemently denied by the incumbent Digital Minister Jean-Noël Barrot: “It is the High Authority for Transparency in Public Life that ensures the absence of conflicts of interest among former government members.” Read more.

NYT vs OpenAI lawsuit. At the end of last year, The New York Times sued OpenAI and Microsoft for using copyrighted work. The Federal District Court in Manhattan filed the lawsuit, according to which chatbots were trained using Times’ articles. The lawsuit does not name an exact monetary demand. Chatbots using copyrighted material has been an ongoing issue, resulting in several media blocking OpenAI’s web crawler, GPTBot, in the EU, including Euractiv, in September 2023. The litigation is part of a broader trend from traditional media that see Big Tech companies, from social media to search engines, undermining their business model.

AI discovers new molecules for antibiotics. A team from the Broad Institute of MIT and Harvard has identified a new structural class of molecules capable of killing drug-resistant bacteria using artificial intelligence, Nature reported. Twelve million components were analysed through a deep learning approach, allowing them to identify molecules with predicted antibiotic activity and low toxicity for human cells. Eventually, almost 300 compounds have been selected to be empirically tested against Staphylococcus aureus, which happens to resist two common antibiotics. MIT’s Antibiotics-AI aims to find new antibiotics against seven deadly bacteria in seven years.

Vestager is back in town. After a short interruption in its decade-long reign on EU’s competition policy, Margrethe Vestager is back in Brussels after a burning defeat in her bid to secure the top job at the European Investment Bank. In the past months, Vestager has cumulated many grievances, especially towards countries like Belgium and France, which have a Renew government but did not support her move to the EIB. Euractiv understands she might be asking for a third term. Still, the Danish government grew annoyed at her for leaving a big gap for Denmark in the College of Commissioner during her leave of absence, without even mentioning the different political colours. If Vestager is done in Brussels, she has nothing to lose and might remove a few pebbles from her shoes, perhaps starting with the Orange-MasMovil merger. Remarkably, the competition department is one of the few in the Commission that continues working during the electoral period, and the coming months might be the last chance for Vestager to shine internationally with high-profile cases like Google ads, where the possibility of structural remedies was for the first time put seriously on the table.

Adobe-Figma merger off the table. US companies Adobe and Figma decided on 18 December to call off a €18 billion merger they had foreseen for 15 months following concerns from EU, UK and US regulators. Announced on 15 September 2022, Adobe would have acquired Figma, a provider of web-based collaborative tools for product design. The European Commission concluded its investigation of the merger in mid-November by sending Adobe and Figma a statement of objection over the merger. The fact that the merger was called off indicates that the two companies could not develop potential remedies to satisfy the regulators’ concerns. Read more.

No happy new year for Apple. Apple faces a legal reckoning in 2024 due to EU and US regulatory decisions, the Financial Times reported on Monday. According to the article, the most significant decision will most likely come from a US antitrust trial against Google, revealing that Google paid more than $26 billion in 2021 to make its search engine default on Apple devices and browsers.

Cyber Solidarity Act general approach. The Committee of Permanent Representatives (COREPER) reached a common position on the Cyber Solidarity Act on 20 December. The mandate includes several significant changes like the replacement of the Security Operation Centres (SOCs) with Cyber Hubs, the usual flexibility for member states, especially in the area of national security, alignment with NIS2, the voluntary nature of the mechanism, a more substantial role for ENISA. At the same time, the procurement procedures will take place jointly with the European Cybersecurity Competence Centre.

Supporting cybersecurity. The Commission published new calls for Digital Europe Programme proposals on 18 December. The €84 million budget is to support Security Operation Centres with new applications of AI for the implementation of cybersecurity EU legislation, for example, the Cyber Resilience Act. The budget is also for the European transition to post-quantum cryptography. The calls are open to businesses, SMEs, public administrations, and other entities until 16 January 2024.

Orange restored. The French multinational telecommunications corporation Orange’s account in the RIPE Network Coordination Centre has been improperly accessed, affecting the browsing of some of its customers. The service is practically restored, Orange España announced on X on Wednesday.

Google lawsuit settled. At the end of December, Google settled a $5 billion lawsuit which claimed that the tech giant secretly tracked millions of users’ internet use while they thought they were browsing privately. When Google’s Chrome browser is set to “Incognito” mode and other browsers are set to “private” browsing mode, cookies and apps should not be able to track user activity, yet, according to the plaintiffs, this happened. A formal settlement for court approval can be expected by 24 February 2024.

Data sharing & cloud expert group. As the Data Act has become law, lobbying is now concentrated in the expert group on B2B data sharing and cloud computing contracts. The group will organise stakeholder discussions to advise on several standard contractual clauses the Commission will propose under the data law.

Shouldn’t that be free? Noyb filed a complaint on Thursday against the Austrian creditors’ protection association Kreditschutzverband von 1870 or KSV1870, together with the Austrian data protection authority. According to the General Data Protection Regulation, the right to access must be free, yet KSV1870 is “making huge profits from it”, according to Noyb.

Vestager flies to Cali. Vestager is flying to California next week to give a speech at the Tech Antitrust Conference in Palo Alto on Thursday. With the occasion, Vestager is meeting with Tim Cook, CEO of Apple, Google’s CEO Sundar Pichai and General Counsel Kent Walker, Broadcom CEO Hock Tan, NVIDIA’s CEO Jensen Huang, as well as the Chief Technology Officer Mira Murati and Chief Strategy Officer Jason Kwon of Open AI. The focus is on implementing and enforcing the DMA, DSA and AI Act, as well as on economic security, notably in relation to semiconductor supply chains.

Commission remembered porn this time. Three pornography websites will have to abide by strict EU rules after being included on the Digital Services Act’s (DSA) very large online platforms list, the EU Commission announced on 20 December. XVideos, Pornhub, and Stripchat will be included on the DSA list of very large online platforms, joining 19 other platforms. “The designation is the result of Commission investigations concluding that the three services fulfil the threshold of 45 million average monthly users in the EU”, Commission spokesperson Johannes Bahrke told Euractiv. European Commissioner for Internal Market Thierry Breton noted that the Commission “will continue to designate platforms that meet the thresholds and make sure that they comply with their obligations under the DSA”. Read more.

ACM joins the club. The Commission partnered with the Authority for Consumers and Markets (ACM), the Dutch consumer protection authority appointed as the national Digital Services Coordinator. The agreement aims to help the Commission supervise those services listed on the DSA’s Very Large Online Platforms and Search Engines list. Similar agreements have been signed with regulators from France, Ireland and Italy.

PWD’s new impasse. There is significant uncertainty under the sun on what will happen with the Platform Workers Directive after the member states rejected the trilogue’s provisional agreement on 22 December. The Belgian presidency initially floated the idea of holding a new trilogue on 22 January, but that has been quickly dropped. Tension remains between the pro-platform and pro-workers camps, and it is still unclear whether the file will be even discussed at the next Social Affairs Working Party on Monday. The Council will have to develop a revised negotiating mandate before the negotiations can restart.

No more shipments to China. The Dutch manufacturer ASML Holding NV cancelled shipments of three of its machines to China, following US President Joe Biden’s administration’s request several weeks before export bans on chipmaking equipment came into force, Bloomberg reported on Monday. The manufacturer had licences until January to ship its machines.

Ombudsman investigates Europol. EU Ombudsman Emily O’Reilly announced she has opened an investigation into the recruitment of two former Europol officials to the chat monitoring service provider and child protection organisation Thorn, possibly posing risks of conflict of interest. “As a first step, I have decided that it is necessary to inspect certain documents held by Europol related to these post-service activities. I expect to receive these documents by 15 January 2024,” she wrote in a letter addressed to MEP Patrick Breyer. The Pirate MEP welcomes the move: “Since the revelation of Chatcontrol-Gate, we know that chat control is ultimately a product of the lobby of an international surveillance-government-industrial complex,” Breyer stated on his website on Thursday.

Investigatory Powers Act amendment. The UK Parliament’s Investigatory Powers Act 2016 gives limited electronic surveillance powers to British intelligence agencies and police while providing safeguards for exercising such powers. A new amendment to the Act is currently in the report stage in the House of Lords, which is “a Bill to amend the Investigatory Powers Act 2016; to make provision about the information supplied by, or relating to the Judicial Commissioners; and for connected purposes”. However, some are raising privacy concerns about the amendment.

EMFA trilogue agreement. EU policymakers reached a provision agreement on the European Media Freedom Act on 15 December. The thorny issue of the national security exemption was resolved by referencing the EU countries’ national responsibilities as established in the treaties. The legislation is expected to be highly consequential for the media sector, regulating sensitive matters such as public service media, market concentration, state advertising, and the moderation of editorial content online. Read more.

Gigaset’s insolvency proceedings. On Wednesday, the Münster Local Court in North Rhine-Westphalia opened ordinary insolvency proceedings against Gigaset AG, Europe’s market leader for wireless phones, raising questions about how – or whether – the struggling company will be restructured. “We are currently negotiating with potential investors, which are progressing successfully and purposefully. We are confident that we will be able to present a strong new partner in January, with whom we will jointly shape a promising future for Gigaset Communications GmbH,” Raphael Dörr, responsible for Gigaset’s Corporate communication, told Euractiv. Euractiv understands that details of Gigaset’s restructuring are currently speculative, as this depends on the decision of the future investors, who have yet to be identified. Read more.

Missed deadline. UK communications services company BT missed its 31 December deadline for removing telecoms equipment by Huawei, the Financial Times reported on Tuesday. BT missed the deadline following delays in moving its 2G and 3G services while providers are removing them for security reasons. According to the Financial Times, government officials said BT will also have additional time to remove all Huawei equipment because of technical difficulties.

• The Network State: How to Start a New Country (Balaji Srinivasan)
• Your Car Is Tracking You. Abusive Partners May Be, Too. (The New York Times)
• Women in European tech earn 26% less than men, report finds (TNW)

Alina Clasen and Théophane Hartmann contributed to the reporting.

Thanks for reading. Be sure to spread the word and come and say hello on X.