REDefine // Civic Intelligence Podcast

About REDefine // Civic Intelligence Podcast

REDefine Civic Intelligence is a podcast about the systems shaping everyday life — often long before most of us notice them. We look at Europe, democracy, technology, public policy, civic participation and the institutions quietly deciding how societies work, then go beyond the press release to ask what those decisions actually mean for people, organisations and communities. Each episode takes a serious idea and makes it understandable without flattening it. We follow the connections between policy and practice, regulation and behaviour, institutions and ordinary life, with evidence, real examples and the occasional dry observation when bureaucracy earns one. From EU laws and democratic resilience to AI, digital infrastructure, youth participation, sustainability and the future of European cooperation, REDefine Civic Intelligence is for people who want more than headlines — and are curious about what is happening underneath them. associationredefine.substack.com (https://associationredefine.substack.com?utm_medium=podcast)

Publisher

By REDefine — Association for Research, Education and Development

Category

education · technology

Language

en

Explicit

No

First episode

26 Oct 2025

Latest episode

27 Oct 2026

Latest episodes

16 episodes in the feed.

1. 

   27 Oct 2026

   Who Builds the Builders? Why Digital Literacy Is No Longer Enough

   Most of us are great at using digital systems. We log in, upload, approve, search, automate and increasingly ask AI to do parts of the work for us. But knowing how to operate a system is not the same as understanding the system we are operating. This explainer from The Code Beneath the Floorboards looks at system literacy: the ability to see beyond the interface and understand the rules, data, dependencies, decisions and forms of power underneath it. That matters for citizens trying to access services, for educators working inside digital platforms, and for organisations that may depend on systems nobody inside the institution can fully explain anymore. As AI makes technical execution easier, the gap between what we can do and what we can understand may become even wider. The question is no longer whether everyone should learn to code. It is whether enough of us understand the systems shaping our work and public life well enough to question them, change them and remain accountable for what they do. The full REDefine longform goes much deeper into institutional intelligibility, epistemic dependency, decision lineage, knowledge concentration, shadow architecture and the organisational consequences of losing understanding while the technology itself keeps working. This video is part of The Code Beneath the Floorboards, REDefine’s series exploring the invisible digital infrastructure underneath ordinary life, institutions and civic power. Get full access to REDefine // Civic Intelligence at associationredefine.substack.com/subscribe (https://associationredefine.substack.com/subscribe?utm_medium=podcast&utm_campaign=CTA_4)

2. 

   22 Oct 2026

   EU in Practice: The AI Act Is Already Here. Just Not All at Once.

   If you opened a customer-service chat this morning and were told that you were speaking to AI, that notice sits inside a rule that already applies. If an employer buys an AI system to screen job applications today, the full set of AI Act requirements for that kind of high-risk system will not apply until December 2027. If the employer interprets that as permission to build first and think about governance sometime next year, however, the timetable has been badly understood. Both situations belong to the same law, but they sit at very different points in its implementation timetable. The EU AI Act has become harder to explain because it no longer has a useful single answer to the question “when does it apply?” The Regulation entered into force in 2024, some rules began applying in February 2025, obligations for providers of general-purpose AI models followed in August 2025, most of the Act became applicable in August 2026, and the 2026 Digital Omnibus then moved the detailed high-risk regime further into 2027 and 2028. Meanwhile, the Commission has published transparency guidance, enforcement has started, complaint mechanisms are operating, new prohibited practices are approaching their application date, and the first harmonised AI Act standard appeared in the Official Journal last week. A four-colour risk pyramid can still tell us something about the architecture of the law. It can’t tell a citizen what should happen when an AI system is used around them today, whether a company developing a system in 2026 can safely ignore requirements that apply in 2027, or why a European standard with the deeply unromantic name EN 18286:2026 suddenly matters. So we are going to leave the pyramid alone for a while. The more useful questions in October 2026 are what the Act already requires, what remains in transition, what people should notice when AI is used around them, and what organisations should be building now even when the legal deadline is still more than a year away. First, “provider”, “deployer” and “user” are not interchangeable Before looking at the dates, one piece of terminology is worth clearing up because it causes a surprising amount of confusion. Under the AI Act, a provider is broadly the organisation or person that develops an AI system or has it developed and places it on the market or puts it into service under its own name or trademark. A deployer is an organisation or person using an AI system under its authority. Personal, non-professional use is excluded from the deployer definition. That means an employee casually using an AI assistant, a company integrating an AI tool into recruitment, and the company that developed that tool do not automatically occupy the same legal position. Nor does a citizen asking a chatbot a question become a “deployer” simply by pressing Enter. The distinction matters because the Act distributes responsibility across the AI value chain. Providers may have obligations concerning how systems are designed, documented, tested and supplied. Deployers can have their own responsibilities concerning how systems are used, monitored and overseen in practice. In other words, buying an AI system does not magically transfer every governance question back to the vendor. Anyone who has ever bought enterprise software may recognise the general principle. The timetable now has several different clocks running The first substantial AI Act rules began applying on 2 February 2025. That included the original prohibited AI practices and the AI-literacy provision. Article 4 has since been amended by the 2026 Digital Omnibus, but it still requires providers and deployers to take measures supporting the development of AI literacy among staff and others operating AI systems on their behalf. What changed is that organisations are no longer required to guarantee some undefined “sufficient” level of literacy for every individual. The obligation is contextual: technical knowledge, experience, training, the way the system is being used and the people affected by that use all matter. That distinction is worth making because two equally unhelpful interpretations have circulated around AI literacy. One turns it into a universal certification exercise in which everyone needs the same course. The other assumes that the Omnibus quietly removed the obligation. It did neither. From 2 August 2025, obligations for providers of general-purpose AI models also began applying. Providers of those models have duties concerning technical documentation, information for downstream system providers, compliance with EU copyright rules and publication of information about training content. Providers of the most advanced models presenting systemic risk face additional risk-management, incident-reporting and cybersecurity requirements. Models already on the market before August 2025 have a longer transition period, until August 2027. For an ordinary organisation using a general-purpose model, that doesn’t mean it suddenly becomes the provider of the underlying model. It does mean that the AI Act is already regulating parts of the infrastructure on which many familiar AI products depend. The statement that “the AI Act doesn’t really start until 2027” is therefore simply wrong. Then came 2 August 2026, when the general application date arrived. Enforcement powers became operational for provisions already applicable, and Article 50’s transparency obligations began affecting the AI systems and synthetic content people are much more likely to encounter directly. The next important date is 2 December 2026, when the new prohibition introduced by the Digital Omnibus on AI systems generating non-consensual sexually explicit or intimate material and child sexual abuse material begins applying. The same date is also the end of the limited transitional period for the Article 50 machine-readable marking requirement for generative AI systems that were already placed on the market before August 2026. Then we reach the dates that have generated most of the confusion: 2 December 2027 for many Annex III high-risk AI systems, including systems in areas such as employment, education, essential services, migration and certain biometric uses, and 2 August 2028 for high-risk AI embedded in products covered by the legislation listed in Annex I. Those are not dates on which the rest of the AI Act suddenly becomes real. They are application dates for specific parts of the high-risk regime. That difference matters enormously. What should a citizen actually notice today? The most visible part of the Act in ordinary life is now transparency. Article 50 requires providers of certain interactive AI systems to make people aware that they are interacting with AI, unless that is already obvious from the circumstances. Providers of systems generating or manipulating synthetic content also have obligations to make those outputs detectable through machine-readable marking. Deployers have separate disclosure obligations for uses including emotion recognition, biometric categorisation, deepfakes and certain AI-generated or manipulated texts dealing with matters of public interest. These are related duties, but they are not the same thing. The visible notice telling you that the customer-service agent is artificial is there for a different reason from the machine-readable information embedded in synthetic content. One is about making the nature of an interaction clear to a person. The other helps technical systems identify content as AI-generated or manipulated. Deepfakes bring another layer. Where AI has generated or manipulated image, audio or video content in a way that could falsely appear authentic, the deployer may need to disclose that artificial origin. Artistic, fictional, satirical and similar works are treated more flexibly because transparency has to be provided without destroying the work itself. European law has, thankfully, not yet decided that every science-fiction film requires a warning across the actor’s forehead. The rules on text concerning matters of public interest are especially interesting because they make a distinction that much of the public argument about AI writing doesn’t. The disclosure obligation targets AI-generated or manipulated text published to inform the public on matters of public interest where there has not been meaningful human review or editorial control. Where a human has genuinely reviewed the text and an identifiable person or organisation assumes editorial responsibility, the disclosure requirement can fall away. That doesn’t give professional writers, researchers or organisations permission to wave vaguely at “human oversight” after asking a model to write something and publishing it unread. The Commission’s guidance distinguishes substantive human review from merely formal intervention. What matters is whether someone with appropriate judgement actually examined the work and had the ability to change, reject or take responsibility for it. For us at REDefine, this is one of the more sensible distinctions in the current implementation. The important line in AI-assisted professional work is not whether a machine touched the draft. It is whether professional judgement survived the process. A researcher can use AI and remain responsible for evidence. An editor can use it and remain responsible for publication. A project team can use it and remain responsible for the architecture, claims and decisions in a proposal. The dangerous version is not “AI was involved”. It is “nobody competent checked what happened next”. Transparency tells you something important. It doesn’t certify the system This is also where expectations need to remain realistic. A notice saying that you are interacting with AI tells you something about the nature of the interaction. It doesn’t tell you that the system is accurate. A deepfake label tells you something about provenance. It doesn’t tell you whether the underlying claim is true. A machine-readable mark can help identify synthetic content, but it cannot decide what that content means or whether somebody is using it dishonestly. A genuine photograph can be presented with a false description. A synthetic image can be used honestly as an illustration. Provenance matters because it gives us information with which to make a judgement. It doesn’t perform the judgement for us. The same is true of AI disclosures in services. Knowing that an automated system is involved can help a person understand what they are dealing with, but the label is not an EU seal of intelligence, fairness or competence. It is possible to build a completely transparent bad system. Some uses of AI are already prohibited The high-risk timetable has also created the impression that Europe has postponed the serious part of AI regulation. It has not. Several categories of AI use have been prohibited since February 2025. The bans include certain manipulative or exploitative systems, social scoring, some forms of individual criminal-risk prediction based solely on profiling, untargeted scraping of facial images to build recognition databases, emotion recognition in workplaces and educational institutions except in limited medical or safety contexts, certain biometric categorisation involving sensitive characteristics, and most real-time remote biometric identification by law-enforcement authorities in public spaces, subject to tightly defined exceptions. These are bans, not simply “high-risk” classifications. That distinction often gets lost because risk pyramids visually put everything on one ladder. A high-risk system can be lawful if the relevant requirements are satisfied. A prohibited practice sits beyond that point. The question is no longer how to comply with the high-risk regime; the particular use is not permitted except where the Regulation itself provides an exception. The Digital Omnibus added another prohibition that becomes applicable on 2 December 2026, covering AI systems used to create non-consensual sexually explicit or intimate content and child sexual abuse material, including nudification systems. For citizens, those dates matter much more than a generic statement that the Act is “being phased in”. The later high-risk dates don’t create a legal vacuum Now we reach the part that is easiest to explain badly. Many systems with potentially serious consequences for individual people sit in Annex III: AI used in recruitment and worker management, education, access to essential private or public services, migration and asylum, certain biometric uses, law enforcement and other sensitive areas. The detailed requirements governing those systems have now been postponed until 2 December 2027. That does not mean a company can use AI however it likes in those fields until December next year. GDPR still applies where personal data are processed. Employment and labour law still applies in workplaces. Equality and non-discrimination law still applies when people are treated differently. Consumer protection, product regulation, sector-specific rules and national law continue to operate where relevant. The AI Act adds AI-specific requirements to an existing legal environment; it doesn’t replace everything that came before it. Imagine an employer using AI to rank candidates in 2026. The full Annex III high-risk obligations may not yet apply to that system under the revised AI Act timetable. That doesn’t give the employer a twelve-month holiday from data protection, employment rules or discrimination law. Nor would calling the software “decision support” make those questions disappear if the system materially influences what happens to applicants. For citizens, that means it would be wrong to describe December 2027 as the date on which “protection begins”. What begins then is a particular set of AI Act requirements for Annex III high-risk systems. That is a much narrower statement. Nor does December 2027 suddenly reach backwards and rebuild every older AI system The other common mistake goes in the opposite direction. The high-risk regime is not simply retroactive in the sense that every system developed or deployed before December 2027 automatically becomes subject to every new requirement the morning the deadline arrives. The amended Article 111 contains a grandfathering rule. For high-risk systems already placed on the market or put into service before the relevant high-risk provisions begin to apply, the Regulation generally reaches those systems after that date where they undergo significant changes in their design. High-risk systems intended for use by public authorities have a separate requirement to be brought into compliance by 2 August 2030. The 2026 Omnibus also clarified that the grace period can attach to a type and model of system already lawfully placed on the market. Further units of the same type and model can remain within that grace period where the design stays unchanged. That is why calling the regime “retroactive” would be too crude. It is also why telling companies that they need not think about 2027 until 2027 would be terrible advice. The deadline is later. The design decisions are happening now. Consider a company developing an AI recruitment system this autumn. If that system is first placed on the market or put into service after December 2027, the Annex III requirements will already be waiting for it. If an older system later undergoes significant design changes, the transitional protection may no longer apply in the same way. If the product is expected to operate for years, decisions being made in 2026 about data, logging, interfaces, monitoring and organisational responsibility can determine how painful compliance becomes later. The high-risk requirements involve much more than writing a compliance policy. They cover risk management, data and data governance, technical documentation, logging, information provided to deployers, human oversight, accuracy, robustness, cybersecurity and quality management. Some of those obligations are impossible to reconstruct elegantly after the fact. If an organisation needs logs, the system has to produce useful logs. If human oversight is supposed to mean something, the human needs access to the right information and enough authority to intervene. If a system has to be tested against defined risks, someone must know which version was tested, under what conditions, with which data and against which thresholds. If changes to the system need to be controlled, versioning and change management cannot consist of discovering six months later that somebody updated the model and nobody wrote it down. This is why the delay should be understood as implementation time, not free time. The Commission itself explains that the 2027 and 2028 extensions were introduced partly because standards, guidance and other support instruments were not going to be available early enough for organisations to implement the high-risk regime properly. That is a very different story from “Brussels postponed the AI Act”. Some rights tied to high-risk systems also deserve more careful explanation When the Annex III regime is fully operating, the AI Act does not only tell providers what to document. It also puts obligations on organisations deploying those systems. Deployers of high-risk systems must assign human oversight to people with the necessary competence, training, authority and support. Employers using high-risk AI at work must inform affected workers and workers’ representatives before putting it into service. Where a high-risk AI system is used to make or assist decisions about natural persons, affected people must be informed. Public authorities and certain providers of public services must perform fundamental-rights impact assessments before specified high-risk systems are first used. The Act also contains a right to explanation for certain individual decisions based on Annex III high-risk AI systems where those decisions produce legal effects or similarly significant adverse effects on health, safety or fundamental rights. The explanation is supposed to cover the role of the AI system in the decision-making process and the main elements of the decision. There is, however, a timing wrinkle here that deserves to be stated rather than smoothed away. Article 86, which contains that right, sits outside the sections of Chapter III whose application was explicitly postponed. But the right itself depends on a system being an Annex III high-risk system, while the application of the provisions that classify and regulate those systems has been postponed until December 2027. The consolidated legislation therefore creates an awkward interaction between the general application date and the delayed high-risk framework. The legal text is clear about the right and clear about the postponed Chapter III dates; the practical relationship between the two before December 2027 is much less clean. That is not a reason to ignore the provision. It is a reason not to tell citizens, with false confidence, either that the right is unquestionably fully operational in every Annex III case today or that it simply does not exist until 2027. Sometimes the accurate answer really is: the law has created an interpretative problem that still needs clarification. A demystifier should be allowed to say that. AI literacy is already an organisational obligation Another rule that deserves more attention than it usually receives is AI literacy. Since February 2025, providers and deployers have had an obligation around the knowledge of people operating and using AI systems on their behalf. The Digital Omnibus softened the wording in 2026: organisations now have to take measures to support the development of AI literacy rather than guarantee a particular level in every individual. The Commission and Member States are expected to provide practical examples and guidance. That still leaves organisations with a real question. What should a person know before using AI in a particular context? The answer is not the same for someone using a writing assistant to reformat meeting notes, a recruiter relying on an AI ranking tool, a doctor working with a clinical system, or an administrator using AI around vulnerable young people. The relevant knowledge depends on the system, the task, the consequences and the people affected. AI literacy therefore should not be confused with knowing how to write clever prompts. Someone can be very good at getting a model to produce the output they want and still be very bad at recognising when that output is wrong, inappropriate, legally problematic or unsupported by evidence. In many workplaces, that distinction is becoming considerably more important than prompting skill. General-purpose AI is already inside the regulatory picture too The AI Act also reaches a layer that citizens rarely see directly: the general-purpose models underneath many AI products. Since August 2025, providers of general-purpose AI models placed on the EU market have had requirements concerning technical documentation, information for downstream providers, copyright compliance and publication of summaries concerning training content. Providers of general-purpose models with systemic risk have additional obligations concerning risk assessment, mitigation, incident reporting and cybersecurity. Older models receive transition time until August 2027, but new models entering the market after the relevant date don’t. This matters because the AI product a person interacts with may be built by one organisation on top of a model provided by another. The Act increasingly treats that chain as a chain rather than pretending the final interface is the whole system. That is important for accountability. An organisation integrating somebody else’s model does not necessarily control how that model was trained. The model provider does not necessarily control how a downstream organisation deploys it. Good regulation therefore has to decide which obligations belong at which layer. Anyone hoping for one actor to carry all responsibility is going to be disappointed. Complaints are no longer a hypothetical part of the Act The enforcement architecture has also become more concrete since August. Article 85 gives natural and legal persons the right to complain to the relevant market-surveillance authority where they have grounds to believe the AI Act has been infringed. The Commission has also launched an AI Act Complaints Tool for cases within the AI Office’s own supervisory competence. If the matter belongs elsewhere, the AI Office can, where appropriate and with the complainant’s consent, refer it to the relevant national authority. The important word there is relevant. The EU has not created one magical inbox into which every AI-related problem can be dropped. A complaint may belong with a national AI market-surveillance authority, a data-protection authority, an employment regulator, a consumer-protection body or another competent authority depending on what actually happened. That can be frustrating for citizens, but it reflects the underlying reality. AI does not create one kind of harm. If an AI system unlawfully processes personal data, that remains a data-protection problem as well as potentially an AI-governance problem. If an employer discriminates through an automated recruitment system, the existence of AI does not erase employment and equality law. If a company misleads consumers using synthetic content, consumer-protection rules do not politely step aside because Article 50 also exists. The technology may be new. The legal relationships around it often aren’t. And then, on 14 October, the first harmonised AI Act standard arrived This week brought a development that will be almost invisible to most citizens but extremely important for organisations preparing for the high-risk regime. On 14 October 2026, the European Commission published the reference to EN 18286:2026, Artificial Intelligence — Quality management system for EU AI Act regulatory purposes, in the Official Journal. It is the first harmonised standard cited in support of the AI Act. The word harmonised matters here. European standards can exist without carrying this particular legal effect. A harmonised standard is developed in response to an EU standardisation request and, after assessment by the Commission, its reference can be published in the Official Journal. Under Article 40 of the AI Act, complying with a cited harmonised standard can create a presumption of conformity with the legal requirements that the standard actually covers. That doesn’t mean EN 18286 is an “AI Act compliance certificate”. It covers quality management. The AI Act contains many other requirements. Standards are also voluntary: an organisation can use another method to demonstrate compliance, but it then has to show that its alternative approach satisfies the relevant legal obligations without relying on the standard’s presumption of conformity. The distinction matters because “we follow an AI standard” can sound far more comprehensive than it actually is. A quality-management standard can tell us a great deal about how responsibilities, processes, documentation and controls should be organised. It does not magically answer every question about data quality, human oversight, bias, robustness, cybersecurity or whether a particular AI use was a sensible idea in the first place. Compliance remains annoyingly resistant to magic. The rest of the technical rulebook is still being built Other standards intended to support the AI Act remain in development. One of the most interesting is prEN 18229-3, the draft human-oversight standard. It deals with the terminology, requirements and guidance needed to make human oversight operational rather than decorative. The draft has been moving through public enquiry during 2026 and remains in the standardisation process; it hasn’t been cited in the Official Journal and therefore doesn’t currently create a presumption of conformity under the AI Act. Another is prEN 18283, dealing with concepts, measures and requirements for managing bias in AI systems. It entered public-enquiry stage in October 2026 and likewise has no Official Journal citation yet. Those two subjects are revealing. “Human oversight” sounds reassuring until somebody has to decide what the human can actually see, how quickly they must react, whether they understand the system well enough to challenge it, and whether they have the authority to stop what it is doing. “Manage bias” sounds equally reasonable until an organisation has to decide which groups it is testing for, what data it is using, how it measures disparate outcomes, which differences are justified, and what happens when improving one metric creates a problem somewhere else. Legislation can state the principle in a sentence. Implementation has to survive contact with the organisation. That is why the standardisation work matters far beyond the people who enjoy reading CEN documents voluntarily. So what does the AI Act mean for someone living in Europe today? It means you should increasingly be told when certain interactions are with AI and when certain synthetic or manipulated content is being presented to you. It means some AI practices are already prohibited. It means providers of general-purpose models already carry obligations that did not exist two years ago. It means complaints can now enter an enforcement system rather than remaining only hypothetical rights written into future legislation. It also means you should be sceptical of anyone reducing your current legal position to “the high-risk rules don’t start until 2027”. Some AI Act obligations start later. Other AI Act obligations already apply. And other areas of European and national law may protect you regardless of the AI Act timetable. The dates matter, but so does knowing which rule the date belongs to. And what does it mean for an organisation in 2026? It means the next year shouldn’t be treated as a waiting room. Some obligations — transparency, prohibited practices, general-purpose-model rules where relevant, AI literacy and other parts of the Act — are already part of the regulatory environment. Other obligations are approaching. Transitional provisions may protect some older systems, but they are not a substitute for understanding what an organisation owns, uses and plans to change. An organisation building or buying AI today needs to know which systems it has, who provides them, what they are used for, which people are affected, what data they rely on, who has authority over them and what happens when the output is wrong. Not because every system is high-risk. Most are not. But you can’t decide that intelligently without knowing what is actually running inside the organisation. And if a system will fall under the high-risk regime later, much of the evidence needed for compliance will have to come from choices being made now: design records, testing, logs, data governance, oversight arrangements, version control, incident processes and clearly assigned responsibility. The deadline is when the obligation becomes enforceable. It is not necessarily when the work should begin. Below the surface: what companies now have to build That is where the professional part of this EU in Practice starts. We are going inside EN 18286, rather than simply mentioning that a standard has appeared. We will look at what a quality-management system under the AI Act actually means, which requirements the new harmonised standard can support, what presumption of conformity does and does not buy a provider, and why using one standard cannot make an entire AI system “compliant”. We will also look at the draft work on human oversight and bias management, because both reveal how much complexity hides behind familiar governance language. We will connect those standards to the practical work organisations should already be doing in 2026: mapping AI systems, deciding who owns them, preserving evidence from development, establishing change control, defining meaningful oversight and working out which systems may cross into the high-risk regime as the implementation dates approach. The interesting part of the AI Act is no longer only what Brussels wrote into the Regulation. It is what somebody now has to make work on Monday morning. The deadline is later. The evidence starts now. A company trying to prepare for the EU AI Act can waste quite a lot of time by beginning with the question that appears on most compliance slides: “Is this system high-risk?” It is an important question. It is simply not the first one. Before classification, an organisation needs to know what AI it is actually using, what each system is supposed to do, who supplied it, who can change it, which people are affected by it, whether another legal regime already applies, and what role the organisation occupies under the AI Act. It also needs to check that the intended use is not prohibited before spending three meetings debating whether it belongs in Annex III. The Commission’s own classification guidance follows much the same logic. Before determining whether a system is high-risk, organisations need to establish whether they are dealing with an AI system within the Act at all and identify its intended purpose. Only then do the Annex I and Annex III routes, and the Article 6 filters, make sense. This is why AI governance built around a spreadsheet headed simply HIGH / MEDIUM / LOW tends to age badly. The classification is an outcome of understanding the system, not a substitute for understanding it. Start with the systems, not the Regulation A useful AI inventory needs more than the product name. “Microsoft Copilot”, “ChatGPT”, “recruitment AI” or “fraud detection” isn’t enough information to make a serious regulatory assessment. The organisation needs the system or feature being used, its provider, version where relevant, intended purpose, actual use, affected groups, data involved, integration points, business owner and the person or function able to approve changes. That last distinction between intended use and actual use deserves attention. A tool bought to summarise applications may gradually begin ranking applicants. A general assistant introduced for drafting may become part of a workflow that produces assessments about identifiable people. An AI feature may arrive inside an ordinary software upgrade without anyone formally deciding to acquire an “AI system” at all. Those quiet expansions are precisely why inventories should be reviewed rather than completed once and ceremonially stored. The systems most likely to be absent from the inventory aren’t necessarily the expensive AI programmes everyone remembers buying. They are often the AI functions that appeared inside software the organisation already had. Then establish your role, because “we use AI” tells you almost nothing legally The AI Act distinguishes between actors in the value chain for a reason. A provider broadly develops an AI system, or has it developed, and places it on the market or puts it into service under its name or trademark. A deployer uses an AI system under its authority in a professional context. Providers and deployers have different obligations, and Article 17’s quality-management-system requirement is specifically a provider obligation for high-risk AI systems. A company therefore doesn’t acquire the whole provider compliance package merely because it licenses an AI product. But the label “customer” isn’t a permanent legal shield either. Under Article 25, an importer, distributor, deployer or other third party can become the provider of a high-risk AI system where, among other things, it puts its own name or trademark on it, makes a substantial modification while the system remains high-risk, or changes the intended purpose of a system in a way that makes it high-risk. The allocation of responsibility can therefore change during the life of the product. This is particularly relevant to companies that say they “only use third-party AI” while substantially integrating, adapting or repurposing it. The practical question isn’t whether your engineers trained the foundation model. It is what you have done to the resulting system and under whose responsibility it reaches the people affected by it. Do the prohibition check before celebrating a clever classification The prohibition check should sit early in governance because a system that falls under Article 5 presents a very different problem from one that is merely high-risk. If a contemplated use is prohibited, developing an elaborate Annex III classification analysis doesn’t rescue it. Likewise, organisations need to identify rules already applicable today, including the current transparency obligations and any other legal regimes relevant to the use, rather than treating the December 2027 high-risk date as the beginning of regulation. The Commission confirms that prohibited practices, GPAI obligations and Article 50 transparency rules are already enforceable, while Annex III high-risk rules start on 2 December 2027. This matters operationally because projects often begin with product architecture and involve compliance once the design has already hardened. That order becomes expensive when the governance question changes the permissible design. High-risk classification is more specific than “we use AI in HR” Annex III doesn’t declare every AI system used in education, employment, banking or public administration high-risk. It identifies particular use cases within those fields. In employment, for example, systems intended to recruit or select people, filter applications, evaluate candidates, make decisions affecting work relationships, allocate tasks based on individual behaviour or traits, or monitor and evaluate workers are among the listed uses. In education, the list includes certain systems affecting admission, learning assessment, educational level and exam monitoring. Even then, Article 6 contains a further filter. An Annex III system may fall outside high-risk classification where it doesn’t pose a significant risk to health, safety or fundamental rights, including because it doesn’t materially influence decision-making, and where one of the listed narrow conditions applies. Profiling of natural persons remains high-risk. A provider relying on this exception must document the assessment before placing the system on the market or putting it into service, and Article 49 requires registration of that decision in the EU database. That documentation point is easy to miss. “We decided it was not high-risk” is itself a regulatory conclusion that may need evidence. For a professional reader, I would therefore treat classification as a written decision record: system, intended purpose, relevant Annex III category, Article 6 analysis, factual basis, responsible reviewer, date, and triggers for reassessment. If the intended purpose changes, the classification needs another look. EN 18286: what actually happened on 14 October Last week brought the most concrete standardisation development under the AI Act so far. CEN and CENELEC published EN 18286:2026 — Artificial intelligence — Quality management system for EU AI Act regulatory purposes earlier this year. On 14 October 2026, Commission Implementing Decision (EU) 2026/2274 published its reference in the Official Journal, making it the first harmonised standard cited in support of the AI Act. The Commission’s harmonised-standards register currently lists that decision as the first AI Act publication of this kind. That second event matters more legally than the first. A European standard can exist without an Official Journal citation. Once a reference is cited as a harmonised standard, conformity with the relevant parts can support a presumption of conformity with the corresponding legal requirements covered by the standard. CEN-CENELEC now explicitly describes EN 18286 as giving high-risk providers a route to demonstrating conformity with the corresponding AI Act quality-management requirements. The important words remain corresponding requirements. EN 18286 is not a general certificate saying that an AI system complies with the whole AI Act. A professional compliance claim should be mapped to the actual provisions covered by the final standard, using its Annex ZA, rather than inferred from the title. This is also why an organisation should work from EN 18286:2026 itself, not an old prEN enquiry draft downloaded months ago. The draft helped people understand where the work was heading; the final European standard is the document that has now been cited. That distinction sounds painfully technical until somebody puts “compliant with EN 18286” into a contract. Then it becomes very practical. What Article 17 actually requires Article 17 requires providers of high-risk AI systems to operate a documented quality-management system. The minimum scope includes regulatory strategy, control of modifications, design and design verification, development and quality assurance, testing and validation, technical specifications, data management, risk management, post-market monitoring, serious-incident reporting, communication with authorities and customers, record-keeping, resource management and an accountability framework defining management and staff responsibilities. That is not a quality policy. It is an operating system for compliance. If an organisation says it has an AI QMS, I would want to know how a change to the model enters change control; which tests have to be repeated; who decides whether the change affects conformity; where results are stored; how a known limitation reaches the deployer; who receives an incident report; which person has authority to stop release; and how management knows whether the system is still operating inside the assumptions under which it was approved. EN 18286 matters because it converts that collection of obligations into an auditable management structure. CEN-CENELEC describes it as covering governance, lifecycle control, documentation and consistency in the way AI systems are developed and maintained. That should change how companies think about the coming high-risk regime. The compliance object is not only the model. It is the combination of the system and the organisational processes that allow somebody to know what happened to it. Existing management systems can carry some of the load Not every company needs to build a separate AI bureaucracy from zero. Article 17 expressly allows providers already subject to quality-management requirements under sectoral Union law to incorporate the AI Act elements into those systems. Financial institutions receive an even more specific treatment: existing internal-governance rules can satisfy part of the QMS obligation, although the AI-specific risk-management, post-market-monitoring and serious-incident elements remain. For companies already operating mature quality, information-security, medical-device or financial-governance systems, that is good news. The right question is not “Do we need another management system?” It is “Which existing processes can genuinely satisfy the AI obligation, which need modification, and which AI-specific processes do not exist yet?” Reusing a real control is efficient. Renaming an existing policy and hoping the headings look close enough is not. Small organisations get proportionality, not exemption The Digital Omnibus amended Article 17 to make proportionality clearer for SMEs, start-ups and small mid-cap companies. The way the QMS is implemented should be proportionate to the size of the provider, while maintaining the necessary level of rigour and protection. That is important because a 15-person specialist provider shouldn’t need to imitate the committee structure of a multinational in order to govern one high-risk product. But proportionality doesn’t mean that the evidence disappears. A small company may have one person covering several responsibilities rather than five committees. It still needs to know who holds those responsibilities, how conflicts are handled, what must be documented and who can stop a release. The AI Act permits smaller machinery. It doesn’t permit no machinery. The other standards are not all at the same stage EN 18286 is now cited. The rest of the standards landscape is still moving, and professional readers need to distinguish between draft, published European standard, and harmonised standard cited in the Official Journal. The human-oversight draft, prEN 18229-3, remains under standardisation after its 2026 enquiry stage. Its scope is to develop terminology, requirements and guidance for human oversight. It is not currently cited in the Official Journal and therefore does not carry the same legal effect as EN 18286. The bias-management standard, prEN 18283, entered public enquiry in October. It addresses concepts, measures and requirements for managing bias in AI systems, and again it is still a draft with no Official Journal citation. Other work is further along. prEN 18228 on AI risk management and prEN 18282 on cybersecurity are in approval-stage work according to the public standardisation trackers, while prEN ISO/IEC 24970 on AI system logging is also progressing through approval. None currently appears alongside EN 18286 in the Commission’s Official Journal list. For compliance teams, the distinction is straightforward. A draft standard can tell you where technical consensus appears to be heading and can help with preparation. It should not be described internally or to clients as though it already gives a legal presumption of conformity. That small vocabulary discipline will prevent a surprising number of bad procurement slides. Human oversight is already specific enough to design Companies don’t need to wait for prEN 18229-3 before thinking seriously about human oversight because Article 14 already gives a considerable amount of direction. A high-risk system must allow effective human oversight. The people carrying it out must, where appropriate, be able to understand the system’s capabilities and limitations, monitor it for anomalies and unexpected performance, recognise the risk of automation bias, interpret outputs, decide not to use an output, override or reverse it and intervene in or stop the system. Article 26 then moves from system design to organisational reality: deployers must assign oversight to people with the necessary competence, training, authority and support. All four words matter. A competent employee who has no authority to overturn the system is not meaningful oversight. An authorised manager who does not understand the system is not meaningful oversight either. A trained reviewer handling a volume of cases that makes review impossible may exist beautifully on an organisational chart while contributing almost nothing to actual decision quality. That suggests a much better oversight test than asking whether “a human is in the loop”. Take one consequential AI output and follow it through the real workflow. What does the reviewer see? What information is withheld? How much time do they have? Can they disagree? Does disagreement need approval? Is an override logged? Does repeated disagreement trigger investigation? What happens to the employee who regularly challenges the model? If an organisation cannot answer those questions, the problem is not waiting for the standard. The oversight design is simply unfinished. Bias management cannot be delegated to one fairness score The developing bias standard matters for a similar reason. Article 10 already requires data-governance practices for high-risk systems involving training, validation and testing data. That includes attention to data origin, preparation, assumptions, availability and suitability, possible biases affecting health, safety or fundamental rights, and measures to detect, prevent and mitigate those biases. The relevance and representativeness of data must be considered in relation to the system’s intended purpose and, where appropriate, its geographical, behavioural or functional context. A company therefore needs a more serious answer than “our model passed the fairness test”. Which fairness test? For which population? Against which outcome? What error was considered important? Which groups were examined? Was the system tested in the environment where it will actually operate? A candidate-screening model can perform acceptably across an aggregate European dataset and behave very differently in a particular national labour market. A language system may look excellent in English and fail on local administrative terminology. A model can improve one statistical fairness measure while making another worse. Bias management is therefore partly technical and partly organisational. Somebody has to decide what differences matter, what evidence is sufficient and what consequence requires intervention. No metric can make those normative choices disappear. Procurement is going to become part of AI governance Article 25 now deserves a place in procurement meetings. Where a high-risk AI provider depends on a third party supplying an AI system, model, tool, service, component or process, the Act requires a written agreement specifying the information, capabilities, technical access and other assistance needed for the provider to comply. There is an exception for certain publicly available free and open-source components, other than general-purpose AI models. That has consequences long before a system reaches conformity assessment. A provider relying on another company’s model may need documentation about limitations and changes. A company buying a high-risk system may need reliable logs, performance information, notification of updates, incident escalation, support for regulatory requests and enough technical information to carry out its own deployer duties. Procurement therefore needs to ask questions that ordinary SaaS contracting was not designed to answer. Can the supplier change the underlying model without notice? What happens to performance evidence after that change? Which logs are available to the customer? How quickly are serious incidents communicated? What testing information is available for the population in which the product will be used? Which subcontractors or model providers sit underneath the service? If the supplier terminates the product, what records remain accessible? A vendor promising that its software is “AI Act ready” is not an answer to any of those questions. It is a sentence for the marketing page. Conformity assessment doesn’t always mean an external auditor Another simplification worth removing is the idea that every high-risk AI system will need third-party certification. For most Annex III systems in points 2 to 8, Article 43 provides for a conformity-assessment procedure based on internal control, without a notified body. Certain biometric systems under Annex III point 1 have different routes, and regulated products under Annex I follow the relevant sectoral conformity-assessment framework with the AI requirements integrated into it. This makes internal evidence more important, not less. If the company itself is responsible for demonstrating conformity through internal control, the quality of its technical documentation, testing evidence, risk file, change history and management controls becomes central to the credibility of the assessment. “Self-assessment” should not be translated as “self-declaration without evidence”. It means the provider carries the responsibility for establishing and documenting the case. Change control is where the transitional rules become operational The transitional provisions make version control unusually important. Under the amended Article 111, most high-risk systems placed on the market or put into service before the relevant Chapter III application date generally come within the later requirements if they subsequently undergo significant changes in design. Public-authority high-risk systems have a separate requirement to be brought into compliance by 2 August 2030. Separately, Article 43 requires a new conformity assessment where a high-risk system that has already been assessed undergoes a substantial modification, subject to the Act’s rules for predetermined changes in systems that continue learning. A compliance team therefore needs reliable change control for reasons that go beyond software hygiene. Suppose the user interface stays exactly the same but the supplier changes the underlying model. The new model handles languages differently, changes error rates and alters the way confidence is expressed. From the employee’s perspective, nothing visible happened. From the governance perspective, quite a lot may have happened. The organisation needs a record of the previous version, the new version, what changed, what tests were repeated, whether the intended purpose remains the same, whether risk controls still work and whether the change affects classification or conformity obligations. “Version updated automatically” is going to become a surprisingly expensive sentence. Deployers have their own evidence to maintain A company that buys a high-risk AI system is not finished once the vendor produces its provider documentation. Article 26 requires deployers, among other things, to follow the instructions for use, provide competent human oversight, monitor operation and respond where the system may present a risk. Where logs are under the deployer’s control, they must generally be retained for at least six months, unless another applicable law requires otherwise. Employers must inform workers’ representatives and affected workers before introducing high-risk AI in the workplace, and natural persons subject to certain AI-assisted decisions must be informed that the high-risk system is being used. For certain public bodies and entities delivering specified essential services, Article 27 also requires a fundamental-rights impact assessment before first deployment. That assessment covers the intended use, categories of affected people, relevant risks, human-oversight arrangements and measures responding to those risks. This is an important division of responsibility. The provider can assess how the system was designed. The deployer knows the setting into which it is being introduced. A recruitment vendor cannot know every organisational pressure inside a customer’s HR department. A model provider cannot know whether a caseworker has twenty seconds or twenty minutes to review an output. A supplier may describe appropriate oversight; the deployer determines whether the working conditions make that oversight real. The AI Act increasingly expects both sides of that boundary to carry information. Post-market monitoring means “compliant at launch” is not the end of the story Article 72 requires providers of high-risk systems to establish a documented post-market monitoring system proportionate to the technology and its risks. It must actively and systematically collect and analyse relevant performance information throughout the lifetime of the system, with the monitoring plan forming part of the technical documentation. The Commission is due to provide guidance and a template by 2 September 2027. That makes deployment part of the evidence-generating process. The provider needs to know whether performance changes in the field, whether expected controls are working, whether deployers are encountering new failure modes and whether interaction with other systems creates risks that were not visible in pre-release testing. Article 73 adds serious-incident reporting. The default outside limit is 15 days after awareness once the relevant causal link or reasonable likelihood is established, with shorter limits for certain widespread infringements and incidents and for deaths. Providers must also investigate and take corrective action. An organisation preparing now therefore needs more than an incident mailbox. It needs a definition of what gets escalated, a route from frontline users to the relevant technical and governance teams, preservation of evidence, responsibility for regulator contact and criteria for suspending use. If the incident process begins with somebody asking “Who owns this system?”, the system inventory has already failed. What I would expect to see by the end of 2026 For a company with material AI use, I would expect the following evidence base to be under construction now. Not every row applies equally to every system, but this is a much better starting point than trying to draft one enormous “AI Act policy” that supposedly governs everything from spam filters to recruitment. A useful test is whether a competent person who was not involved in the original project could follow that evidence and understand why the organisation reached its conclusions. If the answer depends on calling the developer who left last March, the documentation is not yet institutional knowledge. A recruitment system shows how the pieces fit together Take a company planning to procure an AI recruitment product in November 2026. The first question is not whether the supplier has an AI Act badge. The company needs to establish what the product actually does. A scheduling assistant and a system that filters CVs or evaluates candidates occupy very different positions under Annex III. Recruitment and candidate-evaluation systems are expressly listed among high-risk employment uses. Suppose the product ranks applications. The customer should identify itself initially as a deployer and the vendor as the provider, subject to checking how the system is branded, modified and integrated. The vendor will need to prepare for provider requirements including its QMS, risk management, technical documentation, testing, data governance and conformity assessment. The employer will need to prepare for deployer obligations including oversight, monitoring, logs where under its control and worker information. Now imagine procurement receives this answer from the vendor: “Our platform will be fully compliant with the EU AI Act by the deadline.” That is not enough. The customer needs to know which version is being assessed, whether the system will change before 2027, what population it was tested on, which known limitations affect the intended use, what information reviewers receive, which logs are available, how model updates are communicated, what happens when performance deteriorates and what evidence will remain available if the vendor changes the underlying model. The employer also has to design its own side of the process. Who reviews the ranking? Can they see enough information to question it? Are recruiters free to disagree? Is an override recorded? Will recurring overrides be investigated? Could workload turn the human reviewer into a rubber stamp? The supplier cannot solve those organisational questions for the employer. That is precisely why “provider compliant” and “deployment well governed” are different claims. The standardisation pipeline should change planning, not freeze it There is a reasonable concern behind the argument that companies should wait for the standards. The Commission itself postponed the high-risk timetable partly because organisations needed harmonised standards, guidance and other support measures before the requirements became enforceable. The Commission explicitly says the postponement is intended to allow providers and deployers time to prepare and implement the rules before the legal deadline. But that doesn’t mean every preparatory decision depends on a final standard. No future version of a human-oversight standard is likely to tell an organisation that nobody needs to know who can stop the system. No final logging standard is likely to make version identification irrelevant. No bias standard will make data provenance unnecessary. No cybersecurity standard will make ownership of incidents optional. The unfinished standards matter because they will add precision. They don’t erase what the Regulation already tells us. A sensible 2026 programme therefore separates stable work from standards-dependent work. Stable work includes inventory, role allocation, intended purpose, current-law screening, governance ownership, version control, supplier contracts, evidence preservation and the design of real escalation authority. Standards-dependent work includes detailed technical mappings, specific measurement procedures and the conformity arguments that will eventually rely on the cited standards. That approach prevents two equally bad outcomes: building an expensive compliance structure around draft technical requirements, or doing nothing until the final standards arrive. The question I would ask in a governance review I wouldn’t begin by asking to see the company’s Responsible AI principles. I would pick one real system. Show me who owns it. Show me why the organisation decided to use it. Show me the intended purpose and the use that actually occurs. Show me which version is running. Show me the classification decision and the evidence behind it. Show me what the vendor is contractually required to provide. Show me the tests, the known limitations and the data assumptions. Show me who can reject an output and what happens when they do. Show me what changed in the last release. Show me what would cause the organisation to suspend the system. Show me where an incident goes on Monday morning. If that chain exists, the organisation has started building AI governance. If each answer lives with a different department and the answers contradict one another, a beautifully formatted AI policy will not repair the gap. That is what makes EN 18286 important beyond the fact that Europe has finally cited its first harmonised AI standard. The compliance conversation is moving away from principles alone and into management responsibility, lifecycle control, procurement, testing, evidence, versioning and what happens after deployment. For organisations developing systems in 2026, that is also the clearest reason not to treat December 2027 as the day the work begins. By then, some of the most important evidence may already be a year old. Below the surface: what companies now have to build That is where the professional part of this EU in Practice starts. We are going inside EN 18286, rather than simply mentioning that a standard has appeared. We will look at what a quality-management system under the AI Act actually means, which requirements the new harmonised standard can support, what presumption of conformity does and does not buy a provider, and why using one standard cannot make an entire AI system “compliant”. We will also look at the draft work on human oversight and bias management, because both reveal how much complexity hides behind familiar governance language. We will connect those standards to the practical work organisations should already be doing in 2026: mapping AI systems, deciding who owns them, preserving evidence from development, establishing change control, defining meaningful oversight and working out which systems may cross into the high-risk regime as the implementation dates approach. The interesting part of the AI Act is no longer only what Brussels wrote into the Regulation. It is what somebody now has to make work on Monday morning. Subscribe or upgrade to access the professional section on EN 18286, human oversight, bias and AI Act readiness for 2027. Get full access to REDefine // Civic Intelligence at associationredefine.substack.com/subscribe (https://associationredefine.substack.com/subscribe?utm_medium=podcast&utm_campaign=CTA_4)

3. 

   15 Oct 2026

   The Illusion of Ownership: Why Perfectly Good Tech Dies

   We often talk about technology as if it simply “gets old.” A laptop stops receiving updates. A battery becomes impossible to replace. A sensor still works, but the software around it no longer does. A small failure suddenly decides the fate of an entire device. This short explainer looks at the hidden systems that determine whether technology can actually remain useful: repairability, spare parts, software support, data access, maintenance knowledge and the increasingly blurred line between owning a device and controlling its future. The full Code Beneath the Floorboards article goes much deeper into the idea of maintenance sovereignty — how organisations can identify support-horizon mismatch, lifecycle choke points, repair-pathway friction and supplier dependency before a small failure becomes an expensive replacement decision. The paid edition also includes the REDefine Technology Lifecycle & Repairability Audit, our connected professional workbook for turning those hidden dependencies into practical evidence, actions and procurement requirements. This video is part of The Code Beneath the Floorboards, REDefine’s series exploring the invisible systems underneath everyday technology, institutions and public life. Get full access to REDefine // Civic Intelligence at associationredefine.substack.com/subscribe (https://associationredefine.substack.com/subscribe?utm_medium=podcast&utm_campaign=CTA_4)

4. 

   8 Oct 2026

   EU in Practice: The European Digital Identity Wallet

   Someone asks whether you are over 18. You hand over an identity card. They now know much more than whether you are over 18. Your full name is there. Your exact date of birth. Your photograph. Your nationality. A document number. Depending on what you handed over, perhaps several other pieces of information that have nothing whatsoever to do with the question. We are so used to this arrangement that it barely registers as odd. Physical identity documents come as bundles, and the bundle is what we show. You cannot peel your age off a passport, hand over that one fact and keep the rest in your pocket. Digital identity doesn’t have to work that way. That is what makes the European Digital Identity Wallet more interesting than the phrase “digital wallet” suggests. Europe is not only trying to move familiar documents onto phones. It is trying to make identity more precise: to let us prove the particular thing that matters in a particular interaction without automatically handing over everything else. A system designed around that principle begins with a much better question than Who are you? It asks: What do I actually need to know about you? Your identity doesn’t have to travel as one big package The European Digital Identity Wallet will allow people to hold and use identity information and official credentials digitally, including things such as driving licences, educational qualifications and other attestations. Member States are required to provide wallets capable of working across the European Union. But putting a driving licence on a phone is the least interesting part of the idea. The bigger change is selective disclosure. The European framework is designed so that a person can disclose only the attributes required for a particular transaction. Where full identification is unnecessary, the system can also support pseudonyms and privacy-preserving methods that confirm a fact without exposing all the data underneath it. In practical terms, that means an interaction could look like this: a service needs to know whether you are over 18, so it receives confirmation that you are over 18. It doesn’t automatically receive your date of birth. An institution needs to know that you hold a certain qualification, so it receives a verifiable credential confirming that qualification rather than a miscellaneous bundle of identity documents assembled around it. That is a significant change in the logic of identification. For years, European data-protection law has told organisations to collect only the personal information they actually need. The principle is called data minimisation. It sounds perfectly sensible written into legislation. Everyday digital life has been somewhat less disciplined. The wallet attempts to turn that principle into something a person can actually use. Europe is effectively asking whether privacy can be built into the transaction itself, rather than added afterwards through another notice explaining what happened to all the data you already surrendered. The most interesting thing about the wallet may therefore be what it allows us not to say. Europe is not creating one giant identity database in Brussels The name can also give the wrong impression in another direction. The European Digital Identity Wallet is not one enormous EU identification system into which every European will be deposited. National identity systems remain national. Member States provide the wallets, directly or through recognised providers, while common European rules and standards are meant to make those different systems interoperable. Europe already has plenty of digital identity systems. The difficulty begins when people cross borders. A digital identity that works beautifully inside one country may suddenly become much less useful when you need to enrol at a university, prove a qualification, access a service or complete an administrative process somewhere else. At that point, digital Europe can still become remarkably fond of scanned documents, attachments, translations and certificates proving the authenticity of other certificates. The Commission says that only a relatively small share of key public services currently allow cross-border authentication through existing electronic-identification arrangements. So the problem is not simply that Europe needs digital identity. It needs portable digital trust. If a university in Portugal issues a digital qualification, an institution in another Member State needs to know what it is looking at. Who issued it? Was that organisation entitled to issue it? Has the credential been altered? Is it still valid? Does it belong to the person presenting it? None of those questions is solved merely by converting a diploma into a prettier file. This is why the Wallet is really part of a much larger trust infrastructure. The visible credential is only the front end. Underneath it are standards for issuance, verification, revocation, security, authentication and legal recognition across different countries and institutions. The QR code is easy. Getting twenty-seven administrative systems to agree on what the QR code means is rather more European. “Over 18: yes” is enough Age verification gives us the clearest example of how different this could feel in practice. The European Commission has already been developing a privacy-preserving age-verification solution based on technical specifications compatible with the future Wallet. The basic idea is deliberately simple: an online service that genuinely needs to know whether somebody is over 18 can receive confirmation of that fact without also receiving the person’s name, exact date of birth or broader identity. Instead of: Jane Doe, born on X date, holder of document Y. the service receives the information it actually needs: Over 18: yes. That separates two ideas that digital systems have spent years muddling together: verification and identification. If the question is whether somebody meets an age threshold, identifying the person may be entirely unnecessary. A service needs an answer to one question, not an introduction. Privacy-preserving cryptography can make that separation stronger. One of the technologies discussed in the European framework is the zero-knowledge proof, which allows a statement to be verified without exposing the underlying information used to establish it. The name is considerably more dramatic than the concept needs to be. You can think of it as proving that you know something without revealing the thing itself, or proving that a condition is true without handing over the data behind it. You don’t need to understand the mathematics to appreciate the change in philosophy. For decades, digital systems have often treated more information as more certainty. If we know your name, birthday, address, document number and perhaps a little more for luck, surely we can trust the transaction. The Wallet introduces a more disciplined possibility: sometimes a system can trust what you are entitled to do without knowing everything about who you are. A digital diploma is useful only when somebody else can trust it Age verification is neat because the proof is tiny. Cross-border credentials reveal the more complicated part of the project. The Digital Credentials for Europe pilot, DC4EU, brought together organisations from 22 European countries to test wallet-based credentials in education and social security. Its use cases included educational diplomas, professional qualifications, European Health Insurance Card information and social-security documentation. Consider the diploma. You graduate from a university in Portugal and later need to use that qualification in Germany. The obvious digitalisation project would be to replace the paper diploma with a digital diploma. Useful, certainly. Sufficient, no. The institution receiving it still needs to know whether the university was authorised to issue the qualification, whether the credential has been tampered with, what the qualification actually represents, whether it remains valid and whether the person presenting it is the rightful holder. A digital credential becomes genuinely valuable only when the receiving institution can trust the chain behind it. That is why the European architecture includes far more than storage. It has to define the relationships between credential issuers, wallets and the organisations that rely on the information they receive. The same principle applies to driving licences, prescriptions, public services, banking, electronic signatures and many of the other uses being tested. A person shouldn’t have to become the integration layer between two institutions every time they cross a border. Anyone who has carried one official document into an office to prove the validity of another official document, accompanied by a certified translation explaining the first official document to the people responsible for recognising the second, will understand the attraction. Better privacy technology doesn’t make organisations less curious The European framework contains real privacy protections. Wallet use is supposed to remain voluntary. The system supports selective disclosure. Users should be able to see and control what information they share. The architecture includes protections against tracking and linking transactions across contexts, and relying parties have obligations around what data they request. Those protections matter. They also don’t make institutional curiosity disappear. The European Data Protection Supervisor has warned about over-disclosure, transaction linkability, profiling and the possibility that organisations may request more information than they actually need. Another problem is almost behavioural: when credentials become very easy to share, saying yes can become so frictionless that people stop examining what they are saying yes to. We have considerable evidence from the rest of digital life that humans are not at their most reflective when presented with consent interfaces. The internet spent years producing buttons called Accept All, and people responded with the perfectly rational objective of making the box disappear. Better controls help. But a privacy system that depends on every person remaining alert during every tiny data request has moved a considerable amount of responsibility onto the person who is simply trying to rent a car, open an account or access a public service. Good privacy cannot mean giving people twenty excellent opportunities a day to refuse unnecessary requests. It should also mean having fewer unnecessary requests. That pushes the problem beyond cryptography and back into governance. Once verification becomes easy, everybody may want some This may become one of the more interesting consequences of the Wallet. Identity verification currently involves friction. Much of that friction is bureaucratic nonsense and deserves to disappear. But friction also creates a cost for the organisation asking for information. When verifying an attribute becomes nearly instant, the temptation to verify more attributes may grow with it. A website can check whether I am over 18. Fine. But does this particular website need my age? A service can confirm my place of residence without asking for a utility bill. Useful. But why does the service need my place of residence? An employer can verify a qualification immediately. Excellent. But does that particular role genuinely require it? The privacy conversation usually begins after the request: how can we disclose as little information as possible? We should also pay attention to the question before it: Why are you asking? Selective disclosure can reduce the information transferred once a request has been accepted as legitimate. It cannot decide which requests should become normal. That is why the risk is not only oversharing. It is over-asking. A privacy-preserving identity system could make online life far less invasive because organisations begin requesting narrow proofs instead of whole identities. It could also create a culture in which verified personal attributes are requested everywhere simply because requesting them has become convenient. Both futures are technically compatible with the same wallet. The difference will come from rules, design choices and institutional restraint. A genuinely successful European identity system should therefore not be judged by how many things it can prove about us. One of the better measures may be how often organisations discover they never needed to ask. “Voluntary” is easy to write into a regulation The Regulation says the Wallet must be voluntary. People who do not use one are not supposed to be disadvantaged, and other ways of accessing services must remain available. That protection will matter enormously once the system becomes widespread. There is a difference between an alternative existing and an alternative being usable. Imagine that the Wallet route takes ninety seconds on your phone. The non-Wallet route requires downloading a PDF, locating a printer, booking an appointment, bringing photocopies and visiting an office that opens between 09:17 and 11:43 on alternate Wednesdays. Nobody has formally forced you to use the Wallet. Reality has made a fairly strong recommendation. Digital systems create pressure partly through convenience. Once one route becomes faster and cheaper, organisations naturally invest more heavily in it. The alternative survives legally while deteriorating operationally. That would matter to anyone without a suitable device, anyone with limited digital skills, older people, people with disabilities, people experiencing unstable housing or documentation problems, and people who simply do not want to place this part of their lives into a digital wallet. If the system is genuinely optional, we should be able to see that in the quality of the alternatives, not merely in the wording of the law. The success statistics will inevitably include wallet adoption. I would also like to know how difficult it becomes to live without one. The pilot is becoming infrastructure The European Digital Identity Framework entered into force in 2024, and Member States are required to provide at least one Wallet by the end of 2026. We are therefore no longer talking about a speculative proposal sitting comfortably several years in the future. Europe is moving from pilots, reference architecture and technical standards towards infrastructure that ordinary people will actually encounter. Large-scale pilot projects have already tested wallet uses in education, social security, banking, payments, telecommunications, travel, health, public administration, electronic signatures and mobile driving licences. Cybersecurity and certification work has continued alongside that testing, which matters because these wallets will sit unusually close to some of the most consequential information people use when dealing with governments, businesses and institutions. The difficult stage begins when the system stops being a pilot. A pilot is full of people who know they are testing something. They know what the expected workflow is, who to call when something behaves strangely and which failure is important enough to record. Infrastructure has to work for somebody who has never heard of the architecture, doesn’t care about the specification and merely wants to pick up a prescription before the pharmacy closes. That is a much higher standard. The university administrator, bank employee, pharmacist, hotel, public servant and ordinary user should not need to understand the machinery underneath the Wallet. The machinery still has to understand enough about all of them to preserve trust, security, proportionality and choice. An identity system should sometimes leave you alone Physical identification trained us to think of identity as a package. If somebody needed one fact, we routinely showed them the package. Digital identity gives us an opportunity to stop doing that. The European Digital Identity Wallet could allow a person to prove that they are old enough, qualified, licensed, authorised or entitled to something without automatically opening the administrative file labelled THIS PERSON every time. Whether that promise survives implementation will depend on far more than the technical quality of the Wallet. Organisations will have to learn to ask for less. Users will need to understand what they are sharing. Transactions must not quietly become tracking infrastructure. Alternatives must remain genuinely available. Cross-border interoperability has to work outside demonstration environments. And convenience must not gradually turn into compulsion. But the principle underneath the project is worth holding on to. A good identity system should help us prove who we are when our identity genuinely matters. It should be equally capable of recognising the many situations in which it doesn’t. The European Digital Identity Wallet is often described as a way to carry more official credentials on our phones. Its more interesting promise is almost the opposite. It may finally give us a practical way to leave more of ourselves at home. Get full access to REDefine // Civic Intelligence at associationredefine.substack.com/subscribe (https://associationredefine.substack.com/subscribe?utm_medium=podcast&utm_campaign=CTA_4)

5. 

   1 Oct 2026

   The Open School

   Schools teach far more than what appears on the timetable. Every platform, login, data trail and digital workflow also teaches students something about ownership, privacy, dependence, agency and who gets to shape the systems around them. This short explainer looks at the hidden curriculum inside educational technology — from curriculum captivity and teacher attention to AI, data, interoperability and digital dependency. The full article goes much deeper, with the professional section introducing the REDefine Educational Technology Dependency Model and our connected Open School & Educational Agency Audit for schools, universities, training providers and educational organisations. Get full access to REDefine // Civic Intelligence at associationredefine.substack.com/subscribe (https://associationredefine.substack.com/subscribe?utm_medium=podcast&utm_campaign=CTA_4)

6. 

   29 Sept 2026

   The 28th Europe

   Europe has 27 Member States, but one of the more intriguing ideas in its current competitiveness debate is a 28th regime: a European corporate framework that could sit alongside national systems rather than replacing them. In this episode, we unpack what EU Inc. could actually change for a founder trying to scale across Europe, where national law would still reappear, and what earlier European experiments can teach us about why some common regimes thrive while others quietly join the institutional graveyard. The deeper question is larger than company law: is Europe beginning to discover the institutional equivalent of an API — a way to make 27 different systems work together without first making them identical? Read the full article for the complete analysis. Get full access to REDefine // Civic Intelligence at associationredefine.substack.com/subscribe (https://associationredefine.substack.com/subscribe?utm_medium=podcast&utm_campaign=CTA_4)

7. 

   22 Sept 2026

   EU in Practice: Canada and Europe Are Getting Closer. But What Exactly Are They Building?

   The European Union is generally rather fond of categories. There are Member States, candidate countries, potential candidates, European Economic Area countries, associated countries, strategic partners, third countries associated with individual programmes and third countries very specifically not associated with those programmes. Somewhere in Brussels, one suspects, there is a taxonomy for the taxonomy. This week, however, Europe did something rather less characteristically tidy. In her State of the Union address on 16 September, European Commission President Ursula von der Leyen proposed opening the door for Canada to become the EU’s first “associate member.” She placed the idea inside a much broader “Alliance for the Future”: a common prosperity and economic-security space covering advanced manufacturing, defence industries, the Arctic, energy, critical minerals, batteries, artificial intelligence, quantum technologies, cybersecurity and economic security. There is just one small institutional detail. The European Union does not currently have a general membership category called associate member. The ordinary accession route under Article 49 of the Treaty on European Union is written for a “European State”. The EU does have powers under Article 217 of the Treaty on the Functioning of the European Union to conclude association agreements with third countries, involving reciprocal rights, obligations, common action and special procedures. But that is not an off-the-shelf status called “associate membership” into which Canada can simply be inserted after completing the appropriate form in triplicate. A day after von der Leyen’s speech, Canadian Prime Minister Mark Carney welcomed the ambition and supplied considerably more detail about what Canada would like the relationship to contain. His proposals included closer cooperation in critical minerals, defence production, AI and computing capacity, energy, space and payments; smoother digital trade in non-agricultural goods and services; deeper financial integration; stronger youth mobility; Canadian membership of Erasmus+; and participation in the next generation of Horizon Europe. So we have reached an unusually interesting point in European integration: the political ambition is visible, several pieces of the practical integration already exist, and the constitutional label remains under construction. This is therefore not a story about Canada joining the European Union. It is about a more interesting question. How many parts of Europe can a country join without joining the Union itself? First, Canada and Europe did not suddenly discover one another in Strasbourg The easiest way to misread this week’s announcement is to imagine Canada and the EU standing on opposite sides of the Atlantic until geopolitical anxiety suddenly caused them to exchange telephone numbers. The relationship is already substantial. CETA, the Comprehensive Economic and Trade Agreement, has been provisionally applied since September 2017. EU–Canada trade in goods reached €81.5 billion in 2025, 76% higher than in 2016, while bilateral services trade reached €49 billion, up 91% over the same period. The EU is Canada’s second-largest trading partner. CETA also supplies an early warning about the difference between political announcements and European institutional reality. Almost nine years into provisional application, only 17 of the EU’s 27 Member States have completed their national ratification processes. Belgium, Bulgaria, Cyprus, France, Greece, Hungary, Ireland, Italy, Poland and Slovenia still have not. Before Europe constructs an entirely new relationship with Canada, then, there remains the small matter of fully ratifying the old one. That is not merely a Brussels joke. It tells us something important about what follows. European international agreements can operate, deepen and produce real economic effects while parts of their legal architecture remain unresolved for years. The announcement of an “associate membership” relationship is therefore the beginning of an institutional process, not evidence that the process has already happened. Meanwhile, cooperation has continued growing around CETA rather than waiting politely for every national parliament to finish. In 2025, Canada and the EU established a Security and Defence Partnership. In June 2026, Canada became the first non-European country formally able to participate in procurement under SAFE, the EU’s Security Action for Europe instrument. That means Canadian companies and Canadian-origin products can participate in parts of common European defence procurement under the agreement. A few days before the Strasbourg speeches, Canadian and European leaders were already pointing to the first Canadian contract under SAFE. This is rather more consequential than the diplomatic language might suggest: Canadian firms are no longer merely cooperating with European defence companies from the outside. They can participate inside a specific EU procurement framework. And defence is not the only example. Horizon Europe has already shown what partial integration looks like In July 2024, Canada became associated with Pillar II of Horizon Europe, the enormous part of the EU research programme devoted to collaborative work on global challenges and industrial competitiveness. Canadian universities, researchers and organisations can participate there on broadly equal terms with their European counterparts. They can join and lead consortia and receive Horizon Europe funding directly. This is easy to overlook because research programmes don’t receive the theatrical lighting of summits and parliamentary speeches. But institutionally, it is quite revealing. Canada did not need to become an EU Member State to become integrated into one of the EU’s major research systems. That existing arrangement also helps clarify Carney’s proposal for Canadian participation in the next generation of Horizon. He is not proposing that Canada suddenly discover European research cooperation. He is proposing continuity and potentially deeper participation beyond the current framework. This is where the emerging model becomes visible. Instead of imagining one enormous gate marked EU MEMBERSHIP, imagine a building with many doors. Research is one door. Defence procurement is another. Digital trade may become another. Education and youth mobility could become another. Critical-mineral supply chains, financial services and technological cooperation may produce still more. Canada is already through some of them. Erasmus+ may matter more than the strategic sectors in the spotlight The headline sectors in the new alliance are exactly the ones one would expect in 2026: defence, AI, critical minerals, energy, quantum technologies and economic security. But one of Carney’s proposals may ultimately tell us more about the durability of the relationship than any of those. He explicitly proposed Canadian membership of Erasmus+, arguing that it could expand opportunities for Canadian and European students and strengthen long-term ties between the two societies. Canada is not currently fully associated with Erasmus+. Under the current programme rules, EU Member States and a limited group of associated third countries participate fully across the programme. Countries such as Canada belong to the much larger category of third countries not associated with the programme, which can participate only in particular actions under specific conditions. The distinction matters because Erasmus stopped being merely a university-exchange programme a long time ago. It now connects universities, schools, vocational education, civil society organisations, adult learning, staff mobility, sport and large networks of institutional cooperation. Since 1987, Erasmus and its predecessor programmes have provided international learning opportunities to more than 16 million people. The Commission’s latest evaluation found that more than 6.2 million participated in learning mobility during 2014–2020 and around another 1.6 million between 2021 and 2023. It also concluded that the programme has contributed to common values, civic participation and a shared identity. Those effects make Erasmus politically unusual. Trade agreements connect markets. Research programmes connect institutions. Defence agreements connect states and industries. Erasmus has spent nearly four decades connecting biographies. A Portuguese student acquires friends in Poland. A Bulgarian youth worker builds a project with a Spanish organisation. A French vocational teacher returns from Finland with different ideas about training. People acquire colleagues, partners, languages, professional networks and an intuitive familiarity with countries that previously existed largely as shapes on maps. Much of the EU has been built through law. Erasmus added something law cannot manufacture so easily: repeated personal experience of other European societies. Canadian association could begin extending that infrastructure across the Atlantic. The interesting effects would not flow in only one direction. European participants would gain more systematic routes into Canadian universities, organisations and communities, and those exchanges could reach well beyond conventional higher education. Canadian expertise in Arctic communities, Indigenous knowledge and reconciliation, multilingual federalism, AI, rural and remote education, climate adaptation and natural-resource governance would create very different possibilities for European universities, organisations and vocational institutions. For civil society, the implications are particularly interesting. Erasmus+ funds participation, organisational partnerships, training and capacity development as well as student mobility. A fully associated Canada would not simply mean more Canadian undergraduates spending a semester in Barcelona. It could mean recurring institutional relationships between European and Canadian organisations, schools, training institutions and civic actors. Strategic partnerships are normally announced by governments. They become much harder to reverse when ordinary people acquire friends, colleagues and professional reasons for keeping them. The two sides are getting closer for different reasons The public rhetoric around Canada and Europe is understandably heavy on shared values. Both leaders emphasised democracy, the rule of law and voluntary cooperation. Those similarities are relevant, but they should not obscure the material interests underneath the partnership. For Canada, diversification has a very concrete economic meaning. Despite recent growth in trade elsewhere, 71.7% of Canadian merchandise exports still went to the United States in 2025. That was down from 75.9% the previous year, while Canadian exports to non-US destinations grew strongly, but geography remains geography. Europe cannot replace the United States as Canada’s economic neighbourhood, nor has Carney proposed that it should. His argument was instead about reducing concentrated dependence. He described the objective as “collective resilience” rather than self-sufficiency and argued that diversification can reduce the leverage created when critical systems depend too heavily on one country or company. That distinction matters. Diversification doesn’t mean replacing your largest relationship. It means making sure it is not your only answer. The EU’s incentives are different. Canada is important to Europe, but not because it is one of the EU’s largest trading partners. Canada ranked only 12th among the EU’s goods trading partners in 2025, representing 1.8% of EU external goods trade. Yet Canada possesses assets that have become disproportionately valuable in the EU’s current strategic agenda: large reserves of critical minerals, extensive energy resources, Arctic geography, defence-industrial capacity, strong capabilities in AI, quantum and space technologies, and deep pools of institutional investment capital. Carney explicitly paired those Canadian strengths with Europe’s market size, advanced manufacturing, research depth, regulatory reach and expanding defence-industrial base. This creates an interesting inversion. The strategically important partner is not necessarily the partner with whom you trade the most. Europe’s economic-security debate increasingly revolves around precisely that distinction. A supplier may represent a modest portion of total commerce while being extremely important in lithium, rare earths, defence components, energy infrastructure or computing capacity. A relatively small trade relationship can therefore carry very large strategic weight. The Canada relationship is partly an experiment in translating that insight into institutions. Critical minerals sound simple until somebody has to build the refinery One of the most repeated phrases in this week’s announcements is critical minerals. The underlying logic is clear enough. Europe wants more secure sources of the materials needed for batteries, semiconductors, clean technologies and defence production. Canada has substantial mineral reserves. Carney said Canada has deposits of more than 34 critical minerals and argued that a deeper alliance could connect reliable Canadian supply with European processing capabilities and build more complete value chains. But “Canada has minerals and Europe needs minerals” is the kind of sentence that becomes less complete the closer one gets to an actual industrial strategy. A mineral deposit is not yet a resilient supply chain. There are mines to permit, infrastructure to build, communities to consult, financing to secure, refining and processing capacity to develop, environmental standards to meet, logistics to organise and downstream manufacturing to connect. Indigenous rights and participation are particularly important in the Canadian context. Processing capacity is often the point at which geopolitical dependency re-enters the chain. This is why Carney’s formulation about complete value chains matters more than the headline about geological abundance. The same principle applies to energy. Canada can offer LNG, hydrogen and other energy resources; Europe can offer markets, technology and investment. But whether those complementarities translate into major new flows depends on ports, pipelines, commercial contracts, infrastructure economics, climate policy and time. Strategic compatibility does not abolish physical infrastructure. Unfortunately for international politics, ships remain stubbornly material. Digital trade is already moving from speech to negotiation Other parts of the relationship are much further along. Canada and the EU formally launched negotiations on a Digital Trade Agreement in March 2026. Four negotiating rounds had already taken place by August. The stated objective is to complement CETA with a framework for digital trade that improves legal certainty for businesses, consumer protection and cross-border digital commerce. That puts some substance behind Carney’s call for more seamless digital trade in non-agricultural goods and a wide range of services. For businesses, this is where the grand language about an “Alliance for the Future” could eventually become remarkably mundane, which is usually how you know economic integration is becoming real. It may show up in how electronic contracts are recognised, how businesses authenticate themselves, how consumer protections operate online, how data can move, how technical standards interact, how cybersecurity requirements are recognised and how companies avoid duplicating compliance work unnecessarily. The existing CETA Regulatory Cooperation Forum is already working on areas where regulatory alignment could reduce friction, and its 2026 work explicitly describes deeper Canada–EU regulatory alignment as a priority. That does not mean Canada is about to adopt the EU rulebook wholesale. Regulatory cooperation can range from dialogue and mutual recognition to much deeper alignment, and the details will matter enormously. But this is precisely why the phrase associate member currently tells us less than the individual negotiations taking place underneath it. And then agriculture leaves the sentence There is one wonderfully revealing word in Carney’s proposal that deserves more attention than it has received. He called for seamless digital trade in non-agricultural goods and a wide range of services. That adjective is doing quite a lot of diplomatic work. Nothing in the speech explains why agriculture was excluded from that formulation, so it would be unwise to manufacture motives. But the omission is a useful reminder that ambitious international partnerships don’t deepen evenly across every sector. Canada and the EU continue to have specific agricultural and agri-food issues on the CETA agenda. Agriculture brings domestic politics, quotas, food standards, regulatory traditions and producer interests into a relationship that sounds considerably simpler when discussed at the level of “shared values and complementary strengths.” The March 2026 CETA Joint Committee agenda still listed agri-food issues among bilateral trade concerns. Grand strategic partnerships tend to become more specific once beef, cheese and quotas enter the room. This doesn’t mean agricultural integration cannot deepen. It means that the Canada–EU relationship will almost certainly remain uneven: deeper in some systems, much shallower in others. That may ultimately be its defining feature. The phrase “live, work and study” needs some plumbing too Carney also spoke about allowing young people to live, work and study where they want on either side of the Atlantic. It is an attractive formulation, and potentially a consequential one. But it is important to distinguish the aspiration from current legal rights. Canada and the EU do not currently have a general freedom-of-movement regime comparable with movement inside the European Union. Erasmus+ association could make educational and youth mobility substantially easier within programme activities, while separate arrangements might expand work placements, professional exchanges or youth mobility schemes. None of that automatically creates a general right for Canadians to move to the EU, or Europeans to Canada, for employment. “People-to-people mobility” sounds wonderfully frictionless in a political speech. Immigration law has historically been less poetic. The same caution applies to Carney’s proposal to explore an integrated market for financial services. This could potentially affect capital flows, investment access and financial competition, but at present it is an idea for exploration rather than a negotiated market. This is one of the distinctions readers should keep throughout the Canada story: some integration already exists, some is under active negotiation, and some currently exists only as political ambition. The three should not be confused simply because they appeared in the same speech. So what, exactly, is an “associate member”? At this point, we arrive at the part of the story where certainty falls away. There is no published Canada–EU agreement defining associate membership. There is no treaty article setting out a standard package of rights. There is no announced financial contribution, institutional voting arrangement, dispute-settlement system or general framework for regulatory alignment attached to the phrase. We do not know whether the relationship would ultimately be established through one broad association agreement, several sectoral agreements, or a combination of the two. We do not know whether Canada would gain any forms of selective market access beyond what CETA and future agreements already provide. We do not know how much continuing alignment with EU regulation would be required in sectors where Canada sought deeper access. We do not know whether the term “associate member” will eventually become a defined legal status or remain the political umbrella under which a series of much more specific arrangements are assembled. And we do not yet know which pieces would require EU-level approval alone and which could trigger the kind of national ratification requirements that have accompanied CETA. What we do know is that the treaties offer legal pathways for association with third countries. Article 217 TFEU allows agreements that establish reciprocal rights and obligations, common actions and special procedures. So there is legal machinery available. The label attached to the machinery is the part still being invented. At present, “associate member” is less a completed constitutional destination than a political instruction to start drawing the map. The Canada proposal exposes something interesting about the EU itself This may ultimately be the most important part of the story. European integration has historically been imagined through geography. The European Union has members. It has European countries trying to become members. It has neighbouring countries linked through association, enlargement policy, the European Economic Area and other specialised arrangements. More distant democracies are typically described as trade partners, strategic partners or international partners. Canada sits awkwardly inside that map. It is geographically North American, institutionally independent and not seeking ordinary EU accession. Yet it is already associated with a major EU research programme, participating inside a European defence-procurement instrument, negotiating a digital-trade framework and now proposing association with Erasmus+. Carney made the intellectual argument unusually explicit in Strasbourg: institutions inherited from the past are organised by geography, while many of the strategic capabilities countries now need are organised by function. That is a much larger proposition than bilateral cooperation with Canada. It suggests that parts of international integration might increasingly be built around systems rather than territories. Research countries. Defence-production countries. Education and mobility countries. Digital-trade countries. Critical-mineral networks. AI and computing alliances. A state might sit deeply inside several of those systems without joining the political union at their centre. Canada would not be the first non-member to participate in individual EU programmes, of course. Europe already has a complicated ecosystem of associated countries and external partners. But the breadth of the Canadian proposal makes it particularly revealing because it gathers many of these functional relationships into one political project. The interesting question may therefore not be whether Canada becomes something resembling a partial EU member. It may be whether Europe is beginning to develop a more modular form of external integration. There are several ways this could take shape Because the institutional design has not been announced, it would be misleading to pretend there is one obvious outcome. Several different arrangements are compatible with what has been proposed so far. One possibility is that “associate membership” becomes essentially an umbrella term. Canada and the EU would deepen cooperation through separate instruments — Horizon, Erasmus+, SAFE, the Digital Trade Agreement, critical-minerals partnerships, energy cooperation, financial services and other sectoral arrangements — while the political label gives those pieces a common identity. In practice, this may produce deep integration without creating one grand legal status. A second possibility is a broader formal association agreement under existing treaty powers. Such an agreement could establish common institutions and a more coherent framework of reciprocal rights and obligations, with the detailed sectoral arrangements operating underneath it. Article 217 provides a legal route for that kind of association, although neither side has yet announced that this will be the chosen structure. A third possibility is more selective: Canada could become deeply integrated into particular European systems while remaining clearly outside the Single Market and other central features of EU membership. In some respects this is not hypothetical at all. Horizon and SAFE already demonstrate the basic principle. And there is a fourth possibility that European history encourages us not to dismiss: the grand political label could prove difficult to define while the practical integration continues anyway. CETA has been provisionally operating since 2017 even though ten Member States still have not completed national ratification. European integration has occasionally displayed a remarkable ability to function while its constitutional sentences are still being edited. None of these scenarios should currently be treated as the forecast. They are simply different institutional shapes consistent with what is known today. The next summit may narrow them considerably. The United States is part of the context, but it should not consume the story Much of the public discussion naturally interprets Canada’s European turn through its relationship with the United States. That context matters. Canada remains extraordinarily economically connected to its southern neighbour, and Carney’s own Strasbourg argument repeatedly focused on the risks created when trade, finance, technology or supply chains become sources of coercive leverage. But reducing the EU–Canada relationship to a reaction against Washington would distort its history. CETA predates the current moment. Canadian association with Horizon Europe was agreed in 2024. The Security and Defence Partnership was signed in 2025. SAFE participation was negotiated before this week’s “associate member” proposal. The Digital Trade Agreement talks began in March. The deeper pattern is diversification. For Canada, that means increasing the number of credible economic, technological and security relationships available to it while remaining deeply embedded in North America. For Europe, it means reducing critical dependencies by building denser relationships with countries it regards as reliable partners. Neither requires pretending the Atlantic became narrower during the night. The real test begins after the applause There will be another Canada–EU Summit on 29–30 October 2026, hosted by Canada. That is the next obvious point at which some of the ambiguity may begin turning into institutional detail. The useful questions then will be less romantic than the speeches. Is there a mandate for a broader association framework? Does Erasmus+ move from proposal towards formal association? What happens to the Digital Trade Agreement? Are there concrete commitments on critical-mineral processing, energy infrastructure or AI cooperation? Does deeper financial-market integration acquire an actual work programme? Which areas will require regulatory alignment, financial contributions or new governance structures? Those details matter because alliances eventually have to survive contact with budgets, regulators, customs procedures, universities, procurement rules and national parliaments. This is precisely why Erasmus may prove such a revealing indicator. If Canada enters the programme fully, an abstract transatlantic alliance starts acquiring thousands of ordinary human participants. A Canadian student spends a year in Porto. A Portuguese organisation builds something with a partner in Montréal. A Romanian vocational school develops an exchange with Alberta. Teachers, researchers and young people begin using the relationship rather than merely reading about it. Meanwhile, a Canadian defence company may compete inside a European procurement system, a university may lead a Horizon consortium, and a European business may eventually find it easier to sell a digital service in Canada. None of these experiences will look like “EU associate membership” to the person having them. They will look like a course, a contract, a research proposal, a job, a partnership or a plane ticket. And that is usually where connection becomes real. Perhaps the question is no longer who is “inside Europe” The most tempting question after this week’s announcement is whether Canada is somehow joining Europe. That is probably the least useful way to understand what is happening. Canada is not applying to become the 28th Member State. There is no defined associate-membership package waiting for signature, and major questions about law, governance, market access and regulatory alignment remain unresolved. But dismissing the announcement as diplomatic theatre would be equally mistaken. Canada is already inside important parts of the European research and defence architecture. Digital integration is under negotiation. Education and youth mobility may come next. Critical minerals, energy, AI, space, finance and the Arctic have now been placed explicitly on the table. The relationship is therefore becoming difficult to describe with the old binary distinction between member and partner. Perhaps that is the genuinely interesting experiment. For most of its history, European integration has asked how states can move closer to the Union. The Canadian case asks something slightly different: how far can asssociation travel beyond the Union itself? We will not know the answer from a speech in Strasbourg. We will know it from the agreements that follow, the systems Canada actually enters, the obligations both sides accept and, eventually, whether citizens and organisations begin treating those new connections as ordinary. Governments announce alliances. Institutions make them operational. Markets give them incentives. But programmes such as Erasmus do something less visible and perhaps more durable: they give people personal reasons for the relationship to continue. Somewhere in a few years’ time, the success of this experiment may therefore be measured not only in tonnes of lithium, defence contracts or digital-trade volumes, but in something considerably less strategic-looking: a Canadian student complaining about Lisbon rent while a Portuguese youth worker discovers Montréal in February. European integration has always had stranger metrics than it admits. EU in Practice looks beyond the headline to examine what European decisions actually mean for people, organisations and the systems around them. The Canada–EU relationship described here is developing rapidly; proposals discussed in September 2026 should be distinguished from agreements already concluded and rights already in force. Get full access to REDefine // Civic Intelligence at associationredefine.substack.com/subscribe (https://associationredefine.substack.com/subscribe?utm_medium=podcast&utm_campaign=CTA_4)

8. 

   8 Sept 2026

   EU in Practice: Can You Still Call It “Green”?

   Most of us have probably noticed that the humble leaf has had quite a career in marketing. Once confined largely to trees, it eventually discovered packaging design and has never looked back. It now lives on shampoo bottles, hotel websites, trainers, electricity tariffs, washing liquid, clothing collections, food-delivery services and an impressive assortment of products whose relationship with photosynthesis is, at best, indirect. Sometimes it appears alone. Sometimes it is accompanied by a water droplet, a tiny planet, an earnest hand cradling a seedling, or that particular shade of muted green that seems to say: this purchase has already discussed the matter with nature. Around the leaf grew an equally successful vocabulary. Products became green, eco-friendly, natural, responsible, conscious, climate friendly and, most majestically of all, sustainable. These words do rather more than describe. They reassure. They distinguish. They allow an ordinary purchase to acquire a small moral biography. The detergent is no longer merely going to clean your socks; it is apparently participating in the transition to a better civilisation. From 27 September 2026, some of that language becomes considerably harder to use casually in the European Union. Directive (EU) 2024/825, usually referred to as the Empowering Consumers for the Green Transition Directive, starts applying across the EU after Member States were required to transpose it by 27 March this year. It strengthens existing consumer law against misleading environmental claims, unreliable sustainability labels, misleading carbon-neutrality claims and several other practices associated with greenwashing. The interesting part is not that Brussels has suddenly developed an aversion to the colour green. It is that European consumer law is beginning to ask a deceptively difficult question about the environmental language surrounding everyday products: what, exactly, is this sentence asking the consumer to believe? That question turns out to take us somewhere much more interesting than packaging. The problem with buying something you cannot inspect When you buy a chair, you can sit on it. When you buy a peach, you can eventually discover whether it tastes like a peach or like a small damp disappointment. But many environmental qualities cannot be verified by the person buying the product, even after using it. Economists describe characteristics like these as credence attributes. Whether a product was made under particular environmental conditions, whether its supply chain really has lower emissions, whether a material comes from the source claimed, or whether a production process genuinely reduces ecological harm is largely invisible to the buyer. Consumers therefore depend on signals supplied by producers, labels, certifiers and retailers to bridge an information gap they cannot realistically investigate themselves. Research on sustainability certification has long identified exactly this problem: environmental qualities are unusually dependent on trust because the consumer often cannot independently verify them through either inspection or experience. This makes environmental communication commercially powerful. A sustainability claim does not merely transmit information; it can influence how the entire product is perceived. Psychologists and consumer researchers call one version of this the halo effect. Once something is marked as environmentally preferable, people may unconsciously attribute other positive qualities to it as well. A wonderfully strange series of experiments published in Food Quality and Preference found that an eco-label could even make fruit seem to taste better and influence assessments extending beyond environmental performance. More recent research continues to find similar effects: a 2024 study involving 1,010 German consumers found that an environmental score affected not only perceived environmental friendliness but, under some conditions, expectations about healthiness and taste. So when regulators worry about a vague green claim, they are not being pedantic about adjectives. They are dealing with an information signal capable of changing how people value the thing being sold. The problem becomes sharper when almost anybody can manufacture the signal. The European Commission’s own work found that 53% of green claims examined provided vague, misleading or unfounded information, while 40% had no supporting evidence. It also counted 230 sustainability labels and 100 green-energy labels in the EU, with widely varying levels of transparency, and found that around half of green labels offered weak or non-existent verification. At that point, the humble leaf starts looking less like decoration and more like an unregulated unit of credibility. A market in adjectives This is why the new rules make more sense if we stop thinking about them as environmental legislation and start thinking about them as market legislation. Imagine two companies selling comparable products. Company A spends several years redesigning production, changing suppliers, measuring impacts, improving materials and paying for independent certification. Company B keeps roughly the same product but introduces a new package featuring a tasteful forest, the words planet conscious and, naturally, our old friend the leaf. If consumers cannot distinguish the underlying environmental performance, Company A has a problem. It has invested in environmental improvement while Company B has invested in environmental atmosphere. This is partly what the EU is trying to correct. The Directive itself explicitly connects reliable environmental claims with fair competition: if consumers can distinguish products with genuinely better performance, businesses making substantive environmental improvements are less likely to compete on equal terms with businesses making substantively better graphics. There is a democratic dimension here too. The green transition relies heavily on consumer choice, but consumer choice only works as a policy instrument when the information entering that choice is reasonably trustworthy. Asking citizens to “vote with their wallets” while allowing the ballot paper to be written by the marketing department has certain structural weaknesses. And this is where Europe has arrived at the slightly surreal but entirely logical business of regulating adjectives. So, can you still call something “green”? Yes. But not quite in the carefree way the word has sometimes been used. The Directive identifies generic environmental claims such as environmentally friendly, eco-friendly, green, ecological, climate friendly, carbon friendly, energy efficient, biodegradable and similar expressions. From September, such broad claims cannot simply be made unless the trader can demonstrate recognised excellent environmental performance relevant to the claim. There is, however, an important distinction between something generic and something specific. The Directive itself contrasts a phrase such as “climate-friendly packaging” with a statement explaining that 100% of the energy used to produce the packaging comes from renewable sources. The latter tells the consumer what the environmental advantage actually consists of, rather than asking two words and a hopeful colour palette to carry the entire burden. That distinction may sound linguistic, but it changes the logic of sustainability communication. For years, marketing has often done exactly what good marketing is trained to do: compress complexity. Supply chains, energy sources, material composition, lifecycle impacts and production methods become a memorable phrase because nobody has ever stood in a supermarket thinking, I wish this yoghurt label contained a methodological annex. The new law does not reverse that completely. Nor should it. But it does begin to set a limit on how much environmental complexity can be compressed before information becomes impression. The problem is not brevity. It is what disappears during compression. “Sustainable” may be an even more ambitious word than we thought One of the more fascinating details in the legislation concerns words such as sustainable, responsible and conscious. Those words can imply more than environmental performance. Sustainability may also carry social meanings: working conditions, fairness, animal welfare, human rights and other aspects of how a product or organisation behaves. The Directive therefore warns that excellent environmental performance alone cannot automatically justify sweeping generic claims such as sustainable or responsible. This is important because sustainable has spent years behaving rather like a very ambitious umbrella. A recycled package becomes a sustainable product. An efficiency improvement becomes a sustainable service. A lower-emission process becomes a sustainable business. One better-performing characteristic quietly expands until it appears to describe the moral condition of the whole organisation. The Directive tackles that tendency directly as well. It prohibits environmental claims about an entire product or business when the claim really concerns only one aspect of the product or one unrepresentative part of the company’s activities. Its own example is wonderfully ordinary: if only the packaging is made from recycled material, marketing the whole product in a way that gives the impression that the product itself is made from recycled material can be misleading. This may eventually become one of the most important habits the new rules encourage: the scale of the claim should resemble the scale of the evidence. A small improvement is still an improvement. It does not need to be promoted to sainthood. Zalando and the curious legal life of a leaf We already have a useful glimpse of what this new approach looks like in practice. The European Commission and national consumer authorities began a coordinated action involving Zalando after concerns about the platform’s sustainability claims. The resulting commitments are unusually revealing because they were not only about words. Zalando agreed to remove its sustainability flag, stop using misleading environmental icons including leaves and trees, and replace broad sustainability terminology in relevant product filtering with more specific information about product standards and attributes, including percentage figures where appropriate. There is something quietly significant about this case. Consumer protection law is entering the territory of semiotics: not only what a company literally says, but how colour, symbols, labels, positioning and language combine to create meaning. The Directive itself recognises that environmental claims can arise through the overall presentation of a product and that words combined with images or colours can create a generic environmental message. Which means the leaf is not prohibited. It simply no longer has diplomatic immunity. And researchers suggest regulators are right to care about visual cues. A 2026 study of more than 2,100 German consumers found that unregulated sustainability-related claims could significantly raise perceptions of environmental friendliness and, strikingly, often produced impressions comparable to those generated by the regulated EU organic label. Consumers did not always distinguish clearly between rigorous certification and much looser environmental signals. This is the deeper difficulty in what researchers sometimes call the label jungle. Consumers do not arrive at a shelf carrying a comparative database of certification methodologies. They use shortcuts. A logo looks official. Green looks environmental. A technical phrase sounds measured. A badge surrounded by enough circles begins to look as though somebody somewhere must have audited it. Sometimes somebody has. Sometimes the graphic designer had a productive afternoon. Europe would now like to know who gave you that badge The Directive therefore places much stricter conditions on sustainability labels. A sustainability label displayed in consumer-facing marketing generally needs to be either established by a public authority or based on a certification scheme meeting transparency and credibility requirements, including objective third-party monitoring. The goal is to stop organisations from creating private trust marks that visually resemble meaningful certification without having comparable verification behind them. Again, this is not an obscure concern. The Commission’s count of hundreds of sustainability and green-energy labels illustrates how difficult the landscape has become for ordinary consumers. The problem is not simply that there are many labels. It is that the visual grammar of certification is extremely easy to imitate. Put some text around a circle, insert a leaf, perhaps add the word verified, and the object begins to acquire institutional authority before anyone has asked who the institution is. Certification, at its best, solves an information problem by putting a credible third party between seller and buyer. A self-created sustainability badge can do the opposite: it borrows the visual language of independent verification while returning all the authority to the seller. Europe has decided that this distinction should be easier to see. The bottle that was 100% recycled, except for the bits that were not Another enforcement case shows how small the difference between clarity and impression can be. After a complaint concerning environmental claims on plastic bottles, Coca-Cola and Nestlé Waters entered discussions with the European Commission and national consumer authorities. Among the resulting commitments was a rather precise piece of language: claims such as “This bottle is 100% recycled” would need an adjacent clarification making clear when the cap and label were excluded, presented with appropriate prominence. This sounds almost comically minor. Surely nobody’s understanding of the European Green Deal depends on the bottle cap. But the example gets to the heart of the regulatory shift. 100% is not a mood. It is a number. If the thing being described is not actually 100%, the missing scope matters. The same principle becomes far more consequential when the subject is not a bottle but a company, a product lifecycle or a climate claim. Environmental communication often becomes misleading not because every individual fact is false, but because a true fragment is allowed to imply a larger truth. A factory runs on renewable electricity, therefore the product is green. A package contains recycled plastic, therefore the product is sustainable. A company buys carbon credits, therefore the service is climate neutral. Each step contains information. The trouble is the distance between the information and the conclusion. The particularly awkward case of the climate-neutral flight Aviation offers perhaps the clearest illustration. In March 2024, the District Court of Amsterdam ruled that several past KLM advertisements had been misleading. The court found that broad environmental statements and overly optimistic presentation of measures such as sustainable aviation fuels and reforestation could give consumers an excessively positive picture of the environmental consequences of flying. KLM remained free to communicate about its environmental ambitions, the court emphasised, but those communications needed to be honest and concrete. The issue did not stop with one airline. A coordinated European consumer-protection action eventually involved 21 airlines, which committed to changes concerning misleading environmental claims. Among the points addressed were claims suggesting that the emissions of a specific flight could be neutralised through a contribution or payment, use of vague green terminology and imagery, claims involving sustainable aviation fuels, and inadequately substantiated future environmental targets. The new Directive gives this issue a firm legal boundary. Product- or service-level claims such as climate neutral, CO₂ neutral, carbon positive, climate compensated or reduced climate impact cannot be based on greenhouse-gas offsetting outside the product’s own value chain. Companies can still tell consumers that they finance reforestation, carbon-credit projects or other environmental initiatives, provided the communication is not misleading. What they cannot do is transform the existence of that separate activity into the claim that the purchased product itself has become climate neutral. That distinction sounds technical, but it is philosophically rather neat. Funding a forest may be a good thing. It does not retroactively remove an aircraft’s exhaust from the sky. Consumers do not necessarily hear “offset” when businesses say “neutral” Research suggests the distinction matters because consumers may interpret climate language far more broadly than marketers intend—or, occasionally, far more broadly than marketers would mind. That 2026 German study of 2,109 consumers tested claims including climate neutral, CO₂ neutral, CO₂ compensated and climate positive. These labels improved perceived environmental performance for some products, while the researchers also found substantial misunderstandings about what the terms actually meant. Only a small share of respondents correctly understood that climate neutral does not necessarily mean zero emissions. When participants were instead given concrete numerical climate-footprint information, some of the exaggerated effect produced by the broad climate claim disappeared. That result is almost a miniature explanation of the new EU approach. Specific information may be less emotionally elegant than a grand environmental adjective. It is also harder to misunderstand. Brussels has even become suspicious of the future tense Companies are still allowed to set environmental ambitions. Europe has not outlawed optimism. But future-facing claims such as plans to become climate neutral, achieve net zero or reach other environmental targets are coming under tighter scrutiny. Under the Directive, claims about future environmental performance can be considered misleading where they are not supported by clear, objective, publicly available and verifiable commitments, set out in a realistic implementation plan with measurable and time-bound targets, resources allocated to achieving them, and regular verification by an independent third-party expert. This is quite an intervention in a familiar genre of corporate communication. A target set for 2040 has certain rhetorical advantages. It is close enough to suggest seriousness, distant enough to avoid bumping into next Thursday’s procurement meeting, and extremely unlikely to interrupt the current chief executive’s lunch. The new logic asks what connects today to that future date. What changes? Who is responsible? What resources exist? What milestones should already be visible five years from now? In other words, a future environmental promise increasingly needs something more substantial behind it than a future tense. Greenwashing is not only about deceiving the environmentally conscious There is a tendency to imagine greenwashing as a niche consumer issue affecting a particular type of earnest shopper comparing oat milks. The evidence suggests something larger is happening. Environmental cues can spill over into judgments that have nothing to do with the environmental characteristic itself. Research has found sustainability labels influencing perceptions of healthiness, safety, taste, quality and purchase intention. One recent study even found that consumers could treat environmental labels on food as signals of food safety, creating willingness to pay for a characteristic the environmental label was never intended to certify. That is why the word halo is so appropriate. A claim illuminates the attribute beside it and, before long, the glow reaches the rest of the product. This is also why the new legislation is about more than catching dishonest companies. Many misleading claims do not begin with somebody in a boardroom deciding to deceive the public. They can emerge much more mundanely. A sustainability team reports a real improvement. A communications team simplifies it. A designer makes the presentation attractive. A slogan loses a qualification. A product page survives three redesigns. Someone adds eco-friendly because the new packaging contains 30% less plastic. Nobody is necessarily twirling a moustache. By publication, however, the sentence may be promising considerably more than the evidence ever did. Greenwashing can be organisational drift. That makes it harder to solve than simply telling marketers to behave themselves. A small Brussels trap: this is not actually the Green Claims Directive There is one piece of housekeeping worth doing because European legislation has managed to create a branding problem inside legislation intended partly to fix branding problems. The rules applying on 27 September come from the Empowering Consumers for the Green Transition Directive, not the separate proposal commonly called the Green Claims Directive. The latter was proposed in 2023 to create additional rules for substantiating and communicating explicit environmental claims. Its legislative journey became politically complicated: the Commission announced an intention to withdraw the proposal in June 2025, trilogue negotiations were cancelled, yet the proposal remained listed as pending in the 2026 Commission Work Programme. The European Parliament’s Legislative Observatory currently records the procedure as awaiting the Council’s first-reading position. So if you have read that “the Green Claims Directive starts in September”, Europe has supplied us with a very appropriate example of why precision in claims is useful. The legislation that is becoming applicable is already substantial enough. This is also not a ban on sustainability language everywhere The scope matters. These are consumer-protection rules governing commercial practices between traders and consumers. They do not transform every environmental sentence uttered by every organisation into a consumer-law claim. A university research paper, an NGO’s project report and a mandatory corporate disclosure do not suddenly become product advertising because they contain the word sustainability. Context matters, however. The same piece of environmental information can move from reporting into marketing. A company may describe emissions data in a formal report and later reuse a simplified version in advertising. A social enterprise may publish an impact report and also sell consumer services. Organisations increasingly communicate across blurred boundaries, where institutional reputation, product marketing, ESG information and public storytelling overlap. The useful lesson is therefore not to develop a nervous tic every time somebody types the word green. It is to ask what role the statement is performing. Is it informing? Is it promoting? Is it comparing? Is it encouraging a consumer to choose one product over another because of an environmental advantage? Consumer law has always cared about context. Greenwashing simply gives the context more foliage. What changes after 27 September is partly the burden of imagination There is a larger cultural shift here that interests us at REDefine. For years, much sustainability communication has depended on consumers completing the sentence themselves. A leaf appears and we infer environmental care. A conscious collection appears and we infer a better supply chain. A climate-neutral delivery appears and we infer that somehow the delivery no longer contributes meaningfully to climate change. A sustainable choice badge appears and we assume somebody with a spreadsheet has checked. The new rules push back against this technique of outsourcing the claim to the consumer’s imagination. If a communication creates an environmental impression, the fact that the company never wrote the exact conclusion in twelve-point Helvetica may not make the impression irrelevant. Words, colours, images and context can work together. Consumer law increasingly looks at what the ordinary person is likely to understand, not simply at whether a lawyer can isolate one technically defensible phrase from the artwork around it. This is a fascinating development because it brings regulation closer to how communication actually works. Human beings do not consume advertisements as legal documents. We interpret them. And that may be good news for companies that are genuinely doing the work Anti-greenwashing rules are often presented as another compliance headache for business. There will certainly be work involved, particularly for companies that have accumulated environmental claims across packaging, websites, product catalogues, advertisements, labels and old stock. The Commission and national Consumer Protection Cooperation authorities have already had to address the treatment of goods and packaging produced or distributed before the September application date. Their June 2026 common approach emphasises good-faith, timely efforts to bring consumer-facing practices into compliance rather than pretending that warehouses cease to exist when legislation changes. But there is another side to the story. Companies that genuinely invest in environmental improvement have something to gain from a market in which environmental credibility becomes harder to manufacture cheaply. If certification, measurement, cleaner production, repairability, materials research or supply-chain reform costs money, then allowing competitors to achieve a similar consumer impression with an invented badge and a forest photograph undermines the commercial value of doing the difficult work. Better rules can make credibility itself less vulnerable to counterfeiting. That may ultimately be the most important market effect of the Directive. Perhaps the adjective was carrying too much The environmental systems behind a product can be staggeringly complicated: extraction, energy, transport, labour, manufacturing, chemicals, water, packaging, waste, emissions, biodiversity, repair, disposal and an international supply chain capable of giving an Excel workbook existential anxiety. Then, at the very end, we try to compress the entire thing into green. Perhaps it was always too much work for one adjective. The direction of European policy is increasingly towards claims that tell us which environmental characteristic improved, compared with what, across which scope, on what evidence and under whose verification. This does not mean consumer communication must become unreadable. It means clarity will have to come increasingly from precision rather than vagueness. And there is something almost refreshing about that. A company might have to say that its packaging contains a particular proportion of recycled material instead of declaring the product sustainable. An airline can describe investments in lower-emission technologies without pretending the passenger has purchased a climate-neutral flight. A retailer can explain the specific certification or material standard a product satisfies instead of attaching a mysterious leaf and inviting the imagination to finish the job. Perhaps the result will be slightly less poetic packaging. But we may gain something more useful: information. From 27 September 2026, the green transition will therefore acquire a small but important linguistic transition of its own. Environmental ambition can still be communicated. Improvements can still be celebrated. Companies can still tell compelling stories about becoming better. They will simply have to become more careful about the distance between what they have done and what they imply that they have done. Europe is not banning businesses from talking about sustainability. It is beginning to make environmental adjectives more expensive, because an adjective capable of creating trust, influencing purchasing decisions and conferring commercial value is not merely decoration. And after its extraordinary career, the leaf may finally need supporting documentation. Get full access to REDefine // Civic Intelligence at associationredefine.substack.com/subscribe (https://associationredefine.substack.com/subscribe?utm_medium=podcast&utm_campaign=CTA_4)

9. 

   27 Aug 2026

   Europe’s Open Source Moment: Why Digital Sovereignty Cannot Be Built Only with Slogans

   You send an email, save a document, open a school platform, retrieve a patient record or ask an AI assistant to summarise the report you absolutely intended to read yourself. The action takes seconds and feels almost weightless. Yet underneath it sits a technological system of remarkable physical and political complexity: software libraries, operating systems, cloud platforms, data centres, processors, cables, cooling systems, electricity grids, licensing agreements, standards, suppliers and global supply chains. What appears on the screen as a simple click is, underneath, an elaborate choreography of infrastructure. This is one of the peculiar achievements of modern digital technology. The better it works, the less of it we see. Electricity once arrived with visible power stations and telephones with wires running down the street. Cloud computing managed something more impressive: it persuaded us that industrial-scale computing infrastructure had become meteorological. Our files were suddenly “in the cloud”, as though spreadsheets and medical databases had evaporated gently into the atmosphere rather than being stored inside vast buildings full of machines that require land, water, chips, cooling equipment and a considerable amount of electricity. That illusion is becoming harder to maintain, and Europe has noticed. On 3 June 2026, the European Commission presented its European Technological Sovereignty Package, bringing together four major initiatives: Chips Act 2.0, the proposed Cloud and AI Development Act, a new EU Open Source Strategy, and a Strategic Roadmap for Digitalisation and AI in Energy. The Commission describes them as interconnected measures stretching across the technology value chain, from semiconductors and infrastructure to software, cloud and artificial intelligence. At first sight, it looks like the sort of policy bundle that could keep several Brussels conference rooms occupied for years without ever troubling an ordinary laptop user. Semiconductors belong to industrial policy, cloud infrastructure to IT departments, open source to software communities, and electricity grids to energy ministries. Put them together, however, and something much more interesting appears. Europe is beginning to treat the digital world not merely as a market to regulate, but as an infrastructure on which political and economic agency increasingly depends. The question underneath the package is therefore much larger than whether Europe can produce more chips or host more servers. It is this: how much control must a society retain over the technological systems on which it depends in order to remain capable of making meaningful choices? Europe Has Become Very Good at Governing Technology. That Is Not the Same as Controlling It. Over the past decade, the European Union has built perhaps the world’s most ambitious framework for governing the digital economy. The GDPR changed the global language of data protection. The Digital Markets Act challenged the power of technological gatekeepers. The Digital Services Act created new obligations around large online platforms. The AI Act established a risk-based framework for artificial intelligence. The Data Act, Data Governance Act, Cyber Resilience Act and Interoperable Europe Act have added further layers to a regulatory architecture that is now studied well beyond Europe. This has given the EU considerable regulatory power. Companies wishing to operate in the European market must often adapt to European rules, and the size of that market means those rules can influence practices elsewhere. For years, this phenomenon has been described through the “Brussels effect”: Europe may not dominate every technology, but it can exert influence by setting the conditions under which technology enters its market. The Technological Sovereignty Package suggests that Brussels increasingly understands the limit of that model. Rules can determine what a cloud provider is permitted to do, but rules alone do not create an alternative cloud provider. Regulation can require data portability, but it cannot automatically give a hospital the technical capacity to migrate thousands of systems. Europe can regulate advanced AI while still depending heavily on computing infrastructure and processors supplied by companies headquartered elsewhere. It can create sophisticated rights around digital systems while lacking sufficient alternatives if the owners of those systems change their commercial or geopolitical calculations. There is, in other words, a difference between being sovereign over the rules and being sovereign enough to act. The Commission now defines technological sovereignty partly as Europe’s ability to develop and control key technologies, data and infrastructure while reducing excessive reliance on non-EU providers. That concern also appears to have considerable public support. In the 2026 Digital Decade survey, 85% of Europeans supported investment in EU-developed digital infrastructure and 82% favoured reducing dependence on non-EU suppliers. This does not mean that Europe has suddenly discovered protectionism or decided that every useful technology should acquire twelve stars and a .eu domain. The more serious question is about capacity. A political community may remain deeply interconnected with the rest of the world while ensuring that critical dependencies do not become points of paralysis. That distinction matters because dependence is not necessarily weakness. The modern economy is constructed from dependencies. Weakness appears when dependence becomes asymmetric, opaque and difficult to reverse. Perhaps Sovereignty Is Really About Optionality There is a useful idea from finance that rarely appears in debates about digital sovereignty: option value. An option is valuable even when you do not intend to use it, because it preserves the ability to respond if circumstances change. The possibility of leaving a supplier, switching technology, sourcing a component elsewhere or operating a system differently has value long before anybody actually wants to exercise it. That may be one of the most useful ways to think about Europe’s technological sovereignty. Imagine a municipality whose entire administrative infrastructure runs through one vendor. The arrangement may work perfectly well. The supplier may be reliable, the price acceptable and the software familiar. For years, there may be no reason to change anything. Gradually, however, databases, document systems, authentication tools, workflows, staff practices and specialist knowledge become organised around that ecosystem. The cost of leaving rises certainly and invisibly. Then something changes. Prices increase. A product is discontinued. Licensing conditions become less favourable. An acquisition changes the supplier’s strategy. A service becomes subject to legal obligations in another jurisdiction. A cybersecurity concern emerges. Suddenly, the theoretical possibility of moving elsewhere has to confront the practical reality of doing so. At that point, sovereignty is no longer an abstract discussion about where a server happens to be located. It becomes brutally operational. Can the organisation retrieve its data in usable formats? Can competing services interpret those formats? Are open standards available? Are staff capable of managing the migration? Can another supplier take over without rebuilding the entire system? Does the organisation even know which dependencies exist beneath the applications its employees use every day? The proposed Cloud and AI Development Act reflects this more sophisticated understanding. It introduces an EU-wide framework for assessing different degrees of cloud and AI sovereignty, considering not merely physical location but issues such as control, independence from third-country influence, software-supply-chain transparency and resilience. The Commission also links technological sovereignty to procurement, interoperability and open-source alternatives. That is important because European location is not automatically European control. Moving a server from Virginia to Frankfurt may improve some things enormously, but it does not by itself resolve every dependency embedded in the ownership, software, contractual structure or supply chain surrounding that server. A credible exit can therefore be as important as domestic ownership. Indeed, one of the best indicators of power in a relationship is often whether either party can realistically walk away. The Stack Is the Strategy The four components of the Commission’s package make much more sense when we stop looking at them horizontally as separate policy initiatives and instead look vertically at the technological stack. Start with an ordinary cloud application. The application depends on software. The software runs on cloud infrastructure. The infrastructure lives inside data centres. Those data centres contain servers and specialised computing equipment. Those machines depend on semiconductors. Their operation depends on electricity, cooling systems, network infrastructure and physical resources. Artificial intelligence intensifies several of these dependencies simultaneously because advanced models require enormous quantities of computing power. Once seen this way, Europe’s package becomes less mysterious. Chips Act 2.0 addresses one layer. The Cloud and AI Development Act addresses another. The Open Source Strategy reaches into the software layer, while the energy roadmap confronts the physical system supporting the entire structure. The Commission itself describes the initiatives as mutually reinforcing across the value chain. That matters because technological sovereignty is only as resilient as the relationships between these layers. Owning a data centre is of limited strategic value if it cannot obtain the advanced chips it requires. Producing chips is insufficient if Europe lacks competitive cloud infrastructure capable of using them. Building AI computing capacity becomes meaningless without access to electricity. Open-source software cannot provide meaningful alternatives if nobody has the expertise or resources to maintain it. The digital economy therefore begins to resemble older forms of infrastructure more than we sometimes admit. In the nineteenth and twentieth centuries, governments understood perfectly well that railways, ports, telegraph lines, energy networks and industrial capacity were not simply commercial assets. They shaped what a country could move, produce, communicate and defend. Infrastructure created possibilities and dependencies simultaneously. The cloud did not abolish that political economy. It merely gave it better branding. Chips: Europe Does Not Need to Make Everything, but It Cannot Afford to Know Nothing Semiconductors provide perhaps the clearest example of the difference between independence and resilience. Chips sit inside almost every strategic sector modern Europe cares about: telecommunications, vehicles, medical equipment, industrial machinery, defence systems, energy infrastructure, cloud computing and artificial intelligence. Yet Europe’s share of the global semiconductor market remains around 9%, well below its Digital Decade ambition of reaching 20% by 2030. The first European Chips Act, adopted in 2023, nevertheless helped mobilise more than €52 billion in public and private investment and is estimated by the Commission to have created around 46,000 direct and indirect jobs. Chips Act 2.0 now seeks to strengthen both advanced and mainstream semiconductor capacity, support design capabilities, increase European demand and reduce vulnerabilities in critical supply chains. The obvious temptation is to translate semiconductor sovereignty into a simple numerical objective: Europe should produce a larger percentage of the world’s chips. But semiconductor production is one of the most internationally fragmented industrial systems humans have ever created. Chip architecture, design software, lithography equipment, specialist chemicals, fabrication, memory, packaging and testing are concentrated in different companies and regions. Some parts of the chain are extraordinarily difficult to reproduce. Technological sovereignty therefore cannot sensibly mean reconstructing the entire semiconductor ecosystem behind a European border. The more useful question is where the absence of European capacity would become strategically dangerous. Europe needs enough capability to understand the technology, shape its development, maintain leverage in international supply chains and prevent the disappearance of alternatives in areas essential to its economy and public infrastructure. This is the first place where slogans fail. “Made in Europe” sounds reassuring. A resilient semiconductor strategy is much less photogenic: it requires knowledge of supply-chain bottlenecks, investment horizons, specialised skills, energy requirements, customer demand and the awkward reality that genuine resilience often depends on carefully managed international interdependence rather than self-sufficiency. The Cloud Is Becoming Ordinary Infrastructure The cloud layer is already much closer to ordinary European life. In 2025, 52.7% of EU enterprises purchased cloud-computing services, up from just 17.8% in 2014. Among companies using paid cloud services, 85% used them for email, around 72% for office software and another 72% for file storage. For large businesses, overall cloud adoption had reached 85%. Those numbers are revealing because they show how quickly cloud infrastructure has moved from technological novelty to organisational plumbing. Email, document storage, databases, accounting, customer management and increasingly AI functionality now depend on systems that many organisations neither own nor meaningfully understand. This is not inherently a problem. Cloud services offer enormous advantages. A small company no longer needs to build its own data centre to access sophisticated computing infrastructure. Universities can scale research workloads. Public bodies can improve services without maintaining every component internally. Startups can acquire computing resources that once belonged only to large corporations. The sovereignty question emerges because cloud markets also exhibit strong concentration and because switching away from complex ecosystems can become progressively harder. The Commission’s August 2026 study supporting CADA identifies both limited and geographically concentrated European computing capacity and continuing dependence on non-European cloud and AI suppliers as significant challenges. It also highlights lock-in practices, third-country laws with extraterritorial effects, constraints around energy and water, and the difficulty of expanding data-centre infrastructure. CADA responds with an ambitious physical objective: the EU wants to at least triple its data-centre capacity within five to seven years, while simplifying permitting and improving access to land, energy, water and finance. That sentence is worth pausing over. Discussions about digital sovereignty often sound as though they belong entirely to software policy. Yet Europe cannot become more capable in AI and cloud without deciding where large industrial facilities will be built, how they will connect to electricity networks, what resources they will consume and who will finance them. Eventually, every cloud touches the ground. AI Has Rediscovered the Electricity Grid Artificial intelligence has made the physicality of digital infrastructure impossible to ignore. The International Energy Agency estimates that global data-centre electricity consumption reached around 485 terawatt-hours in 2025 and could approach 950 TWh by 2030, roughly doubling in five years. Consumption by AI-focused data centres is expected to grow considerably faster. The numbers become stranger at machine scale. The IEA estimates that by 2027, a single advanced server rack could require peak power comparable to 65 households. Between 2020 and 2025, the power density of AI servers increased eleven-fold. Europe is already feeling this transition. Data centres currently account for around 2.5% of EU electricity consumption, while installed capacity is expected to rise from roughly 12 GW in 2025 to around 28 GW by 2030. The Commission warns that data-centre demand is geographically concentrated and that individual new facilities can require connections comparable to major industrial sites. This creates one of the more interesting paradoxes in Europe’s technology strategy. Artificial intelligence is being promoted partly because it may help optimise electricity networks, forecast demand, integrate renewable energy and improve industrial efficiency. At the same time, the infrastructure required to run AI is placing additional demands on those same electricity systems. AI may help manage the grid. The grid must first survive the AI. That circular relationship explains why a Strategic Roadmap for Digitalisation and AI in Energy belongs inside a technological-sovereignty package. It also tells us something important about the future of digital policy. The boundary between industrial policy, technology policy and energy policy is disappearing. Europe cannot plan an AI economy without simultaneously planning transmission capacity, electricity generation, transformers, cooling, land use and grid connections. The same transition occurred during earlier industrial revolutions. Factories changed the demand for coal and transport. Electrification reorganised cities and industry. Motorisation required roads, oil infrastructure and new forms of urban planning. Artificial intelligence may appear on our screens as software, but its expansion increasingly resembles a heavy-industrial transition occurring behind a user interface. This Is Why Open Source Has Suddenly Become Strategic Among the four initiatives, the EU Open Source Strategy may initially seem like the odd one out. Chips and data centres are obviously strategic assets. Open-source software still carries a cultural association with programmers, collaborative communities and repositories whose names most citizens will never encounter. Yet open source already sits beneath an extraordinary amount of the digital economy. Web servers, operating systems, programming languages, cryptographic libraries, databases, networking technologies, cloud infrastructure and development tools depend extensively on openly developed components. Much of the apparently proprietary digital world is built on foundations that are not proprietary at all. Europe has known for some time that this has economic significance. A Commission study published in 2021 estimated that EU companies invested roughly €1 billion in open-source software in 2018, producing an economic impact estimated between €65 billion and €95 billion. The same study modelled that a 10% increase in contributions to open-source software could generate between 0.4% and 0.6% additional EU GDP annually under its assumptions, alongside more than 600 additional ICT startups. Those figures are older than the current package and should not be treated as a real-time valuation of Europe’s open-source economy. Their importance lies elsewhere: they show that open source was already economically substantial long before European policy began discussing it primarily through the language of sovereignty. The strategic attraction is straightforward. Open code can be inspected. It can often be adapted. Multiple companies can provide services around it. Standards and interfaces can be more transparent. Knowledge does not necessarily disappear when one vendor withdraws a product. In principle, open-source ecosystems can make technological systems more contestable. And contestability is closely related to the optionality we encountered earlier. If five companies can maintain, host or extend a technology, the relationship between customer and supplier looks very different from a system in which only the original vendor possesses the knowledge and legal authority required to operate it. Open source therefore matters not because it makes Europe technologically pure, but because it can preserve the possibility of alternatives. This is an important distinction. Some of the world’s most successful open-source projects are profoundly global. Their contributors, users and maintainers cross political borders constantly. Open source is not inherently European, and attempting to turn it into a form of digital nationalism would miss much of its value. What open source can provide is distributed technological agency. The Maintenance Problem Nobody Puts on the Poster There is, however, an uncomfortable problem hiding inside the enthusiasm for open alternatives. Access to code is not the same thing as the capacity to sustain it. Software has to be maintained. Security vulnerabilities have to be repaired. Dependencies need to be monitored. Documentation must be written. New hardware and operating systems have to be supported. Someone needs to answer questions from users who have somehow managed to configure the system in a way nobody believed technically possible. The entire modern digital economy contains critical components maintained by relatively small communities. This creates a peculiar mismatch between social dependence and economic visibility. Infrastructure can be essential while the people maintaining it remain poorly funded because the infrastructure is most valuable precisely when nobody notices it. There is a parallel here with bridges, drainage systems and electricity networks. Maintenance rarely produces political excitement. Opening a new bridge attracts cameras; inspecting the bolts for twenty years does not. Yet infrastructure usually fails because societies neglect maintenance, not because they forgot how to cut ribbons. Open-source infrastructure faces the same problem. Europe’s new strategy recognises this more clearly than previous approaches, proposing measures around long-term sustainability, security, public-sector competence and maintenance. This may prove more consequential than encouraging public administrations simply to “use open source”. Without skilled people, institutional knowledge and sustainable funding, open code can become another form of dependency. Europe could theoretically replace reliance on a multinational software company with reliance on a small group of chronically overworked maintainers and then declare the exercise a victory for sovereignty. The real objective has to be deeper: Europe must become capable not merely of accessing important technologies, but of understanding, maintaining and developing them. That is a much more demanding form of sovereignty. The Invisible Power of Procurement If open source provides potential alternatives, public procurement may determine whether those alternatives ever become strong enough to matter. This sounds considerably less exciting than semiconductors or artificial intelligence, which is probably why it deserves more attention. Most of the time, digital lock-in doesn’t show up through a dramatic geopolitical decision. More often it accumulates through years of perfectly rational procurement choices. A ministry buys the software its employees already know. A municipality renews the contract because migrating would be expensive. A school chooses the platform used by neighbouring schools. Additional systems are then integrated around that original decision. Staff are trained. Data accumulates. Contractors specialise. Five years later, switching is technically possible but organisationally terrifying. Economists call this path dependence: early choices influence the range of choices that remain practical later. Technology markets are particularly susceptible because standards, skills, data formats and network effects can amplify the consequences of apparently small decisions. This is where digital sovereignty becomes less about heroic European inventions and more about procurement clauses nobody will ever frame on a wall. Does the contract require usable data export? Are open standards supported? Are interfaces documented? Can another provider assume operation of the system? Does the organisation retain access to necessary technical knowledge? How are switching costs assessed? Is the cheapest offer today still the cheapest offer once ten years of dependency are included? The new European initiatives increasingly recognise procurement as an industrial-policy tool. CADA proposes common procurement mechanisms for public administrations, while the Open Source Strategy specifically addresses procurement guidance and public-sector adoption. This is important because markets do not produce alternatives merely because policymakers wish alternatives existed. European providers need customers, scale and predictable demand. Open-source ecosystems need organisations willing to procure services around them. Smaller technological actors need interoperability rules that prevent incumbents from turning existing market share into permanent architecture. A sovereign technology policy therefore has to care about buying boring things well. Sovereignty Is Not Autarky None of this means Europe should attempt to build a sealed digital economy. Technological autarky would be both unrealistic and undesirable. Modern semiconductor production relies on international specialisation. Scientific research depends on global exchange. Open-source communities are international by design. European companies benefit enormously from technologies developed elsewhere, just as companies elsewhere benefit from European research, equipment, standards and markets. The problem is not foreign technology. The problem is unavoidable dependency without adequate counterweight. There is a crucial difference between interdependence and helplessness. In an interdependent system, participants need one another and possess enough alternatives, expertise or bargaining power to prevent one relationship from becoming absolute. In a helpless system, one side discovers that the other can change the conditions while it has nowhere meaningful to go. This is why technological sovereignty should not be measured simply by counting European companies or calculating the percentage of infrastructure physically located on European soil. A genuinely sovereign system could include non-European suppliers while remaining resilient because standards are open, services are substitutable, skills are distributed, procurement preserves competition and critical capabilities exist inside Europe. Conversely, a system filled with European flags could remain remarkably fragile if it depends on a handful of irreplaceable suppliers. The deeper goal is not independence from everyone. It is freedom of action within interdependence. The Most Interesting Test Is Whether Europe Can Say No Seen in this light, the European Technological Sovereignty Package is not really four initiatives. It is an attempt to construct a more complete theory of digital power. Chips matter because computing requires physical components. Cloud matters because digital economies increasingly rent rather than own computing infrastructure. AI matters because access to computation is becoming an economic capability in its own right. Energy matters because computation ultimately depends on electricity. Open source matters because knowledge, inspectability and substitutability influence who can control and maintain the systems connecting all the other layers. The package will therefore deserve to be judged by more than the amount of investment it mobilises or the number of data centres Europe builds. Those indicators matter, but the more revealing tests will be practical. Can a European public administration change a critical supplier without years of disruption? Can European companies obtain advanced computing capacity on conditions that preserve meaningful choice? Can hospitals and schools understand where their most sensitive digital dependencies sit? Can European firms participate in strategic layers of the semiconductor value chain strongly enough to preserve bargaining power? Can governments identify and sustain the open-source components embedded in critical systems? Can the electricity system accommodate rapidly growing digital infrastructure without transferring its costs and vulnerabilities elsewhere? Ultimately, can Europe say no when saying yes is no longer in its interest? That may be the most useful definition of sovereignty in the entire debate. A choice is meaningful only if declining one option does not make participation in modern society impossible. Looking Under the Floorboards This brings us back to the question we have been exploring in The Code Beneath the Floorboards. For a small organisation selecting software, the immediate questions tend to be practical. Does the platform work? How much does it cost? Will staff understand it? Does it integrate with existing systems? Those are sensible questions, but they are questions about the present. The more consequential questions concern the future. What happens if the supplier changes? Can the data move? Who understands the technology? Can another provider maintain it? Are there alternatives? What disappears if the organisation stops paying? Which dependencies have been created by today’s convenience? Europe is now asking exactly the same questions at extraordinary scale. That is why the 3 June package matters beyond Brussels. It suggests that digital sovereignty is beginning to mature from a political slogan into a discussion about architecture, capabilities and choices. The interesting part is not whether Europe can manufacture every chip, host every service or produce a European equivalent of every successful technology elsewhere. It cannot, and it should not try. The more credible ambition is to ensure that Europe retains enough knowledge, infrastructure, supplier diversity, open technology, industrial capacity and interoperability that dependency does not quietly become powerlessness. This is a less dramatic vision of sovereignty than technological independence. It is also much harder to achieve. It requires investment, but also maintenance. Competition, but also standards. Open software, but also people capable of sustaining it. European infrastructure, but also global partnerships. Regulation, but also industrial capacity. And perhaps most importantly, it requires institutions to think about exit before they urgently need one. The next time you save a file to the cloud, nothing geopolitical will appear to happen. The document will disappear behind a familiar icon, the interface will reassure you that everything has been saved, and most of the technological stack underneath will remain invisible. But that stack increasingly determines who can build, who can compete, who can change direction and who has to accept the conditions offered by somebody else. Digital sovereignty begins when we stop admiring the interface and start asking what lies underneath it. Europe does not need to own every floorboard. But it does need to understand what the house is standing on, which parts it can repair, and whether the doors still open from the inside. Get full access to REDefine // Civic Intelligence at associationredefine.substack.com/subscribe (https://associationredefine.substack.com/subscribe?utm_medium=podcast&utm_campaign=CTA_4)

10. 

    24 Jul 2026

    EU in Practice: Your Phone May Soon Have More Than One Brain

    When Your Phone Answers, Who is Allowed to Speak? You ask your phone for help. Maybe you are cooking and your hands are covered in flour, or driving, or late, or half-charged, or trying to remember whether the meeting is at 10:00 or 10:30 while also pretending you are not annoyed with the entire universe. You say the little phrase your phone recognises, and the assistant wakes up. It answers, searches, opens something, suggests a route, adds a reminder, reads a message, or tries very hard to be helpful while occasionally misunderstanding the simplest possible instruction. It feels like a private moment between you and your device, but behind that tiny moment sits a much larger question: who was allowed to answer? A phone assistant is not only a friendly voice. It is connected to the operating system, the microphone, the screen, the apps, the search engine, the calendar, the map, the notification layer, the browser, the data trail, and the permissions that decide what can act on your behalf. The assistant that can wake up easily, understand context, move across apps, and perform tasks in the background is not just another app. It is closer to a new interface layer between the user and the digital world. That is why the European Union is interested. Brussels did not suddenly develop strong feelings about whether your phone should sound cheerful before telling you it cannot find your headphones. The issue is deeper than that. In digital markets, choice is not limited to whether you can download another app. Real choice depends on defaults, permissions, interoperability, access to data, system integration, and whether a rival service can actually work inside the environment where people already live their digital lives. In other words, the question is not only whether you can install another AI assistant. The better question is whether that assistant can actually function as an assistant. The Phone Is Becoming an Interface to Everything For years, smartphones have been described as devices. That is still true, but it is increasingly incomplete. A smartphone is also a wallet, a map, a camera, a calendar, a notebook, a search portal, a memory machine, a workplace, a school bag, a health tracker, a family coordination centre, and the small glowing rectangle through which many people now negotiate daily life. AI assistants may intensify that role because, if they become more capable, they may not simply answer isolated questions. They may coordinate tasks across apps, understand context, draft replies, summarise content, book services, compare options, retrieve information, interpret what is on screen, and act on the user’s behalf. That could be useful. It could also make the assistant one of the most important gateways inside the device. If one company controls the operating system and also gives its own assistant deeper access to that system, rival assistants may technically exist while being practically disadvantaged. They may be available to download, but less convenient to activate. They may be intelligent, but unable to access enough context. They may be present on the phone, but not truly integrated into it. One assistant becomes part of the nervous system. The others are politely waiting behind icons. This matters because most users do not redesign their phones from first principles. They use what is easiest, most visible, most integrated, and least annoying to configure. Life is busy, settings menus are often hostile to human dignity, and no ordinary person wants to spend Saturday afternoon conducting a constitutional convention inside their device. Default settings are not neutral. They are behavioural architecture. Why Digital Choice Is Not Just Downloading Another App Digital choice is often described as if it begins and ends with availability. Can you download another browser? Can you install another assistant? Can you create an account with a different service? If the answer is yes, the market may look open from the surface. But digital markets are shaped not only by whether alternatives exist, but by whether alternatives are usable, visible, trusted, integrated, and convenient enough to become real options. A user may technically be free to choose a rival AI assistant, but if that assistant cannot be activated easily, cannot access the features it needs, cannot act across apps, cannot run in the background, or cannot understand enough context to be genuinely useful, the choice is weaker than it looks. It is not fake, exactly, but it is thinner than the word “choice” suggests. It is like being told you can choose any door you want, while one door is open, lit, signposted, and connected to the building, and the other is technically available somewhere behind six settings menus and a warning screen. This is why default settings matter so much. Convenience is power. A service that works immediately has an advantage over a service that requires extra steps, extra permissions, extra configuration, and extra patience. In ordinary life, people do not choose tools under laboratory conditions. They choose while tired, busy, distracted, and trying to get something done. A rival service that requires users to fight the device before they can use it is not competing on equal terms with the service already built into the device. What the Digital Markets Act Is Trying to Do The Digital Markets Act, or DMA, is the EU’s attempt to make digital markets fairer and more contestable by setting rules for very large platforms that act as “gatekeepers.” These are companies that control important access points in the digital economy: operating systems, app stores, search engines, marketplaces, browsers, advertising systems, or other core platform services. The DMA does not say that large platforms are bad simply because they are large. The concern is what happens when the same company both controls the gate and competes with everyone trying to pass through it. The word “gatekeeper” is useful because it names a kind of power that is easy to miss. Some companies do not only sell products in a market. They shape the conditions under which other products can be found, installed, activated, trusted, paid for, connected, or used. They define the rules of access. They decide what is easy, what is buried, what is seamless, what is technically possible, and what requires users to fight their own device. This is why the current AI assistant debate is so interesting. In the older version of this conversation, the focus was on app stores, browsers, search engines, marketplaces, and operating systems. Now the same logic is being applied to AI assistants. The question is shifting from the old internet problem of whether competitors can reach users to a newer AI problem: can competitors function properly once they get there? What the Commission Decided About Google, Android and AI Assistants In July 2026, the European Commission issued two sets of binding specification measures to Google under the DMA. One set concerns AI interoperability on Android. The other concerns sharing certain Google Search data with eligible competitors. The Commission says the aim is to give European users a wider and more feature-rich range of options for AI services on Android and for search services. The Android part is the one that feels most immediate. The Commission argues that competing AI assistants on Android currently face restricted access to key operating-system functionalities, while Google’s own AI services, such as Gemini, may benefit from deeper access. It also notes that around 60% of European mobile users use Android devices, which means the way Android structures access has consequences far beyond a technical developer dispute. Under Article 6(7) of the DMA, Google must provide developers with free and effective interoperability with hardware and software features controlled by Android. The Commission’s specification proceedings were opened in January 2026 and led to a final decision in July 2026 covering 11 Android features relevant for AI services. These include invocation, context, actions on apps and the operating system, access to resources, hardware and software resources, on-device AI models, and background execution. These are not decorative features. They determine whether an assistant can be woken by voice, understand what the user is doing with consent, act across apps, and perform useful tasks beyond its own small corner of the phone. Translated into ordinary language, the issue is this: if Google’s own AI assistant can use the phone’s deeper functions, should rival assistants be unfairly locked out of those functions? The Commission’s answer is no. That does not mean every assistant gets unlimited access to everything. It means that the gatekeeper must provide effective interoperability so competing services can offer users a genuine alternative. A rival assistant should not have to compete with one hand tied behind its back simply because it was not built by the company that controls the operating system. This is where the title becomes less silly than it sounds. Your phone may soon have more than one brain, but the question is whether each brain is allowed to connect to the body. An AI assistant that can wake up by voice, understand context, act across apps, and run in the background is not competing in the same way as an assistant that waits behind an icon. One is integrated into the phone. The other is merely present on it. Why Search Data Matters for AI Assistants Too The second part of the Commission’s decision concerns Google Search data. Search may feel like yesterday’s internet compared with AI assistants, but it is actually central to the next stage. AI assistants and AI search tools need fresh information, retrieval systems, ranking signals, query understanding, and access to the web. They do not become useful only by sounding confident. They become useful by being able to find, rank, retrieve, and ground information well. Google Search has had a huge advantage here because it has operated at extraordinary scale for years. The Commission says Google Search has held more than 90% market share in Europe for decades, giving it access to user data that other search engines cannot match. Under Article 6(11) of the DMA, Google must share anonymised search data with eligible online search engines under fair, reasonable and non-discriminatory terms. The Commission’s specification proceedings are intended to make that obligation effective, including for AI chatbots offering search functionalities. Again, the simple version is that search engines learn from searches. They learn what people ask, what results are shown, what users click, which results appear useful, which spelling corrections matter, how queries change, and what kinds of results satisfy different questions. If one search engine has decades of this data at enormous scale, and if search becomes part of AI assistant competition, then the old search advantage may become a new AI advantage. This is why the Commission treats search data as part of the competition story. A rival AI assistant may have good models, good design, and strong user interest, but if the information infrastructure behind it is weaker, it may struggle to compete. Users will not choose alternatives out of civic duty for very long. They choose tools that work. If alternatives are to compete, they need enough access to become good. The Counterargument: Openness Can Create Real Risks This is where the counterargument becomes important, because Google’s concerns are not ridiculous. Google argues that the Commission’s decisions could weaken privacy and security protections for European users. In its response, Google says the Android ruling could grant external apps sensitive and powerful device permissions without the safeguards that normally come through Android’s existing security and device-maker vetting processes. It also argues that private searches could be exposed to unfamiliar companies, creating risks for privacy, business secrets, and security. This argument should not be dismissed simply because it comes from Google. There are real risks in opening system-level access. AI assistants are not weather widgets. They may request access to microphones, screens, context, apps, messages, calendars, location, browser activity, or background functions. If a weak, malicious, careless, or poorly governed assistant receives deep access to a phone, the consequences could be serious. Users may not understand what they are granting. Consent screens may become too frequent to be meaningful. Security review may become harder. Device integrity may be affected. Bad actors may try to exploit new pathways. The same is true for search data. Anonymisation is important, but anonymisation is not magic dust sprinkled over risk. Search queries can be sensitive. They can reveal health worries, political interests, financial stress, family problems, legal concerns, location patterns, and intimate questions people ask only because they believe a search box is private enough. Even when personal identifiers are removed, data protection still depends on how data is processed, aggregated, restricted, audited, and protected from re-identification or misuse. So yes, there is a real tension here. Open too little, and dominant platforms can lock competitors out while telling users they have choice. Open too much, or open badly, and the phone becomes a more dangerous environment. The question is not whether openness is always good. The question is what kind of openness is safe enough, accountable enough, and meaningful enough to make competition real without turning users into the price of competition. The Counter-Counterargument: Security Can Also Protect Market Power At the same time, we need to be honest about another possibility. Security and privacy are real concerns, but they can also be used as arguments to preserve control. This is one of the hardest problems in digital regulation. The company that controls the platform often knows more about the technical risks than regulators, competitors, or users. That expertise is valuable, and it may also be self-interested. When a gatekeeper says, “Only we can keep this safe,” it may be telling the truth, or it may be defending a closed system that benefits from being closed. Often, it may be doing both. This is why the EU cannot simply accept either side’s framing. If regulators treat all gatekeeper concerns as excuses, they may create dangerous rules. If they treat all gatekeeper concerns as decisive, they may allow safety language to become a permanent barrier to competition. The hard work is to design access with safeguards. The Commission says its search-data decision requires anonymisation of end-user personal data and includes technical, organisational, administrative and contractual protections, as well as audit mechanisms and eligibility criteria for who can access the data. That is the regulatory balancing act: not “open everything,” and not “trust the gatekeeper forever,” but controlled access, defined purposes, safeguards, audits, restrictions, and accountability. Whether that will work in practice is the question worth debating. The Commission can design procedures, but implementation will matter. Competitors will have to prove trustworthiness. Google will have to comply in ways that do not make access useless. Regulators will have to monitor whether safeguards work. Users will have to understand enough about their choices to make them meaningful. This is not a neat story with a clean hero and a clean villain. It is a story about competing risks. What Does User Choice Really Mean? This whole debate becomes more meaningful when we stop treating “choice” as a surface-level concept. In ordinary conversation, choice sounds simple. You either can choose something, or you cannot. But digital choice is more complicated because the environment shapes the options before the user arrives. A user may be free to install another assistant, but if that assistant cannot be activated easily, cannot access enough context, cannot perform tasks across apps, and cannot operate smoothly in the background, the user is likely to return to the default. Not necessarily because the default is better, but because the default is easier. Convenience is power. Digital markets are not only shaped by price or quality. They are shaped by friction. A service that requires five extra steps is not competing on equal terms with one that works immediately. A tool buried in settings is not competing equally with one that appears during setup. A rival assistant that cannot use system-level functions is not competing equally with the assistant built into the operating system. This is why “you can download another app” is often an incomplete answer. It is like saying a small shop can compete with a supermarket because both technically exist in the same city, while ignoring that one is on every main road, has exclusive parking, owns the delivery network, controls the map, and appears as the default option whenever anyone searches for food. Existence is not the same as access. Access is not the same as usability. Usability is not the same as meaningful choice. The DMA is trying to regulate that difference. What Could Go Right? If the Commission’s approach works, European users may see more meaningful competition between AI assistants. A user could choose a preferred assistant and have it function more deeply inside Android. Smaller or alternative providers could build services that compete on quality rather than being trapped outside the operating-system layer. AI search services could improve because they gain access to certain search data under defined conditions. The market could become less dependent on one company’s default position. Users could have more paths through digital life. That optimistic version is not trivial. If AI assistants become central to how people search, work, learn, shop, communicate and organise tasks, then preventing that layer from becoming locked early could matter enormously. The internet has already taught us that defaults, data advantages and platform control can shape markets for decades. The AI assistant layer may become another moment where early architecture hardens into long-term power. If the EU gets this right, it may help keep that layer more open. It may also support better innovation. When alternatives can genuinely compete, the market may produce assistants with different strengths: more privacy-focused assistants, more specialised professional assistants, assistants designed around accessibility, assistants that work better in specific languages, or assistants connected to different search and knowledge ecosystems. Competition is not only about giving users more logos to choose from. At its best, it creates pressure to improve the actual experience. What Could Go Wrong? But there is also a less optimistic version. If interoperability is implemented badly, users may face confusing permission systems, weaker device protections, or assistants that request more access than they need. If the search data-sharing system is poorly governed, sensitive data could be mishandled, or supposedly limited data could be used in ways users did not expect. If the compliance burden is too complex, only larger competitors may be able to benefit, while smaller actors remain excluded. If the rules are too rigid, they may struggle to keep pace with technical change. There is also a more subtle possibility: the EU may succeed in opening access, but users may not care. Regulation can create the possibility of choice, but it cannot force people to exercise that choice. Many users may continue using the default because it is familiar, good enough, or already connected to everything else. Competitors may gain access and still fail to offer a better experience. Choice screens may appear and be ignored. Interoperability may improve competition at the margins without changing everyday behaviour very much. That would not mean the effort is pointless, but it does remind us that regulation is not magic either. The EU can open doors. It cannot make people walk through them. A fairer market still needs credible products, clear design, real user trust, and alternatives that are not only available, but good enough to become habits. The Deeper Question: Who Governs the Assistant Layer? The deeper question is not whether one decision about Google is good or bad. The deeper question is how the assistant layer should be governed. If AI assistants become the new interface to digital life, then they sit at the intersection of several forms of power. They are shaped by operating systems, search engines, app ecosystems, hardware permissions, data flows, cloud infrastructure, model providers, privacy rules, safety standards, and user habits. They are not only products. They are arrangements of power. That means the governance question cannot be reduced to competition alone. Competition matters, but it is not enough. A more competitive market can still be unsafe. A safer system can still be anti-competitive. A privacy-preserving design can still entrench the dominant company if no one else can interoperate. An open design can still create risks if users cannot understand or control what they are granting. The real task is to hold several values together: competition, privacy, security, user choice, innovation, accountability, interoperability, device integrity, transparency, and consumer protection. That is hard, which is why this article should not pretend there is a neat answer. The point is not that the EU is obviously right in every detail. The point is that the EU is forcing a necessary question into the open: if AI assistants become infrastructure, should the owner of the operating system decide alone who gets meaningful access to that infrastructure? That question deserves public discussion, because it will shape not only companies, but ordinary users. EU in Practice: A Voice Command, a Default Setting, and a Regulatory Fight The most revealing thing about this story is how ordinary it looks from the outside. A phone. A voice assistant. A search result. A default setting. A permission request. None of these things feel like constitutional questions. Yet together, they shape how people access information, how businesses reach users, how new services compete, how data flows, and how much practical control individuals have over their digital environment. That is why EU in Practice matters. The European Union often appears in public life as something distant, procedural, slow, and covered in acronyms. Sometimes it is. But the real story of EU regulation is often much more concrete. It appears in the charger that fits more devices. The roaming charge that disappeared. The privacy banner that asks for consent. The platform rule that changes what defaults you see. The competition case that decides whether another service has a chance. And now, perhaps, the assistant that answers when you speak to your phone. Your phone may soon have more than one brain. That sounds funny, and it is. There is something beautifully absurd about imagining your phone as a small committee of competing artificial minds, each politely raising a hand to answer your question about pasta boiling time. But beneath the humour is a serious issue. When AI assistants become gateways to everyday digital life, the rules that shape their access will matter. Closing: More Than Choosing Between Icons If only one assistant can fully use the device, choice becomes thinner than it appears. If every assistant can access everything without strong safeguards, safety and privacy become fragile. If search data remains locked inside one company’s long-standing advantage, competition may never catch up. If search data is shared carelessly, users may pay the price. That is the tension, and it is precisely why the debate matters. The EU is not simply saying “more AI, please.” It is asking how competition, interoperability, privacy and user choice should work when AI moves from being a separate tool into the infrastructure of daily life. That is exactly where public debate should be: not only on whether AI assistants are clever, not only on whether Google is too powerful, not only on whether the EU regulates too much, but on what kind of digital environment we want to live in when the next interface layer is being built. Because the next time you say “Hey…” to your phone, the answer may depend not only on technology. It may depend on law, competition, privacy, security, and the still-unfinished question of whether digital choice should mean more than choosing between icons. Get full access to REDefine // Civic Intelligence at associationredefine.substack.com/subscribe (https://associationredefine.substack.com/subscribe?utm_medium=podcast&utm_campaign=CTA_4)

11. 

    14 Dec 2025

    A Virtual Parliament: Why Democracy Needs Practice, Not Just Participation

    Democracy is often taught as a system to understand, and discussed as a problem to solve. But it is rarely treated as a practice, something people must experience in order to learn. The EU Democracy Campus was built around a simple observation: democratic breakdown does not come from a lack of opinions. It comes from a lack of shared spaces where disagreement can be held, navigated, and sustained across difference. Europe, in particular, faces this challenge at scale.Multiple languages. Multiple political cultures. Multiple historical memories.Very few opportunities to experience what it actually feels like to deliberate together. This is why we built a virtual parliament. Not as a symbol, but as a working civic environment. In the EU Democracy Campus, young people from different countries don’t consume content about democracy. They enter a shared space where rules, roles, procedures, and time shape how participation unfolds. They debate, negotiate, listen, and experience the weight of collective decision-making. Virtual reality matters here not because it is immersive, but because it makes presence possible without proximity. It allows democratic practice to happen across borders, in real time, under conditions that resemble the complexity of European public life. This video offers a brief look inside that space.Not as a promise about the future of technology, but as an argument about what democracy requires if it is to be learned at all. Get full access to REDefine // Civic Intelligence at associationredefine.substack.com/subscribe (https://associationredefine.substack.com/subscribe?utm_medium=podcast&utm_campaign=CTA_4)

12. 

    7 Dec 2025

    Illegible Systems: Why Institutions Resist Change

    Reform fails not because people resist change, but because institutions inherit decades of emotional and procedural memory.This video explains the ghost layer: the invisible structure that absorbs, dilutes, or reinterprets reform before it ever reaches citizens.Watch the explainer, then read the full essay: Get full access to REDefine // Civic Intelligence at associationredefine.substack.com/subscribe (https://associationredefine.substack.com/subscribe?utm_medium=podcast&utm_campaign=CTA_4)

13. 

    29 Nov 2025

    Micro-Repair for Macro-Change

    A guide to the tiny emotional tools that help us stay resilient, clear, and engaged in a complex world. In this video, we explore three powerful micro-repairs: 🌿 The 1% Shift — the smallest action that changes your direction🧭 The Emotional Audit — a simple reset for clarity and emotional regulation🛡️ The Micro-Boundary — a gentle way to protect your energy and attention Why these tools matter:When emotional bandwidth collapses, civic engagement collapses with it.But when we take small, steady steps to repair ourselves, we strengthen our capacity to think, connect, and shape the world around us. Drawn from REDefine’s work with young people in civic education, Youth4Peace programs, and emotional literacy practices, this video offers a soothing, intelligent look at how micro-repairs create macro-impact. ✨ If you found this helpful, consider subscribing for more content on:• Emotional intelligence• Civic resilience• Democracy and participation• Systems thinking• Political Literacy Get full access to REDefine // Civic Intelligence at associationredefine.substack.com/subscribe (https://associationredefine.substack.com/subscribe?utm_medium=podcast&utm_campaign=CTA_4)

14. 

    26 Nov 2025

    What did 300 youth debates across Europe teach us about thinking, dialogue, and democracy?

    This short video captures the real lessons we learned from working with over a thousand young people through the Youth4Peace and EU Democracy Campus projects — in classrooms, community hubs, and immersive virtual spaces. You’ll see how young people transformed debate when the environment supported them with:✨ psychological safety✨ clear structure✨ time to think✨ curiosity-first norms✨ and space to explore values, not attack identities These moments taught us that young people aren’t disengaged or polarized — they’re just waiting for environments designed for real thinking. IN THIS VIDEO:– Why youth debates surprised us– The power of “I don’t know yet”– How slowing the room changes everything– The micro-moments that shift thinking– What young people can teach adults about democratic dialogue RELATED ARTICLE:A longform essay exploring the deeper design principles behind thinking spaces and youth dialogue: RESOURCES (Free Downloads):✔ Thinking Space Design Principles✔ Youth Debate Framework✔ Reflection Prompts for Psychological Safety✔ Curiosity-Based Dialogue Tools About REDefine:We build civic intelligence tools, youth learning experiences, and emotionally intelligent dialogue frameworks for a healthier democratic culture. If this resonates, consider subscribing or sharing. It helps this work reach more educators, youth workers, and curious humans. Get full access to REDefine // Civic Intelligence at associationredefine.substack.com/subscribe (https://associationredefine.substack.com/subscribe?utm_medium=podcast&utm_campaign=CTA_4)

15. 

    25 Nov 2025

    Peace for Our Time

    This video is the visual version to our essay “Peace For Our Time” — a look back at the choreography of 1938 and the strange familiarity it carries today. It’s not a history lesson so much as a mirror: how a document, a smile, and a carefully staged declaration can offer reassurance long before reality has a chance to respond. The Munich Agreement remains one of those moments that is endlessly replayed but rarely fully understood. What fascinates us is not just the decision itself, but the structure of it: the speed of the celebration, the absence of those who would bear the cost, and the way performance often precedes policy. The echoes are hard to ignore, especially when the world once again entertains the idea that peace can be scripted with a single page. This video brings that pattern to life, showing why inclusion, legitimacy, and multilateralism matter more than ever. Get full access to REDefine // Civic Intelligence at associationredefine.substack.com/subscribe (https://associationredefine.substack.com/subscribe?utm_medium=podcast&utm_campaign=CTA_4)

16. 

    26 Oct 2025

    Democracy in 3D: How the EU Democracy Campus Reimagined Learning for a New Generation

    What if democracy could be experienced — not just explained? Inside the EU Democracy Campus, over 1,000 young Europeans from Portugal and Türkiye stepped into a fully immersive virtual replica of the European Parliament.They debated, collaborated, disagreed — and discovered what democracy feels like. Built in VR and co-funded by the European Union through Erasmus+, the Campus turned civic education into an emotional, participatory, and transformative experience.Each day followed a living rhythm:Experience → Reflection → Conceptualisation → Action. From history to empathy, from simulation to civic action — this is how Europe’s next generation is learning to shape the future.Democracy, in 3D. Get full access to REDefine // Civic Intelligence at associationredefine.substack.com/subscribe (https://associationredefine.substack.com/subscribe?utm_medium=podcast&utm_campaign=CTA_4)