Spain AI Infrastructure, EU Cyber Resilience Act & AI Regulation

Samantha: Welcome to The State of Tech — The European Edition. I'm Samantha Lawrence.

Bob: And I'm Bob Russell. Let's kick things off with a story about raw computing power and where it's being built. Spain is becoming a serious AI infrastructure hub, and the numbers just got a lot bigger.

A massive expansion of AI data center capacity in Spain signals Europe's growing appetite for compute power.

Samantha: So EdgeMode, which trades on the OTC markets, has expanded its joint venture with Blackberry AIF. And we're not talking about a modest bump here. Their AI data center development pipeline in Spain has now reached four point three five gigawatts. That is an enormous amount of power capacity.

Bob: To put that in perspective, a single gigawatt can power roughly a million homes. So we're talking about a pipeline that, when fully built out, would consume more electricity than many mid-sized European cities. And this is all earmarked for AI workloads. The approach they're taking is interesting too. They're calling it "Ready-to-Build," meaning these aren't speculative plots of land. They've secured the power connections, which is often the biggest bottleneck in data center development anywhere in Europe.

Samantha: And that's the thing, isn't it? You can announce a data center all day long, but if you don't have the power contracts in place, you're just drawing on a napkin. Spain actually makes a lot of sense for this. Abundant solar energy, relatively cheaper land compared to say, the Netherlands or Frankfurt, and increasingly good connectivity.

Bob: The bigger picture here is that Europe has been playing catch-up on AI infrastructure for years. Most of the hyperscale capacity has traditionally been concentrated in the US. But deals like this suggest that the tide is turning. Investors and developers are betting that Europe needs its own massive compute layer, partly driven by sovereignty concerns and partly by simple demand. Companies operating in Europe want their data processed in Europe.

Samantha: And Spain is clearly positioning itself to be one of the main beneficiaries. This isn't the first big data center announcement in the country this year, and I doubt it'll be the last.

New server hardware designed specifically for Europe's AI ambitions makes its debut at CloudFest.

Bob: Staying on the infrastructure theme, let's talk hardware. Pegatron showed up at CloudFest twenty twenty-six with a new portfolio of AI-optimized servers, and they're specifically targeting European data center operators.

Samantha: Pegatron is a name a lot of consumers might not recognize, but in the server and manufacturing world, they're a big deal. They're one of the largest electronics manufacturers globally. What caught my eye here is the focus on liquid cooling and high-density computing. They unveiled a one-rack-unit server that packs two compute nodes with AMD's latest EPYC nine thousand series processors. That's a lot of processing power in a very small physical footprint.

Bob: The liquid cooling part is crucial. As AI chips get more powerful, they generate significantly more heat. Traditional air cooling is hitting its limits. Liquid-cooled systems can handle much higher thermal loads and they're more energy efficient, which matters enormously in Europe where energy costs are high and sustainability regulations are tightening. Pegatron explicitly mentioned sovereign AI infrastructure in their announcement, which tells you a lot about what European buyers are asking for.

Samantha: It's a smart play commercially. European data center operators are under pressure from two directions. Regulators want greener operations, and their customers want more AI compute. Pegatron is essentially saying, here's hardware that addresses both problems at once. Scalable, energy-efficient, and powerful enough for next-generation AI workloads.

Bob: And it feeds directly into that first story about EdgeMode. You build the data centers, you fill them with servers like these, and suddenly Europe has a real AI compute ecosystem. The pieces are starting to come together.

Samantha: Quick interruption. If you listen to The State of Tech regularly, hit that like button and subscribe — that way you'll never miss an episode. Okay, moving on.

The CEO of Europe's biggest engineering company tells Brussels to back off on AI protectionism.

Bob: Roland Busch, the head of Siemens, has fired a warning shot at the European Commission. His message is blunt. Don't let the push for sovereign European AI come at the cost of actually using the best tools available right now.

Samantha: And those best tools, let's be honest, are largely American. Busch is basically saying that if Europe insists on building everything from scratch domestically before allowing adoption, it's going to fall further behind. He's worried about higher costs, slower investment, and a widening innovation gap.

Bob: This is a tension that's been bubbling under the surface for a while now. On one side, you have policymakers in Brussels who are genuinely concerned about strategic dependence on US tech companies. They want European alternatives, European data sovereignty, European champions in AI. That's a legitimate concern. On the other side, you have industrial leaders like Busch who run massive global operations and need the most capable AI tools today, not in five years when a European equivalent might exist.

Samantha: It's the classic European dilemma, right? Do you protect and nurture your own industry even if it means short-term pain, or do you open the gates to the best technology regardless of where it comes from? And Busch isn't some small startup complaining. This is Siemens. They employ over three hundred thousand people. When the CEO of Siemens says your approach might backfire, Brussels tends to listen. Or at least, they should.

Bob: What's interesting is that this comes the same day we're covering OVHcloud making a move to strengthen European AI capabilities. So you have this fascinating split within European industry itself. Some companies are building sovereign solutions and others are saying, look, let's not reinvent the wheel. The truth probably lies somewhere in the middle, but finding that middle ground is proving really difficult for regulators.

Samantha: And the clock is ticking. Every month Europe spends debating this is a month where AI adoption accelerates everywhere else.

A major European cloud provider makes its first ever acquisition to build sovereign AI models.

Bob: OVHcloud just made a move that directly connects to what we were just discussing. They've acquired Dragon LLM, a French startup that builds large language models specifically designed for regulated industries. It's OVHcloud's first acquisition ever, and they're also launching a dedicated AI lab alongside it.

Samantha: This is significant on multiple levels. Dragon LLM isn't just any AI startup. They actually won the European Commission's Large AI Grand Challenge, so they've got credibility. And their focus is on sensitive sectors — think healthcare, finance, government — where data sovereignty isn't just nice to have, it's legally required.

Bob: OVHcloud has long positioned itself as the European alternative to the American hyperscalers. They run their own data centers across Europe, they've championed European data sovereignty for years. But they've been primarily an infrastructure company. This acquisition signals they're moving up the stack into AI services. They want to train and fine-tune sovereign large language models that can be deployed either in their cloud or on-premises at a customer's own facility.

Samantha: And that on-premises option is key for regulated industries. A hospital or a bank can't just throw patient or financial data into any cloud. They need guarantees about where that data lives and who can access it. An AI model trained and hosted entirely within European jurisdiction, under European law, is a genuine competitive advantage.

Bob: This is essentially OVHcloud's answer to the Siemens CEO's concern. They're saying, you don't have to choose between sovereignty and capability. We can build European AI tools that actually work for European needs. Whether they can truly compete with the scale and performance of models coming out of OpenAI or Google remains the big question. But for specific use cases in regulated industries, they might not need to match them on every benchmark. They just need to be good enough and legally compliant.

Samantha: It's a pragmatic approach. Don't try to out-build Silicon Valley on everything. Find the niches where European values and European law create genuine demand for a local solution.

A sweeping new EU law is about to force every tech vendor on the planet to rethink product security.

Bob: The European Union's Cyber Resilience Act was published today, and if you sell any digital product in Europe, this one matters enormously.

Samantha: We're talking about hardware, software, embedded devices, consumer electronics, platforms — basically anything with a digital component. The Act imposes strict security requirements across the entire lifecycle of a product. That means from design through to end of life. Vendors have to provide continuous security updates, run vulnerability assessments, and be transparent about their supply chains.

Bob: And here's where it gets teeth. Non-compliance can result in fines of up to two point five percent of annual global revenue. For a company like Apple or Samsung, that's billions of dollars. So this isn't something any major tech company can afford to ignore.

Samantha: What's fascinating is the ripple effect. We've seen this pattern before with GDPR. Europe passes a regulation that technically only applies within its borders, but because the EU market is so large and so lucrative, global companies end up adopting the standards everywhere. It's cheaper to build one product that meets the strictest standard than to maintain different versions for different markets.

Bob: The Cyber Resilience Act is expected to do the same thing. It's likely to become the de facto global baseline for product security. US and Asian tech companies will adapt their practices not just for Europe but worldwide. That's the Brussels Effect in action again. The EU doesn't always lead in innovation, but it consistently leads in regulation. And through regulation, it shapes global markets.

Samantha: The real test will be enforcement. GDPR showed us that having rules on paper and actually enforcing them consistently across twenty-seven member states are two very different things.

Key deadlines under the EU AI Act are approaching fast, and companies need to pay attention.

Bob: Let's close out with the EU AI Act, because the compliance timeline is moving quickly and there are several deadlines that businesses need to have on their radar.

Samantha: So a few milestones have already passed. The European Commission was expected to publish guidelines on Article six by February second of this year — that's the classification system for high-risk AI systems. And on March third, we got the second draft of the Code of Practice covering the marking and labeling of AI-generated content.

Bob: The big one coming up is August second, twenty twenty-six. That's when most of the remaining provisions kick in. Transparency rules become enforceable. And every EU member state needs to have at least one AI regulatory sandbox up and running. These sandboxes are designed to let companies test AI systems in a controlled environment with regulatory oversight, before deploying them commercially.

Samantha: The sandbox idea is actually one of the smarter parts of the AI Act. Instead of just saying "here are the rules, good luck," regulators are offering a space where companies can figure out compliance in practice. But August is only about four months away. A lot of companies, particularly smaller ones, are still scrambling to understand what the high-risk classification means for their products.

Bob: And the labeling requirement for AI-generated content is going to touch a huge number of companies. If you're using generative AI to create marketing materials, customer service responses, news summaries — any content that reaches the public — you'll need to mark it appropriately. The details of how that works in practice are still being finalized, which is why that second draft Code of Practice matters.

Samantha: The overall pattern is clear though. Europe is building a comprehensive regulatory framework around AI that touches everything from how models are trained to how their outputs are labeled. Whether you think that's visionary or heavy-handed probably depends on which side of the regulation you're sitting on.

Bob: For companies operating in Europe, the practical advice is simple. Don't wait for final guidance on every detail. Start mapping your AI systems against the risk categories now. August will arrive faster than anyone expects.

Samantha: Today we covered: EdgeMode's massive data center expansion in Spain, Pegatron's new AI servers for Europe, Siemens warning Brussels on AI regulation, OVHcloud acquiring Dragon LLM for sovereign AI, the Cyber Resilience Act reshaping global tech security, and the EU AI Act's fast-approaching compliance deadlines.

Bob: Want to know more or react? Visit stateoftech.eu or email us at info@doorzetters.net.

Bob: State of Tech — the tech world in 15 minutes.