Tallinn Digital Summit’s second morning asks who controls the AI Europe runs on

Editor’s Note: Who controls the AI systems Europe depends on ran through the second morning of the ninth Tallinn Digital Summit on Nov. 6, 2026. Liisa-Ly Pakosta, Estonia’s minister of justice and digital affairs, asked what happens to a state’s sovereignty if the AI it buys costs a hundred times more. Governments need open source as they need water, she said. Former Estonian President Toomas Hendrik Ilves and former ICANN chief executive Rod Beckstrom called the AI race a contest between the United States and China. Ilves pointed to recent limits on satellite service in Ukraine, which the Center for Strategic and International Studies documented as Starshield speed restrictions of disputed origin. Cecilia Bonefeld-Dahl, director-general of the industry group DigitalEurope, said Europe could live with a U.S. export control that kept an Anthropic cybersecurity model offline for about three weeks, according to The Record. Europe’s own rules, she argued, delay medical devices for up to 24 months.

For cybersecurity, information governance and eDiscovery professionals, vendor dependence becomes a continuity question about what stops if a model is cut off or repriced. Next: negotiations on the EU’s proposed Cloud and AI Development Act and Central and Eastern European coordination on the AI Act.

Disclosure: ComplexDiscovery attended the 2026 Tallinn Digital Summit, its third consecutive year covering the event. ComplexDiscovery OÜ is a private limited company registered in Estonia, and two ComplexDiscovery staff members are e-residents of Estonia.

Industry News – Technology Beat

Tallinn Digital Summit’s second morning asks who controls the AI Europe runs on

ComplexDiscovery Staff

Estonia’s justice and digital minister used the opening address of the Tallinn Digital Summit’s second day Friday to ask what happens to a state’s sovereignty if its AI suddenly costs a hundred times more. Liisa-Ly Pakosta said governments pay a handful of companies for tokens and AI agents, and she asked what would follow if the price added two zeros the next day. “This is the question where we definitely need open source as we need water,” she said.

The two Agentic Stage sessions that followed, and a competitiveness panel on the Kratt Stage, kept returning to her question of who controls the systems Europe depends on. A Tokyo vice governor said the question for governments is no longer how to use AI but how to govern it. A former Estonian president and a former head of ICANN, the body that coordinates internet domain names, weighed whether the transatlantic alliance can hold while the United States and China race ahead. The Kratt Stage panel then heard that Europe already owns more of the AI stack than it admits, and that its own rulebook may be a bigger obstacle than any switch in Washington.

The day’s framing built on Nov. 5, 2026, the summit’s first day, which ComplexDiscovery covered in two earlier installments. The opening sessions asked who holds the rope in the agentic era, and the afternoon turned to testing that may not keep pace with AI agents. Host Sandra Särav-Tammus said Day 2 would ask what happens when AI starts changing the rules inside states, alliances and institutions.

A minister’s questions without agreed answers

Pakosta said she would be practical, listing questions Estonia has met while using AI in government that she said will need international agreements whose wording no one yet knows. The first was the battlefield. AI can already manage cyberattacks, she said, and warfare is developing toward AI used for targeted killing. International humanitarian law does regulate automated weapons, she said, but the speed and precision AI brings are beyond the scope the world is used to. She said Europe’s AI Act rules out using AI for killing, but asked what that means when an AI-led army faces Europe’s sons and daughters. The AI Act itself does not reach that ground: it excludes AI systems placed on the market or used exclusively for military, defense or national security purposes. Pakosta’s call was for renewed international regulation. “Maybe we should think again as humankind,” she said.

Her second concern was democracy. AI can already manipulate minds, she said, and the AI Act’s ban on manipulation does little when people lean on agents that quickly learn what moves them. Article 5 of the Act prohibits AI systems that use purposefully manipulative or deceptive techniques to materially distort people’s behavior by appreciably impairing their ability to make an informed decision. The ban applies only where that causes, or is reasonably likely to cause, what the Act calls “significant harm.” Election manipulation would be easy, she said, “because the machines know what you are interested in or what bothers you,” and no one can say which political parties are the good ones. Estonians will be able to vote by mobile phone next spring, she said, and ERR News reported that the National Electoral Committee agreed in late October to allow e-voting from smart devices in the 2027 parliamentary election. Election security, she said, is no longer only about the technical integrity of the process but also about political manipulation that is already widespread.

She then turned to Russia. Estonian officials mostly track Russian propaganda finding its way into large language models, she said, and some models resist it better than others, with many American ones, in her account, quite open to it. Young people may take their history and identity from chatbots rather than books, and Russia, she said, is not only trying to erase Ukrainian culture but is changing Estonian history and how Estonians understand themselves. “The war is ongoing about our identities, about our histories,” she said.

The token question came last in her list, and it was where she put open source alongside water. Her closing ask was speed. Not every country needs to join at first, she said, because international rules usually start with a few signatories and others follow, “but we can’t go on without international agreements.”

Tokyo’s case for governing, not only using

Manabu Miyasaka, vice governor of the Tokyo Metropolitan Government and its chief information officer, carried Pakosta’s governance question to the city level. Governments have adapted to every new technology, he said, but AI may be fundamentally different, a technology that, as the session description put it, can perform tasks involving human thought. If AI gives a more accurate answer than a person, he asked, should people simply follow it? He said it is not that simple, and that the question has shifted from how humanity should use AI to how humanity should govern it.

Employment is where the stakes are clearest, he said, and he rejected the idea that governments can answer job losses with welfare payments alone. “Can government solve this simply by paying unemployment benefits? My answer is no,” Miyasaka said. Work is how people take part in society and find a role and responsibility, he said, so losing jobs to AI could also mean losing the purpose and place in society that work provides. He offered a counterweight from Tokyo’s open data hackathon, whose final stage the city held in October. The metropolitan government reported 2,180 participants and 486 proposals. This year, Miyasaka said, generative AI brought in people who had always stood apart from such events: not engineers, but people who live with the problems and wanted to build the public services they needed.

AI may reduce jobs but can also expand what people are able to do, Miyasaka said, and the outcome is a choice for societies to make. Democracy was built to hold powerful forces to account, and he said a new version of that work requires nations, cities, businesses, citizens and technologists to act across boundaries. “Government cannot do it alone,” he said. Tokyo will continue the conversation at SusHi Tech Tokyo 2027, the city’s innovation conference, which the metropolitan government has scheduled for May 20 to 22, 2027, at Tokyo Big Sight.

Four horsemen and a two-horse race

Moderator Liz Alderman, a former European business correspondent for The New York Times, said the panel title, “Facing the Four Horsemen: can the transatlantic alliance survive the AI age?” had made her raise her eyebrows. “We’re going to try to not get too apocalyptic on you,” she said, before asking where Europe and the United States stand in the AI race. The session description named four fault lines: diverging AI rules, uneven defense technology cooperation, a competitiveness gap and unequal dependence on China’s AI build-out.

Toomas Hendrik Ilves, president of Estonia from 2006 to 2016, answered with 15th-century China, which he said abandoned its great voyages of exploration in the 1430s and went no further. That is Europe today, he said, a continent that decided regulation is how one gets ahead. Soon, he argued, there will not be much left to regulate, and Europe can “regulate ourselves to death.” China and the United States are the only two AI powers, Ilves said. He said the U.S. private sector invested $400 billion in AI last year and would probably top $700 billion this year, while Europe would be lucky to reach 100 billion; he did not name a currency for the European figure or say what any of the figures measured. For comparison, Stanford University’s 2026 AI Index put private investment in AI in 2025 at about $286 billion in the United States and about $21 billion in Europe.

Rod Beckstrom, former chief executive of ICANN and founding director of the U.S. National Cybersecurity Center at the Department of Homeland Security, agreed it is “a two-horse race.” In about three years, he said, China has gone from absent to well represented in the top 10 and top 20 of the model leaderboards, though U.S. models still lead by a narrow gap. He cited Moonshot AI’s Kimi, which he said jumped ahead through distillation, extracting knowledge from other models. Moonshot allegedly built Kimi into a top-10 model for under $100 million, he said, so he would not rule out a top European model. Separately, in July, Michael Kratsios, President Donald Trump’s science and technology adviser, accused Moonshot of distilling an Anthropic model to build Kimi K3, according to Business Today; a Chinese embassy spokesperson called the allegations entirely unfounded.

Beckstrom’s larger point was European integration itself, which he traced to Jean Monnet and other postwar architects of a united Europe and credited with largely keeping the peace in Europe for 80 years. It should not be taken for granted, he said. Asked what relying mostly on American technology means for Europe, Ilves pointed to Ukraine. He cited a recent cutoff of communications to Ukraine through Starlink or Starshield, saying it remains unclear who ordered it, and a cutoff of Maxar satellite imagery the year before. The record is narrower on both counts. In an analysis published Nov. 2, the Center for Strategic and International Studies said Ukrainian officials reported unannounced speed restrictions on Starshield Oct. 14, under which fast-moving terminals lost connectivity. CSIS said responsibility remained disputed and that service was back to normal by Oct. 24. In March 2025, Maxar said the U.S. government had decided to temporarily suspend Ukrainian accounts in GEGD, a U.S. government imagery program, and that its other customer programs were unchanged.

Technology rules are only part of the problem, Ilves said. The bigger part is the reforms Europe has not made since the early 2000s, which he said Mario Draghi’s competitiveness report lists: unified capital markets, a completed single market, less regulation and cheaper energy for data centers. European money is largely invested in the United States, he said, so a European tech company that wants to grow goes there and is funded with European capital. “It is insane,” he said. On defense, he said Europe’s deeper weakness is not incompatible equipment but that intelligence, surveillance, reconnaissance and command and control in NATO rest with the United States. If France, Germany and Italy will not move, he said, a smaller group running from the Netherlands and Denmark through the Nordics and Baltics could use the EU’s enhanced cooperation mechanism. The result, he said, would resemble the Hanseatic League.

All wars as AI wars, and agents as the edge

Alderman asked Beckstrom what he means by saying all wars are now AI wars. “Technology drives wars and wars use the latest technology,” he said. Ukraine began as a cyber conflict and has become a drone war in which AI helps with targeting, he said, and models will eventually fight one another. He also described a contest between human civilization and an AI civilization of agents, estimating at least 10 agents per person within 10 years, about 80 billion, and over a trillion within 20. People in romantic relationships with AI, he said, are an attack surface into humanity.

That view shapes his security argument. Industrial control systems, mostly made by a handful of companies with Siemens and Schneider among them, are being hacked widely, he said, and Europe and the alliance need the capacity for a low-grade, tit-for-tat offensive response in cyberspace. “I’m not advocating escalation,” he said, but without any response, he argued, attacks will keep growing. Ilves said capacity is not what is missing. “I don’t think the problem is lack of technological capacity. It’s a lack of political will,” he said, adding, “We are boiling the frog here.”

Beckstrom said the edge of cybersecurity has moved from the computer to the network, the cloud and mobile devices, and now to AI agents. “Agents are the edge,” he said, a theme of a Forbes column he published Nov. 4 arguing that each agent, with its own permissions, memory and power to act, is an attack surface. Asked whether nuclear arms control offers a model, he said nuclear weapons are a centralized problem with identifiable counterparties, while AI, like cybersecurity, is massively decentralized. Ilves said nuclear deals came when two powers saw mutual destruction coming, that China does not want to discuss even the nuclear side and that the United States has stepped back from international agreements over the past two years.

Beckstrom’s maxim and Ilves’ romaine lettuce

The regulation debate came through a market move. Alderman noted that the Nasdaq had fallen over 5 percent the day before on concerns that Democrats’ midterm gains could slow the AI data center build-out. The Nasdaq Composite closed down about 5.5 percent Nov. 5, according to Yahoo Finance. Beckstrom said chips backlogged around the world would then go elsewhere, giving Europe a say through its investments, even in data centers in the Middle East or Africa if European power stays too expensive.

Beckstrom then offered the maxim he said he used in U.S. interagency policy work: “do not regulate what you do not understand.” Existing law on liability, food, electrical systems and housing already applies to AI, he said, and he read the current White House as telling industry to proceed but bear the liability, which he said is not what hyperscalers want. He said the EU AI Act is about 10 times as long as the U.S. Constitution, and urged an immediate carve-out for open-source software, saying the best open models exclude EU use in their licenses because developers who receive nothing do not want AI Act and General Data Protection Regulation liability. The Act already exempts systems released under free and open-source licenses, unless they are placed on the market or put into service as high-risk systems, as prohibited practices under Article 5 or as systems subject to Article 50’s transparency duties. For general-purpose models the exemption is narrower: open-source providers are spared only some documentation duties, still owe a copyright policy and a public summary of their training content, and get no exemption if the model poses systemic risk.

Ilves drew a line. “Regulation is not bad. We don’t get sick in Europe because of romaine lettuce,” he said, but regulation of technology by people with no understanding of it is another matter. Alderman said a recent French poll, cited by a French minister at the summit on Day 1, found about 80 percent of the population wants AI regulated. Beckstrom said he expects AI to weaken democracy as things stand, pointing to the number of people using AI for relationship advice and romance.

Connectivity, where Ericsson says Europe leads

The competitiveness panel on the Kratt Stage, “AI and the new economics of competitiveness,” moved the dependence question from security to markets. Moderator Jennifer Schenker, founder and editor-in-chief of The Innovator, said she has watched the same European problems persist through decades of reporting. Cecilia Bonefeld-Dahl, director-general of DigitalEurope, the trade association for digital industries, said Europe needs a common company form, the idea behind the proposed EU Inc., and a common stock market. “We are great innovators. We are lousy scalers because we miss the market,” she said.

Mikko Karikytö, Ericsson’s chief product security officer, said Europe is ahead in one layer of the stack. “We are winning in connectivity,” he said, pointing to two global champions from Sweden and Finland. Future networks will connect AI agents, robots and sensors at a new scale, and much of that traffic will run over European technology, he said. Ericsson announced a system Nov. 2 that adds sensing to 5G networks to detect and track drones; the announcement, as carried by TelecomTV, puts commercial pilots in 2027 and broader deployments in 2028. Europe is not building the networks, Karikytö said. By his figures, 5G standalone, which he called a prerequisite for 6G, stands under 2 percent in Europe, against 80 percent in China and 50 percent in India. He did not say what those percentages measure, whether subscribers, traffic or network coverage.

Bonefeld-Dahl said Europe also leads in energy technology, radar and drones, and should stop belittling rivals. She said the European Commission is finally looking at how to interpret competition law to allow innovation-friendly mergers, noting Europe has 110 telecom operators while the United States has five and China four. She proposed a dual-use scale-up fund, which she put at about 50 billion without naming a currency, saying pension funds would believe in it. “Don’t do what doesn’t work. More of what works,” she said.

Thomas Madsen-Mygdal, co-founder and chief executive of the video platform TwentyThree, said Europe invented most of the digital era’s technologies but did not scale them. He founded Rebuild, which he said is 10 months into a 12-month sprint to rebuild Europe’s social platforms, and its directory now lists 1,300 of them that people did not know existed. He put Europe’s lost value in social platforms alone at around 100 billion euros, which he said equals about 2 million jobs. Public-sector IT spending, which he estimated at 500 billion euros or more, flows mostly to consulting firms and American companies, he said. “You’re not going to get fired for renewing the Microsoft contract,” he said of the mindset that persists. Earlier in the panel, he had said, “Currently, I haven’t seen a single strategy in Europe that actually is a winning play.”

Brussels, capitals and a three-week cutoff

Lukáš Kačena, whom the Czech government appointed its envoy for AI in January, said the most surprising thing about government was how much its proactivity shapes a country’s brand. Schenker noted that he has warned the Czech Republic risks becoming an open-air museum in AI. Nine Central and Eastern European governments signed the Prague Declaration on Artificial Intelligence at the CEE AI Summit in September. It is a nonbinding political pledge to seek shared positions ahead of EU AI policy discussions and to work toward connecting the region’s AI factories. Kačena said the group wanted to align how members implement the AI Act, because “you cannot coordinate with 27 countries at the same time.” Its first agenda item is AI adoption in public administration, he said, with a Brussels meeting Nov. 16 on how governments can reach frontier models.

On the state’s role, Kačena named education and regulation. Bonefeld-Dahl said Europe may have passed the point at which it can usefully regulate more. She objected to rules on business-to-business data sharing and to the proposed Cloud and AI Development Act, which she said would make companies certify each service 27 times. The Commission proposed that act June 3, and it is still before Parliament and the Council. It would establish four assurance levels for public-sector cloud use, three of them requiring an independent audit, and under the proposal a provider would apply to the authority in its home member state, with recognition valid across the EU. Her answer was to scale back regulation and teach people to be “clever, empowered citizens, not protected weak individuals.” Kačena said the blame lies with national governments rather than Brussels, pointing to the digital and AI omnibus simplification packages, and said the push has to come from within.

Karikytö said security rules such as the Cyber Resilience Act and NIS2 will create a certification and consultancy market but may not improve technology, and he called the U.K.’s telecom security law better suited to telecom networks. Security and trust are different problems, he said, because a technically secure product from an untrusted maker is still a risk. Europe has agreed to remove high-risk vendors, he said, yet some of the largest member states are now investing more in them. “So we are not even able to enforce the simplest controls to secure European infrastructure,” he said. The EU’s 2020 5G toolbox, which urges member states to limit reliance on high-risk suppliers, is voluntary, and a mandatory phase-out the Commission proposed in January is still under negotiation.

Schenker raised a U.S. export control decision this summer that she said had briefly blocked access to some of the most capable American AI models. The Record reported that the controls barred foreign nationals from Anthropic’s cybersecurity-focused Fable 5 model, that Anthropic disabled access for all customers to comply, and that Anthropic restored global access July 1 after a shutdown of roughly three weeks. Bonefeld-Dahl rejected “kill switch” talk, saying Europe has export controls too and that the United States is by far the largest market for European technology. Europe is exposed, she said, but so is the United States, because Europe has technologies it lacks and sits inside American infrastructure as American companies sit inside Europe’s. If Europe could clear its most powerful technologies in three weeks, she said, she would write a book about it, since a lifesaving medical device takes 18 to 24 months to reach the European market. Three weeks, she said, Europe can live with; 24 months for a medical device is not acceptable. Karikytö said the answer to exposure is flexibility, so critical services can keep running whatever model, cloud or provider fails.

Asked for one metric of success in five years, Madsen-Mygdal chose the share of 14-year-olds who had built something because of AI. Bonefeld-Dahl chose the share of chief executives who find Europe a great place to scale, and Kačena the share of smaller companies using AI. He said about one in five firms use it now, and fewer of the small ones; Eurostat reported that 20 percent of EU enterprises with 10 or more employees used AI in 2025. Karikytö said success would be riding a train from Switzerland to Finland while staying connected to his AI agent. “I can’t have it today,” he said.

Asked which policy they would copy from elsewhere, two of the four pointed back to the host country. Kačena would copy Bürokratt, Estonia’s network of public-service AI assistants, so the state speaks to people through one agent. Karikytö named Estonia’s X-Road data exchange and its once-only principle, under which citizens give the state a piece of information only once. Bonefeld-Dahl looked to the United States and Ukraine, wanting common European defense procurement at American scale and Ukrainian speed, where she said a soldier’s order reaches the front in eight days. Madsen-Mygdal named what he called the Chinese model, in which regions compete until winners emerge, and said that if Ukrainians make the best drones, they should make them for all of Europe.

Pakosta’s question, what a government does when a vendor sets the price, drew two kinds of answers by late morning. Speakers on the Kratt Stage argued that Europe holds more cards than it admits, in networks, energy technology and technologies the United States does not have. Two of the wish lists pointed to infrastructure the state itself controls, such as X-Road and Bürokratt, while Pakosta and Beckstrom both pressed for open source. For ComplexDiscovery readers, the three-week shutdown this summer was a continuity test already run: a review platform, retention tool or incident workflow that depends on one outside model could inherit that model’s export status and its price. If your AI provider went dark for three weeks, or its price added two zeros, which of your legal, security or records processes would stop first, and who would know?

News Sources

• agenda | Discover the Event Schedule (Tallinn Digital Summit)
• Regulation (EU) 2024/1689 (Artificial Intelligence Act) (EUR-Lex)
• Article 2: Scope (EU Artificial Intelligence Act, Future of Life Institute)
• Article 5: Prohibited AI Practices (EU Artificial Intelligence Act, Future of Life Institute)
• Article 53: Obligations for Providers of General-Purpose AI Models (EU Artificial Intelligence Act, Future of Life Institute)
• アジア最大のグローバルイノベーションカンファレンス SusHi Tech Tokyo 2027: 5th Anniversary 始動！注力テーマ、新たなアワード創設、出展者募集等を発表 (Tokyo Metropolitan Government)
• 都知事杯オープンデータ・ハッカソン2026「Final Stage」を10月17日（土）開催 (Tokyo Metropolitan Government)
• 都知事杯オープンデータ・ハッカソン2026 都知事杯を含む8つの賞の受賞者を決定！ (Tokyo Metropolitan Government)
• COM(2026) 502 final: Proposal for a Regulation on the Cloud and AI Development Act (EUR-Lex)
• Proposal for Cloud and AI Development Act (CADA) (European Commission)
• Who Controls Ukraine’s Starlink Access? (Center for Strategic and International Studies)
• US lifts export controls on Anthropic’s frontier cybersecurity AI models (The Record)
• Stock market today: Dow plunges 1,800 points, Nasdaq enters correction in AI trade meltdown (Yahoo Finance)
• Smart devices can be used for e-voting in Estonia’s 2027 election (ERR News)
• Economy | The 2026 AI Index Report (Stanford HAI)
• AI Index Report 2026, Chapter 4: Economy (PDF) (Stanford HAI)
• Brussels pushes for stronger cybersecurity oversight of high-risk technology suppliers (Euronews)
• Prague AI Declaration (Regulations.ai)
• Ericsson brings drone detection capabilities to mobile networks (TelecomTV)
• Nine European Countries Agree Closer AI Cooperation (Prague Daily News)
• 9 CEE Governments Sign a Declaration on AI (The Recursive)
• US claims China’s Moonshot AI used Anthropic’s Fable 5 to build Kimi K3 AI model (Business Today)
• US aerospace firm Maxar disables satellite photos for Ukraine (Arab News, citing AFP)
• Maxar confirms US government blocked Ukrainian access to satellite data (UPDATED) (Euromaidan Press)
• One-fifth of EU businesses use AI technologies (The Brussels Times)
• European Commission Publishes Proposal for Act to Reduce Reliance on Foreign Cloud and AI (Wilson Sonsini Goodrich & Rosati)
• Why Decentralized AI Is A New Cybersecurity Threat. Here’s How To Fight Back (Forbes)
• It’s Time to Rebuild: A 12-Month Sprint for Europe’s Social Platforms (DLD)
• Estonia’s new virtual assistant aims to rewrite the way people interact with public services (e-Estonia)
• Tallinn Digital Summit opens on who holds the rope in the agentic era (ComplexDiscovery)
• Tallinn Digital Summit’s first afternoon finds Europe slow where AI agents are fast (ComplexDiscovery)
• Tallinn Digital Summit 2026 puts the agentic state to the test (ComplexDiscovery)

Assisted by GAI and LLM Technologies

Additional reading

• Nine months across Europe’s tech-sovereignty arc, from Tallinn to London
• The flame and the frontier: how Estonia carries a 1919 victory into a tense 2026
• Estonia aims to be first to give AI agents official digital IDs

Source: ComplexDiscovery OÜ

ComplexDiscovery’s mission is to enable clarity for complex decisions by providing independent, data‑driven reporting, research, and commentary that make digital risk, legal technology, and regulatory change more legible for practitioners, policymakers, and business leaders.