Editor’s Note: Sovereignty moved from rhetoric to operations across Europe this year, and the shift played out on conference stages from Tallinn to London. Over nine months, ComplexDiscovery tracked seven events across four cities in the New Nordics, the Baltics and the Ireland-UK corridor, watching the same argument recur: who controls the data, models and defenses that now run public and commercial life.

The story matters to cybersecurity, data privacy, regulatory compliance and eDiscovery professionals because each stop produced a concrete obligation. Defense-tech sessions raised data-provenance duties. Estonia’s regulatory sandbox tested how fast a state can write enforceable rules. Dublin put deepfake authentication squarely inside the evidence chain.

Watch three things next: how Estonia codifies its sandbox exemptions, whether Ireland’s AI-regulator role hardens as the EU AI Act timeline slips, and how the transatlantic off-channel messaging crackdown changes corporate retention. Read it as a field retrospective, not breaking news: the conference hall, this year, offered an early view of where the next decade’s compliance precedents may be forming.

Disclosure: ComplexDiscovery OÜ’s editor and managing director, Rob Robinson, also serves as chief marketing officer of HaystackID and covers events for Newsline by HaystackID. HaystackID-related references in this article are included as reported event and product-positioning context, not as an independent product evaluation.


Content Assessment: Nine months across Europe’s tech-sovereignty arc, from Tallinn to London

Information - 92%
Insight - 90%
Relevance - 90%
Objectivity - 88%
Authority - 92%

90%

Excellent

A short percentage-based assessment of the qualitative benefit expressed as a percentage of positive reception of the recent article from ComplexDiscovery OÜ titled, "Nine months across Europe’s tech-sovereignty arc, from Tallinn to London]."


Industry News – Technology Beat

Nine months across Europe’s tech-sovereignty arc, from Tallinn to London

ComplexDiscovery Staff

The journey ran from Tallinn in October to London in June, by way of Helsinki and Dublin: four cities, seven events, nine months and one question that refused to let go. Who controls the data, the models and the defenses that now run Europe?

ComplexDiscovery OÜ staff made the trip, on the ground from the New Nordics and the Baltics to Ireland and the United Kingdom. What follows is a selected journey, not a census, a deliberate line drawn through the four cities where sovereignty, defense technology and AI governance kept colliding with the daily work of securing systems, governing records and producing evidence. Several of those cities hosted multiple events, three in Tallinn across two visits, Slush in Helsinki with a defense satellite alongside, the summit in Dublin, and two in London against a tech-week backdrop, so the city, not the badge, marks each stage. Taken in order, they tell a single story. The same argument travels from one stage to the next, and somewhere along the way it stops being a worry and turns into rules, capital and product.

That turn is why this retrospective exists. The rules, the capital and the obligations taking shape on these stages are already reaching security, governance and discovery teams far from the Baltic, and read in sequence they show where the next ones are forming. The point of retracing the year is to read that sequence before it arrives as a deadline.



First stop, Tallinn, where the terms get set

Estonia opened the year with audacious staging. In a single week last October, the capital ran three gatherings at once: the Tallinn Digital Summit at the Estonian National Library, a ministerial meeting of the 42-member Freedom Online Coalition the country chairs, and a quiet conclave of European presidents. The host nation has long treated digital life as public infrastructure, from national e-identity and the X-Road data exchange to online voting, and its newest education program, AI Leap, now requires a clear AI-use agreement in every participating school. It was security by design, applied at national scale. The summit itself carried the theme “Collectively at the Crossroads: Towards Secure and Resilient AI Futures.”

On the second day of the summit, Kaja Kallas took a fireside chair across from CNN’s Kimberly Dozier. The European Union’s foreign-policy chief and a former Estonian prime minister warned that platform algorithms, not legislation, increasingly decide what citizens see. She reached for fresh evidence: in the run-up to Moldova’s elections, monitors flagged about 19,000 disinformation incidents and pulled over 100,000 Kremlin-aligned TikTok accounts; in Poland, a rattled public split three ways over who had flown drones into NATO airspace. Kallas called it digital warfare in real time and asked the technologists in the room to help defend democratic systems. A vision paper unveiled that week, “The Agentic State,” pressed the same nerve from the government’s side. Led by former Estonian technology chief Luukas Ilves and the Global Government Technology Centre Berlin’s Manuel Kilian, the paper argued that AI agents will soon run core public functions and will need cryptographic audit trails and human escalation paths to stay accountable, the very logic an eDiscovery team applies to a chain of custody.

The hard edge came in a panel called “Under Pressure,” run by The Atlantic’s Shane Harris. Colonel Maksym Pavliuk of Ukraine’s cyberwarfare directorate said the infrastructure collapse forecast for the 2022 invasion never came, because Ukraine had hardened its systems after the 2015 grid attacks and NotPetya. Polish officials described 20 to 50 attacks a day on critical infrastructure, a city water network breached in August, and a cyber budget lifted from €600 million to €1 billion. Finland’s national center described a defense knit together from over 20 sector-specific sharing groups. Pavliuk’s line stuck: Russia will go as far as you let them go.

The point came home along the eastern border, in Narva, where a September incursion by Russian jets and a severed Baltic Sea cable turned abstract risk into a records problem, the case for tagging data by geopolitical exposure and copying litigation holds across regions before the map, not the lawsuit, forces the question. For cross-border matters, that is the moment when sovereignty and sanctions questions arrive first, and records teams are judged on whether they treated geopolitical exposure as a classification problem before it became a crisis.

North to Helsinki, where worry meets money

Six weeks later the journey crossed the Gulf of Finland to Slush, which packed 13,000 founders and investors into Helsinki on Nov. 19 and 20. If Tallinn framed the anxiety, Helsinki priced it. The headline number came from Atomico’s State of European Tech report, and it described a paradox: technology now makes up about 15 percent of regional output, up from 4 percent a decade ago, yet yearly investment has stalled near $44 billion while the United States pours in close to $500 billion. European pension funds park 0.01 percent of their assets in venture capital, leaving roughly $210 billion idle, and seven in 10 founders blame a market splintered across 27 national rulebooks. Atomico’s Tom Wehmeier said it without flinching: Europe is bootstrapping its future.

Defense ran through the halls, with one report clocking a 55 percent jump in defense-tech funding to $1.6 billion. At a satellite gathering called BORDERLAND, about 300 founders and officials met within reach of Finland’s 1,300-kilometer border with Russia, where Foreign Minister Elina Valtonen argued that speed and integration, not headcount, decide a modern fight; by the foreign ministry’s count, Finland had issued close to 900 dual-use export licenses on the year. The quieter warning was about data itself. When a model registry or a training set can end up inside a weapons system, its lineage becomes discoverable evidence rather than a footnote. Google used a private breakfast to show off its Gemini 3 Pro model and tell marketing chiefs they had crossed from a production economy into a selection economy, where the cost of trying one more idea falls toward zero. And on the founder stage, Harvey’s president Gabe Pereyra traced how the legal-AI company reached over 700 customers across 58 countries on a human-in-the-loop design, a preview of the vendor fight waiting in London.

Back to Tallinn, for the rules and the capital

Spring brought the year’s densest stretch, back where it started. FutureLaw 2026, billed as Northern Europe’s largest legal innovation conference, opened May 14 at the Port of Tallinn cruise terminal, where founder Valentin Feklistov told the room that legal AI was moving past hype toward verifiable infrastructure. The question under the whole program, who governs the governors, carried from a regulator-heavy morning into panels that recast AI agents as new risk actors under the EU’s NIS2 and DORA regimes and nudged the human role from in the loop to on the loop. How far do lawyers actually trust what these tools produce? One panel put the answer at 6.6 out of 10 across three Baltic legal teams, a score held down by models that replied in Russian when prompted in Latvian or Estonian. The closing day turned to the billable hour. Uwais Iqbal, who runs a London legal-AI consultancy, described what adjudicators learned after spending 20 months running an AI workbench across over 20,000 decisions at a British tenancy-deposit dispute service: 77 percent said they would not go back to working without it. And a preview published before the conference left a point hanging, that small language models, kept behind a firm’s own firewall, may fit privilege review and cross-border matters precisely where sending data to the cloud is the risk.

Days later, Latitude59 turned the same city into a marketplace. The 14th edition, held May 20 to 22 under the banner “The Global Village Experiment,” drew about 3,000 people from over 70 countries and set out to wire the New Nordics to startup networks in Africa and Asia. Its main stage made room for big tech, defense and climate, and a new two-day Builders Lab put 10 teams in front of companies including Google. Its pitch contest, with investors pressing harder on operational readiness than on polish, pulled a record 465 applications from 53 countries, the New Nordic region accounting for 44 percent, with 70 African and 24 Ukrainian teams in the mix. The prize pool climbed to at least €400,000, syndicated by Estonian, Latvian and Finnish angel networks with Lithuania’s Firstpick fund joining, and on the final day judges split €450,000 among three winners: Estonia’s DogBase took €100,000, Finland’s Granarium Technologies took €200,000, and Lithuania’s Backoffice took €150,000. The capital came paired with policy. At an opening session called “Thinking in Billions,” economy minister Erkki Keldo presented a regulatory sandbox that hands companies real legal exemptions to test products the statute book does not yet allow, regulation, he said, turned into a competitive advantage. President Alar Karis argued from the Bold stage that education, not raw compute, decides whether AI makes people smarter, and a closing debate on sovereignty gave Skeleton Technologies’ Arnaud Castaignet the floor to remind everyone that AI economics is, at bottom, about energy and power. For a cybersecurity and eDiscovery audience, the sandbox was the thing to watch: a live test of how fast a small state can write enforceable rules.

West to Dublin, where synthetic evidence tests the rulebook

If the Nordic stops showed how fast a small state can write rules, Ireland raised the next question: who enforces them. The journey crossed west to Dublin, where the Dublin Tech Summit, in its 10th edition May 27 and 28 at the RDS, put two governance questions under the lights. William Fry partner Barry Scannell opened a panel by calling Ireland the de facto regulator of AI globally, a side effect of hosting the European operations of so many large platforms, before the talk turned to whether GDPR, rather than a delayed EU AI Act, will govern most AI in practice; OpenAI’s Emma Redmond, who runs the company’s Irish operation, sat alongside him. The second question cut to the evidence itself. In a workshop hosted by digital-forensics firm HaystackID, its forensics leaders John Wilson and Jeff Shapiro walked through a deepfake video call that, they said, moved about $25.6 million before a finance officer checked with head office, and made an unsettling point: a faithful recording of a fabricated meeting is, forensically, genuine. The fix may have to come from the rulebook, through proposed Rule 707 on authenticating machine-made evidence, and from a new generation of privacy and discovery tools, including single-pass scanners built to find sensitive data before regulators under the AI Act, NIS2, DORA and GDPR come asking.

That is the through-line worth naming before the journey reaches London. These states move fast because they are small: a sandbox or an e-identity scheme can ship in a compact, digitally run state where it would stall in a larger one. Agility alone, though, does not explain the reach. The European single market and the pull that scholars call the Brussels Effect carry a rule written or first enforced in Tallinn or Dublin onto the desk of any company that wants European customers. Ireland already supervises platforms it does not own, and Estonia’s sandbox and X-Road data exchange become templates others copy. The small states set the terms, and the larger markets, London among them, inherit and pay for them.

London, where the audience turns enterprise legal tech

By June the journey reached London, and the cast changed. London Tech Week had opened June 8 with Prime Minister Keir Starmer pledging £400 million to buy sovereign AI compute, part of a day of commitments running above £4 billion, with AMD and Nebius adding private capital. That was the backdrop. For this journey, the two relevant events drew a different room, the AI-infused enterprise legal technology crowd, the buyers and builders who turn such policy into product.

The first was Relativity Fest London, the eDiscovery vendor’s user conference. At its opening keynote, Relativity pushed its aiR Assist and no-code review tools toward general release and argued that legal teams will soon talk to their data rather than only search it. Chief executive Phil Saunders named the catch, a readiness gap between fast AI adoption and slow governance, and held that the goal is an auditable single source of truth, not a chatbot. The pitch answered the worry that had traveled the whole way: conversational access to a matter helps only when every answer is grounded, traceable and defensible.

A few days later, LegalTechTalk filled the InterContinental O2 on June 17 and 18 to close the trip. One session ran on the phrase “blueberry hot dogs,” a shared human code word meant to defeat synthetic impersonation, and replayed that $25 million deepfake fraud to argue no single department owns cyber risk. Another, from HaystackID, showcased COMET, a tool that captures business messages off personal phones, a bet that the off-channel crackdown which has drawn over $3.5 billion in U.S. penalties since 2021 is about to reach regulated firms in London and Frankfurt.

What the journey showed

The question that opened the journey, who controls the data, the models and the defenses, never got a tidy answer, but the trip pointed to one. Taken in order, the nine months read as one story. Anxiety voiced in Tallinn and priced in Helsinki hardened into capital, then rules, then product by the time it reached London. The thread never changed. Every stop left a concrete obligation behind it: provenance for defense code, sandbox rules for fast-moving tools, authentication for synthetic evidence, retention for off-channel messages. A tutorial released alongside the run, modeled on the Oxford method and built around 21 contestable propositions across three terms, made the same case in a different key, that cybersecurity, governance and eDiscovery are one discipline, trained to tell a defensible claim from a fashionable one.

The journey also sharpened a question about geography. The places helping to write the next decade’s rules are not only the obvious capitals. Estonia, Finland and Ireland, working the seam between startups and defense and between traditional and AI-enabled security, look poised to set exportable terms the larger markets may inherit. So here is the question to carry home from the journey: if sovereignty is now a discovery problem, where should a practitioner look first for the precedent that decides the next case, the courtroom or the conference hall?



News Sources



Assisted by GAI and LLM Technologies

Additional reading

Source: ComplexDiscovery OÜ

ComplexDiscovery’s mission is to enable clarity for complex decisions by providing independent, data‑driven reporting, research, and commentary that make digital risk, legal technology, and regulatory change more legible for practitioners, policymakers, and business leaders.

 

Have a Request?

If you have information or offering requests that you would like to ask us about, please let us know, and we will make our response to you a priority.

ComplexDiscovery OÜ is an independent digital publication and research organization based in Tallinn, Estonia. ComplexDiscovery covers cybersecurity, data privacy, regulatory compliance, and eDiscovery, with reporting that connects legal and business technology developments—including high-growth startup trends—to international business, policy, and global security dynamics. Focusing on technology and risk issues shaped by cross-border regulation and geopolitical complexity, ComplexDiscovery delivers editorial coverage, original analysis, and curated briefings for a global audience of legal, compliance, security, and technology professionals. Learn more at ComplexDiscovery.com.

 

Generative Artificial Intelligence and Large Language Model Use

ComplexDiscovery OÜ recognizes the value of GAI and LLM tools in streamlining content creation processes and enhancing the overall quality of its research, writing, and editing efforts. To this end, ComplexDiscovery OÜ regularly employs GAI tools, including ChatGPT, Claude, Gemini, Grammarly, Midjourney, and Perplexity, to assist, augment, and accelerate the development and publication of both new and revised content in posts and pages published (initiated in late 2022).

ComplexDiscovery also provides a ChatGPT-powered AI article assistant for its users. This feature leverages LLM capabilities to generate relevant and valuable insights related to specific page and post content published on ComplexDiscovery.com. By offering this AI-driven service, ComplexDiscovery OÜ aims to create a more interactive and engaging experience for its users, while highlighting the importance of responsible and ethical use of GAI and LLM technologies.