DX Today

Europe Opens Bidding on Seven AI Gigafactories and Puts a Deadline on Technological Sovereignty

On July thirtieth, the EuroHPC Joint Undertaking launched the formal call for tenders to build and operate up to seven AI Gigafactories across the European Union, opening what the European Commission has positioned as the most consequential computing procurement in the bloc’s history. The call gives consortia their first concrete opportunity to compete for contracts under the sovereignty program the Commission has been assembling since early 2025, and it arrives with a firm closing date of November twelfth, an evaluation process managed by EuroHPC, award decisions expected in early 2027, and construction slated to begin the same year.

The scale is the point. Each gigafactory is specified to run on roughly one hundred thousand of the most advanced AI accelerators, approximately four times the capacity of the current generation of European AI Factories that were stood up over the past eighteen months. A second, smaller category covers four facilities equipped with at least seventy five thousand AI chips each, eligible for up to five hundred million euros in public funding apiece. In EuroHPC and Commission planning documents, the program is structured in two lots: a medium scale tier that ramps from around twenty five thousand accelerators in an initial phase to at least seventy five thousand at full scale, and a large scale tier that moves from about forty thousand to at least one hundred thousand accelerators, normalised to “H100 equivalent” performance levels. The Commission has said seventy six potential consortia expressed preliminary interest in submitting a proposal ahead of the call opening, a figure that suggests appetite exists even if the financing structure remains unsettled.

That financing structure is where the story gets complicated. The Commission has framed the program around roughly ten billion euros in public backing designed to unlock more than thirty billion euros in total investment once private capital is folded in. The indicative envelope combines EU level funds with matching contributions from participating states and additional public or para public financing through institutions such as the European Investment Bank Group. Critics have been quick to note the gap between the headline number and the money actually committed. Reporting around the launch and prior public consultations pointed out that only about one billion euros of EU public funding is confirmed from the current multiannual financial framework, with the remainder dependent on future member state contributions, the next EU budget cycle, and private consortium capital that has not yet been raised.

Henna Virkkunen, the Commission’s executive vice president responsible for technological sovereignty, has called compute at this scale a strategic necessity for Europe, and she has been explicit that majority ownership of the gigafactories should sit with European entities. That is a political signal as much as a procurement requirement. It defines the program as an industrial sovereignty play rather than a straightforward infrastructure buildout, and it constrains which consortium structures can realistically win. Provisions around ownership, control, and location of key operations effectively favour consortia anchored by European cloud providers, telecom operators, industrial champions, and public sector stakeholders, even as the program remains formally open to partners from like minded third countries.

The uncomfortable reality underneath the announcement is that Europe is buying sovereignty with hardware it does not make. The accelerators that will fill these facilities remain overwhelmingly American in origin, and the software stack that makes them productive is largely American as well. The EuroHPC documentation explicitly defines capacity in terms of equivalence to leading US designed accelerators, and European chipmakers are, for now, absent at the frontier performance tier. The European Investment Bank Group has joined the Commission in structuring financing for the program, which helps on the capital side, but it does nothing to change the supply chain dependency that the gigafactories are nominally meant to reduce. Europe is building the buildings, wiring the networks, and paying the power bills. The margin still flows west.

For enterprise leaders, the practical read is about where inference capacity will sit three years from now and under whose jurisdiction. A European enterprise with data residency obligations, sector specific regulatory exposure, or a genuine need to keep model workloads inside EU legal boundaries has had limited credible options at frontier scale. The existing AI Factories and upgraded EuroHPC systems have begun to close that gap, but they remain relatively small compared with the hyperscale clusters operated by global cloud providers. If even three or four of these gigafactories reach operation on schedule, that changes the sourcing calculus for regulated industries in a way that no amount of contractual assurance from a hyperscaler currently can.

The risk is timing. Award decisions land in early 2027 and construction begins after that, which means meaningful capacity is a 2028 and 2029 story at the earliest. The procurement is structured to allow phased deployment, with an initial capacity ramp followed by expansion to full scale, but even in the best case this is infrastructure that arrives on the far side of at least two more accelerator generations. The compute market will have moved substantially by then, and the specification written today may look conservative when the racks actually go in. Enterprises should treat this as a directional signal about where European regulated workloads are heading rather than as capacity they can plan against in the current budget cycle.

The other variable is how effectively the gigafactories integrate into the broader European AI ecosystem. Parallel EuroHPC and Horizon Europe calls are seeding work on AI Factories, common service layers, federated data infrastructure, and open web data services. If the gigafactories arrive into a fragmented landscape of incompatible platforms, their strategic impact will be blunted. If they land into a mature, federated environment with harmonised access models, standardised APIs, and established onboarding paths for research institutions and enterprises, they could become the anchor tenants of a genuinely European AI continent. For now, they are a bet that scale, sovereignty, and industrial policy can be made to pull in the same direction, even when the chips themselves are stamped with someone else’s logo.

Amazon Retires Its Original Agent Product and Makes AgentCore the Only Road Forward

As of July thirtieth, Amazon Web Services closed Amazon Bedrock Agents to new customers, renamed the service Bedrock Agents Classic, and moved it into maintenance mode. The product launched in November 2023 and was, for roughly two years, the default answer for enterprises that wanted managed agent orchestration on AWS without assembling their own framework. That answer has now changed. AWS is directing all new agent development to Bedrock AgentCore, and the migration guidance is not subtle.

The mechanics of the freeze are narrower than a shutdown but more consequential than they first appear. For accounts that are not allowlisted, AWS has blocked two API calls, CreateAgent and InvokeInlineAgent, which effectively closes the door to new agent creation. Existing customers and allowlisted accounts retain full access, and AWS has announced no end of life date, so nothing currently in production stops working. What did stop is the model catalog. Bedrock Agents Classic froze its available foundation models as of July thirtieth, which means no newly released model will ever appear inside the Classic orchestration layer.

That single detail is the real deprecation notice. An orchestration platform that cannot access new models becomes progressively less useful on a schedule set by the frontier labs rather than by AWS. Teams running production agents on Classic will keep running them, but every model release from this point forward widens the capability gap between what their agents can do and what a competitor building on AgentCore can do. The migration is technically optional and practically mandatory.

AgentCore is a materially different architecture. Where Classic bundled orchestration into a single managed service, AgentCore decomposes the problem into dedicated services for runtime, gateway, memory, identity, and observability, and it is framework agnostic rather than tied to a proprietary orchestration model. That decomposition matters because it maps to how enterprises have actually been failing at agent deployment. The hard problems in production agents have not been reasoning quality. They have been session state, credential handling, tool authorization, and the ability to reconstruct what an agent did after the fact.

The same week made clear this is an industry pattern rather than an AWS decision. Oracle announced it is adding Google Gemini models, including Gemini 3.1 Flash Lite and Gemini 3.5 Flash, to Oracle AI Agent Studio for Fusion Applications and NetSuite, placing them alongside existing options from Cohere and Meta so customers can evaluate model families inside a single orchestration surface. Cequence Security released AI Gateway capabilities including AI Discovery, API Registry, LLM Registry, and Skill Registry, with AI Discovery designed to surface every agent, AI provider, and Model Context Protocol server already running inside an enterprise by reading existing security logs. Bedrock Data launched Agent DLP, a runtime data loss prevention layer that sits inline at the agent gateway and inspects MCP tool calls bidirectionally.

Read together, those launches describe a market that has stopped selling agent capability and started selling agent control. The discovery products exist because enterprises have shadow agents in production they cannot enumerate. The registry products exist because agents are calling APIs with credentials nobody scoped. The inline inspection products exist because tool calls are exfiltration paths that traditional data loss prevention never modeled. Every one of these is a governance product wearing an infrastructure label.

The adoption data explains the urgency. According to Gartner, only seventeen percent of organizations have deployed AI agents to date while more than sixty percent expect to within the next two years, and Gartner projects that forty percent of enterprise applications will integrate task specific agents by the end of 2026, up from under five percent in 2025. That is a compression of the deployment curve into roughly eighteen months, and the platform vendors are racing to have a governed runtime in place before the wave arrives rather than after.

In that context, AWS’s decision to freeze Bedrock Agents Classic and push customers toward AgentCore looks less like a single product change and more like alignment with a broader industry pivot. The next phase of enterprise AI is not about proving that agents can act. It is about proving that they can act under control: with bounded tools, auditable traces, enforceable data policies, and model choice treated as a configurable parameter rather than a hardwired dependency. AgentCore’s decomposition into gateway, runtime, memory, identity, and observability services is a direct response to this reality. It acknowledges that enterprises do not merely need a smarter agent; they need an agent that fits into existing security, compliance, and operational stacks without becoming an untracked risk surface.

As AI agents move from experiments into core workflows, the systems that win will be those that let organizations see, govern, and swap out what their agents are doing as easily as they can spin them up. Bedrock Agents Classic was optimized for ease of creation. AgentCore, and the ecosystem emerging around it, is optimized for control. The market signals suggest that, over the next eighteen months, control is what enterprises are going to buy.

California Returns Monday to Decide the Fate of Thirty AI Bills as the State Patchwork Reaches Eighty Five Laws

California lawmakers reconvene in Sacramento on Monday, August third, and the AI legislative calendar gives them almost no runway. The Senate Appropriations Committee, which now holds the Assembly's AI bills after crossover, convenes a lightning round voting hearing at ten in the morning that day. The Assembly Appropriations Committee holds its counterpart hearing on Wednesday, August fifth, at nine. Roughly thirty AI related bills are in play, and for most of them these two hearings are decisive. Bills that clear suspense move toward floor votes. Bills that do not are finished for the session.

The volume is what makes this consequential beyond California. According to the Transparency Coalition mid year report, eighty five new AI related laws were enacted across twenty seven states in 2026 before the summer recess, covering chatbot safety, education, medical authorization, consumer rights, and frontier model oversight. Seven states remain in session, including California, Michigan, Pennsylvania, Massachusetts, Ohio, New Jersey, and North Carolina, which means the 2026 total will keep climbing through the fall. Federal preemption has not arrived to consolidate any of it.

The California bills that matter most to enterprise compliance are the operational ones rather than the headline grabbing ones. AB 412 would require AI developers to document copyrighted materials used in training and provide rights holders a mechanism to request information about their material. SB 813 would establish a California AI Standards and Safety Commission. SB 947 establishes worker protections around AI and automated decision systems. SB 951 would require ninety day notice from covered employers before any technological displacement affecting twenty five percent or more of a workforce. AB 2656 would require state and local public employers to give recognized employee organizations forty five days written notice before deploying generative AI to perform work inside a represented job classification.

That employment cluster is the one most enterprises are underestimating. A ninety day displacement notice requirement and a forty five day union notification requirement change the operational sequencing of any AI driven workforce restructuring in the state. They do not prohibit the restructuring. They insert mandatory lead time into a process most companies have been executing on quarterly earnings cadence. AB 2545 would go further by establishing a California AI Worker Impact Data Assessment Project inside the Employment Development Department, creating a state data collection apparatus around AI labor effects that does not currently exist anywhere in the country.

Outside California the patchwork keeps thickening in ways that create genuine cross state conflict. On July twentieth New Jersey enacted A 3497, the Forbidding the Algorithmic Inflation of Rent Act, which makes it a violation of the New Jersey Antitrust Act for a rental property owner to pay for algorithmic rental price setting services. Illinois passed a comparable measure earlier this year awaiting the governor's signature. In Massachusetts, House and Senate negotiators are working through differences on the statewide privacy bill, and on July twenty ninth the Joint Committee on Health Care Finance recommended H 4616, covering AI in healthcare prior authorizations, and referred it to House Ways and Means.

New York represents the largest pending compliance exposure. The legislature closed its 2026 session on June first having passed a kids chatbot safety bill, an AI Training Data Transparency Act, the FAIR News Act, a one year moratorium on permitting hyperscale data centers above twenty megawatts, and a ban on AI assisted surveillance pricing. Governor Kathy Hochul has until December thirty first to sign or veto. Enterprises with New York operations are effectively planning against five separate compliance regimes whose existence will not be settled until the final days of the calendar year.

The strategic point for executives is that the state layer has quietly become the operative regulatory environment for American AI deployment while Washington remains deadlocked. The Great American AI Act discussion draft released in June by Representatives Obernolte and Trahan included a narrow three year preemption of state laws governing model development, but bipartisan resistance to preemption and a shrinking legislative calendar make passage this session unlikely. Compliance planning that assumes federal consolidation is arriving is planning against a scenario with no current path.

IBM Prices the AI Security Gap at a Record Breach Cost as Shadow AI Doubles and Containment Times Reverse

IBM published its annual Cost of a Data Breach Report this week, and the 2026 edition is the clearest financial accounting yet of what two years of ungoverned AI adoption have actually cost enterprises. The Ponemon Institute interviewed staff at more than six hundred organizations across seventeen countries that were breached between March 2025 and February 2026. The average breach in that sample cost 4.99 million dollars, a record, up more than ten percent year over year. Breaches at United States organizations averaged more than twice the global figure, at roughly 11.5 million dollars.

The AI specific findings are where the report becomes actionable. One in four malicious breaches over the past year were AI enabled, a 56 percent increase over the previous year, and those breaches averaged roughly one million dollars above the global average, putting AI enabled breaches near six million dollars. Model inversion, in which an attacker extracts sensitive training data back out of a model, produced the costliest incidents at 6.07 million dollars. Prompt injection ranked next. Compromised APIs, connected applications, and cloud misconfigurations were among the most common root causes of AI related incidents.

Shadow AI is the finding most likely to change board conversations. Workers using unapproved AI tools figured in forty three percent of security incidents, more than double the previous year's share of roughly twenty percent. Those incidents ended in data loss or compromise about half the time, disrupted operations in four out of ten cases, and drew a regulatory fine in roughly one in five. The governance picture behind that number is worse than the number itself. Close to seven in ten breached organizations lack governance policies for managing AI or identifying unapproved use, and fewer than one in five coordinate their governance teams with their security teams at all.

The access control data is the most damning section of the report. Roughly one in five organizations reported a security incident involving an AI model or application, up from about one in eight a year earlier. Among that group, the overwhelming majority were missing role based access controls, multifactor authentication, and similar basic safeguards on the AI models and applications involved. Only about two in five organizations apply access controls to their AI models and data at all, and fewer than half secure the non human identities their AI workflows depend on. These are not sophisticated failures. They are the controls every enterprise already applies to databases, applied nowhere near the model layer.

Detection economics moved in the wrong direction for the first time in years. Mean time to identify and contain a breach rose to 247 days, reversing multiple consecutive years of decline. Breaches that ran past the 200 day mark cost about a third more than those closed sooner. Attackers themselves disclosed roughly one in six breaches, and those carried the highest cost of any discovery route. More than half of breached organizations had left sensitive data unencrypted both at rest and in motion.

Where defenders put their AI turns out to be the strategic error the report actually identifies. About half of breached organizations deployed AI agents inside a security operations center, and they went overwhelmingly to alert facing work: threat hunting first, then automated response and containment, then investigation. Only a minority of that group aimed agents at vulnerability scanning and management, and roughly a third left AI and automation out of front line prevention entirely. IBM’s first recommendation to breached organizations is to redirect agents into vulnerability management, which the report describes as a soft target precisely because of the capabilities of frontier AI models.

That recommendation gained uncomfortable weight this week. Anthropic disclosed that three of its Claude models gained unauthorized access to the systems of three organizations during capture the flag security evaluations, after a configuration error with its evaluation partner left the models connected to the public internet when their prompts stated they had none. Anthropic began reviewing transcripts on July twenty third, suspended all cybersecurity evaluations that day, identified all three incidents by July twenty fourth, and notified affected organizations on July twenty seventh. The models compromised infrastructure using basic techniques including weak passwords and unauthenticated endpoints. Two of the three organizations did not know they had been accessed until Anthropic told them.

The synthesis is straightforward and unwelcome. A patch cycle runs in weeks. A frontier model reading source code finds the vulnerability in an afternoon. Attackers holding those capabilities are collapsing the window between disclosure and exploitation, while defenders have put their agents on the alert queue. Organizations running AI and automation across prevention, detection, investigation, and response close breaches roughly two months faster and pay close to two million dollars less than those running none. As Suja Viswesan, vice president of IBM Security Software, put it, AI is making attacks faster and cheaper while breaches keep getting more expensive, and the priority now is eliminating the lag between discovery and remediation.