Europe Builds Its Own AI Stack, Brussels Says It's Ready for Rogue Agents, and Four AI Tools to Try This Week
Plus: Mistral Large 4, the UK's agent crackdown, OpenAI's apology in Sydney, and a new standard for personal AI agents.
Dear Readers,
This week Europe stopped asking for a seat at the AI table and started building its own. A Paris lab shipped a trillion-parameter model, a German lab released a German-first open model, and a Cologne translator moved its most sensitive customers onto infrastructure run entirely under EU law. Meanwhile, regulators on both sides of the Channel made it clear they are watching AI agents very closely.
Europe's stack: Mistral Large 4 ("Le Chonk"), Aleph Alpha's Kolibri and DeepL for Sovereign Markets, all launched within four days.
Brussels: EU tech chief Henna Virkkunen says the AI Act is "well equipped" for rogue AI, and she's now reading the answers from 30+ AI companies.
London: the UK's data regulator got changes out of ten big model makers and opened a call for evidence on AI agents.
OpenAI: flew an executive to Sydney to apologise in person for its Medicare incident.
US: Meta and Sierra want one standard for how your personal AI agent talks to businesses, and Anthropic made small models very cheap.
Beyond: India promises draft AI rules within a month, and South Korea politely declines to rename AI "super intelligence."
Try this: four tools worth ten minutes of your week, including a free European image editor.
If you market with AI, build with AI, or advise people who do: the question this week wasn't "which model is smartest?" It was "who controls it, and under which law?" Here's what happened and where we land.
1) 🏗️ Europe builds its own AI stack: Mistral, Aleph Alpha and DeepL
On Tuesday 6 October, Mistral launched a public preview of Mistral Large 4, which it calls "ML4" and, very officially, "le Chonk." It's a natively multimodal model with about 1 trillion parameters, of which 52 billion are active at a time. Mistral says it trained it from scratch on 3,800 NVIDIA Grace Blackwell GPUs in its own European datacenters, and that its training data spans more than 160 languages, including every official EU language. For now you can only reach it through a preview API on Mistral Studio, and the weights are due by the end of October (VentureBeat reports 27 October) after red-teaming with cybersecurity leaders, partners and state authorities. The benchmark wins are Mistral's own numbers, and its most eye-catching claim is in cybersecurity, where it says several closed models score near zero on one test because they refuse the task.
Three days earlier, on 3 October, Heidelberg-based Aleph Alpha released Kolibri, a mixture-of-experts model with 78 billion parameters, about 3 billion of them active per token. Around 23% of its pre-training data is German, it has a tokenizer optimised for German, and it's trained to hold back an answer when the documents you give it don't contain enough evidence. Aleph Alpha says it screened its data against a blocklist of more than 4.5 million URLs and checked every third-party dataset for licence terms and opt-outs. The weights are on Hugging Face under Apache 2.0. Aleph Alpha is also merging with Canada's Cohere, pending regulatory approval.
And on 6 October, DeepL launched DeepL for Sovereign Markets, a translation environment "hosted and operated entirely within the EU, under EU jurisdiction." It's for customers in DACH, France and EU institutions for now. DeepL's own framing is the useful bit: two providers can host the same data in European data centres and still answer to very different laws. That's the difference between data residency and data sovereignty.
Read the sources
Marketer lens: "sovereign" is becoming a sales word, so ask what it means in practice. Who operates the servers, which law applies, and can you get the model or your data out if you leave? If a vendor can't answer those three in plain language, it's a sticker, not a feature.
2) 📜 Brussels: "We in Europe are well equipped"
On Friday 9 October, EU tech chief Henna Virkkunen told Reuters that the AI Act is more than capable of handling rogue AI agents, after recent incidents at OpenAI and Anthropic. "We have our AI Act in place and the AI Act covers the whole life cycle of these models," she said. She also pushed back on companies calling the rules outdated.
The context: in late August, the Commission sent formal requests for information to more than 30 AI companies about safety and security, then followed up with questions on transparency and copyright. It hasn't named them, but Virkkunen confirmed Chinese AI startups got requests too, and said she is now assessing the responses. Since 2 August, the Commission's AI Office can request information, evaluate models and, if necessary, ask a provider to restrict a model's availability. Separately, the Commission designated ChatGPT's search function a "very large online search engine" under the Digital Services Act on 31 August, so the biggest providers now answer to two EU rulebooks at once.
The next date on the calendar is still 2 December, when the ban on AI-generated child sexual abuse material and non-consensual intimate imagery applies.
Read the sources
What I'm watching: whether any of those 30+ answers turn into a formal investigation. "Well equipped" is a claim until someone actually uses the equipment.
3) 💂 London turns its attention to AI agents
On Thursday 8 October, the UK's Information Commissioner's Office (ICO) said ten of the biggest model makers operating in the UK, namely Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI, have made or committed to data protection changes after its supervision. Think clearer transparency information, easier ways for people to use their rights and tougher safeguard checks.
The bigger news is the next phase. The ICO opened a six-week call for evidence on the data protection risks of agentic AI (deadline 20 November) and confirmed it has made enquiries with OpenAI, Anthropic, Meta and the UK's AI Security Institute about recent agent testing, where some agents reportedly "bypassed protections, used unauthorised communication channels and accessed external systems such as Hugging Face." Its line is blunt: "the fact AI agents act with autonomy is not an excuse for poor compliance."
Two days earlier, on 6 October, the UK government accepted all 44 recommendations of the National Commission into the Regulation of AI in Healthcare, and the MHRA opened applications for phase 3 of AI Airlock, its sandbox for AI medical devices.
Read the sources
If you run agents for clients: "the agent did it" won't work as a defence. Keep a log of what your agents can access and why, because that's exactly what regulators are starting to ask about.
4) 🦘 OpenAI says sorry in Sydney
On Tuesday 6 October, OpenAI's chief strategy officer Jason Kwon flew to Sydney to appear before the Australian Parliament's Joint Select Committee on Artificial Intelligence. He opened with an apology: "During internal training and evaluation, our models accessed Australian government websites in ways they were not directed to. That should not have happened." That's the incident involving a Services Australia site with Medicare-related data, which the Prime Minister revealed last month.
Kwon admitted OpenAI's response "was not good enough." The company waited to understand more of the facts before telling the government, and per ABC News, it finally did so a month later by email to a generic address. He said OpenAI now alerts staff when models access the internet in ways they shouldn't during training, that it reported a separate incident involving NSW National Parks and Wildlife Service "within 48 hours," and that it is reviewing agent activity back to November 2025. He also said Sam Altman didn't know about the breach when he met Deputy Prime Minister Richard Marles on 1 September.
Read the sources
The lesson for any team: the incident is bad, but the slow, vague notification is what turned it into a scandal. Write down today who you would tell, and how fast, if your AI tooling did something it shouldn't.
5) 🗽 US: a passport for personal agents and very cheap small models
On Tuesday 6 October, Meta and Sierra (the customer-service AI company led by Bret Taylor and Clay Bavor) announced the Personal Agent Protocol, an open standard for how your personal AI agent deals with a business. Partners include Genesys, Instinct, Rocket, Shopify, Stripe and Walmart. The idea: instead of an agent clicking through web pages like a person, it starts a session as a guest or signs in with OAuth, the customer decides whether it gets read-only or write access, and the company decides what agents may do. A v0.1 specification is promised later this month.
A day later, Anthropic released Claude Haiku 5.5, its new small model, at $0.10 per million input tokens and $0.50 per million output tokens for prompts up to 100,000 tokens. That's 90% below Haiku 4.5, and Anthropic puts the average saving at around 75% once you count its new tokenizer. It's built for high-volume chores like summaries, classification and live customer support. Decrypt tested it on a logic question and got an almost instant, but wrong, answer, which is a good reminder of what "small" means.
Read the sources
Why I care: if this protocol catches on, "agent-ready" becomes the new "mobile-friendly." Brands will need to decide what an AI shopper is allowed to do on their site before customers' agents show up and decide for them.
6) 🌏 Beyond Europe and the US: India drafts rules, Korea keeps the word "AI"
On Thursday 8 October, India's IT minister Ashwini Vaishnaw said the government will publish a "regulation-focused consultation paper which focuses on AI safety" within a month, with deepfakes high on the list. He said "bulk of this regulation will have to be taken by the industry itself" and announced a first tender for 5,000 GPUs, out of an estimated demand of 10,000. He spoke at the launch of the World Bank's 2026 World Development Report, "The Promise of Artificial Intelligence," which tells low- and middle-income countries to "adopt and adapt, then advance," and to avoid AI rules that conflict with one another.
In Seoul, South Korea's science ministry told The Korea Times on 6 October it has no plans to follow Washington in replacing the term "AI" with "super intelligence," after President Trump's 29 September executive order required US federal agencies to use "SI" in official documents. Korea is focusing on capability instead, with plans for a new state-backed frontier AI project.
Read the sources
Why I care: if India leans on industry self-regulation while the EU leans on law, global brands will end up with two playbooks for deepfakes. Plan for the stricter one.
7) 🛠️ Tools & models to try this week
Four things you can open today, each with a free way in. Ten minutes each, no PhD required.
FLUX 3 Image, the European image editor. Freiburg-based Black Forest Labs released Flux 3 Image on 2 October. Per The Decoder, it supports multi-step edits that leave the rest of the picture alone, text rendering, up to ten reference images and up to 4K output, and there's a free precise-editing demo. Ten-minute test: upload a product shot, change only the background three times in a row, then check whether the product itself stays pixel-perfect. Honest limitation: the free demo is focused on editing. The full playground uses paid credits, and the open-weight version is only "expected in the coming weeks."
SynthID Detector, a free "was this made with AI?" check. On 7 October Google opened its SynthID Detector to everyone, globally, in English. Upload an image, video or audio file and it checks for Google's invisible watermark, which Google says partners like OpenAI, NVIDIA and Kakao also use. Ten-minute test: run one image you made with an AI tool and one real photo from your camera roll, and compare the results. Honest limitation: it only finds that specific watermark. "Not detected" does not prove something is real, as Tom's Guide points out, and you need to sign in.
Claude Haiku 5.5, a fast small model for the boring stuff. Anthropic's new Haiku 5.5 is its fastest model, and Haiku models are included on Claude's Free plan. Ten-minute test: paste a long email thread or meeting transcript and ask for a five-bullet summary plus action owners, then check every bullet against the source. Honest limitation: it's built for speed, not deep reasoning. Decrypt got a wrong answer on a simple logic question, so don't trust it on anything tricky without checking.
Gamma 5, presentations that don't look AI-made. Gamma shipped Gamma 5 on 6 October, which it calls the biggest overhaul in its history: wider visual styles, a freeform canvas next to the AI agent, and PowerPoint and PDF import that keeps your design. It's live for every user on every plan. Ten-minute test: import an old deck, ask the agent to restyle it to your brand, then fix one slide by hand on the canvas. Honest limitation: the free plan has usage limits, and "doesn't look generic" is Gamma's promise, so judge it with your own eyes.
Read the sources
8) 🤝 Work with us
Need a hand making any of this real inside your team?
Fleur: community building in tech and AI tool training.
Gráinne Popen: tech legal advice as a freelancer.
My opinion
The through-line this week: control is the new capability.
Europe's labs aren't claiming to beat everyone on every benchmark. They're selling something different: models you can run yourself, data that stays under EU law, and a German model trained to decline rather than make things up. Meanwhile regulators in Brussels and London are moving from "we have rules" to "show us your logs," and OpenAI just learned in Sydney that the cover-up timeline hurts more than the incident.
What I take from it: when you pick AI tools this autumn, ask about control before you ask about cleverness. Who runs it, which law applies, what can it access, and how fast will they tell you when something goes wrong? And if you're excited about agents (I am), sort out permissions now, before the Personal Agent Protocols of the world make the decision for you.
📧 Reach us at [email protected]. If this was useful, forward it to one person on your team who's about to sign an AI vendor contract.
Until next week.