The exposure was immense, with AI multiplying the risks — and yet time-tested global cybersecurity procedures appeared to be functioning. Then suddenly, it all broke down.        

The decision by a cybersecurity company on Wednesday to prematurely release information about a flaw in the popular PHP computer programming language left much of the web exposed to hackers, triggering a panic that brought to life months of warnings of how the AI-powered era could cause widespread damage.

The flaws in PHP, discovered using AI tools through a months-long process coordinated by OpenAI, caused cyber agencies across Europe, the U.S., the U.K., Australia and Canada to post urgent warnings Wednesday. Numerous governments took websites offline as a precaution.

While no major hacking damage was immediately apparent, the way the incident unfolded over 72 hours showed how easily cybersecurity processes can break down and the outsized consequences of cyber risks in the AI era.

The man who set off the chain reaction with the early release — Chainguard’s CEO Dan Lorenc — quickly apologized in a LinkedIn post. But on Thursday, in an interview with POLITICO, Lorenc said he’d shared the information ahead of time because the flaw was already being exploited. Though others disputed that, Lorenc said he believed he’d seen enough evidence to invalidate an embargo set up to allow time to find a fix for the flaws. 

While he disputed that his actions would have caused problems for other defenders, Lorenc conceded that the evidential threshold in these coordinated cyber defense systems is a “grey area.” 

The revelation of the PHP flaw brings out into the open what cyber officials have been bracing for since the arrival of the most powerful tools of artificial intelligence, which not only can be used to discover vulnerabilities but also to exploit them at scale. 

The cybersecurity world’s long-established protocols helped prevent disaster scenarios, in which hackers would have successfully exploited the vulnerabilities to take control of numerous websites and access their data. But the scale and end-of-days potential of AI-driven cyber risks are now visible for the world to see. 

This “is what happens when AI turns up a flaw that’s been hiding for years,” said Eylam Milner, co-founder and chief technology officer at cybersecurity start-up Echo. The vulnerabilities, he added, are “about as serious as it gets for the web.”

Origin story

Understanding how this week’s emergency unfolded offers a glimpse at how companies and authorities are working to stave off attacks — and how much risk they face going forward. 

The origins of the incident can be traced back as far as April when leading frontier AI firm Anthropic unveiled Mythos, leading some in the cybersecurity world to worry that systems would quickly be overrun by advanced artificial intelligence, with potential for catastrophic events to ensue.

But while researchers did find more flaws in computer systems in the months after Anthropic and other AI firms like OpenAI released those models, they had little impact in the real world. Even the Hugging Face incident, a widely discussed hack that saw OpenAI’s autonomous AI agents go rogue during an internal security evaluation, related more to the level of control AI companies exert over their models than their power to break into systems worldwide. 

That changed this week after researchers unveiled the vulnerability in PHP, a coding language estimated to be integrated into some 70% of the web.

The process by which information about flaws is released among cybersecurity officials and affiliated companies is crucial. Through a longstanding practice known as coordinated disclosure, researchers and companies that identify flaws can find a fix and share it confidentially with agencies and others before releasing to the public, meaning they don’t hand malicious hackers the gift of a hole without a fix.

In the case of the PHP flaw, that process worked well, but not perfectly. Information about the bugs started to circulate ahead of the planned release time. Then, according to the PHP Foundation, Chainguard “unilaterally broke the embargo,” which “disregarded weeks of work by many parties toward a coordinated disclosure.” PHP Foundation executive director Elizabeth Barron told POLITICO by email that while it was “disappointed” with Chainguard, it hopes to “rebuild trust with them in the future to ensure we can continue to collaborate effectively.”

After the leak— which meant information about the bugs was in the open before the fix was ready — confusion quickly ensued, with government bodies and private companies choosing to temporarily shut down their websites rather than risk potentially damaging breaches to their data and the sites themselves.

Early Thursday, Matthew Prince, the CEO of Cloudflare, an internet services company that is widely used by websites to block cyberattacks, giving it a high level of visibility over what hackers are doing, said in a post on X that it had seen “millions” of attempts to exploit the flaw.

Cloudflare saw thousands in the 10 hours before the flaw was publicly announced, then tens of thousands in the 45 minutes after the announcement, hundreds of thousands within two hours, and now millions, Prince said.

Amazon’s cloud division also said the flaw is “now being broadly exploited in the wild.”

One senior U.S. government cyber official said that federal authorities have been overwhelmed — and not just by PHP. The same day the world was racing to address PHP, they were also dealing with bugs in node.js, a widely used JavaScript framework, Fortinet, GitHub and Oracle.

“The fire department is fighting multiple fires at once,” the official said, adding: “The good news is they’re all one-story structures on fire, which the fire department deals with all day, every day.”

More to come

Dauntingly, OpenAI said there’s more on the way. “These bugs are among several significant vulnerabilities we’ve already found and are working to fix, and we expect similar findings to increase sharply in the coming months,” the company said Wednesday in a statement.

Matthijs van Amelsfort, head of the Dutch cybersecurity agency, said in an interview that the job of keeping computer systems safe has been transformed by the advancement of AI. “As soon as the frontier models came out, that’s exactly what we said, this will be the trend,” he said. “And actually that’s happening now.”

Thomas Caspers, vice president of Germany’s cyber agency BSI, concurred: “We expect that [to be] happening more and more during the coming months.” 

AI also ramps up the risks once the flaws are out in the open. Cyber agencies’ recommendation that organizations take their websites offline was “really a drastic measure,” Caspers said. “We wouldn’t have done that a few years ago or so.” But because AI has made it quicker and easier to exploit flaws, “we had to do that,” he said. 

At the same time, the use of advanced AI to detect the flaws may create a new level of protection against malicious hackers looking to take advantage of them. Caspers said that though his German agency has also seen attacks, it has not seen any successful use of the flaw by hackers.

“It seems a little bit more complicated than expected to exploit,” he said. 

Despite the fact that AI offers a new way to discover flaws, the work involved in keeping systems protected is more quotidian, with cyber agencies urging organizations to install the fix shared by the PHP Foundation, in a process known as patching.

“There are three things that you have to do right now,” said van Amelsfort from the Dutch agency. “And that’s patch, patch, and patch.” 

John Sakellariadis contributed to this report.

MADRID — The Spanish government has won a significant victory in a long-running legal dispute with international investors over its decision more than a decade ago to scrap renewable energy subsidies.

This week, a Belgian court overturned a ruling that ordered the Spanish government to pay investors nearly €76 million.

It was a major win for Spain, which has been fighting attempts to freeze its assets around the world from clean energy investors who claim they are owed at least €2 billion in subsidies.

The dispute dates back to 2013, in the middle of the European debt crisis, when cash-strapped Spain, then under a new conservative government, decided to remove subsidies for renewable energy. Investors who had poured money into Spanish renewables said this was a breach, as they had invested on the understanding they would receive the subsidies.

The International Centre for Settlement of Investment Disputes ruled that Spain must pay the money, but the European Commission has told Spain doing so would constitute unlawful state aid.

The standoff has played out all over the world, with investors attempting to freeze Spanish assets in multiple jurisdictions. In June, U.S. investment fund Blasket Renewable Investments LLC issued subpoenas demanding documents from Adidas, Hilton Hotels, and other entities involved in Spain’s Football World Cup participation to help with its bid to freeze Spanish assets.

In the end, the team went back home with its assets intact, along with the World Cup.

Spain also has cases going on in courts in Australia, Germany and the U.S.

In 2023, a British court ordered an embargo on an international school in London owned by the Spanish state. The Belgian court’s original decision was one of the few examples where investors were successful, and the decision this week to overturn it will set a precedent for other challenges.

The case

Spain’s defense persuaded a Belgian court to lift an embargo imposed in 2025 on state-owned air-navigation company Enaire for €75.76 million, according to documents seen by POLITICO.

The case was also brought by Blasket, which bought the dispute from an investment fund called RREEF. The European Commission intervened in support of Spain.

RREEF, which was originally linked to Deutsche Bank, invested in Spanish wind and solar power under a 2007 regulatory framework that guaranteed subsidies for renewable energy. In 2013, amid the economic crisis, the government of then-Prime Minister Mariano Rajoy, of the conservative People’s Party, cut those subsidies to reduce electricity costs.

International investors turned to arbitration, arguing that the Energy Charter Treaty, an international agreement signed in the 1990s, guaranteed them fair and predictable treatment. The funds sought more than €10 billion in compensation, according to sources at Spain’s Environment Ministry.

The International Centre for Settlement of Investment Disputes, part of the World Bank, which handled most of the arbitration cases, ruled against Spain, though it reduced the amount sought in many cases. The total awards came to about €2 billion. In its 2019 ruling, the tribunal ordered Spain to pay RREEF €59.6 million, plus interest and costs.

Most of the claims, including RREEF’s, were sold to Blasket, which began seeking to enforce the awards. The funds have searched for Spanish assets that could be seized to satisfy the claims.

Spain says it cannot pay because the European Commission has determined that doing so would constitute unlawful state aid. The funds invested through companies based in Luxembourg, and the EU’s top court ruled that the Energy Charter Treaty did not apply to disputes between EU investors and EU member states; EU law governed instead.

In August 2026, the Commission opened infringement proceedings against Spain over a €23 million payment on an award involving a Japanese company, which was not based in the EU.

On June 17, 2025, Blasket secured a Belgian court order freezing €75.76 million belonging to Enaire, the state-owned company that manages air navigation in Spain. Enaire receives payments from Eurocontrol, the Brussels-based European organization that collects air-navigation charges from airlines and distributes the proceeds.

That arrangement made it possible to freeze Spanish public funds in Belgium. After a legal dispute, Spain deposited €75,759,538 on May 4, 2026.

The freeze was a high-profile win for investors pursuing Spain. They have secured other attachments in the United Kingdom and are engaged in ongoing U.S. court disputes over enforcement of the awards.

Spain appealed, and the European Commission intervened on its behalf. The Belgian state also argued that the attachment breached EU law. The Belgian court has now ruled in Spain’s favor, lifting the freeze and ordering Blasket to pay the legal costs.

That leaves Spain in a stronger position against international investors seeking to enforce the awards — at least within the EU.

BRUSSELS — The EU’s influential competition regulators have taken on some of the planet’s most powerful companies, from Google to Gazprom. But they are steering clear of opening a case against the world soccer governing body, FIFA. 

A complaint lodged by the European Leagues professional soccer association in October 2024 accused FIFA of abusing its dominant position by imposing its international match calendar on other sporting stakeholders. It argued that FIFA’s dual role as a governing body and the organizer of its own competitions creates a conflict of interest, through which it enriches itself. The leagues broadened the complaint last month to cover the women’s game — but the Commission has yet to open formal proceedings.

Brussels has left the European Leagues complaint in the “freezer,” one senior EU official with knowledge of the file told POLITICO. 

The episode underscores the Directorate-General for Competition’s long-running reluctance to open investigations into sports federations, which current and former European officials say is due to sport’s special status in EU law — the treaties recognize its social and educational role — but also a deliberate policy choice to swerve potentially controversial cases in an emotionally charged sector.

Now, pressure is building against the competition department over the languishing European Leagues complaint, after a cross-party group of EU lawmakers urged the Commission to use its antitrust powers to rein in FIFA. 

In a letter to European Commission President Ursula von der Leyen, obtained by POLITICO and copied to competition chief Teresa Ribera, MEPs called for action. Bruno Gonçalves and Hannes Heide (both from the Socialists and Democrats) and Bogdan Zdrojewski (from the conservative European People’s Party) asked the Commission to take formal action, including in relation to the complaint lodged by the European Leagues, which represents 53 men’s and women’s professional football leagues across the continent.

The MEPs say the governing body’s application of the calendar “raises concerns about FIFA’s use of regulatory powers to advance FIFA’s own commercial interests,” and that those powers “must be exercised through transparent, objective, non-discriminatory and proportionate procedures, with effective safeguards against conflicts of interest.” The EU’s top court set that test for sports bodies in its landmark 2023 Super League ruling.

“FIFA is both referee and promoter of the show,” Gonçalves told POLITICO. “We have to make sure the referee doesn’t put business before people.”

Representatives for the European Leagues pressed their case in a meeting with Competition Commissioner Teresa Ribera’s Cabinet in late April, but their overtures have so far been fruitless.

“The thinking has always been, on the one hand, that sports has a special status, so it is not a market comparable to others that normally are scrutinized by the competition directorate,” said one former senior EU official, who was granted anonymity to discuss a sensitive file in order to protect relationships. 

“But also, sports cases get very political and the Commission feels that member states tend to take the side of the federations so it’s hesitant to pick this fight up,” the former official added.

The Vestager principles

Over the last 15 years, Brussels has opened blockbuster investigations into Gazprom’s behavior in Central and Eastern European gas markets; whether Google illegitimately hindered the development and market access of rival mobile operating systems; and Apple’s rules for app developers.

But the Commission’s caution on sports is long-standing. 

When then-competition chief Margrethe Vestager ordered the International Skating Union in 2017 to drop rules threatening speed skaters with lifetime bans for joining money-spinning rival events, she said the decision didn’t mean the Commission was “trying to be the referee in every dispute about sport.”

Many disputes, from doping penalties to deciding the precise scheduling of games, have “little or nothing at all to do with competition rules,” Vestager said at the time. National courts and competition authorities, she added, are “usually well placed to deal with competition disputes involving a sport federation.”

Those principles have since come to guide how the Commission’s competition department decides which sports disputes to take on. There is no shortage of candidates, with controversies in sports including tennis, padel and sailing, as well as soccer.

Any investigation would test recent case law. A pair of July rulings on FIFA’s agent rules went largely the governing body’s way. In those cases, the Court of Justice of the European Union accepted that federations can impose restrictions if they pursue legitimate aims proportionately.

Ben Van Rompuy, a competition law professor at Leiden University who helped bring the original ISU complaint, said there would likely be “little appetite” in Brussels to take up the leagues’ case.

When the ISU complaint reached the Commission, courts had said little about how competition law applied to sport. Since then, “we’ve had an abundance of such guidance,” and “national enforcement in front of the courts seems to work,” Van Rompuy said. That leaves less reason for the Commission to step in. The leagues have also sued in a Brussels court, which suggests “they themselves believe that the national courts could protect their rights.”

Measured against the Commission’s own criteria for prioritizing complaints, the case looks weak, Van Rompuy said. Its impact on the EU’s internal market is “extremely limited,” he added.

FIFA declined to comment on the European Leagues complaint and the EU lawmakers’ letter.

Commission spokesperson Ricardo Cardoso said international sports bodies have “a primary responsibility” for organizing global events, and that sport is mainly a matter for national governments, with the EU playing a supporting role.

When sports organizations act as undertakings, the EU legal term for entities carrying out economic activity, they are subject to the rules of competition, Cardoso said. He added that the Commission constantly monitors markets for possible breaches, and that “if any complaint is filed, the Commission will assess according to standard practice.”

Public and political criticism of FIFA has reached fever pitch over the last 12 months due to the governing body’s cozy relationship with U.S. President Donald Trump’s administration and an ultimately aborted plot this summer to sell off parts of the World Cup tournament to private investors.

According to the letter from EU lawmakers, FIFA President Gianni Infantino’s commercial sell-off scheme “exposed serious shortcomings in transparency, accountability and institutional decision-making.”

BRUSSELS — The center-right European People’s Party joined forces with far-right lawmakers Thursday to push through a vote delaying a key EU climate law governing the methane emissions of oil and gas companies.

It was the latest example of the European Parliament’s biggest group ignoring old taboos and working with the far right to pass legislation weakening environmental rules.

The EU Methane Regulation requires fossil fuel companies to monitor and report emissions of methane, a potent greenhouse gas that’s a major cause of global warming.

The requirements were due to come into force in 2027, but the Commission last week proposed delaying implementation by a year following intense lobbying from the oil and gas lobby and the U.S. government.

The EPP proposed going further, calling for a three-year delay. The amendment passed by 326 votes to 244, with the support of far-right groups Patriots for Europe, the group of Marine Le Pen’s National Rally; and Europe of Sovereign Nations, the group of the German far-right party the AfD. Giorgia Meloni’s European Conservatives and Reformists also backed the proposal.

Most lawmakers from other centrist and center-left groups, including Renew Europe, Socialists and Democrats and the Greens, opposed the three-year delay.

The right-wing majority also voted for an amendment that would force the Commission to review the law and propose any necessary changes by mid-2029.

It comes a year after the EPP — the group of Commission President Ursula von der Leyen — set a new precedent when it sided with the far right to vote to weaken environmental reporting rules for companies, breaching the so-called cordon sanitaire. Since 2024, right wing groups have made up a majority in Parliament.

Thursday’s vote, if adopted by other EU institutions, would move the deadline for implementation of rules to 2030 — well beyond the Commission’s proposed delay to 2028.

It comes after a months-long pressure campaign by oil and gas companies, which claimed that key elements of the rules requiring them to monitor and track leaks of the potent greenhouse gas were unclear, risking compliance failures that could deter critical supplies from reaching Europe.

The Parliament’s position aligns it with industry’s own call for a three-year delay, and lawmakers echoed the sector’s concerns about the risk of supply disruptions linked to hasty implementation of the rules.

“The postponement of the requirements for oil and gas importers in the Methane Regulation is a matter of political responsibility … We need legally certain rules in place … to safeguard Europe’s energy supply and competitiveness,” MEPs Andrea Wechlser and Christian Ehler, both in the EPP, said in a statement to POLITICO.

“The crisis in the Middle East is already putting massive pressure on energy markets—about 20 percent of global LNG trade passes through the Strait of Hormuz,” they added.

The Parliament’s position could empower national delegations — which failed to agree on a joint position Wednesday after pushback from Germany, Italy and Poland — pushing for a longer delay. Member countries hope to find a compromise next Wednesday after failing to find agreement earlier this week.

CORRECTION: This article has been updated to reflect that Parliament voted to delay the rules until 2030.

BRUSSELS — Centrist parties backing European Commission President Ursula von der Leyen clashed at Thursday’s European Parliament plenary over whether to hold artificial intelligence firms accountable for harm.

The EU executive had considered specific liability rules for AI in 2022, but withdrew these last year as part of the EU’s major simplification effort to make the bloc more competitive.

“To withdraw the AI liability directive was a big mistake,” said Alex Agius Saliba, a Maltese vice-president of the Socialists and Democrats, part of the majority coalition. “We strongly urge the Commission to bring forward this important piece of legislation.”

Thursday’s plenary debate, in which discussions centered on a global framework to regulate AI, showed strong tensions inside Europe between the centrist coalition backing von der Leyen. While the center-left pushed for new rules to address a series of AI-fueled hacking incidents, the center-right doubled down on simplification to ensure European companies can compete in the global AI race.

Socialist and Green lawmakers called for a new AI Liability Act in a bid to hold AI companies liable for harm done by their models, as with more traditional manufacturers’ products.

OpenAI CEO Sam Altman floated a similar idea for a new liability framework for companies whose models are capable of autonomous cyberattacks in the wake of this summer’s hack by autonomous OpenAI agents into another AI platform, Hugging Face.

“If a phone charger explodes in your house, we never call it innovative. We call it cheap, dangerous junk, and we hold the manufacturer liable for damages,” said Dutch Green European Parliament lawmaker Kim van Sparrentak.

She urged the Commission to “stop scrapping rules to please [U.S. President Donald] Trump” and come up with a “strong new liability act that covers the testing and the development of AI.”

The debate quickly descended into a fierce back-and-forth between key AI-focused lawmakers from von der Leyen’s centrist coalition.

“It feels [to] me like the Greens and the Socialists are living [on] a completely different planet than the rest of us when they are screaming for more regulation,” said Swedish center-right lawmaker Arba Kokalari, who led the work on the AI omnibus, which delayed a core section of the EU’s flagship AI law.

She said the EU already had a comprehensive regulatory framework — the AI Act — of which some parts are not even into force, and said the EU should focus on avoiding falling behind in the global AI race instead. She called for “less bureaucracy, more private investments, better access to data and computing infrastructure.”

Italian Social Democrat Brando Benifei, who led work on the AI Act in the previous mandate, snapped back that Europe should lead with new liability rules, “or we will need to wait for the next blogpost of a CEO to know what is happening.”

German Green lawmaker Sergey Lagodinsky also fired back at Kokalari: “What planet do you live on? Not on the planet where [AI] agents break out.”

International Partnerships Commissioner Jozef Síkela pointed out at the end of the debate that the rules were withdrawn because EU countries and European Parliament lawmakers couldn’t reach an agreement on them.

BRUSSELS — Europe’s biggest media companies have asked regulators in Brussels and London to stop Meta from introducing new terms they say would let it copy publishers’ websites to build artificial intelligence, as a backlash that began in the U.S. spreads across Europe.

In a letter Monday, the European Publishers Council, whose members include POLITICO’s owner Axel Springer, called on EU competition boss Teresa Ribera and tech chief Henna Virkkunen to press Meta to put the terms on hold before they take effect Oct. 30.

The group wants Brussels to check them against EU copyright and competition law, and has requested an urgent meeting with the teams of both commissioners.

“The Commission remains committed to ensure that Meta’s practices fully comply with all applicable obligations under EU law, including competition rules and the Digital Markets Act,” Commission spokesperson Ricardo Cardoso told POLITICO, referring to the EU’s rulebook for Big Tech. He said Brussels was aware of both Meta’s changes and publishers’ concerns.

The U.K. competition watchdog has moved as well. British publishers have complained to the Competition and Markets Authority that Meta is so dominant they are compelled to accept its terms. 

The watchdog’s chief, Sarah Cardell, told British lawmakers on Tuesday that it had asked Meta to explain the changes and would meet the company on Wednesday. She named Meta as a possible candidate for Britain’s new rules for tech giants.

The terms cover businesses that use Meta’s tools to run Facebook pages, Instagram accounts or ads, which includes almost every newsroom. 

The fight began in the U.S. last week, when Nieman Lab, a journalism research outlet at Harvard, reported on the terms after receiving a tip from a small business owner.

As first written, they let Meta send automated programs to copy websites linked to those accounts and use the material to “train” its products, Nieman Lab concluded. There is no opt-out, and a business that continues to use Meta’s tools after Oct. 30 will be deemed to have consented.

Publishers say the terms would hand Meta content for free that other AI companies pay to license.

Rapid reaction

On Friday, Meta communications chief Andy Stone responded on X that the Nieman Lab report was “false” and that there was “no change to how Meta uses web crawlers.”

Stone said the update aimed to let Meta pull accurate product information from shopping sites for ads, not to scrape news sites. The company also said the crawling language already existed in other Meta terms and was just being gathered in one place.

Late Friday, however, Meta revised the terms and deleted the word “train,” saying the terms cover only its advertising and business products.

“We’ve heard you and want to clarify,” a spokesperson for Meta told POLITICO over the weekend, adding the change was “not about scraping news sites.”

Publishers say that changes little, however. 

Meta has given them verbal assurances that they can keep using its tools without surrendering their content to AI, but the terms themselves don’t guarantee that, the European Publishers Council’s letter says.

“Meta’s supposed Friday night correction is a farce,” said Jason Kint, who heads Digital Content Next, a U.S. publisher group whose members include Axel Springer. “Exactly what you’d expect from a gatekeeper notorious for abusing its market power.”

Others have gone further. 

“This is unscrupulous theft,” Germany’s newspaper and magazine associations said in a joint statement on Tuesday. They want Brussels to block the terms while it reviews them, warning that once articles are copied into AI systems, they can’t be clawed back.

Joseph Bambridge in London contributed reporting.

BRUSSELS — The EU is preparing to try and persuade Canada and the U.K. to increase their support for Ukraine as part of efforts to plug the €70 billion funding gap Kyiv faces next year.

The EU-Canada summit on Oct. 29-30 and the EU-U.K. summit on Nov. 20 will give Brussels a chance to make the case at the highest level. With Kyiv’s financing needs rising and U.S. backing uncertain, Brussels is increasingly looking to non-EU allies to contribute more, five EU officials, including two from the European Commission, and two EU diplomats told POLITICO.

The EU and its member countries provide 80 percent of Ukraine’s external aid, Commission President Ursula von der Leyen said Friday. “We urgently need other partners to step up.”

European Council President António Costa told the European Parliament on Wednesday morning that “international partners have to intensify and step up financial support to Ukraine.”

The EU has committed to a €90 billion loan for 2026 and 2027, intended to cover about two-thirds of Ukraine’s needs. Brussels had expected other partners — including Canada, Japan, South Korea, Australia and Norway — to provide another €45 billion, but much of that money has been slow to arrive as other governments have yet to firm up or disburse the support Brussels expected.

While calls to help Ukraine defend itself are not new, the projected 2027 bill has grown as Russia intensifies its assault, the U.S.-Israeli war with Iran drives up costs and Washington shifts toward positions more favorable to Moscow — leaving Europe and other allies to shoulder more of the cost of keeping Kyiv afloat.

Brussels is heading into negotiations about closer economic and defense ties with London and Ottawa. Diplomats and EU officials said they do not expect a formal bargain, but that support for Kyiv from the EU’s partners is likely to shape the political climate around the talks. Like others in this article, they were granted anonymity to speak about the sensitive diplomacy.

The EU has also raised Ukraine’s 2027 financing needs at meetings of the International Monetary Fund, the G7 and the G20, as well as with Gulf Cooperation Council countries.

“During my meetings in Bangkok, the need to secure financial support for Ukraine in 2027 was a prominent topic,” European Economy Commissioner Valdis Dombrovskis told POLITICO, referencing last week’s IMF and World Bank Group meetings. He said he called for “broad burden sharing and stressed the importance of international partners each doing their part as Ukraine continues fighting Russian aggression.”

All the EU officials and diplomats stressed that the push was not a criticism of the U.K. or Canada, both of which are strong supporters of Ukraine. The point, they said, is that Kyiv’s needs have grown.

The U.K. says it has committed a total of £25 billion for Ukraine and Canada has promised the equivalent of €5.4 billion in military assistance and €8.2 billion in direct financial support.

The EU and its member countries say they have contributed over €231 billion since Russia’s full-scale invasion, including military aid, budget support and guarantees, support for Ukrainians hosted in the bloc, and proceeds from immobilized Russian assets — an amount one senior EU diplomat described as already “over and above.”

How to meet Ukraine’s financial needs has become “a central discussion in every single meeting” with partners supporting Kyiv, a Commission official said.

The push to secure Ukraine’s financial needs comes as support for Kyiv will be tested in a series of elections across Europe next year. In France, far-right front-runner Marine Le Pen has vowed to end aid if elected president in 2027, while in Italy, Prime Minister Giorgia Meloni faces a challenge from Russia-friendly Roberto Vannacci ahead of next year’s election.

The looming votes, combined with the unpredictability of Washington’s backing for Kyiv, mean European countries need to look beyond their own budgets, the senior diplomat said. “We need to think wider and broader.”

The EU is also urging the Ukrainian government to secure more support from non-EU backers. “This is the first next step that they need to secure from their partners,” the Commission official said.

Not ‘pulling a Trump’

EU ambassadors are set to talk about the upcoming Canada and U.K. summits tomorrow, with Ukraine funding expected to form part of the discussions, the two diplomats said.

Brussels, “without pointing the finger,” wants to use the run-up to the meetings to press for broader support, the senior diplomat said. But the EU “won’t be pulling a Trump” and explicitly linking favorable treatment to contributions to Ukraine, they added.

The Commission has not set out what it will ask partners for or how any request might connect to trade and defense talks. The diplomat said the EU still needed to work out “how much will translate in joining those dots.”

Von der Leyen proposed making Canada the EU’s first “associate member” in her State of the Union speech last month. The October summit in Montreal is an opportunity to develop the idea.

Ottawa will participate in the EU’s SAFE program, which finances joint defense procurement, giving Canadian companies preferential access to SAFE-funded contracts. Closer defense cooperation and industrial access could form part of the wider conversation about support for Kyiv, one of the diplomats said.

In a statement to POLITICO, Kathryn Serieux, a spokesperson for Canada’s Privy Council Office, said Ottawa “is and has been a steadfast supporter of Ukraine,” with Canada committing nearly C$26 billion in military, financial development and humanitarian assistance.

“Canada continues to stand by Ukraine and remains engaged with international partners on Ukraine’s needs,” Serieux said.

The U.K. summit is expected to advance Prime Minister Andy Burnham’s promised reset with the bloc, including agreements on youth mobility, food and emissions trading. Burnham has said the status quo is “not good enough” and wants Britain to move closer to the EU.

London wants U.K. companies to count as European under the proposed Industrial Accelerator Act, which would give preference to goods made in Europe in public contracts and industrial support. British officials worry U.K. firms could lose out despite close links between British and European supply chains.

Three U.K. officials said Tuesday they had not heard of a request for Britain to provide more support for Ukraine in exchange for letting its companies qualify under the act. A fourth EU official said Ukraine was expected to feature in the summit declaration with the U.K., but that it would reflect both sides’ efforts to help Kyiv, rather than a Brussels demand for more support.

The EU is also pressing Japan to increase its contributions, with one senior EU official saying it was lagging in 2026. A person familiar with the thinking in Tokyo pushed back on the idea that Japan was not pulling its weight, saying Tokyo had already given around $20 billion in support to Kyiv — but there could be room for more if Ukraine requested it.

Tokyo is also seeking assurances that Japanese companies will retain access to the EU market, following concerns the Industrial Accelerator Act’s “Made in Europe” preferences could put its firms at a disadvantage.

The Mission of Japan to the EU didn’t respond to a request for comment.

Australia says it has not yet received a request for more funding for Ukraine for 2027. Canberra is likely lower on the list, if it is on it at all, because its prime minister and foreign minister met Ukrainian President Volodymyr Zelenskyy at the U.N. General Assembly last month and announced additional funding and a security agreement, an Australian official said.

Dan Bloom contributed reporting from London. Amanda Copp contributed reporting from Canberra. Mike Blanchfield contributed reporting from Ottawa. Gregorio Sorgi contributed reporting from Brussels.

LONDON — Labour swept to power with a big, expensive promise: to create a government-owned energy company, hand it billions to invest in British renewables, and watch it grow, eventually, to rival other state-owned energy giants. 

Two years on from the foundation of Great British Energy, that isn’t what has happened. 

Analysis from POLITICO shows billions of pounds from its budget have been redirected to schemes not included in GBE’s initial remit, stripping away some of the cash earmarked for costly, large-scale renewable energy projects like wind and solar. Those funds are being used instead for very different purposes, like planning new nuclear schemes and reviving Britain’s creaking electricity grid. 

Set up by then Energy Secretary Ed Miliband, the government backed GBE with £8.3 billion of fresh funding. Its purpose at the time seemed clear. “Great British Energy will own, manage and operate clean power projects,” Miliband pledged, “and generate energy in its own right.” 

Labour officials familiar with GBE plans told POLITICO in 2024 local projects would get around £3 billion of its total budget, while the rest would go on helping the company establish itself in the market, including by taking stakes in wind and solar projects. 

Yet now experts can’t agree on what, exactly, GBE is for. 

How to spend it

Miliband’s GBE pitch to the public was ambitious.  

The company would allow Britain to become a bigger player in its own clean energy market in Labour’s dash to hit green goals, he said. Referencing huge state-owned companies in Denmark and France, he told Channel 4 News weeks after the election that GBE was “not going to become Ørsted or the generation arm of EDF overnight. But that is the long-term vision.” 

Soon after GBE passed into law, though, former Chancellor Rachel Reeves reassigned £2.5 billion of its budget to help developers design small-scale nuclear power plants and prep sites where those mini-nukes will eventually go.

The government also scaled back its funding for those local, smaller-scale projects, which include getting solar panels onto school and hospital roofs. The mooted £3 billion for GBE’s Local Power Plan became just £1 billion when more details were announced this February. 

GBE has set aside another £1 billion to build up clean energy supply chains.  

And that’s all before Prime Minister Andy Burnham used Labour’s annual conference to pledge another whack of GBE’s budget to a totally new venture: Great British Grid. 

Enter GB Grid  

In a bid to put his own stamp on Miliband’s pet project, Burnham announced that the new unit would sit within GBE, using some of its budget to speed the build out of Britain’s creaking grid network.  

GB Grid will invest alongside existing grid operators in a bid to cut costs, Energy Secretary Miatta Fahnbulleh said last week, at a time when the grid regularly struggles to handle the levels of power being generated by developers. 

Energy experts are torn over whether GB Grid, in particular, is a smart pivot for the government — but acknowledge it is not the same thing Miliband promised to deliver.  

“I think the focus has shifted, but I don’t think that should be seen as a problem,” said Joshua Emden, a senior research fellow at the Institute for Public Policy Research think tank. 

GB Grid would have access to £4 billion of GBE funding, according to media reports published at the time of Burnham’s announcement, although officials from the Department of Energy Security and Net Zero insist they “don’t recognize” that figure. 

It is still enough for Kemi Badenoch’s Conservatives to pile the pressure on ministers to explain why their plans have changed. 

“Taking half the GB Energy budget and putting it into a venture that was only announced a few weeks ago leads to the obvious question of: What actually is GB Energy for? And does the GB Energy of today bear any resemblance to what the government envisaged in July 2024?” asked Shadow Energy Minister Harriet Cross. 

Doubters and defenders  

Some energy industry officials are doubtful that setting money aside for grid investment is the best use of public cash.  

“If it does that last mile [of grid] to a data center, if it helps where there isn’t actually any program or plan, [then] fine. We’re not going to say: ‘No, don’t spend it on making the grid better,’” Dhara Vyas, chief executive of the industry group Energy UK, told a panel at Conservative Party Conference earlier this month. 

But transmission operators — who run the network — are already spending tens of billions on the grid, she said. “The energy transition will be paid for by the private sector.”  

GBE “made a slow start and has focused on low-impact activities, important though they are,” said Bill Esterson, a Labour MP and chair of parliament’s Energy Security and Net Zero Committee. Creating GB Grid, he argued, “suggests a shift in emphasis to build what the country needs where the network companies are not delivering.” 

The pivot “makes sense as an efficient use of government money,” argued IPPR’s Emden, if there’s a choice between investing in power generation — where there’s competition between providers — and in the grid where private networks have a “total monopoly.” 

GB Energy has “the foundations now to create something genuinely useful,” argued one government figure. “Politicians of all stripes should give it the space to get on with the job.”  

A spokesperson for DESNZ said “securing new homegrown energy and building a grid fit for the 21st century work hand in hand. Great British Grid will bring public and private investment together, helping to build the infrastructure Britain needs.” 

Additional reporting by Nicholas Earl.

The cyberattack last week that hit hundreds of French supermarket refrigerators had Europeans wondering if the nonstop warnings about AI risks had finally landed in the real world.

They hadn’t — at least, not yet.

Experts say the attack, which forced hundreds of retailers to throw away defrosted food and spoiled milk, was mostly a reminder of the importance of old-school cybersecurity in safeguarding essential goods and services.

The attack is a “typical example” of how “low-key cyber-enabled sabotage can affect very crucial supply for society,” said Ferdinand Gehringer, hybrid threats lead at FTI Consulting. 

It’s arguably the most consequential hack in the European Union this year, with tangible, disruptive real-world repercussions. France’s Prime Minister Sébastien Lecornu personally managed the fallout, which prompted coordination and information-sharing at the EU level. 

The perpetrators, whose identity and motives are currently unknown, hacked into digital systems to remotely raise the temperature of refrigerators in supermarkets including Intermarché and Carrefour.

One cybersecurity expert working with Lecornu’s office said the French government held meetings after the attack to try to map all the potentially affected sectors, beyond supermarkets. “We’re in the middle of the flu vaccination campaign,” he said, referring to vaccine storage, which also relies on temperature control solutions, though no such attacks have been registered.

To add to the fear and confusion, supermarkets in the Netherlands and Belgium experienced unrelated cyber incidents that same week. Though there was limited impact in those cases, they were a good example of “how big our reliance is in the food supply chain on IT and network systems,” Dutch food security minister Silvio Erkens told POLITICO. 

The attacks come after citizens and policymakers have spent months being bombarded with warnings about scenarios in which unpredictable advanced artificial intelligence models escape human control.

While most good and bad actors on the internet are increasingly using AI models to increase speed and capacity, cyber experts say the hackers in question in the French case most likely used traditional methods to take advantage of devices needlessly exposed to the internet.

Connecting devices to the internet in this way is “an old-fashioned bad practice,” said Amir Preminger, chief technology officer at Claroty, a cybersecurity company that identified a software flaw in a product made by Danfoss, one of the refrigeration companies targeted by the French hacks. Danfoss fixed that flaw in 2025. 

Food systems

The attacks come at a time when Europe’s food security is already under considerable pressure due to geopolitical insecurity and climate change. The continuing disruptions in the Strait of Hormuz are pushing up fuel and fertilizer prices at a time where farmers struggle with the fallout of extreme drought that caused lower yields in many parts of Europe. These problems are compounded by the blockade of the Black Sea which is fueling the rise of global food prices.

“It is very serious that cyber criminals attack our food systems,” said Else Groen, director general of trade body Independent Retail Europe. She nonetheless stressed that food supply chains are resilient, which reduces the chances that consumer food supply would be endangered — even if such attacks are already a “major blow” for retailers operating on razor-thin margins.

The incidents bring to the fore a long-running problem with so-called operational technology, meaning industrial devices with physical outputs, like refrigeration systems. Critical sectors are packed with these kinds of devices, many of which are old, poorly protected, unnecessarily connected to the Internet, or some combination of the three. They’re also obscure and sometimes forgotten, despite the ramifications if they’re tampered with.  

And last week’s problems are far from solved. French and German cyber authorities warned that attacks were probably still ongoing, and the Greek cyber agency and an industry tracker said after the attack that there were hundreds of devices still connected to the internet.

Preminger too said there are still devices exposed, though he added that the number is declining, and not all are necessarily vulnerable to attack. Another research group found that the number of exposed Danfoss devices had significantly decreased.

Finding a fix

What’s changed with the widespread diffusion of advanced AI models is that cyber attacks are now faster and easier to replicate. Claroty reproduced the original flaws in Danfoss products in 28 minutes at a cost of $6, it said. 

In broad terms, AI makes it easier to carry out many types of cyberattacks and enables attackers to pounce on software flaws more quickly. Financially motivated cybercriminals — who have already spent years extorting businesses and disrupting essential services like hospitals — can use AI to simultaneously launch attacks on multiple targets.

Though the motive for the attacks on French supermarkets remains unknown, it is notable that there was no reported attempt at extortion. The strike did come as Russia ramps up its campaign of hybrid warfare against Europe, and senior EU and European leaders have consistently warned that Moscow could use cyberattacks to disrupt real-world services. Beyond food supplies, AI-enhanced targeting could be aimed at banking, hospitals and the functioning of the internet itself.

Still, these fears of bad human actors using AI should be distinguished from the science-fiction scenarios pushed by so-called AI doomers, in which bots themselves are motivated and able on their own to wipe out humanity.

Digital security experts, including the EU’s own in-house cyber team, are also turning to AI for defense. But it’s not a silver bullet, said Rémi Enjolras, a chief technology officer at Splunk, part of Cisco. Critical industries need to stop “seeing AI as a magical tool that will solve everything and go back to the fundamentals,” he said.

The EU has passed laws intended to force critical industries and product manufacturers to get those fundamentals right. But France, for example, is lagging in implementing such national regulations, and there are few other incentives to get companies to do that difficult and costly work.

Still, the images of empty supermarket shelves could provide a new incentive. “It should serve as a kind of a wake-up call,” Enjolras said.

Émile Marzolf contributed to this report.

DUBLIN — The Irish capital, which doubles as Europe’s de facto tech capital, hosted two very different AI summits in the past week.

Most eyes were on the International AI Summit, the signature tech event of Ireland’s six-month presidency of the Council of the EU, where top brass from the world’s biggest tech firms discussed ways to harness artificial intelligence and minimize safety risks.

But the weekend before, a very different conversation was taking place at the Workers’ AI Counter Summit, as Ireland’s tech workers demanded a say in how the burgeoning technology reshapes the workplace and society.

Ireland’s lucrative tech sector has been rattled by waves of AI-driven layoffs — and the country’s fledgling tech union has seen an exponential spike in sign-ups from workers who are worried about their future.  

There’s an “awakening” happening right now among workers in Ireland’s tech sector, and a growing “awareness that they’re not bulletproof,” said Sinéad Gibney, a social democrat lawmaker who previously worked for Google.  

“I do think what we will see is that parts of roles will be automated, which means that people will be competing more heavily for the same roles,” she said. “They won’t have the same labor power and therefore we’re going to see a drop in quality of work, we’re going to see more zero-hour contracts, in more places than we already see it.”

The labor movement brewing in Ireland, where many of the world’s tech giants have their EU bases, is part of a wider trend among tech workers globally, who have seen their work disrupted by rapidly evolving AI.

Rise in layoffs

Ireland’s dedicated union for tech workers, the Digital and Techworker Alliance (DATA), has seen a five-fold increase in membership since it was first founded in 2023.  

In its first year and a half of existence, membership hovered around 270 people. In the past year-and-a-half, it’s jumped to more than 1,350 members, DATA organizer John Bohan told POLITICO.  He added that this number tends to spike around layoffs and other actions.

“The tech industry was founded on the idea that it would never have a union, because they’re making people rich, and treat them really well,” Bohan said.  “But post-Covid, workforce adjustments happened again and again, with layoffs and declining conditions in the sector. We started to see more people wanting to get organized around redundancies.”  

The spike in sign-ups coincides with a wave of layoffs in Ireland’s tech bubble (and the tech sector globally), as companies corrected pandemic-era overhiring, and diverted investment to AI.  

Ireland hosts the EU headquarters of most of the world’s largest tech companies, and more than 170,000 people are employed in the tech sector, according to the country’s statistics institute.

Social media giant Meta has roughly halved its workforce in Ireland since the pandemic, axing well over 1,000 roles to offset AI investment and boost efficiency. Separately, Meta subcontractor Covalen also announced massive layoffs earlier this year, cutting more than 700 people.  

Video-sharing platform TikTok announced this year it would shed around 300 Irish jobs, mostly from its trust and safety team, shifting the work to other countries, outsourced vendors or automated AI solutions.  

A report by the IMF earlier this year warned that Ireland’s labor market is “relatively more exposed” to AI than many advanced economies, partly due to its concentration of tech workers.  

The AI race is also creating new jobs on the Irish market – as AI firms like Anthropic and OpenAI are setting up Irish bases and trying to lure Big Tech workers with even bigger salaries.  

Amid the uncertainty and volatility of the AI boom, tech workers are turning to unions for the first time as a safety net. One tech worker who used to work in trust and safety at a big tech firm told POLITICO that there used to be a feeling that as a “pampered” tech worker you “can’t ask for your rights, because you already have it so much better.” 

But as layoffs continue and teams get leaner, workers in fields like trust and safety “now have to deal with these issues with fewer and fewer resources”, and face a “constant threat of being chopped,” the worker said.  

That’s causing an “undoing of a certain perspective that we have of ourselves as tech sector workers,” they said, “because of undeniable experiences that now put us in situations where we clearly see our rights being violated, even if we may have it so much or somewhat better than most people.” 

A different tech worker who currently works for Covalen told POLITICO that there is a sense that “if they believe they can replace you with AI, they will do that.”  

“All these Big Tech firms only care about profit, and what I have realized is the Irish government protects that Big Tech capital [rather than workers],” the Covalen worker said. “But the question is, what’s the government going to do when the tech bros change their mind and move elsewhere?”  

Workers at the center

The speaker list at this week’s AI summit was a flex of the country’s strength as a tech hub, as top names from the world’s biggest companies like Google and Microsoft took to the stage.

Fionnuala Ní Bhrógáin, head of organizing and campaigning at Ireland’s Communications Workers’ Union (DATA’s parent union), was the only union voice on the line-up.

“The fact that 36 executives and industry bosses featured on the program, compared with just one trade union speaker — invited at the last minute after attention was drawn to the absence of workers’ voices — says a lot about the value the Irish government places on AI’s impact on workers,” she told POLITICO.

“The reality is that a meaningful conversation about AI’s future can only happen through genuine engagement with workers and collective bargaining,” Ní Bhrógáin added. “Without that voice, we risk deepening mistrust and resistance rather than creating the conditions for workers to shape these changes collectively.”

DATA organized its counter-AI summit the previous weekend, to put “workers at the center of the debate about power, AI, technology and the future of work.” 

The event cut through the “hype and futurism of politicians and industry figures to focus on the real present harms faced by ordinary workers and communities,” DATA’s Bohan said.  

The union is pushing for stronger legal protections for tech workers caught up in AI-driven layoffs in Ireland, including making it mandatory for employers to recognize unions during collective bargaining. It is also calling for a ban on cooling-off clauses that prevent laid-off workers from moving between Big Tech subcontractors.  

A spokesperson for Ireland’s department for enterprise told POLITICO in a written statement that the government is “committed to strengthening collective bargaining and industrial relations” and has published an action plan to do so between now and 2030.  

They said that employers already have to comply with obligations under Irish employment law, including consultation and notification procedures for collective redundancies, and workers who feel those rules have been broken can complain to the Workplace Relations Commission. 

Firefighting to future-proofing 

Naoise Ó Cearúil, a center-right Fianna Fáil lawmaker who chairs the AI committee, pointed out that while there have been high-profile job cuts in Ireland’s tech sector, “the actual net is that there has been an increase [in jobs], particularly over the past year and even five years.” 

According to Ireland’s central statistics office, total employment in tech and related sectors surpassed 177,000 in the second quarter of this year, up from around 144,000 at the same time in 2021.  

Ó Cearúil pointed out that many job losses were in trust and safety jobs like content moderation that are “very difficult mentally,” and now tech firms are able to “utilize AI and software to be able to do a lot of detection, rather than using humans.”  

He has called for a national program to be established, to support workers whose jobs are at risk due to AI and automation.  

A spokesperson for Ireland’s department of enterprise acknowledged that the country’s tech sector has “experienced significant adjustment in recent years,” but said the changes were generally part of wider global restructuring “rather than reflecting any Ireland-specific weakness.” 

They said the Irish government is currently focused on “ensuring workers and businesses are equipped to adapt to technological change through investment in education, training, lifelong learning and digital skills.”  

BRUSSELS — France and Germany said Friday they had struck a deal to favor European-made cars under a landmark EU industry bill in exchange for weakening a 2035 vehicle emissions target, ending months of wrangling between the bloc’s two biggest economies.

Under the agreement, Germany would accept stricter “Made in Europe” — or local content — requirements for the automotive industry in the proposed Industrial Accelerator Act, a longstanding French demand, while France would back Berlin’s push to relax the EU’s plan to phase out new combustion-engine cars.

The EU’s current target is for companies to reduce emissions from new vehicles by 100% from 2021 levels by 2035, with the possibility to “earn” 10% of emissions leeway through initiatives like offsets and investments.

France and Germany now want to soften the 2035 target to 90% but without having  to offer investments in alternative fuels to compensate the remaining 10%, as proposed by the European Commission.

“This balanced approach will enable the European Union to pursue its climate objectives while strengthening the technological sovereignty, industrial base and international competitiveness of its automotive industry,” the two countries said in a joint statement.

The agreement, first reported by POLITICO in July, was due to have been announced Thursday, during a meeting of EU leaders in Brussels. But it was held up at the last minute by disagreements within Germany’s governing coalition.

“We hope that this Franco-German dynamic can swiftly lead to an agreement with our partners, for our jobs and our industry,” French President Emmanuel Macron said in a post on social media.

An Elysée official on Friday made clear that, under the Franco-German deal, the scope of Made in Europe for automotive can be extended to the U.K. and Switzerland under certain conditions. — addressing a key concern of Prime Minister Andy Burnham’s government ahead of a Nov. 20 U.K.-EU summit in Brussels.

The agreement was reached after the German Social Democratic Party, the junior partner in Chancellor Friedrich Merz’s coalition government, dropped its opposition.

“This is a modern realignment of German industrial policy that places significantly greater emphasis on preserving jobs and production sites,” said German Environment Minister Carsten Schneider, who is from the SPD.

“The clear expectation for German companies is that they will use these new opportunities to make investments and guarantee jobs here in Germany,” he added.

CORRECTION: This article was updated on Oct. 16 after an earlier version misrepresented the figures in the Franco-German proposal on the softening of 2035 targets.

BRUSSELS — European Commission President Ursula von der Leyen wants EU leaders to look into the idea of developing bloc-wide strategic gas reserves amid concerns the continent faces a winter shortage, three diplomats and two EU officials told POLITICO.

Europe’s existing gas storage caverns — which are typically refilled over the course of the year by commercial actors — are running at record lows this year after high summer prices linked to the war in Iran undercut market incentives to restock, leaving the bloc underprepared for winter.

While it wasn’t immediately clear to diplomatic officials what form the reserve idea would take, one senior EU official described it as a long-term measure to cushion the bloc against future supply risks, as countries already do with oil and refined products. The Commission president’s comments came at a major summit of European leaders in Brussels on Thursday.

Documents detailing November plans to revamp the bloc’s gas security architecture, seen earlier this year by POLITICO, include plans to encourage better crisis management by companies. However, they stop short of explicitly endorsing strategic reserves that governments would have to fill to a set level to offset supply shortages, regardless of market conditions.

Countries that typically rely on commercial refilling have already been forced to change tack this year as the limits of the existing model became clear. The Netherlands has moved to subsidize energy purchases, costing it almost €1 billion, while Germany is exploring whether to develop its own strategic stockpile.

A separate Commission proposal to set up an EU-wide mechanism to carry out joint energy purchases was received without enthusiasm by EU leaders on Thursday, two diplomats said.

BRUSSELS — The EU and China are in a good place to talk after last week’s trade deal on hybrid cars, but challenges remain, panelists at POLITICO’s European Resilience Summit on Wednesday agreed.

“From the Chinese business perspective this is very welcome,” said Linlin Liang of the China Chamber of Commerce to the EU, calling the understanding reached in Beijing “quite balanced from our perspective.”

An agreement to halve China’s exports hybrid vehicles to Europe was the main deliverable brought home by Trade Commissioner Maroš Šefčovič.

The two sides said in a joint statement that they would keep talking about issues such as market access for medical devices and the Foreign Subsidies Regulation, an EU measure that scrutinizes foreign subsidies that distort competition in public procurement and corporate acquisitions.

Šefčovič will hold further talks with Chinese Commerce Minister Wang Wentao in January, and they will meet again in March, as he pushes to rein in a €1 billion-a-day bilateral trade deficit.

Liang said Beijing stands ready to act if further talks go off track.

“I would like to remind all what MOFCOM mentioned: that they reserve the right to retaliate in case that things … don’t go around as agreed,” she told the panel on Europe in global trade, referring to the Chinese Ministry of Commerce.

Kathleen Van Brempt, a Belgian MEP for the Socialists & Democrats, said the most important outcome of last week’s Beijing talks was that there was “some sort of trade deal or result.”

Yet Beijing’s aggressive subsidy policies remain a hurdle, the senior trade lawmaker said, referring to a widely cited OECD study which found that Beijing’s subsidies to industry are up to eight times higher than in other countries: “It’s not normal,” she said.

Liang said that China’s export success should not be attributed solely to subsidies, and was the result of “decades of investment in innovation.”

She also said there was “a super appetite” among Chinese businesses to invest in Europe, but that they needed to assess the profitability of the EU market just like European companies.

The discussion also revealed differences between policymakers and businesses over the EU’s proposed Industrial Accelerator Act, a flagship measure aimed at steering public procurement spending toward European companies in sectors ranging from renewable energy to steel and the automotive industry.

Van Brempt, the S&D group’s lead lawmaker on the file in the trade committee, said the parliament’s three co-leads are aligned on the bill. While the center-right European People’s Party was “very divided” over the measure, she said lawmakers should be able to come to a common position.

The bill’s “Made in Europe” provision is a cause for concern for industry, meanwhile, as it risks isolating the EU from global supply chains.

“I would be careful always saying, okay, localize, put fences up,” said Holger Weintritt of German pharmaceutical company Bayer. “Let’s make sure that we still remain globally connected and look for reliable partnerships instead of isolating ourselves .”

BRUSSELS — The European Commission’s cybersecurity division is rolling out a plan to use artificial intelligence to respond to high-risk cyberattacks, according to a document obtained by POLITICO.

The undated document, written by the Commission’s IT department, sets out how to prepare the EU executive’s cyber defenses for “emerging AI-driven threats.” It proposes an action plan to shore up defenses in light of AI, with the most urgent move being the speed of response to attacks.

Governments have rushed to grapple with the rising threat brought by AI’s ability to expose and exploit cybersecurity vulnerabilities. Incidents like OpenAI’s accidental intrusion into Hugging Face have prompted calls, including at the highest political level, to be more wary of advanced AI models.

Being able to respond quickly to cyberattacks is most crucial in “high-risk scenarios,” the EU executive’s internal cyber defenders warned, saying that the ability to detect an attack is “not sufficient if containment measures cannot be taken quickly enough.”

Officials at the in-house IT department, DG DIGIT, are planning to use automated “protective measures” in specific high-risk scenarios, it said. Those scenarios were redacted in the document, which was provided to POLITICO in response to a freedom of information request.

The plan does not amount to “uncontrolled automation” and there will be strict controls in place including human oversight, according to the document.

As well as laying out the response plan, the document sets out the cybersecurity challenges the Commission faces from AI.

The most advanced AI models are expected to “significantly increase the speed, scale and adaptability of cyberattacks” and the Commission must therefore have defenses in places for an environment where “attacks are likely to become faster, more frequent and more scalable,” it said.

Risks include situations where “malicious activity occurs outside EC [European Commission] normal working hours, spreads more rapidly across systems, or results in large-scale exfiltration or operational disruption before manual intervention can be organized by EC,” they said.

The Commission’s cyber division has sought approval internally to move ahead with the plans, it said, though it’s not clear whether the plans have yet been put in place.

The Commission didn’t respond to a request for comment.

We’ve spent our entire political careers in different camps. One of us was a Democratic governor and chairman of the Democratic National Committee. The other served as a conservative Republican in Congress for over a decade, representing a deep-red district in the Indiana heartland that President Donald Trump won in each of his three presidential elections by over 30 points.

But before we got into politics, we were both physicians in internal medicine and cardiothoracic surgery, respectively. We’ve seen firsthand how crucial it is for the patient-provider relationship to guide and determine the right care. And that’s why we’re so alarmed that nearly half of Americans, according to a recent survey by KFF, the independent health organization, now report that their health insurers have delayed or denied coverage for a doctor-recommended treatment within the past two years.

Corporate insurers should not be at the forefront of patient care. Delays and denials put patients’ health at risk. And they often lead to preventable complications and higher long-term spending.

We both believe reforming the health insurance system is a moral and an economic imperative, as do many of our colleagues on both sides of the aisle. Even in a bitterly divided Congress, we have seen encouraging signs that reform is possible.

In recent months, Democrats and Republicans have worked together to hold insurers accountable — especially when it comes to “prior authorization,” the notorious and widely despised insurer practice of denying certain procedures and treatments unless doctors and patients first obtain permission. In a recent American Medical Association survey, 95% of physicians said they’ve seen prior authorization requirements delay necessary care. Nearly four in five have witnessed patients abandon treatment because of problems with the process.

Leaders in both parties already agree that improvements to the American insurance model are necessary. The bipartisan Improving Seniors’ Timely Access to Care Act would move Medicare Advantage prior authorizations to an electronic system and require quicker response times and greater transparency from insurers. Significantly, over 300 House members and 70 senators have cosponsored the legislation. This summer, it cleared two House committees unanimously.

---

Want more sharp takes on politics? Sign up for our free newsletter, Standing Room Only, written by Amanda Marcotte, now also a weekly show on YouTube or wherever you get your podcasts.

---

Lawmakers are also finding common ground on transparency. In July the House Energy and Commerce Committee advanced a bipartisan bill that would require health insurers to publicly report how often they deny claims.

That scrutiny is overdue. Medicare Advantage insurers denied more than four million prior authorization requests in 2024.

When patients and their doctors appealed those denials, insurance companies reversed roughly 80% of their initial decisions. That high reversal rate suggests insurers are denying lots of medically appropriate procedures, tests and treatments — and hoping that doctors and patients will be too busy, sick and frustrated to follow through with an appeal.

That’s often a safe, albeit callous, bet. For too many Americans, fighting insurance companies can feel like a battle they cannot win. It often requires tremendous mental and emotional fortitude at a time when they are simply trying to get well. That is why Congress must take on that fight for them. Families already pay extraordinary sums for health coverage — by some measures, the monthly cost of employer-sponsored family health coverage now rivals the typical monthly mortgage payment. And still, these families face denials, delays and difficulty accessing the care and medicines they need.

As physicians, we know that time matters when someone is sick. As a Democrat and a Republican, we also recognize how rare genuine consensus is in Washington. That’s why we’re cautiously hopeful that after the midterms, Congress will seize the opportunity to make prior authorization and broader insurance marketplace reforms a priority.

The post A health reform both parties can get behind appeared first on Salon.com.