Two apparently separate developments are currently reshaping the digital relationship between Europe, the United States and China. The first concerns the legal foundations of EU-U.S. data transfers. The second concerns the increasingly powerful role of artificial intelligence in cybersecurity. In reality, they are closely connected. Both raise the same strategic question: how dependent should Europe be on foreign legal systems and foreign technologies for the protection of its data and digital infrastructure? The EU-U.S. data transfer problem returns To answer this question, one must start with transatlantic data flows. The European Commission currently recognizes the United States as providing an adequate level of protection for personal data transferred under the EU-U.S. Data Privacy Framework. In practical terms, an adequacy decision allows personal data to move from Europe to participating organizations in the United States without requiring companies to construct a transfer impact assessment or have a separate transfer mechanism for every individual transfer. For European businesses, this is enormously important. Cloud computing, HR systems, cybersecurity services, customer relationship management, online advertising and increasingly artificial intelligence all depend upon international data flows. Legal certainty surrounding EU-U.S. transfers therefore has significant economic value. But the stability of this framework is again being questioned. The U.S. Supreme Court ruled in July that President Donald Trump can dismiss members of independent federal agencies. This development has attracted the attention of European privacy regulators because independent oversight is an important component of the European assessment of whether a third country’s legal system provides essentially equivalent protection for personal data. The European Data Protection Board has consequently asked the European Commission to examine carefully whether the U.S. judgment affects the assumptions underlying the existing adequacy decision. This is legally significant. An adequacy decision is not a permanent political endorsement of another country’s privacy system. It depends upon the continuing existence of the legal and institutional safeguards upon which the Commission based its assessment. If material elements of that system change, the Commission must consider the consequences. And independent supervision matters because data protection is not secured merely by putting rights into legislation. There must also be institutions capable of enforcing those rights with sufficient independence from political power. Schrems III — or something similar? Politically, this inevitably recalls the history of transatlantic data transfers. Europe and the United States have already experienced repeated legal instability in this area. Successive frameworks have been challenged because of concerns regarding U.S. surveillance and the protection available to Europeans once their personal data reaches the United States. The current controversy therefore creates a familiar risk: businesses invest in a transfer framework, reorganize their compliance structures around it, and then face the possibility that the legal foundations of that framework may change again. The French politician Philippe Latombe, who already has a challenge concerning the current EU-U.S. framework pending before the European courts, has gone further than the European privacy regulators. It seems that he has asked the Commission to suspend or repeal the adequacy decision, arguing that the U.S. Supreme Court's judgment directly affects essential protections for Europeans. The Commission has not reached that conclusion. It is examining the implications of the American judgment and has emphasized continued cooperation with Washington. The existing framework has also survived a challenge before the EU’s lower court. Consequently, it would be premature to say that EU-U.S. adequacy is collapsing. But it is equally difficult to dismiss the issue. The fundamental legal question is whether developments in the United States materially alter the guarantees upon which the Commission relied when determining that the American system provides an adequate level of protection. The economic dimension: data transfers are infrastructure This legal debate has enormous economic consequences. International data transfers are sometimes discussed as though they were primarily a privacy-compliance issue. Economically, however, they have become part of the infrastructure of international commerce. A European company may use American cloud infrastructure, AI models, cybersecurity platforms, communications services, analytics systems and enterprise software simultaneously. Disrupting the legal mechanisms supporting these transfers therefore creates costs far beyond the privacy department. Companies may need alternative transfer mechanisms, contractual restructuring, transfer impact assessments, technical safeguards, localization strategies or alternative suppliers. Large multinational corporations can absorb some of these costs. SMEs may find them considerably more burdensome. There is therefore an important tension in European policy. Europe must protect fundamental rights and cannot simply disregard structural changes in the legal system of an adequate third country because reassessing adequacy would be economically inconvenient. At the same time, repeatedly destabilizing international transfer mechanisms creates regulatory uncertainty and potentially weakens European competitiveness. The long-term objective should therefore be durable interoperability between legal systems, rather than a continuous cycle of framework, litigation, invalidation and replacement. And then comes AI Against this already complicated background, artificial intelligence is transforming cybersecurity. Recent information highlights concerns surrounding the expected release of a new Chinese open-weight model, GLM 5.3, developed by Z.ai. The concern is straightforward. The most capable AI systems are becoming increasingly useful for cybersecurity tasks. Those capabilities can assist defenders in discovering vulnerabilities, analysing malware and identifying attacks. But substantially the same capabilities may also assist malicious actors. This creates the classic dual-use problem. Some leading American AI developers have responded by restricting access to their most advanced cybersecurity capabilities. OpenAI and Anthropic have made certain cyber-focused capabilities available principally to trusted defenders. Open-weight models create a different dynamic. Once a sufficiently powerful model is openly available, controlling who uses it — and for what purpose — becomes substantially more difficult. If open models rapidly approach frontier cybersecurity capabilities, the effectiveness of restricting access to advanced closed models may consequently diminish. The economics of AI cybersecurity There is also a commercial dimension that should not be ignored. If AI dramatically increases offensive cyber capabilities, companies will have a strong incentive to purchase increasingly sophisticated AI-based defensive systems. This creates an extraordinary market opportunity for the same technology companies developing advanced AI. The argument becomes almost circular: AI makes cyberattacks more powerful; therefore organizations require more AI to defend themselves against AI-enabled cyberattacks. That proposition may contain considerable truth. But policymakers should distinguish carefully between objective cybersecurity risk assessments and commercial incentives. A recent example is particularly interesting. OpenAI argues that increasingly capable open-weight models could accelerate cyber threats. Yet Hugging Face reportedly stated that an earlier Chinese model, GLM 5.2, played an important role in defending against an incident involving an OpenAI agent. The lesson is that the open-versus-closed debate is not straightforward. Open models can empower attackers. But they can also empower defenders. The relevant policy question is therefore not simply whether AI should be open or closed. It is how access, capabilities, permissions, safeguards and accountability should be governed according to actual risk. A geopolitical triangle: Europe, America and China These developments ultimately form part of a much larger geopolitical contest. The United States possesses many of the world’s dominant cloud, AI and digital-platform companies. China is rapidly developing competitive AI capabilities, including increasingly sophisticated open models. Europe possesses perhaps the world’s most developed digital regulatory architecture but remains significantly dependent upon non-European technology. That creates a strategic asymmetry. Europe regulates the conditions under which data can leave its territory, but much of the infrastructure processing that data belongs to American companies. Europe regulates AI, but many of the most powerful AI models are American or Chinese. Europe regulates cybersecurity, while critical cybersecurity technologies and cloud infrastructure may again originate outside Europe. This is why privacy, cybersecurity, AI regulation and technological sovereignty can no longer be considered separate policy areas. They are becoming different dimensions of the same strategic problem. The fundamental European dilemma From a legal perspective, Europe must determine whether developments in the United States continue to satisfy the requirements underlying adequacy and the protection of fundamental rights. From an economic perspective, it must preserve international data flows that are indispensable to European businesses while avoiding excessive technological dependency. And from a political perspective, Europe must decide how much strategic autonomy it wants in cloud computing, cybersecurity, data infrastructure and artificial intelligence. There is also an important connection between the two stories. The adequacy controversy concerns trust in foreign institutions. The AI cybersecurity controversy concerns trust in foreign technology. Europe currently depends significantly upon both. The strategic objective should therefore not simply be to restrict transfers to the United States or restrict access to Chinese AI. Nor should it be to assume that market forces alone will provide adequate protection. The more ambitious objective is to create a European digital ecosystem capable of combining fundamental-rights protection, cybersecurity resilience, economic competitiveness and technological sovereignty. And this is perhaps the central message, as it is in my opinion the fundamental role that Europe should take at global level. The EU’s regulation of technology and data is paramount to safeguarding the fundamental rights and freedoms of individuals and, more broadly, the values underpinning our democratic societies. This mission is both noble and necessary. At the same time, reclaiming the EU’s global identity requires Europe to assert itself not merely as a rule-maker, but as a global leader capable of combining the protection of fundamental rights with technological ambition, economic competitiveness and responsible innovation. The EU should continue to shape the global digital environment by promoting a distinctively European model of data-driven innovation that is responsible, trustworthy and sustainable, while ensuring that its regulatory framework creates the conditions for European businesses and technologies to develop, scale and compete globally. This requires a carefully calibrated regulatory approach that protects individuals without unnecessarily constraining technological development or economic growth. Concluding, and back to the topics of this discussion, data protection is no longer merely privacy law. Cybersecurity is no longer merely IT security. And AI governance is no longer merely technology regulation. All three are becoming instruments of economic and geopolitical power. The question facing Europe is therefore increasingly clear: can it continue to exercise global regulatory power without developing comparable technological power of its own?   Voluntary Transparency Notice Use of AI: This text includes AI-assisted content. Workflow: I regularly review a broad range of authoritative sources to stay informed about the topics discussed. I independently develop my analyses, opinions, and conclusions, and use AI solely as a tool to help organize and summarize my thoughts, as well as to assist in preparing the podcast transcript and the accompanying blog post. All content is carefully reviewed, refined, and validated by me before publication, and I take full responsibility for it. Personal capacity: The views expressed are my own and are provided in my personal capacity. They do not necessarily reflect the views of any organization with which I am affiliated.