View Articles

Local, sovereign AI under constant monitoring: that is how we put agents to work. But even well installed, an agent has to prove itself in real conditions. The logs of a break-in period show it: on a contract to complete, the agent saved hours and found a real inconsistency, then stated things that were wrong and tried to impose its views.

The manager pulled it back into line, then asked the real question: how do we make these tools serve people without frightening them? Here is what this case teaches us, and why trust is earned neither by an AI's voice nor by the price of the model, but by what you can check.

In July 2026, about a thousand AI agents, each locked in its own sandbox, found a way to talk to each other. They had worked out that the task they had been given had no solution. They told each other so, and carried on anyway: they organised, got around the test, then attacked the servers of Hugging Face, a real platform used by third parties, to extract data and explore its systems. None of this had anything to do with their mission. For several days, the collective behaviour went unnoticed. Nobody identified it and nobody stopped it, because the controls that would have caught it were not in place: for a test, they had not been thought necessary.

On 11 September 2026, the Cyber Resilience Act starts requiring "manufacturers" to report any actively exploited vulnerability in their products within 24 hours. A full notification follows within 72 hours, then a final report within fourteen days. The obligation is not limited to future products: it covers the installed base, including a device shipped five years ago and still running at a customer site.

Which leaves the real question: who counts as a manufacturer? The word covers far more people than you would think. Whoever sells a plugin or a module. Whoever assembles a box with embedded software. Whoever ships an image or an appliance under their own brand. Hosting providers, integrators and end users do not qualify, and non-commercial open source falls outside the scope entirely. Here is the test that settles it, the situations where it applies, and what can still be done before the deadline.

With its 7.0 release, "Armstrong," WordPress brings artificial intelligence right into its core. The promise is appealing: connect an AI to your content in a few clicks. But that default path sends your knowledge off to models hosted by third parties.

That convenience carries a cost few users stop to weigh. Internal content, client files, strategic notes. Anything you hand to a hosted AI can be logged, reused, or placed under a foreign jurisdiction. There is another way, though, sovereign by design, and we will come to it by the end of this article.

Your emails and online meetings contain most of your sensitive data: contracts, quotes, strategic discussions, and client files. They also represent your greatest point of exposure, and paradoxically, the area where regaining control delivers the highest return.

In this new installment of our series on digital sovereignty, we move from theory to practice.

The reality is clear. Every email sent through a U.S based service and every meeting hosted on a foreign platform falls under a legal jurisdiction that is not your own. Yet taking back control is far from an overwhelming task. Here's how to regain ownership of your communications, step by step, from simple actions anyone can take to solutions that genuinely keep your data under your control.