TL;DR: At the 2026 State of the Union in Strasbourg on 16 September, Ursula von der Leyen said the sentence this series has been building towards: "So we are reversing the burden of proof." The next day, the Commission wrote it into a legislative proposal for children online. Put that next to what Europe did this year for identity, AI, cloud and chips, and to the terms it now offers its partners, and one architecture appears: a sovereignty stack in which access depends on proof, inside Europe and at its borders. Part 2 argued that trust is something you verify. Part 3 maps where verification is becoming law, who it applies to, and why it moves fastest where the proof can be written down.

The sentence

The age limits made the headlines. The framing matters more: "It is not about our minors accessing social media. It is about when and how do we allow social media to access minors."

The EU KIDS Act turns that into obligations. No social media under 13; from 13 until 15, a parent-managed "mini account" with limited features and one hour a day; your own account from 15. Providers of very large online platforms "will have to show that their services are safe for children." The defaults change too: fewer addictive features, no unsolicited contact from strangers, private profiles, and AI chatbots switched off.

It is a proposal, not yet law. Parliament and Council now negotiate the text. But the principle is travelling. "Addictive design, for example, is harming everyone," von der Leyen said, announcing a Digital Fairness Act for this autumn. For frontier AI, she wants to team up with Canada, the UK and others on "model evaluation, verification, early warning, AI security".

Prove it first, then get access. That rule is now being written into every layer.

The sovereignty stack

Read 2026 as one system rather than a string of announcements, and Europe is building five layers. Each asks a different question, and each demands a different kind of proof.

| Layer | The question Europe now asks | The proof | Where it stands | |---|---|---|---| | Identity | Is this person old enough, without revealing who they are? | EU age verification app; EU digital identity wallets | App rollout urged and wallets required, both by the end of 2026 | | Platforms | Is this service safe for the people it reaches? | Platforms show their services are safe for children | KIDS Act proposed 17 September; Digital Fairness Act due this autumn | | AI models | Does the model do what it claims, safely? | Evaluation, verification, conformity assessment | Transparency rules in effect since August; high-risk rules delayed to 2027–28 | | Cloud | Who controls the infrastructure? | Sovereignty assurance levels, up to no third-country control | Four levels proposed in June; the Commission's own scale already decides who it buys from | | Chips | Where does the compute come from, and will supply hold? | Supply-chain visibility and early-warning indicators | Chips Act 2.0 proposed in June |

Part 2 called the machinery behind this the Verification Layer: provenance, assurance and interfaces. The stack is where it gets legal force. But the stack only decides what may reach Europeans. The same speech also set out who may join them.

Who gets verified: trust across borders

Start with Canada. Von der Leyen said she wants to work on "opening the door for Canada to be the first associate member of the EU", and to "move from CETA to an Alliance for the Future". Under CETA, trade in goods has grown by 75% in less than a decade. This is trust by membership rather than by geography: a partner verified into the stack once, instead of re-audited at every border.

The opposite case is dependency. Europe's trade deficit with China is now €1 billion a day, and Europe is more than 80% dependent on China for many critical raw materials, and 90% for some rare earths. The answer is not a wall but a buyer: a new European Corporation on Critical Raw Materials, to "obtain and stockpile what we need". At the bottom of the stack, proof means provenance and reserves.

Europe is also building connectors of its own. It now has trade deals with more than 80 countries. A new Middle Corridor would link the South Caucasus and Central Asia directly to the European market, with Global Gateway aiming to crowd in up to €12 billion and to triple trade flows by 2030. In Part 2, connector economies were how trade rerouted around tariffs, often carrying Chinese inputs. Now Europe is laying a route on its own terms.

Power, she said, "does not belong to the strongest, the richest or the loudest". Part 2 made the same point: not the loudest player, nor the largest, but the most verifiable.

Four speeds: require, procure, build, wait

Inside the stack and at its borders, Europe does not move at one speed. It has four verbs for trust, and which one it uses depends on whether the proof can be specified.

Require, where proof can be specified. A label, a default setting or an age threshold can be written into law and checked. The AI Act's transparency rules, including the duty to tell people when they are dealing with an AI system, came into effect in August, and lawmakers shortened the grace period for marking AI-generated content, which now ends on 2 December 2026. The KIDS Act went from speech to legislative proposal in a day.

Procure, where it can't yet mandate. When the law isn't ready, Europe uses its purchasing power. In April the Commission awarded €180 million in sovereign cloud contracts over six years, open only to providers at level two or higher on its SEAL assurance scale. The proposed Cloud and AI Development Act would map public-sector cloud demand against four assurance levels. The raw-materials corporation applies the same logic to minerals.

Build, where proof depends on capacity. You can't demand sovereign compute that doesn't exist. The same Act aims to at least triple EU data-centre capacity within five to seven years, needing around €200 billion of mostly private investment. Europe accounts for less than 10% of global chip production. Even power is a build problem: Europe installed more than 80 gigawatts of renewable capacity last year, but six times as much is still waiting to be connected.

Wait, where the standards don't exist. The AI Act's high-risk rules were pushed back through the Digital Omnibus on AI, part of the Commission's simplification drive. The Commission's proposal made the waiting explicit: the rules would "start to apply once the Commission confirms the needed standards and tools are available". Lawmakers then fixed the dates: December 2027 and August 2028. For frontier models, von der Leyen chose convening over mandates, noting that the CEOs of the most advanced companies say "it is time to slow down on the self-recursive models".

The pattern is the finding. The binding constraint on trust-as-law is not political will. It is the supply of proof: standards, test methods, assessors, verification tools and, at the bottom of the stack, physical capacity. Every layer that stalls, stalls there. That is the market that opens next.

It is also a testable model. If it holds, Europe's next trust rules will arrive in the order their proof can be written down: disclosure and defaults first, procurement thresholds next, capacity after that, high-risk AI last. The first test comes in November, when the Commission announces its industrial AI initiatives: if they lean on procurement and standards rather than new mandates, the four speeds hold. Part 4 will score it.

The weak joint: identity

One layer carries the others. Platforms can only prove who they let in if people can prove their age. The KIDS Act allows checks through the EU age verification app, "which does not retain identity documents or biometric data." Proof of age without handing over identity is the right design.

Adoption is the problem. In April the Commission urged member states to make the app available by the end of 2026. At that point none had formally adopted it; Ireland, France and Poland preferred national tools, and security flaws surfaced soon after launch. By September it was still being piloted in seven countries. Europe can require platforms to verify age faster than it can give citizens a trusted way to prove it. That is the joint to watch.

The missing half

Regulation can take hours back from the feed. It can't decide what fills them. That question belongs to our Experience Layer research, and it deserves its own piece.

What changes for leaders

Growth. Market access is being redrawn around trust: trade deals with more than 80 countries, a proposed associate membership for Canada, public cloud contracts gated by assurance level. Map your growth plan against the stack: which layer's proof does each market require, and when does it arrive? The supply of proof itself (standards, testing, verification tools) is a growth market in its own right.

Brand transformation. Trust claims are becoming credentials. Engagement metrics are turning from assets into liabilities, and transparency is moving from what customers can read to what regulators and AI systems can verify, the shift behind the Studio's H&M Group transparency work. Build the evidence with the product, not after launch.

AI-native innovation. Europe does not need to own the frontier to win from it. In von der Leyen's words: "We do not need to be the ones who develop the frontier technology to be the ones who draw the greatest value from it." That was Part 1's thesis: regional IP and collaboration interfaces, not winning every category. The value lies in "moving AI from the screen to the real economy and society", on foundations that can be verified. Make evaluation, provenance and disclosure product features from day one.

Cities and policymakers. Fund the supply of proof: testbeds, assessors, verification tools. Then fund what fills the hours regulation gives back: third places, youth programmes and civic tools designed for participation, not retention.

A Stockholm note

Sweden starts ahead on the identity layer. Almost six in ten Swedes already mainly see benefits in every user verifying their identity on social media. The debate is live here too: Swedish MEP Jörgen Warborn has argued that less sensitive areas should stay open to foreign investment. Public trust in verification, plus open disagreement about how far sovereignty should reach, makes Stockholm a natural testbed for the stack: privacy-preserving verification, assurance pilots and, the missing half, real-world alternatives to the feed.

Key metrics

  • Proof-before-access rate: share of your digital products with documented safety evidence before launch.
  • Assurance coverage: share of critical workloads running on providers at a sovereignty level that meets your buyers' threshold.
  • Time-to-Assurance (from Part 1): lead time to certify against each layer's rules, which now run on different clocks.
  • Friend-Shored Dependency Ratio (from Parts 1–2): now worth tracking for critical raw materials, where Europe is more than 80% dependent on China for many inputs.

> Locked preview — full framework available in the complete version.

Call to action

The KIDS Act will get the headlines. The deeper story is the stack beneath it and the borders around it. Europe is making trust something you demonstrate before you get access, one layer and one partner at a time, and it moves fastest wherever the proof can be written down. Industry 5.0 promised a sustainable, human-centric and resilient European industry. The sovereignty stack is how Europe starts to enforce that promise. Build your proof before it's demanded.

Interested in piloting a verification testbed out of Stockholm? Get in touch.

Updated 23 September 2026: we added the cross-border layer (partners, raw materials, trade routes) and a testable prediction, replaced secondary sources with official texts where available, and set the screen-time material aside for a separate piece.

Sources

Part 3 of the Guarded Globalization series. Part 1 set out the thesis (October 2025). Part 2 named the Verification Layer (July 2026) and was corrected on 23 September 2026 after we re-checked it for this piece. Part 4 will follow the Commission's industrial AI initiatives, due in November.

Machine-readable version of https://deriss.com/articles/the-sovereignty-stack-and-trust-as-law. Full canonical context: llms-full.txt.