The Realities of the Digital Transition: A Conversation with Hilary Hudson

The Enforcement Challenge of the EU AI Act: As the EU transitions from passing digital regulations to actively enforcing them, what do you see as the biggest operational challenge for global tech firms trying to comply with the EU AI Act mandates without losing their competitive edge?

Hilary Hudson: The biggest operational challenge for global technology companies won't be understanding the AI Act, they have lawyers and teams full of compliance experts for that. The real challenge will be turning the Act's requirements into a repeatable operational process without slowing the product-development cycle.

This is why we hear so many companies talk about regulation hampering innovation: there's a difficult balancing act to strike. AI products are being developed, trained and deployed across EU markets at considerable speed, while the AI Act requires companies to build processes around risk classification, documentation, transparency, human oversight, testing, monitoring and governance. These requirements become particularly significant for high-risk systems once the relevant rules apply from December 2027, with some product-related systems following in August 2028.

The operational risk is that compliance becomes a parallel process sitting outside product development. If every new model or AI-enabled feature requires a separate EU legal assessment, additional documentation, and potentially a separate technical configuration, companies will face longer development cycles and higher costs. That creates a temptation to potentially restrict certain functionalities in the EU rather than integrating compliance into global product production.

Balancing Innovation and Digital Sovereignty: Brussels is heavily pushing for European digital sovereignty, particularly regarding cloud infrastructure and data privacy. How can global technology providers successfully navigate these protectionist tendencies while continuing to deliver seamless cross-border services?

Hilary Hudson: EU digital sovereignty is often framed as a choice between EU autonomy (simply "made in Europe") and exposure to a kill switch. In theory, the "made in Europe" approach sounds right when the question is posed that way, but in practice it needs a much more nuanced lens. The EU is not seeking to close its market to international providers; rather, it seems to be seeking greater control over the technologies, infrastructure and data on which Europe depends, but is still working out how to make this happen. "How do we protect against the kill switch" is a better way of framing the question.

The European Commission's June 2026 Technology Sovereignty Package illustrates the direction of travel. It covers chips, cloud, AI and open source, while the proposed Cloud and AI Development Act sets out four levels of cloud and AI sovereignty for public-sector use, ranging from EU-based infrastructure to more stringent requirements around ownership, control and third-country influence.

For international tech companies, the response should therefore not be to resist the concept of sovereignty, but to demonstrate how global scale and European strategic interests can coexist by giving guarantees of control over the kill switch. This can start with localisation where it genuinely adds value: companies that can offer European customers appropriate options around data residency, encryption, security, operational control and access to infrastructure are likely to be welcomed. This doesn't require building an entirely separate European technology stack - that would be too costly and take too much time, but rather a model that can meet different sovereignty requirements while retaining common global infrastructure, software and security standards wherever possible.

Take the EU's approach to cloud switching as an example: the Data Act is designed to make switching between cloud providers easier and more interoperable, rather than forcing customers toward particular EU providers. From 12 January 2027, cloud providers will also no longer be able to charge switching or data-egress fees. This creates a competitive environment in which global providers can continue to participate, but have to compete on transparency, interoperability and customer control, as well as price and performance.

Ultimately, all companies need to make trust an operational product feature for both governments and individual customers. Being able to explain where data is stored, who can access it, which entities control the infrastructure, how government access requests are handled, and how customers can move their data will increasingly influence purchasing decisions, particularly in sensitive sectors and public procurement. The companies that can demonstrate that their global model can operate within EU rules, while giving EU customers greater control over the technologies and data they depend on, will be the ones with a competitive edge in the EU.

The Evolving Role of Tech Policy Advisory: With digital policies now blending deeply into national security and trade discussions in the European Parliament, how must public affairs strategies evolve for tech companies to remain proactive rather than reactive in Brussels?

Hilary Hudson: The traditional EU public affairs model used to be relatively straightforward: identify a legislative proposal, understand its implications, build a coalition and engage with the institutions before the text was finalised. That model is becoming less effective for technology companies. Don't get me wrong, there is certainly still a place for these public affairs actions, but they need to sit within a broader strategic function, one that connects policy developments with a company's investment decisions, technology roadmap and geopolitical exposure.

Digital, data and tech policy, for example, is increasingly being treated as part of Europe's economic security. The Commission's 2026 Tech Sovereignty Package explicitly links technology dependencies to economic security and geopolitical risk. The European Parliament has similarly called for greater alignment between trade, competition, digital regulation, industrial policy, research and innovation, and foreign investment. For companies, this means public affairs needs to move upstream. The question is no longer simply "What does this regulation mean for us?" It is "What is the EU trying to achieve, what political pressures are driving it, and where does our business fit into that strategic debate?"

That requires a much broader stakeholder map. A technology company discussing cloud policy, for example, may need to engage not only with DG CONNECT and the European Parliament's technology-focused committees, but also with officials and policymakers working on trade, competition, industrial policy, economic security and procurement. The same technology can be viewed simultaneously as an innovation opportunity, a market, an infrastructure dependency and a security consideration.

This means public affairs consultants need to be much closer to clients in understanding their next business move, and able to frame this within a political and geopolitical setting. At Access Partnership we advise clients to think more carefully about the timing of engagement and to take a role in developing thought leadership around their evolving business needs. Bringing evidence upfront helps develop the narrative much earlier in the debate.