The EU Built a Compliance Fortress and Forgot to Put Anyone Inside

Here is the situation in one sentence: 85% of Nordic enterprises say they want EU-based alternatives to US tech, and almost nobody is building them because Europe made it economically irrational to try. That is not a market failure. That is a policy failure with a compliance badge on it.

I run a tech company in Jönköping, Sweden. We build AI solutions, SaaS products, and blockchain systems. Every week I talk to founders, CTOs, and enterprise buyers across the Nordics. The demand signal is real. The Proton survey numbers are real. People genuinely want sovereignty over their data and their tech stack. But wanting something and being able to get it are two different things. And right now, the EU is very good at making people want things it simultaneously makes impossible to build.

The 85% Number Sounds Great Until You Ask the Follow-Up Question

Proton's 2026 survey is getting shared around LinkedIn like it proves Europe is about to have its moment. Nordic enterprises demanding EU alternatives. Digital sovereignty finally taken seriously. The framing is triumphant.

But I keep asking the same follow-up question that nobody seems to want to answer: alternatives to what, exactly?

To AWS? Europe does not have a hyperscaler that competes. OVHcloud and Hetzner are solid for hosting, but they are not AWS. To Google Workspace or Microsoft 365? Nextcloud is good. It is not Google Workspace. To OpenAI or Anthropic? Mistral is doing interesting work but is already taking US investment and building toward a US-shaped market. Aleph Alpha pivoted away from foundation models entirely.

The demand is there. The supply is not. And the gap between them is not closing. It is widening. Politico is right to call AI "a nightmare for the EU" because the regulatory environment is actively preventing the supply side from responding to the demand side.

The AI Act: Protecting Europe From Its Own Competitiveness

I want to be precise here because this is not a generic "regulation bad" argument. I understand why the AI Act exists. I understand the risks of unregulated AI deployment. What I do not understand is why Europe chose to regulate the builders instead of the deployers, front-loaded the compliance costs onto the smallest companies, and did all of this before a single European AI company had reached global scale.

The compliance costs for a "high-risk" AI system under the AI Act are estimated at €200,000 to €400,000 before you ship anything. For a startup with three engineers in Stockholm or Jönköping, that is not a speed bump. That is a wall. For OpenAI, which raised $6.6 billion, it is a rounding error in their legal budget.

So the AI Act does not constrain the American giants. It constrains the European companies that are supposed to compete with them. The fortress has a moat, drawbridge, and archers on the walls. But nobody is inside because the builders could not afford the entrance fee.

As someone running an AI development company in Europe, I see this play out in real conversations. Clients come to us asking for AI agent systems, intelligent automation, custom models. They want it built in Europe, hosted in Europe, compliant with European rules. We can do that. We do it every day. But every project now carries a compliance overhead that did not exist two years ago, and that overhead hits small players harder than large ones. Every single time.

Ericsson, Nokia, and the Quiet Americanization of Nordic Tech

While everyone celebrates the 85% demand number, something more telling is happening at the top of the Nordic tech pyramid. Light Reading documents how Ericsson and Nokia are systematically Americanizing their operations, R&D centers, and corporate culture. These are supposed to be Europe's crown jewels in telecom technology. They are voting with their feet.

This is not betrayal. It is rational behavior. The US market is bigger, the regulatory environment is more permissive for R&D, the capital is deeper, and the talent pool (augmented by global immigration) is larger. When your own ecosystem makes it harder to build, you go where it is easier. That is what companies do.

And this is the part that should worry Swedish policymakers more than any survey result. The demand for European tech sovereignty means nothing if the companies capable of delivering it keep relocating their brains to Texas and New Jersey. We are creating a Europe that wants European tech but pushes European tech companies to become American.

Deloitte's 2026 TMT Predictions confirm the AI gap between the US and Europe is narrowing but persists. I would argue the "narrowing" is generous. In foundation models, the gap is growing. In AI application development, yes, Europe has pockets of excellence. But pockets do not win markets. Ecosystems win markets. And Europe's ecosystem is optimized for compliance, not creation.

What Sweden Gets Right (and What It Doesn't)

Let me give Sweden credit where it is earned. The Nordic approach to digitalization is genuinely good. BankID, Swish, the broader digital infrastructure. These things work. Swedish engineers are among the best in the world. The per-capita startup rate in Sweden is extraordinary. There is something in the culture here, maybe the combination of systems thinking and individual stubbornness, that produces great builders.

From Jönköping, I watch this tension every day. We have the talent. We have clients who want what we build. The demand for AI agent development and custom SaaS is growing fast. But we also operate inside a regulatory framework designed in Brussels by people who have never shipped a product, never met a payroll, and never had to choose between hiring a compliance officer and hiring an engineer.

Sweden could be leading Europe in AI. In some narrow verticals, it is. But the structural problem is that Swedish startups face the same AI Act compliance burden as French or German ones, while competing against American companies that face none of it in their home market and can absorb the EU compliance cost from their existing legal teams when they decide to sell here.

The result is predictable: American companies sell to the 85% who want European alternatives, because the European alternatives never got big enough to serve them.

Where This Goes: 2027-2030 and the AGI Question

Let me look forward because this is where it gets genuinely concerning.

If current trajectories hold, the path toward AGI will be walked by American and Chinese labs. Not European ones. The capital requirements, the compute requirements, the regulatory freedom required to experiment at the frontier, none of that exists in Europe right now. The EU is not even in the conversation for frontier AI research.

That means the most powerful technology in human history will be built under American corporate governance and Chinese state governance. Europe will be a customer. A regulated customer with strong opinions and no alternatives.

By 2028, I expect the contradiction to become unbearable. European governments will be buying AI capabilities from US providers to run healthcare, defense, education, and infrastructure. They will be doing this while publicly championing digital sovereignty. The 85% demand number will climb to 95%. The supply will not have changed.

There are two possible outcomes. One: Europe wakes up, creates a regulatory fast lane for European AI companies, funds compute infrastructure at scale, and accepts that some risk-taking is necessary to build an industry. Two: Europe doubles down on regulation, the remaining competitive European tech companies finish their migration to the US, and the continent becomes a permanent technology colony with excellent consumer protection laws.

I know which one I am betting on. I also know which one I am working to prevent.

What to Look At

If you are a CTO or founder navigating this, here are things worth your time right now:

Baserow is an open-source, self-hosted alternative to Airtable. GDPR compliant, SOC 2 compliant. If you need no-code database and automation tooling that stays in Europe, this is one of the few real answers. It is also a good example of how open source is the actual path to European tech sovereignty, not regulation.

CISO Assistant is an open-source GRC platform supporting 150+ frameworks including NIS2, DORA, and GDPR. If you are going to be forced to comply with everything, at least use tooling that does not cost you another six figures. The fact that compliance tooling is one of Europe's fastest-growing open-source categories tells you everything about where the ecosystem's energy is going.

Prowler for cloud security auditing across AWS, Azure, and GCP. Nearly 14,000 stars on GitHub. If your European workloads still run on American clouds (and statistically, they do), at least automate your security posture. This is table stakes.

Hemmelig (yes, the name is Norwegian/Danish for "secret") is a self-hosted encrypted secret sharing tool. Small project, useful concept. Keep sensitive data out of Slack and email. The name alone makes it worth mentioning in a Nordic context.

What You Should Actually Do

Stop waiting for Europe to produce a full-stack alternative to the US tech ecosystem. It is not coming in time. Instead:

Build hybrid. Use European providers where they are strong (hosting, identity, payments, specific SaaS verticals). Use American providers where you must. Design your architecture so you can swap components as alternatives mature.

Invest in open source. The real path to European tech sovereignty runs through open-source projects, not through Brussels directives. Every European company that contributes to and deploys open-source tooling is reducing dependency on US vendors in a way that no regulation can match.

If you are building AI, build applications, not foundation models. Europe lost the foundation model race. That is done. But the application layer, AI agents, domain-specific systems, vertical SaaS with embedded intelligence, that race is wide open. And it is where most of the business value lives anyway. That is where we focus at HEIMLANDR and it is where I see the most opportunity for European builders.

Talk to your MEPs. I am serious. The AI Act review is coming. If the people making noise are only the lobbyists from Big Tech and the advocacy groups who think all AI is dangerous, the review will not help European builders. Founders and CTOs need to be in that conversation. Your experience is evidence. Use it.

The Fortress Needs Builders, Not More Walls

I am not against regulation. I am against stupid regulation. I am against regulation that protects consumers from products that will never exist because the regulation killed them first. I am against celebrating demand numbers while ignoring that the supply side is being strangled.

The 85% is a signal. A loud one. It says the market is ready. What it does not say is that anyone is ready to serve it. From Jönköping, from Stockholm, from anywhere in Europe, the builders exist. The talent exists. The will exists. What does not exist is a policy environment that treats builders as an asset instead of a risk.

Europe built a beautiful compliance fortress. Thick walls. Deep moat. Impressive paperwork. Then it looked inside and realized nobody was there. The builders were all outside, trying to figure out if they could afford the entrance fee. Most of them decided they could not, and went somewhere else.

That is the real story behind the 85% number. And until we fix it, the number is just a wish.

Fredrik Brunnberg is the CEO of HEIMLANDR.IO, building AI and software solutions from Jönköping, Sweden. This is the daily HEIMLANDR briefing. If you found this valuable, share it with someone who builds things.