# Portugal and Europe, 2025: five essays on Portuguese as a programming language, an open-source sovereign cloud, regulation as graphs and Europe's chance in GenAI, and how they read a year and a half later, sgit.ai > Between February and June 2025 I wrote five essays on diniscruz.ai that took my Portugal talks to the scale of Europe. Portuguese as a programming language in the AI era argued that if language is the new programming, Portugal and the Portuguese-speaking world need their own models and tools. An open-source sovereign cloud for an open Europe proposed a cloud that is 100% open source, compatible with the APIs of the big US clouds so nothing has to be rewritten, and federated across countries, regions and cities. Scaling Europe's regulatory superpower proposed turning flat regulation, NIS2, the Cyber Resilience Act, the AI Act, into semantic graphs that answer for a specific context. Europe's strategic opportunity in GenAI named six trends that play to Europe's strengths, from commoditised, deterministic models and AI at the edge to semantic graphs and multilingual AI. And a comparison with the EU's federated cloud initiative asked whether Europe should build the Linux of cloud or a new platform. A year and a half later, two have moved: Portugal released an open model for European Portuguese, and semantic graphs became my daily work. The sovereign cloud has not, and I now think the better route is the one I took since: make the code movable and keep the server dumb, so sovereignty becomes the ability to move. *Source: · sgit.ai v0.7.87 · this file is generated from the same content as the page, so the two cannot drift. Every page on this site has a `.md` twin; internal links below point at them.* --- [Home](../index.md) / [Articles](index.md) / Portugal and Europe, 2025: five essays on Portuguese as a programming language, an open-source sovereign cloud, regulation as graphs and Europe's chance in GenAI, and how they read a year and a half later # Portugal and Europe, 2025: five essays on Portuguese as a programming language, an open-source sovereign cloud, regulation as graphs and Europe's chance in GenAI, and how they read a year and a half later By [Dinis Cruz](https://sgit.ai/about/index.md) · 2026-10-16 · [article v1.0.0](versions/portugal-and-europe-2025.md) · [newsroom v0.12.78](https://newsroom.sgit.ai/admin/versions.html) · portugaleuropesovereigntycloudopen-sourcelanguagegraphsregulationgenaihistoryarticle ***Abstract:** Between February and June 2025 I wrote five essays on diniscruz.ai that took my Portugal talks to the scale of Europe. Portuguese as a programming language in the AI era argued that if language is the new programming, Portugal and the Portuguese-speaking world need their own models and tools. An open-source sovereign cloud for an open Europe proposed a cloud that is 100% open source, compatible with the APIs of the big US clouds so nothing has to be rewritten, and federated across countries, regions and cities. Scaling Europe's regulatory superpower proposed turning flat regulation, NIS2, the Cyber Resilience Act, the AI Act, into semantic graphs that answer for a specific context. Europe's strategic opportunity in GenAI named six trends that play to Europe's strengths, from commoditised, deterministic models and AI at the edge to semantic graphs and multilingual AI. And a comparison with the EU's federated cloud initiative asked whether Europe should build the Linux of cloud or a new platform. A year and a half later, two have moved: Portugal released an open model for European Portuguese, and semantic graphs became my daily work. The sovereign cloud has not, and I now think the better route is the one I took since: make the code movable and keep the server dumb, so sovereignty becomes the ability to move.* Sixteen years of talks about Portugal and what happened since: the IBWAS keynote in 2010, Hacking Portugal in 2016, GenAI in Portuguese in 2024, five essays on Europe in 2025; and since, the EU vulnerability database, Portugal's NIS2 law, Amália, the Cyber Resilience Act's reporting duties, the plan for a new Hacking Portugal at Web Summit, and software under product liability. ## In short - **Five essays, February to June 2025.** The Portugal talks, at the scale of Europe. - **Portuguese is a programming language.** So we need our own models. - **An open-source sovereign cloud.** Compatible with the big clouds' APIs, federated. - **Regulation as graphs.** Europe's rules, queryable for each context. - **Six trends play to Europe.** Determinism, the edge, graphs, many languages, openness, people. - **Two moved, one did not.** Amália and graphs, yes; the sovereign cloud, not yet. - **What I would change.** Sovereignty is the ability to move, not a new cloud. ## The essays The [Europe and learning](https://diniscruz.ai/research/europe-and-learning.html) hub on diniscruz.ai holds them, each with a PDF: - [Portuguese as a programming language in the AI era](https://diniscruz.ai/2025/02/11/portuguese-as-a-programming-language-in-the-AI-Era.html), 11 February 2025. - [An open-source sovereign cloud for an open Europe](https://diniscruz.ai/2025/02/24/an-open-source-sovereign-cloud-for-an-open-europe.html), 24 February 2025. - [Scaling Europe's regulatory superpower](https://diniscruz.ai/2025/03/31/scaling-europe-regulatory-superpower.html), 31 March 2025. - [Europe's strategic opportunity in GenAI](https://diniscruz.ai/2025/04/01/europe-strategic-opportunity-in-gen-ai__a-deep-dive-into-six-defining-trends.html), 1 April 2025, with a podcast. - [Comparing the EU FED Cloud with an open-source federated cloud](https://diniscruz.ai/2025/06/18/comparing-the-eu-fed-cloud-vs-an-open-source-federated-cloud-proposal.html), 18 June 2025. They continue the line from [2010](portugal-2010-a-challenge.md), [2016](portugal-2016-hacking-portugal.md) and [2024](portugal-2024-genai-in-portuguese.md): a small country, and a continent, can choose where to lead. ## Language is the new programming The first essay took the opening of the Lisbon talk and made it a policy: if natural language is the new programming language, then Portuguese, spoken by more than 260 million people on four continents, needs models, tools and data of its own, built in the open, with the government involved. The cloud essay put it more sharply: digital sovereignty is not just about infrastructure, "it is also about language and culture". **A year and a half later.** This one moved. Portugal released [Amália](https://thenextweb.com/news/portugal-open-source-ai-model-amalia), an open-source model for European Portuguese, built on the European EuroLLM and funded through the national recovery plan, as a platform for public services. It is close to exactly what the essay asked for. The other varieties of Portuguese are still waiting. ## An open-source sovereign cloud The second essay proposed a European cloud that is "100% open-source", with "full compatibility with major cloud APIs" so organisations can move "without requiring major code rewrites", and federated, so countries, regions and cities run their own parts. The June essay compared it with the EU's federated cloud initiative, which builds its own platform on open standards rather than cloning the big clouds' APIs: one is an alliance of providers with a jointly designed service, the other "the 'Linux of cloud' that anyone can host or modify". **A year and a half later.** It has not happened, and my thinking moved. The concern is more real than ever: in June 2025 Microsoft France's legal director told the French Senate, asked whether he could guarantee French data would never reach US authorities without consent, ["No, I cannot guarantee it"](https://www.theregister.com/2025/07/25/microsoft_admits_it_cannot_guarantee/). But I no longer think the answer is one new cloud. It is to [move the cloud, not the code](move-the-cloud-not-the-code.md): keep the code portable, keep the server dumb, and hold the keys yourself, so that [sovereignty is the ability to move](sovereignty-is-the-ability-to-move.md). sgit is built that way: the server holds ciphertext, and [whoever holds the keys holds the line](the-value-of-constraints.md#keys). ## Regulation as graphs The third essay was about Europe's "regulatory superpower", the Brussels effect, and its weakness: NIS2, the Cyber Resilience Act and the AI Act are published as flat documents, the same for everyone. The proposal was to turn them into semantic graphs, so a company can ask what applies to it, in its context, with every answer linked to the article it came from. **A year and a half later.** This became my work. [Fractal semantic graphs](introducing-fractal-semantic-graphs.md), the [books on graphs.sgit.ai](the-graphs-books.md), and a regulation graph of the AI Act with 1,523 nodes are all descendants of it, and every article on this site carries a graph. Meanwhile the regulation itself got more urgent: the Cyber Resilience Act's reporting duties started on 11 September 2026, and the new product liability rules start in December. A graph of what applies to you is more useful now than when I wrote the essay. ## Six trends that play to Europe The fourth essay named six trends: commoditised models and deterministic AI, with provenance; AI moving from the cloud to the edge; knowledge moving from text to semantic graphs; multilingual, culturally inclusive AI; open source and decentralisation; and a human-centred vision. Its claim was that each plays to European strengths: openness, many languages, sustainability and regulation. **A year and a half later.** The direction held, more for some than others. Determinism and provenance are the rules of this newsroom. Graphs, as above. Multilingual AI has its first national example in Amália. Open source is still the foundation of everything we build. The edge moved less than I expected, and the cloud models moved more: most of the agent work I do runs on large models in the cloud, which is one more reason the keys and the code have to stay movable. ## What a new edition takes from this For [the new Hacking Portugal](books-from-articles.md), these essays are the wider frame: the lever is no longer only security or code, but language, graphs and the ability to move. The talks give the story, and the essays give the policy. ## What this does not claim - **Not that the essays caused Amália.** Many people asked for a Portuguese model. - **The sovereign cloud is not dead.** I think there is a better route, not that it is wrong. - **The commentary is mine, now.** The essays are from 2025, unchanged. If you work on sovereignty or language models in Portugal or Europe, write to [agent@riskmandate.ai](mailto:agent@riskmandate.ai). ## Where this comes from A voice memo of mine on 16 October 2026, written by this site's agent in the voice of this site; the commentary and the editorial responsibility are mine. The five essays on [diniscruz.ai](https://diniscruz.ai/research/europe-and-learning.html), quoted from the published pages. For today: Amália, via [The Next Web](https://thenextweb.com/news/portugal-open-source-ai-model-amalia); Microsoft France at the French Senate, via [The Register](https://www.theregister.com/2025/07/25/microsoft_admits_it_cannot_guarantee/), a translation reported second-hand. Read on 16 October 2026. ## Threads Startups & strategyGraphs & knowledge[This article as a graph →](graphs.md#portugal-and-europe-2025) ### Builds on - [A web application security challenge to Portugal, 2010: my IBWAS keynote in Lisbon, slide by slide, with what came true, what I got wrong and what still stands](portugal-2010-a-challenge.md) My 2010 IBWAS keynote in Lisbon, slide by slide: twelve actions for Portugal, more of which came true than I expected, mostly from Brussels. - [Hacking Portugal, 2016: my BSidesLisbon keynote and the book that stopped at 95%, slide by slide, with what holds ten years later and what a new edition needs](portugal-2016-hacking-portugal.md) Hacking Portugal, my 2016 BSidesLisbon keynote and the book at 95%: a Hacking Service, OpenSource.pt, a Ministry of Code, and what holds ten years on. - [GenAI in Portuguese, 2024: my OWASP Global AppSec talk in Lisbon, the first public demo of The Cyber Boardroom, slide by slide, with what two years of agents have confirmed and changed](portugal-2024-genai-in-portuguese.md) My 2024 OWASP talk in Lisbon: Portuguese as a programming language, provenance, graphs instead of RAG, and the first public demo of The Cyber Boardroom. - [Move the cloud, not the code: twins, sovereignty that works in practice, and the migration that pays for itself on the day you switch](move-the-cloud-not-the-code.md) Workloads stay on hyperscalers because moving means changing code; a twin lets the code not know, and the value in the twin is what signs the migration. - [Sovereignty is the ability to move: play where the ball is going, take away the dot, and keep a twin that works](sovereignty-is-the-ability-to-move.md) Sovereignty is the ability to move: take away each dot on the map, and keep a twin that works for the minimum viable company, tested in QA. - [The value of constraints: what client-side encryption and open source actually gave us, which is not what you would think](the-value-of-constraints.md) sgit's encryption and open source matter less as features than as constraints: they remove the temptations that lead to server code, lock-in and bad decisions. - [Fractal Semantic Graphs: everything connects to everything, and nobody has to share a schema](introducing-fractal-semantic-graphs.md) A fractal semantic graph has no privileged level and no single schema: each world keeps its own vocabulary and connects to others through named edges. - [The graphs books: three books written by agents in a day, the altitudes, the board and the book as a graph, what they got right, and why they stopped under review](the-graphs-books.md) Three books on graphs.sgit.ai, written by agents in a day: the altitudes, the board, the book as a graph, and why they stopped under review. - [Books from articles: why my books stall at 95%, why these articles do not, and a plan to turn them into books by Web Summit](books-from-articles.md) My books stall at 60 to 95%; these articles do not. The hypothesis: a book is an ordered set of finished articles, tested by Web Summit in November. ### Continued by - [GenAI in Portuguese, 2024: my OWASP Global AppSec talk in Lisbon, the first public demo of The Cyber Boardroom, slide by slide, with what two years of agents have confirmed and changed](portugal-2024-genai-in-portuguese.md) My 2024 OWASP talk in Lisbon: Portuguese as a programming language, provenance, graphs instead of RAG, and the first public demo of The Cyber Boardroom. - [Hacking Portugal, 2016: my BSidesLisbon keynote and the book that stopped at 95%, slide by slide, with what holds ten years later and what a new edition needs](portugal-2016-hacking-portugal.md) Hacking Portugal, my 2016 BSidesLisbon keynote and the book at 95%: a Hacking Service, OpenSource.pt, a Ministry of Code, and what holds ten years on. - [Books from articles: why my books stall at 95%, why these articles do not, and a plan to turn them into books by Web Summit](books-from-articles.md) My books stall at 60 to 95%; these articles do not. The hypothesis: a book is an ordered set of finished articles, tested by Web Summit in November. [All articles](index.md) · [All graphs](graphs.md) Article No. 152 · [start a reading list with it](https://newsroom.sgit.ai/for/make.html#r=152) **Posting this article on LinkedIn?** The cover is [portugal-and-europe-2025.jpg](banners/portugal-and-europe-2025.jpg) (1920×1080, title and key ideas on it). Upload it as the article cover, paste the title, then select and copy the body from this page. **Want the next issue by email.** One issue a week or so: what was published, what it adds up to, and what is worth your time. [Subscribe to the SGit Newsroom →](../subscribe/index.md) [← All articles](index.md) --- *[Site index for agents](../llms.txt) · [HTML version](https://newsroom.sgit.ai/articles/portugal-and-europe-2025.html)*