Digital Summit 2026 and Germany's AI Roadmap: World Champion in Risk Management

Germany is the most innovative country on earth. When it comes to risk management.

I say that without malice, I am exactly like this myself. Show me a form and I will fill it in before I read what it is for. And I have spent the last two weeks reading the programme of the Digital Summit that runs today and tomorrow in the Wilhelm Hallen in Berlin-Reinickendorf. Twentieth edition; the first one was held in Potsdam in 2006 and was still called the IT Summit. This year's motto: "Shaping AI: safe, sovereign, competitive". The order is the message. Safe comes first, competitive last, and in between sits a word we have used so often over the past three years that it is slowly losing its meaning.

The roadmap

This afternoon the government presents its AI roadmap, the final report of the AI task force the digital ministry set up in June. Before that it passes through the National Security Council. Eighteen cross-ministry measures. Germany is to become a "sovereign AI nation" by 2030. Eighty percent of large companies and 55 percent of SMEs are to use AI, 90 percent of federal agencies are to run at least one application in production, AI compute capacity is to grow 300 percent over 2025. Add an AI safety institute, a national AI supervisory authority whose draft law has been on the table since February, and the wish to make the EU AI Act "simpler", right after the Digital Omnibus pushed its deadlines further out.

I have nothing against any single one of these measures. I have something against the sum. We are building the safety institute, the supervisor, the security council and the target picture before we have a single product any of it could refer to. It is like ordering the fire code, the house rules and the insurance broker for a house, and then wondering whether you might need a plot of land.

The bill arrived in late September

WIPO's Global Innovation Index came out on 29 September. Germany ranks 11th, out of the top ten for the second year running; in 2022 we were still eighth. Look at the sub-indicators and the whole country is written on one page. Rank 3 in human capital and research. Rank 5 in the share of engineering graduates. And then: rank 60 in the use of digital information technologies, three places worse than last year. Rank 36 in culture and policies supporting entrepreneurship. Rank 94 in inbound foreign direct investment.

We know everything. We use nothing. That is risk management in its purest form, and nobody does it like us. Eva Schewior, president of the German Patent Office, put it diplomatically: we need to get better at turning research results "into attractive products and business models, especially in applying digital technologies". The patent office. The people who make a living administering ideas are telling us we administer too much.

Merz asks Jensen

The scene I cannot shake off for two weeks now: the Chancellor asks Jensen Huang which rules the EU should set for AI. I have treated Nvidia generously in the last two columns and I stand by it: the Industrial AI Cloud in Munich and Blackwell capacity for the Mittelstand are the right call. But you do not ask the chip salesman how to regulate his own market. You would not even do that at a car dealership.

And the chip salesman has just had an interesting month himself. Nvidia closed Friday at 204 dollars, around 15 percent below its yearly high, after October shook the whole sector. The numbers themselves are absurdly good, revenue doubled last quarter. What the market is questioning is the financing behind it. SpaceX borrows 40 billion dollars through an Apollo-managed vehicle to buy Nvidia hardware. The chips are leased, the debt is securitised, the data centres get built before anyone knows who pays for them. Meanwhile Washington closes export loopholes to China, Beijing answers on 16 October with a draft of its own export controls on language models, chip designs at 14 nanometres and below, and compute clusters. In the middle sits Europe, which builds the industry's most important machine at ASML and, in the words of its own management, sells "essentially nothing in Europe".

That is the partner we buy capacity from and label sovereignty. Bought chips are capacity, not sovereignty. I wrote that last week and October only underlined it: capacity from a supplier whose share price hangs on a financing question is a concentration risk. And in a country that has an institute for every risk, this one appears in no roadmap.

The risk that comes with an invoice

There is one dependency that comes with three numbers. 274 million euros, 347 million euros, 481 million euros. That is what the federal government spent on Microsoft licences in each of the last three years, according to its own answer to a parliamentary question. Plus 38 percent in a single year, further price increases announced for 2026. A European Parliament study puts the money flowing from the EU to US tech companies at around 264 billion euros a year. Markus Beckedahl said the sentence on ZDF today that sums up the whole summit: "There is always a pragmatic reason to stay with the Big Tech monopolists after all."

A country that was actually good at risk management would have those three numbers at the top of every summit agenda. A single supplier, double-digit price increases, access by a foreign government confirmed under oath. Instead we debate whether the Deutschland-Stack should make open source mandatory or merely recommend it. The Open Source Business Alliance calls the current draft "fragments" with "too many loopholes for closed-source offerings". Second consultation round. Maturity model postponed. Risk management.

Kiel never found the pragmatic reason

And then there is Kiel. The state chancellery of Schleswig-Holstein has been running on Linux since September. More than 200 desks, around 20 still pending because of specialist applications, the ministries follow step by step, support comes from Dataport and Gonicus. The year before they had replaced Office with LibreOffice, Exchange with Open-Xchange, 44,000 mailboxes, video calls on OpenTalk. Nextcloud is coming, Active Directory is going. The state saves around 15 million euros in licence costs in 2026 alone. Dirk Schrödter, the minister who pushed it through, calls the goal a "future-proof, stable, secure and above all digitally sovereign working environment". No summit, no roadmap, no security council. A state that at some point simply stopped asking.

I have spent a lot of time on a Linux machine myself lately, with zero ideology, because CachyOS is simply faster on my hardware than anything I had before. And something struck me that never comes up in the sovereignty debate: every single Nvidia machine we are buying for the Mittelstand runs on Linux. DGX, the Industrial AI Cloud, every supercomputer in the Top500. The entire AI wave we are discussing in Reinickendorf today runs on open source. The only thing in Germany still paying for an operating system is the public sector. We already have the sovereignty, it sits in every rack. We just put half a billion euros of Office licences on top.

Why I still do not buy the "left behind" narrative

Because the numbers say something else the moment someone builds instead of administers. In the third quarter, 5 billion dollars of venture capital flowed into Germany, the strongest quarter since 2021, second in Europe behind the UK and ahead of France. Helsing 1.8 billion, Quantum Systems 1.2 billion, Proxima Fusion, The Exploration Company. In fintech, KPMG puts Germany at 1.6 billion dollars for the first half, again second in EMEA and the only large market bucking a region that fell 37 percent. And in the FT ranking of Europe's leading start-up hubs, UnternehmerTUM from Munich is number one for the third year running, followed by Start2 and BayStartUP, all three from Bavaria. Plus more hidden champions than any other country on earth.

So the money does come. It comes to people who build drones, fusion reactors, space capsules. It comes to a state that installs Linux instead of launching a third consultation round. It does not come to roadmaps.

That is why Germany is not left behind for me; I wrote that two weeks ago and I stand by it. We are the country with the third-best knowledge in the world and the sixtieth-best nerve to apply it. Kiel and the roadmap want exactly the same thing. The difference is the moment you stop asking the chip salesman for the rules and simply switch the machine on.