Freedom in the Digital: Notes From Day Two in Berlin

What a German law and informatics conference says to people who build AI systems rather than argue about them.

🏛️ The question on the programme

This week in Berlin, a society that has spent fifty years on the law of digitalisation put a single question on a stage: how free are we in an increasingly digitised world?

Three days, four topic blocks, and today covered three of them. Judges, academics, regulators and practising lawyers in the same room, which is rarer than it should be. The welcome evening was hosted by Microsoft Deutschland, and the theme of that evening set up everything that followed.

We came expecting a legal conference. What we got was an engineering conference with better suits. 👔

🧭 Digital freedom is not a default state

The comfortable assumption is that digital freedom is what you get when nobody interferes. Remove the rules and freedom appears.

That is not how it has worked.

Digital freedom is a construction. It stands on three things, and it needs all three at once:

• 1. Sovereignty. Not being dependent, technologically or legally.
• 2. Reliable rules. Clear enough to plan against.
• 3. Real trust. Demonstrated, not declared.

Remove any one and the other two stop working. Most public debate argues for one at the expense of another, which is why most public debate goes nowhere.

🧩 Sovereignty without rules produces fragmentation. Every country building its own stack, nothing interoperating, a smaller market for everyone.

📋 Rules without sovereignty produce compliance theatre. You can write the best AI governance framework in Europe and still have no control over the infrastructure it runs on.

🤝 Either one without trust produces a system nobody uses. Adoption is where governance either proves itself or is revealed as paperwork.

🕵️ Morning: where the anonymity argument stopped being philosophical

The block on anonymity was built as a genuine disagreement, in three parts. The case for a real name obligation. The case for a right to anonymity. And then the one that changed the conversation: what implementing either actually takes.

Most public debate stops after the first two. The third is where the problem lives.

📄 To require a real name, a platform must verify a real name. To verify it, it collects identity documents, or relies on someone who already did. Either way, a database now exists that did not exist before, holding the strongest possible link between an account and a physical person.

That database has a retention period, a breach obligation, a lawful basis that has to hold, and an access request process. It is also a target.

So the honest framing is not anonymity against accountability. It is a trade between two risks. Harm done by people acting badly behind anonymity. And harm done when a comprehensive identity register exists and is compromised, or accessed under a legal order nobody anticipated. Neither is zero.

😬 And there is an uncomfortable asymmetry. Anonymity shelters harassment. It also shelters the person reporting corporate wrongdoing, and the person whose opinion is a criminal offence where they live. A mechanism built to remove the first group's shelter removes the second group's at the same time, because it cannot tell them apart.

That is not an argument against regulation. It is an argument that the mechanism matters more than the intent, and the mechanism is an engineering decision.

⚖️ Afternoon: regulation is not the opposite of innovation

The AI block covered the current state of play on the AI Act and its omnibus revisions, then turned to AI agents specifically. First a technical view, then a legal classification.

🤖 The legal classification is where it got interesting, because the honest finding was that it is unsettled.

If an agent takes an action, who acted? The operator who deployed it. The developer who built it. The user who triggered it. Or nobody in particular, which is what most current contracts quietly imply by failing to address it.

That is not an academic question. Anyone who has given an agent write access to a system of record is already living inside it.

💶 And the familiar argument surfaced, so here is the counter-position plainly.

There is a reflex in parts of the technology industry that treats every regulation as a brake. Sometimes it is. Rules written without understanding the technology, rules requiring evidence nobody can produce, rules that change every eighteen months, all of those do real damage.

But the reflex gets the causation backwards. What stalls investment is not regulation. It is regulatory uncertainty.

A clear rule, even a demanding one, lets a board approve a three year budget because the exposure can be described. An unclear rule means nobody signs, because nobody can price the risk. Different problems, opposite solutions.

🎯 The agentic case makes this concrete. An agent acting on a system of record needs an identity, a bounded permission, an approval point and an audit trail. Each of those is simultaneously a legal requirement and an engineering requirement.

At that point regulation is not fighting the architecture. It is describing it.

☁️ Late afternoon: the question behind the cloud question

The day closed with the session the room had been circling since breakfast. It asked, more or less directly: are we actually sovereign?

The European cloud debate is usually conducted as a question about location. Where does the data physically sit. It is a comfortable question because it has a checkable answer.

It is also mostly the wrong one.

🗺️ A data centre inside the European Union, operated by an entity subject to a non-European legal order, is a geography answer to a jurisdiction question. The bytes are in Frankfurt. The company holding the keys may be answerable somewhere else.

The mechanism people have in mind here is usually the US CLOUD Act, which since 2018 has allowed US authorities to compel US-based providers to produce data in their possession, custody or control, regardless of where that data is stored. There are procedural safeguards and there are routes to challenge. None of that changes the structural point: location and jurisdiction are different variables, and only one of them appears on most architecture diagrams.

🔑 The sharper question has three parts:

• Who holds the keys, and can they be compelled to use them?
• If we want to leave, what do we actually take with us, and how long does it take?
• Can the terms change underneath us, and what is our position if they do?

Read that way, sovereignty is not a flag on a map. It is revocability, portability and the absence of a single point of compulsion.

⚖️ On digital assurances. Providers increasingly offer sovereignty commitments. Access, jurisdiction, what will and will not be disclosed. These are worth something. They are contractual, they create obligations, and breaching them has consequences.

They are also not the same thing as an architecture in which the access does not exist to be compelled. A commitment not to do something is a different class of protection from an inability to do it. Both are legitimate choices. They should be priced differently, and usually are not.

🌍 None of this is an argument about countries. We build on AWS, on Azure and on Google Cloud, and we will continue to. It is an argument about control.

🧩 The thing that connected all three

By this evening it was clear these were not three topics.

In each one, the legal principle was reasonably well understood, and the difficulty sat entirely in what you have to build to make the principle real.

A right that cannot be enforced without constructing the exact infrastructure that endangers it is not a right. It is an aspiration with a compliance budget.

Values survive or die in the implementation layer. That is today's actual thesis, and it is an engineering thesis, not a legal one.

🏗️ What a builder should take from this

Four things, as questions to ask of your own estate rather than conclusions to agree with.

1. Where do your credentials and session records physically live, under which legal order, and who can compel access? If the answer is a provider assurance rather than an architectural fact, at least know which one you bought.
2. Can you leave? Describe the exit in one page. If you cannot, you do not have an exit. You have a hope. 📄
3. Does your AI agent have its own identity and a bounded, time-limited permission, or is it running on credentials a human was issued?
4. If a regulator asked tomorrow what your system did last Tuesday and why, could you answer from records you control? 🗄️

None of these needs a legal opinion. All of them are answerable this week.

🎯 Where we stand

We build and operate agentic AI systems for European organisations, across German and Indian teams. The questions on this programme are the questions our clients raise in the first meeting, usually in a less precise form.

Our position has not changed and today reinforced it: for a growing share of enterprise workloads, model capability is no longer the binding constraint. Governance, unit economics and ownership are.

An agent that can read is a demonstration. An agent that can write needs an identity, a bounded permission, an approval point and an audit trail. Sovereignty, rules and trust are not abstractions in that sentence. They are the things you have to build.

⚖️ What we will not claim

We are not lawyers and nothing here is legal advice. These are our notes on a public conference programme, written for people who build systems rather than people who litigate about them. We are summarising arguments made by others, in our own words, and any clumsiness in the summary is ours.

We also will not claim that governed systems are cheap. They are slower to start and they cost more at the beginning. What they buy is the ability to widen a system's authority later without renegotiating trust from zero, which is where ungoverned pilots usually die.

And on agent liability specifically, the position is genuinely unsettled. The room said so. Anyone telling you it is solved is selling something.

🗣️ Tomorrow the programme turns to platform regulation and freedom of expression. More then.