Summary: In mid-February 2026, the European Parliament’s IT department disabled built-in AI features on official devices issued to lawmakers and staff. The decision was not tied to a specific incident; the reported rationale was that uploads to AI companies’ servers could not be guaranteed secure and the sharing scope was still being assessed. The step targeted default built-in features, not every AI service.
The middle of February 2026 brought a leaked internal email and, inside it, a quiet disclosure: the European Parliament’s IT department had turned off the baked-in AI features that come preloaded on the official work devices issued to lawmakers and their staff. Politico obtained the message; TechCrunch filed a follow-up. No specific incident drove the decision — the driver was a structural judgment. The parliament cannot guarantee the security of data uploaded to AI companies’ servers, the extent of what gets shared is “still being assessed,” and “it is considered safer to keep such features disabled.”
The category swept up here is mainstream cloud chatbots, with Anthropic’s Claude, Microsoft’s Copilot, and OpenAI’s ChatGPT all named as examples. Sit with the irony for a moment: the legislature that regulates AI more aggressively than any other on the planet just barred AI from the devices it hands its own members. And this is no publicity posture — it is an IT department casting a technical veto over data flows and legal jurisdiction.
How It Unfolded
Read Politico’s story alongside TechCrunch’s write-up and the facts reduce to a short list:
- Built-in AI features were switched off across the work devices the parliament issues
- The decision moved through an internal email, which Politico obtained
- The official rationale: no guarantee of security for data uploaded to AI companies’ servers, with the scope of sharing “still being assessed”
- The email’s bottom line: “It is considered safer to keep such features disabled”
The scope deserves a close look. Nothing here amounts to a blanket ban on AI services; the target is AI functionality that ships switched on and woven deep into the device. The threat model is a story about defaults — confidential correspondence drifting into the cloud without explicit, informed consent from the user.
The Case for Blocking: Data Egress and US Legal Reach
TechCrunch lays out the structural risk on two levels. The first is training-data leakage: AI chatbots habitually feed user inputs into model improvement, which means the sensitive material one person types can resurface to somebody else through the model’s outputs. The second is the harder constraint of law: once confidential correspondence sits with an American company’s cloud chatbot, US authorities hold legal instruments capable of compelling those companies to hand over user information.
That second level is worth pulling apart. GDPR’s cross-border transfer framework polices levels of privacy protection; this is a question of foreign subpoena power, which is a different animal. For a legislature, member correspondence, lobbying records, and draft legislation sitting within reach of US legal process represents a risk that no fine can price. Vendor-side product defenses don’t answer it either — OpenAI has only just shipped Lockdown Mode and Elevated Risk labels for ChatGPT, built to counter prompt injection and account compromise. A subpoena, though, is not an injection attack, and no degree of model hardening stops a court order.
The Wider Backdrop: Europe’s Eroding Trust in US Tech
The decision did not appear in a vacuum. TechCrunch frames it against three threads. First, the 27-member bloc claims the world’s strongest data protection rules, yet the European Commission spent last year floating proposals to relax them for AI training — drawing criticism as a capitulation to US tech giants. Second, several EU countries are re-examining how much they depend on US tech firms, weighed down by exposure to US law and by the unpredictability of the current administration’s demands. Third, the US Department of Homeland Security recently issued hundreds of subpoenas seeking data on critics of government policy; Google, Meta, and Reddit complied in several of those cases, even though the subpoenas were neither judge-issued nor court-enforced.
Lay the three threads side by side and the parliament’s choice almost writes itself: the moment “will American companies hand over data” stops being hypothetical and becomes case-documented, the conservative move is to cut the data path off at its source.
Takeaways for Enterprises and Developers
Three conclusions drop straight out of this story. First, how you set defaults is itself policy. The parliament isn’t blocking AI; it is blocking product design that ships confidential data to the cloud by default, and anything sold into regulated industries needs data flow as an explicit choice rather than an opt-out. Second, jurisdiction now belongs in the procurement spec. EU data on US suppliers equals US legal reach — count on that sentence appearing verbatim in enterprise procurement checklists from 2026 onward, and count on sovereign-AI vendors and on-premise deployments to keep converting headlines like this one into pipeline. Third, keep the security narrative aimed at the right threat model. Injection defenses, risk labels, and lockdown modes all merit building — they answer the “attacker” question. What the parliament signaled this week is a trust question about the vendor itself, and a sales deck that blurs the two will get caught by exactly the buyers who now care.