Mikko Malmgren: From Pilots to Scale: Building a Market for Open Digital Solutions in the Public Sector

By: Mikko Malmgren, Director, EU Affairs, DigiFinland

Transcript

1. From Pilots to Scale: Building a Market for Open Digital Solutions in the Public Sector Mindtrek 2026
2. Mikko Malmgren Director, EU Affairs DigiFinland We connect regions’ practical needs with EU policy, funding and implementation. 1 EU policy engagement Bringing regions’ shared priorities into EU legislation, work programmes and funding frameworks. 2 EU funding Identifying needs-based funding opportunities and coordinating applications and European consortia. 3 Regional and stakeholder cooperation Strengthening cooperation between wellbeing services counties, Helsinki, HUS, national government and European partners.
3. Europe does not lack pilots. It lacks pathways to scale. The question is what happens after the project ends. 3
4. Sovereignty is not Isolation. It is the ability to choose. Cloud, AI and procurement are becoming strategic policy instruments. 4
5. Open source can be infrastructure …for interoperability and for markets. Open standards + reusable components lower barriers to entry and reduce lock-in. 5
6. Open source does not remove the market. It can create a larger market around the technology. Implementation • integration • security • operations • services • innovation 6
7. Procurement + standards + funding …can shape the markets. Public organisations are not only customers — they can create the conditions for scale. 7
8. Cloud & AI Development Act (CADA) at a Glance What is the European Commission proposing, and what does it mean for the Wellbeing Services Counties?
9. Four Assurance Levels Determine from Whom a Service Can Be Procured European Commission proposal, June 2026 Level 1 Basic Level Data processing takes place within the EU. Covers the majority of public-sector cloud services. . Level 2 Significan Sovereignity Third-country ownership is permitted, but operations, infrastructure, personnel, and support must be located within the EU. Requires a significant level of cybersecurity certification. Customer data may not be used for third-country AI training. Level 3 High Sovereignity Third-country control is generally prohibited. Exceptions may be granted by the European Commission but are rare. Level 4 Maximum Autonomy Third-country control is completely prohibited. The strictest requirements apply to ownership, supply chains, personnel, and auditing. According to the Commission, Levels 3 and 4 will apply only to the most sensitive healthcare-sector services, but the final determination will be made through a Member State risk assessment.
10. What Will CADA Trigger in Practice for Public Healthcare Regions? European Commission proposal, June 2026 1 2 3 4 5 National Risk Assessment Service Portfolio Classification Transition Period (12 Months) Procurement Criteria Continuous Monitoring Within 12 months of the regulation’s entry into force, each Member State must determine the assurance levels to which different publicsector functions belong. . Regions must identify which of their cloud and AI services fall under Levels 2–4 and assess whether current providers meet the required criteria. . If the assigned level requires a change of provider, migration to a compliant cloud service must be completed within a maximum of 12 months. The evaluation of innovative cloud and AI procurements must apply criteria related to European added value that are independent of price. The risk assessment must be renewed every two years. In addition, reporting obligations apply.
11. Let’s do itse together. Tehdään yhdessä. www.digifinland.fi @DigiFinlandOy DigiFinland Oy