EU have to go on the technical ground and force interop with small, but able to do a good enough job, stable in time, protocols and file formats.

A good compromise: subsets of protocols and file formats. For instance, for the web, noscript/basic HTML interop to break their whatwg cartel (nearly all web services were provided with basic HTML forms only a few years back). Another example, a curated subset of PDF (of course excluding the brain damaged abomination which is 'forms with javascript in PDF'). That way you retain interop with absolutely everbody while keeping the door open for real-life and small alternatives. A warning though: expect Big Tech to try everything to break it, don't forget they are serial offenders and you don't know how deep the rabbit hole goes (shadow-paid hackers? very $$$ oriented lobbying?).

This means you can access and interop with real-life alternative small web engines (past, present and future). It means you can render in a good enough fashion a PDF file (the only improvement PDF does require is full replacement for a near iso-functional file format, but fully cleaned up and rationalized based on PDF experience and simplified from a parsing point of view).

A note for the web, some trash human beings will try to scare EU with 'security' and lure them into the software they control (usually the whatwg cartel). 'security' of an online service is where 99.9% of the work happens: it requires a permanent team of people who can be trusted (hard) close to network operators/data centers/authorities which monitors and hunts. That cannot be 'small' in any capacity, and the following must be presumed: they will fail more than once and more often than you think: this is only a best effort because 'information system security' is a fantasy and does not exist.

Ofc source, super simple file formats must be supported: for instance the ubiquitous utf8 text file or the PNG image (with probably only a subset of pixel formats).

And for AI, we could have a 'curl' web API with public tokens (probably severely rate limited), or with a private token registration process, but which can be done with 'physical mail' (yep, you read it well)', or noscript/basic HTML browsers with optionally combined with a self-hosted email server not paying for DNS (email address with IP literals, which gmail.com is careful at not supporting it even though it is stronger than SPF.....), aka small tech. Since we have IPv6 almost everywhere in my EU country, you could get a private token tied to one and only one IPv6 address (aka the real symmetric internet).