Good morning. The big one this week came out of Oslo, where Goldman Sachs Alternatives just bought a majority stake in Ryde, a profitable e-scooter operator that booked 30.4 million euros of EBITDA last year and handed its early backer a roughly 20x return. Read that twice, because profitable micromobility exits were supposed to be a contradiction in terms. The capital story didn't stop there. Copenhagen's byFounders closed an oversubscribed 130 million-euro fund for the New Nordics, a real signal that LP money is thawing for managers who can show winners. Two Nordic startups, Cloudgeni in Oslo and Gridly in Helsingborg, raised to pour agentic AI into deeply unglamorous problems, cloud operations and game localization. In Helsinki, payments firm Enfuce recruited MySQL and HackerOne veteran Mårten Mickos as board chair, while Stockholm-listed Done.ai opened its AI-native CRM to everyone. And a quiet regulatory shift in Finland switched on the Cyber Resilience Act, which will reshape the economics of every connected device sold into Europe. Let's get into it.

Oslo's Cloudgeni raised 858,000 euros, around a million dollars, to expand its agentic platform that secures, monitors, and fixes cloud infrastructure in production. The bet is that enterprises will let AI agents actually touch their cloud setup, not just flag problems for an exhausted engineer to handle later. The cap table mixes institutional muscle, Antler and StartupLab among them, with operator angels who've built and sold companies. Small round, sharp thesis.

Two things stand out about both rounds. They're small by frontier-AI standards, and they're aimed at problems nobody puts on a conference keynote. That's the Nordic pattern playing out again: pick a deeply technical, deeply boring pain, build with capital discipline, and sell reliability to people who'll pay for it. We've watched it before, from Aiven's co-founder rebuilding CI/CD for AI code to Finnish multiphysics simulation aimed at the AI hardware bottleneck. The flashy companies train the models. These ones make sure the models can actually run.

Over in Helsingborg, content-ops platform Gridly pulled 1.3 million euros to weave agentic AI into the way game studios manage and localize their content. The headline isn't the size. It's that Jörgen Larsson, founder and former CEO of listed gaming group Stillfront, joined as investor and board nominee. Gaming royalty backing a company that sells into game studios. That's the kind of signal that's worth more than the check.

The week's marquee deal. Ryde, the Norwegian e-scooter and e-bike operator, agreed to sell a majority stake to a new fund managed by Equip Capital and led by Goldman Sachs Alternatives. The numbers are the story: 75.5 million euros of revenue in 2025, 30.4 million euros of EBITDA, and EBIT that climbed from 3.4 million to 17.3 million euros in two years. Equip's original fund, an owner since 2021, rolls forward alongside the founders rather than fully cashing out. In a sector that became shorthand for value destruction, Ryde built a profitable machine and just proved early backers can actually get out with a strong return.

Why does one scooter deal matter beyond Oslo? Because clean exits in micromobility have been almost nonexistent, and a profitable one resets how institutional money sees the entire category. Goldman Sachs Alternatives doesn't lead growth deals for sentiment. Its involvement signals that the profitable corner of micromobility is now an investable asset class rather than a cautionary tale. For every founder still grinding in the sector, that repricing of perception is worth nearly as much as the capital itself.

Stockholm-listed Done.ai opened Done CRM to all customers, the first native application inside Done OS, its AI-powered operating system for small and medium businesses. The pitch is a system of action, not a system of record: because the CRM lives on the same platform as the ERP data, it can read invoice history and payment behavior to trigger upsell signals and churn alerts on its own. The CRM is really a proof point. The strategy is the operating system underneath it, and the second app is the one to watch.

There's a useful tell in how Done.ai shipped this. It rolled out from a waitlist rather than a splashy open launch, onboarding customers gradually to protect product quality. That's the right instinct for the SME buyer, who has no IT department, little patience for migrations, and a deep suspicion of any vendor promising to replace the five tools they already grudgingly tolerate. Win that customer with smooth onboarding or lose them to the spreadsheet they came from.

Finland switched on the Cyber Resilience Act. On May 28 the government proposed national provisions supplementing the EU's product-security rulebook, with the legislation taking effect June 1 and transitional periods running through 2027. If you ship anything with a chip and a network connection into Europe, security across the product's whole lifecycle is now your legal responsibility. That's a real cost for device makers who treated security as an afterthought, and a demand engine for the Nordic compliance startups already building tooling to make it painless. Regulation reshapes industries quietly, then all at once.

There's a reason Finland moves first on this kind of rule. The country built a national identity around digital trust, from its widely used electronic ID to a public sector that digitized early, sharpened by a long border with Russia and a hard-earned appreciation for resilience. Early, serious adoption creates a domestic market for compliance expertise before demand spikes elsewhere. Watch the Nordic regtech startups that learn to make CRA compliance automatic and auditable. Their addressable market grows with every EU member state that follows Finland's lead.

Helsinki payments firm Enfuce named Mårten Mickos as Board Chairman of its regulated card-issuing entity. Mickos ran MySQL until Sun acquired it for a billion dollars, then scaled HackerOne into an enterprise security norm. In card infrastructure, where customers bet their whole programs on the stability of what sits beneath them, a board chair of that calibre isn't decoration. It's a credibility stamp aimed squarely at the banks and fintechs doing the deepest diligence. The move follows Denise Johansson taking over as sole CEO in March, and it reads like a company setting up for a bigger chapter.

Copenhagen's byFounders closed an oversubscribed Fund III at more than 130 million euros for the New Nordics, the founder community spanning the Nordic and Baltic countries. In a fundraising market where plenty of firms quietly extended their timelines, blowing past target means LPs see something. In byFounders' case, that's a portfolio with real breakouts, Corti, Lovable, and Normative among them, plus a community-powered sourcing model that's harder to copy than it looks. Capital is flowing back to the early stage, but only for the managers who earned the right to ask.

Put the byFounders close next to the rest of the spring. David Helgason's 128 million-euro Transition Ventures Fund II and the 5 billion-euro Scaleup Europe mandate handed to EQT tell the same story from different altitudes. After a couple of cautious years, serious money is flowing back into the European startup stack, and the Nordics are taking a real slice of it. Early-stage capital is the leading indicator for everything downstream, which makes a well-funded seed ecosystem today the exit pipeline of the early 2030s.

Three things on our radar for the week ahead. First, Germany. Ryde's expansion into ten German cities is the real test of whether Nordic micromobility discipline travels into a bigger, nastier market. If it holds, expect more nine-figure scooter deals to follow. Second, the second Done OS app. A single AI-native CRM doesn't prove an operating-system thesis. The moment two native apps start sharing one intelligent layer is when Done.ai's bet either delivers or deflates. Third, how Finland's regulators actually enforce the CRA. The transitional period through 2027 is where the calibration happens between catching negligent device makers and crushing small vendors and open-source maintainers. Watch the edges.

That's your Monday briefing. Forward it to a founder who needs it, and we'll see you Wednesday.