Geopolitics and Model Origin

Chapter 5 asked whether an organisation is ready to commit to AI; this chapter, which opens Part II, asks whose AI it will commit to. Most capable models available to a European organisation in 2026 were developed in the United States or China, and the law, politics, and trade policy of those countries travel with the model into the European estate. The chapter applies one set of criteria to every origin, distinguishes a foreign provider's hosted service from a foreign open-weight model run on European infrastructure, and ends with a risk-tiered position, expressed as code, that avoids both the blanket ban and the blanket trust. Because the facts move quickly, every figure carries its month and year, and legal statements are architectural implications, not legal advice.

Layers of dependency between an enterprise AI system and its service, model and platform, with risk categories attached to the layers in the table below

Figure 6.1: Three layers of dependency sit behind an enterprise AI system. The table below shows where each risk category attaches.

Risk category Where it attaches
Legal access to data and prompts Hosted model service
Service continuity and sanctions Hosted service; accelerators under export controls
Model behaviour Model weights and training
Supply-chain integrity Model weights and training
Regulatory compliance The enterprise AI system as a whole

Table for Figure 6.1: Risk categories and the layers where they arise.

Why model origin is a separate question

Sovereignty is usually discussed as a property of infrastructure: where data is processed, who operates the platform, and who holds the keys. Those properties remain necessary, but they do not settle three questions specific to models. Who can be compelled to hand over prompts and outputs? Who can withdraw the service or the next model version? And what was the model trained to say, refuse, or omit, by whose rules?

The dependency is concentrated. The European Commission's proposal for a Cloud and AI Development Act, published in June 2026, records that the market share of EU cloud providers fell from 29% in 2017 to 15% in 2022 and that "three non-EU hyperscalers control over 70%" of the European market (111, European Commission, 2026). The Dutch General Intelligence and Security Service warned in April 2026 that technology can be a geopolitical lever and that smaller countries must recognise their strategic dependencies (168, AIVD, 2026).

Architecture as Code (Chapter 25) treats European digital sovereignty as a trend (66, Nordqvist, 2025); for AI it has become a design constraint. However, the answer is not a list of approved countries, because the same model carries different risks depending on how it is consumed. A hosted service sends every prompt to a provider subject to its home country's law. An open-weight model run on European infrastructure sends nothing back to its developer but brings whatever its training gave it. A European provider removes much of the legal exposure but may depend on non-European hardware, investors, and base models.

Five categories of geopolitical risk

Each category applies to American and Chinese providers by the same criteria, although the evidence is uneven; where it is thin, the chapter says so rather than speculating about intentions.

For a provider subject to US jurisdiction, the CLOUD Act, codified at 18 U.S.C. § 2713, requires disclosure of records "within such provider's possession, custody, or control, regardless of whether such communication, record, or other information is located within or outside of the United States" (134, US Congress, 2018). The test is control, not location. Section 702 of the Foreign Intelligence Surveillance Act is the second instrument: according to the Brennan Center, the statutory authority expired on 12 June 2026, but the certifications approved on 17 March 2026 are "locking in surveillance authority until March 17, 2027" (135, Brennan Center, 2026), a reading by an advocate of reform rather than settled law. Reform language proposed in the House in April 2026 was presented by the committee chairman as enhancing privacy protections for Americans, with no protections for non-US persons mentioned (136, HPSCI, 2026).

The EU–US Data Privacy Framework survived Latombe's challenge in the General Court on 3 September 2025, which held the Data Protection Review Court sufficiently independent (140, CJEU, 2025), but an appeal, Case C-703/25 P, is pending (139, CJEU, 2025), and the Privacy and Civil Liberties Oversight Board stated in February 2026 that it "has one Member and is operating in sub-quorum status" (138, PCLOB, 2026). Because the Schrems II judgment invalidated the previous framework on similar grounds (20, CJEU, 2020), keep a fallback transfer mechanism and a current transfer impact assessment ready. Under oath before a French Senate inquiry in June 2025, Microsoft France could not guarantee that French citizens' data would never reach US authorities without French agreement: « Non, je ne peux pas le garantir » (141, French Senate, 2025). Microsoft's April 2026 progress report restates its commitment to challenge requests "where we have a lawful basis to do so" (137, Abu-Ltaif & Bullwinkel, 2026), which is a commitment to contest, not a guarantee of the outcome.

For a provider subject to Chinese jurisdiction, Article 7 of the National Intelligence Law of 2017 provides that "any organization or citizen shall support, assist and cooperate with the state intelligence work in accordance with the law" (157, NPC Standing Committee, 2017), in an unofficial translation whose enforceability commentators dispute. Article 36 of the Data Security Law of 2021 requires approval before data is provided to foreign judicial or law-enforcement bodies (156, China Briefing, 2021), so a European regulator's request may meet a conflicting obligation. The Italian Garante ordered an urgent limitation of DeepSeek's processing of Italian users' data on 30 January 2025, finding the companies' answer "entirely insufficient" (153, Garante, 2025), and the Berlin data protection commissioner reported the DeepSeek app to Apple and Google under the Digital Services Act in June 2025 (152, Kirchner, 2025). Neither is an EU-level decision, but both show regulators acting on the transfer question.

The symmetry matters more than the differences: in both cases the provider's home law can reach data in its control, and the customer cannot verify that it has not. The difference lies in the transfer instruments: an adequacy decision under challenge for the United States, none for China.

Service continuity, sanctions, and export controls

The reference case is the International Criminal Court. After the United States sanctioned its prosecutor in 2025, the prosecutor's email account was cut off; Microsoft maintains that "at no point did Microsoft cease or suspend its services to the ICC" (144, The Register, 2026), and the facts are disputed. Nevertheless, the ICC confirmed on 31 October 2025 that it is replacing Microsoft Office with openDesk from Germany's ZenDiS (145, Tridgell, 2025). The research for this chapter found no 2026 case of a US AI or cloud service withdrawn from European customers, so prepare for the risk without assuming it is imminent.

Export controls move quickly: in May 2025 the US Bureau of Industry and Security stopped enforcing the AI Diffusion Rule issued four months earlier (143, BIS, 2025), and in January 2026 it moved licence review for Nvidia H200-class chips to China to case-by-case review (142, BIS, 2026). Neither cuts off a European customer directly, but both affect the hardware every provider depends on. A hosted service can be suspended, re-priced, or changed by the provider or its government; a downloaded open-weight model cannot be withdrawn, but its successors and security fixes depend on the developer.

Model behaviour

China's Interim Measures for the Administration of Generative AI Services, in force since 15 August 2023, require providers in Article 4(1) to uphold core socialist values and not to generate content that endangers national security or damages the national image (155, CAC, 2023). The US Center for AI Standards and Innovation (CAISI) at NIST reported in September 2025 that DeepSeek models echoed inaccurate or misleading Chinese Communist Party narratives about four times as often as US reference models, and that agents built on DeepSeek R1-0528 were on average twelve times more likely to follow hijacking instructions, and that with a common jailbreak R1-0528 answered 94% of overtly malicious requests against 8% for the US reference models (151, NIST, 2025). Its evaluation of Kimi K2 Thinking found narrative alignment in about 26% of Chinese-language and about 7% of English-language responses, with minimal alignment in Spanish and Arabic (149, NIST, 2025); testing in English alone therefore does not test a deployment in twenty languages. A peer-reviewed study of February 2026 found higher refusal rates and more inaccurate answers from China-originating models on political questions, without establishing that regulation causes the behaviour (148, Pan & Xu, 2026), and France's ANSSI reported models with censorship built in from the design stage (169, ANSSI, 2026). On capability, CAISI placed DeepSeek V4 Pro about eight months behind the US frontier in May 2026 (147, NIST, 2026).

CAISI's work was, however, commissioned under America's AI Action Plan of July 2025, which aims explicitly at US technological dominance (159, White House, 2025), so treat its evaluations as credible and as produced by an interested party. US models are also shaped politically: the same plan recommends revising the NIST AI Risk Management Framework "to eliminate references to misinformation, Diversity, Equity, and Inclusion, and climate change" and to ensure that the government contracts only with developers whose systems are "free from top-down ideological bias" (159, White House, 2025), and OMB memorandum M-26-04 turned that demand into federal procurement terms (158, OMB, 2025). For both origins, then, a model's behaviour and usage policy are set in its provider's political and legal environment.

Supply-chain integrity

Open weights remove the data-access risk of a hosted service but raise the question of what is inside them. Hubinger and colleagues showed that a model trained to write exploitable code when a prompt states a particular year keeps that behaviour through safety training (154, Hubinger et al., 2024), and Souly and colleagues reported that 250 poisoned documents compromised models of every size they tested (150, Souly et al., 2025). Both are constructed demonstrations, not evidence of a backdoor in any released model; ANSSI nevertheless treats attacks on models as a possible new form of supply-chain attack (169, ANSSI, 2026).

Because testing cannot rule out a planted trigger, rely on provenance and containment: download weights from the developer's own channel and pin their hashes, prefer formats that cannot execute code, record the model in a CycloneDX ML-BOM (43, OWASP, n.d.), restrict tool permissions, and prefer models whose training data and recipes are documented, as the Open Source AI Definition asks (39, OSI, 2024). Hosted services raise the opposite question, whether the endpoint serves the model it claims to; a July 2026 preprint fingerprinted 165 served models with about 100 queries per audit and found one proprietary-branded endpoint indistinguishable from an open-weight model (146, Bruckner, 2026).

Regulatory compliance

For hosted services from either origin, establish whether personal data leaves the EEA and on which GDPR Chapter V mechanism (2, European Union, 2016). The AI Act adds role questions. Under Article 2(1) of Regulation (EU) 2024/1689 it applies to providers placing AI systems or general-purpose AI models on the Union market wherever they are established (1, European Union, 2024), and Articles 22 and 54 require third-country providers of high-risk AI systems and of general-purpose AI models respectively to appoint an authorised representative in the Union. A foreign general-purpose AI model reached as a service should therefore come with an identifiable representative and the Article 53 documentation on which, as Chapter 3 explained, your own obligations depend; open-source models benefit from exemptions in Articles 53(2) and 54(6) unless they present systemic risk; and an organisation that builds a self-hosted foreign model into a system under its own name is likely to be that system's provider, as Chapter 7 discusses.

DORA requires financial entities to put in place exit strategies for ICT services supporting critical or important functions (3, European Union, 2022). The proposed Cloud and AI Development Act would introduce four "Union assurance levels" for cloud services and make level 1 the minimum in public procurement (111, European Commission, 2026). In May 2026 the Dutch government prohibited Kyndryl's acquisition of Solvinity, the infrastructure supplier for DigiD, with the CLOUD Act playing an important role (165, Security Management, 2026).

Hosted service versus open weights on European infrastructure

Consuming a service or running weights is the most useful lever an architect has, because it moves risk between categories rather than eliminating it. Table 6.1 is a reasoning aid rather than a scoring scheme.

Risk category Foreign hosted service Foreign open weights on European infrastructure European provider, hosted
Legal access to data and prompts High: provider's home law reaches data in its control Low: no data reaches the developer Lower: depends on ownership and sub-processors
Service continuity Exposed to suspension, sanctions, terms changes Held version secure; roadmap not Exposed to provider failure and its own dependencies
Model behaviour Set by the provider and may change silently Fixed per version and testable Set by the provider; often built on open models
Supply-chain integrity Endpoint substitution possible Hidden triggers cannot be excluded by testing Depends on base model provenance
Regulatory compliance Transfer mechanism and Union representative needed Organisation may become the provider of the system Simplest transfer position; AI Act roles unchanged

Table 6.1: How the deployment mode moves geopolitical risk between categories.

Self-hosting open weights is thus a strong control against legal access risk and a weak one against behaviour and supply-chain risk, so pair it with evaluation and containment. A European provider is lower risk on the axis that third-country law creates; the other axes need the same scrutiny as for any supplier.

European alternatives in 2026

Mistral AI raised €3bn in September 2026, at a valuation reported at more than €21bn, led by Samsung, with investors including Nvidia and the Grand Duchy of Luxembourg (161, TechCrunch, 2026); it is the most substantial European model provider, yet its backers include Nvidia and other American investors, and it works with Microsoft. Aleph Alpha agreed in September 2026 to combine with Cohere, a Canadian company, subject to regulatory approval (160, Cohere & Aleph Alpha, 2026). Fully open models with documented training data are available: Apertus, released in September 2025 by EPFL, ETH Zurich, and the Swiss National Supercomputing Centre, covers more than 1,000 languages and publishes its weights, data, and recipes (164, EPFL, 2025), with Apertus 1.5 offering better support for tool use from July 2026 (163, EPFL, 2026); EuroLLM-22B, launched in December 2025, covers all 24 official EU languages (166, University of Edinburgh, 2025). OpenEuroLLM's first models, by contrast, are due only on 31 December 2026 (167, OpenEuroLLM, n.d.).

Compute is the weakest layer. The EuroHPC AI Factories provide computing resources for the development of large AI models (25, EuroHPC JU, n.d.), but no AI Gigafactory has yet been selected (162, EuroHPC JU, 2026); Gaia-X labels help verify the jurisdiction claims of European services (26, Gaia-X, n.d.). The US hyperscalers' sovereignty offerings, such as the AWS European Sovereign Cloud "operated exclusively by EU residents" (118, Amazon, 2026), reduce operational risk, but Recital 48 of the Commission's proposal states that they "do not address the core sovereignty issues" of extraterritorial law (111, European Commission, 2026). In short, European origin solves legal access for the layers it covers, and capability should be established by your own evaluation.

A risk-tiered position

Blanket bans push staff towards unmanaged consumer tools; blanket trust ignores evidence that is now specific and dated. The alternative varies with two things the organisation already classifies: the sensitivity of the data and the consequence of the use case.

Assessment flow from a request for a new model or provider, through jurisdiction mapping, risk scoring, and testing, to a policy decision with controls and review triggers

Figure 6.2: Every new model or provider passes the same assessment, whatever its origin; the origin policy then decides what it may serve and under which controls.

Practical guide: assessing a model's or provider's geopolitical risk

Purpose. Produce a dated, evidence-backed assessment of one model or provider across the five risk categories. Roles. The AI architect owns the record; legal counsel and the data protection officer assess legal access; the security architect runs the tests.

Steps.

  1. Record the deployment mode and map every party in the chain, with ultimate parent and jurisdiction.
  2. Score legal access and continuity from 1 (no third-country reach) to 4 (compelled disclosure without adequacy), citing the instrument for each score.
  3. Run at least 200 behaviour prompts in every deployment language against a reference model. Defaults: refusal rate no more than 5 percentage points above the reference, European context errors no more than 2 points above it, hijacking success below 5%.
  4. Verify provenance: pin weight hashes and require a non-executable format, or schedule a quarterly fingerprint check of a hosted endpoint.
  5. Record the GDPR transfer mechanism, the Union representative, and the organisation's likely AI Act role.
  6. Take the highest category score as the overall rating, not the average, store the record next to the system's AI Decision Record, and review it within twelve months or at the next trigger event.

The defaults suit a large organisation handling personal data without a national security function; adapt them to your risk appetite.

Definition of done. Every category has a score and evidence, tests ran in every deployment language, and legal and security reviewers approved the record.

Worked example: a model-origin assessment record

Illustrative example. Hansa Mutual's engineering department wants to self-host an open-weight coding model from a developer established in China, here called Example-Coder-32B, on its own cluster. Because nothing leaves Hansa's infrastructure, legal access scores low.

# assessments/GEO-2026-017.yaml - Hansa Mutual, illustrative example
assessment_id: GEO-2026-017
subject: {model: example-coder-32b, version: "2.1", licence: apache-2.0}
deployment_mode: self_hosted_weights
data_class_max: internal            # source code, no customer data
assessed: 2026-10-20
scores:
  legal_access: {score: 1, rationale: No prompts or telemetry leave Hansa; egress denied.}
  continuity: {score: 2, rationale: Held version runs indefinitely; fixes depend on the developer.}
  behaviour: {score: 3, rationale: "Political-topic refusals 11 points above reference in Chinese, not a deployment language."}
  supply_chain: {score: 3, rationale: "Safetensors, hash pinned; training data undocumented."}
  regulatory: {score: 2, rationale: Hansa likely provider of a minimal-risk internal system.}
overall: 3                          # maximum of the category scores
decision: approved_with_controls
controls: [egress_denied, no_tool_access, suggestions_reviewed_by_engineer, quarterly_behaviour_eval]
review_by: 2027-04-20

The developer's jurisdiction mattered less than how the model is run: a hosted service from the same developer would have scored 4 on legal access and been refused for anything beyond public data.

Practical guide: a model-origin policy by data classification and use case

Purpose. State, in a form the AI gateway and the intake pipeline of Chapter 9 can evaluate, which combinations of origin and deployment mode may serve which data classes. Roles. The chief architect owns the policy; the chief information security officer and the data protection officer approve it.

Steps.

  1. Reuse the existing data classification: public, internal, confidential, restricted.
  2. Define origins by legal position (Union or EEA, third countries with adequacy, others), so that a change in adequacy changes the outcome automatically.
  3. Default: hosted third-country services up to internal data with a transfer mechanism; confidential data only on European providers or self-hosted weights; restricted data only on self-hosted weights with egress denied.
  4. Tighten controls for decisions about people under Annex III and for agentic tool use, and have the gateway reject any route the policy does not permit.
  5. Review the policy at the earlier of six months or a trigger event, and record each review in the decision log.
# policies/model-origin-policy.yaml (evaluated by intake pipeline and AI gateway)
policy: model-origin
version: 1.0.0
owner: chief-architect
review_by: 2027-03-17
origins: {union: [EU, EEA], adequate: [third_country_with_adequacy], other: [third_country_without_adequacy]}
data_classes:
  internal:
    allow:
      - {origin: [union, adequate], mode: any}
      - {origin: other, mode: hosted_service, require: [transfer_mechanism, no_training_on_inputs]}
      - {origin: other, mode: self_hosted_weights, require: [provenance_verified]}
  confidential:
    allow:
      - {origin: union, mode: [eu_provider, self_hosted_weights]}
      - {origin: [adequate, other], mode: self_hosted_weights, require: [provenance_verified, egress_denied]}
  restricted:
    allow:
      - {origin: any, mode: self_hosted_weights, require: [egress_denied, documented_training_data, second_source]}
use_case_overlays:
  decisions_about_people: {require: [second_source, human_oversight, behaviour_eval_quarterly]}
  agentic_tool_use: {require: [hijacking_eval, least_privilege_tools]}
second_source: {different_jurisdiction: true, max_switch_days: {standard: 10, critical: 2}}

Definition of done. The policy parses and is versioned, the pipeline evaluates every new AI workload against it, and the gateway refuses a non-permitted route in a test.

Nordvik Region adopted such a policy in 2026 after finding eleven AI services in use, three of them without review, and publishes its approval matrix with its algorithm register.

Origin and hosting option Public and internal Confidential Restricted
EU provider, hosted in the EU Approved after assessment With DPIA and EU-only sub-processors Not approved
US provider, hosted or sovereignty offering in an EU region With transfer mechanism, no training on inputs Case by case, with customer-managed keys and second source Not approved
Third country without adequacy, hosted Public data only Not approved Not approved
Open weights, self-hosted With provenance check With evaluation in every language served and egress denied Only with documented training data, no tools, second source

Table 6.2: Nordvik Region's approval matrix by origin, hosting option, and data class (illustrative).

Its contracts also require suppliers to name every sub-processor, to report government data requests as far as their law permits and contest them where a lawful basis exists, and to give 180 days' notice before retiring a model version. The reporting clause is deliberately modest, because a supplier cannot promise what its home law forbids (137, Abu-Ltaif & Bullwinkel, 2026).

Practical guide: an exit and substitution plan that keeps a second source ready

Purpose. Ensure that any model can be replaced within a defined time by a second source from a different jurisdiction, so that a sanction or ruling is an operational event rather than a crisis. Roles. The product owner of each system owns the plan; the platform team runs routing and drills.

Steps.

  1. Route every model call through the AI gateway by capability, such as summarise-case, not vendor endpoint.
  2. Choose a second source in a different jurisdiction, or self-hosted open weights, and version prompts per model.
  3. Run the portable evaluation suite against it at least monthly; default acceptance is 90% of the primary's task score with every safety threshold met.
  4. Keep it warm with 1% to 5% shadow traffic, and write the triggers into the plan: loss of a transfer mechanism, sanctions, a change of ownership, short deprecation notice, a failed check.
  5. Twice a year, route one capability's traffic to the second source for a working day. Default switch times are ten working days for standard systems and two for critical ones.

Definition of done. Every system handling confidential data or deciding about people has a plan, and the last drill met the switch time.

Hansa Mutual's plan EXIT-004 covers the classification of claims correspondence, which its DORA register of information links to an important function, so that Article 28(8) requires an exit strategy (3, European Union, 2022). The primary is a US provider's model in a hyperscaler's EU region; the second source is a European open-weight model fine-tuned in-house, scoring 0.89 against the primary's 0.94. The April 2026 drill took nine hours and exposed a GPU quota too low for the second source; after the fix, the October drill switched in four hours. During a switch, a reviewed change to the gateway routing moves claims-triage without redeploying any application, the platform team scales the second source to six replicas, which took about 40 minutes in the October drill, and the confidence threshold for automatic routing rises from 0.80 to 0.90, so more claims go to manual triage. The April failure is recorded in the plan, which is what drills are for.

Keeping the position current

An unreviewed geopolitical position decays fast. Store the assessments, policy, and exit plans in the architecture repository, as Architecture as Code (Chapter 10) recommends for policy generally (66, Nordqvist, 2025), and let the pipeline fail when an assessment passes its review date. Dates already in view justify scheduled reviews: the expiry of the Section 702 certifications on 17 March 2027 (135, Brennan Center, 2026), the appeal in Case C-703/25 P (139, CJEU, 2025), the progress of the Cloud and AI Development Act (111, European Commission, 2026), OpenEuroLLM's first release (167, OpenEuroLLM, n.d.), the closing of the Cohere and Aleph Alpha combination (160, Cohere & Aleph Alpha, 2026), and the AI Gigafactory selections (162, EuroHPC JU, 2026). Each is a reason to re-run the assessment, not to change the position in advance. Public authorities should also publish the origin policy alongside the algorithm register entries of Chapter 9, so that citizens and auditors can see the criteria behind each choice of model.

Across the usage modes

Who chooses a model's origin differs across the usage modes of Chapter 2 (usage-mode matrix).

Mode Who chooses the model Lever for the origin policy
Mode 0 – Ambient AI The supplier Contract clauses requiring disclosure of the model
Mode 1 – Conversational assistants The service provider The choice of approved service
Mode 2 – Embedded workplace assistants The suite vendor Region and data boundary settings
Mode 3 – Agentic work tools The tool vendor, sometimes the user An allow-list of models
Mode 4 – Built AI applications The organisation The origin policy in full
Mode 5 – Autonomous production agents The organisation As Mode 4, with a second source ready

In Modes 4 and 5 the policy decides which models may be built into a system; in Modes 0 to 3 it decides which services may receive which data, because the model is not the organisation's to choose.

Nordvik Region and Hansa Mutual

Nordvik Region's policy expresses a public authority's caution: it restricts the most sensitive data to models it can host itself, and its leverage is procurement, and its risk is lock-in to a supplier whose obligations it cannot verify. Hansa Mutual's assessment GEO-2026-017 and exit plan EXIT-004 express a regulated enterprise's caution, anchored in DORA. Because sanctions and supervisory expectations differ between the EU, the United Kingdom and Switzerland, Hansa keeps one group position and asks each non-EU entity to confirm that it satisfies its own regulator before a provider is approved for that market.

Summary

Model origin is a separate question from infrastructure placement because a model brings its provider's law, politics, and training choices into the European estate. Five risk categories apply by the same criteria to every origin: US and Chinese law can both reach data in a provider's control, continuity is exposed to sanctions and export controls, behaviour is shaped by political environments on both sides, supply-chain integrity cannot be established by testing alone, and compliance turns on transfer mechanisms, Union representatives, and the provider role that self-hosting can create.

Self-hosting open weights largely removes legal access risk and leaves behaviour and supply-chain risk to be controlled. Because behaviour differs by language, evaluation must cover every language a deployment serves, not English alone. European alternatives are real but rest on non-European hardware, and hyperscaler sovereignty offerings reduce operational risk but not extraterritorial exposure. The response is therefore a risk-tiered position: an assessment per model, an origin policy enforced in the gateway, and a drilled exit plan with a second source, all reviewed on dated triggers. Chapter 7 turns these into evaluation criteria, contract clauses and supplier oversight.

Sources

  1. European Commission (2026). Proposal for a Cloud and AI Development Act (CADA). COM(2026) 502, 3 June 2026. (111, European Commission, 2026)
  2. Algemene Inlichtingen- en Veiligheidsdienst (2026). AIVD Jaarverslag 2025. Presented to the Dutch Parliament on 23 April 2026. (168, AIVD, 2026)
  3. Nordqvist, G. (2025). Architecture as Code. Companion volume to this book, published at aac.geon.se. (66, Nordqvist, 2025)
  4. United States Congress (2018). 18 U.S.C. § 2713, Required preservation and disclosure of communications and records (CLOUD Act, enacted 23 March 2018 as Division V of the Consolidated Appropriations Act 2018). Legal Information Institute, Cornell Law School. (134, US Congress, 2018)
  5. Brennan Center for Justice (2026). Section 702 Surveillance Authority Will Not Lapse if Reauthorized by March 2027. Brennan Center, 22 September 2026. (135, Brennan Center, 2026)
  6. House Permanent Select Committee on Intelligence (2026). Chairman Crawford Statement on FISA 702 Reauthorization. US House of Representatives, 24 April 2026. (136, HPSCI, 2026)
  7. Court of Justice of the European Union (2025). Press release No 106/25: Judgment of the General Court in Case T-553/23, Latombe v Commission. 3 September 2025. (140, CJEU, 2025)
  8. Court of Justice of the European Union (2025). Appeal brought on 31 October 2025 against the judgment of the General Court in Case T-553/23, Case C-703/25 P. Notice in OJ C/2025/6610, 22 December 2025. (139, CJEU, 2025)
  9. Privacy and Civil Liberties Oversight Board (2026). Congressional Budget Justification Fiscal Year 2027. PCLOB, 13 February 2026. (138, PCLOB, 2026)
  10. Court of Justice of the European Union. Judgment in Case C-311/18, Data Protection Commissioner v Facebook Ireland Limited and Maximillian Schrems ("Schrems II"). 16 July 2020. (20, CJEU, 2020)
  11. Sénat (2025). Commission d'enquête sur la commande publique: compte rendu de l'audition de MM. Anton Carniaux, directeur des affaires publiques et juridiques, et Pierre Lagarde, directeur technique du secteur public, de Microsoft France. Sénat, 10 June 2025. (141, French Senate, 2025)
  12. Abu-Ltaif, S. & Bullwinkel, J. (2026). One year on: Progress on our European digital commitments. Microsoft On the Issues, 29 April 2026. (137, Abu-Ltaif & Bullwinkel, 2026)
  13. National People's Congress Standing Committee (2017). National Intelligence Law of the People's Republic of China (adopted 27 June 2017; unofficial English translation). (157, NPC Standing Committee, 2017)
  14. Dezan Shira & Associates (2021). A Close Reading of China's Data Security Law, in Effect Sept. 1, 2021. China Briefing. (156, China Briefing, 2021)
  15. Garante per la protezione dei dati personali (2025). Intelligenza artificiale: il Garante privacy blocca DeepSeek (press release; order doc. web 10098477). Garante, 30 January 2025. (153, Garante, 2025)
  16. Kirchner, M. (2025). Berlin data protection authority wants DeepSeek to be blocked in app stores. heise online, 27 June 2025. (152, Kirchner, 2025)
  17. The Register (2026). Microsoft throws spox under the bus after Parliament testimony on ICC email kerfuffle. The Register, 18 February 2026. (144, The Register, 2026)
  18. Tridgell, J. (2025). Justice Recoded? Why It Matters that the International Criminal Court Embraced Open-Source Software and Ditched Microsoft. EJIL:Talk!, 20 November 2025. (145, Tridgell, 2025)
  19. Bureau of Industry and Security (2025). Department of Commerce Announces Rescission of Biden-Era Artificial Intelligence Diffusion Rule, Strengthens Chip-Related Export Controls. US Department of Commerce, 13 May 2025. (143, BIS, 2025)
  20. Bureau of Industry and Security (2026). Revision to License Review Policy for Advanced Computing Commodities (Final rule, 91 FR 1684). Federal Register, 15 January 2026. (142, BIS, 2026)
  21. Cyberspace Administration of China and six other bodies (2023). 生成式人工智能服务管理暂行办法 (Interim Measures for the Administration of Generative AI Services), Order No. 15. CAC, 13 July 2023. (155, CAC, 2023)
  22. National Institute of Standards and Technology, Center for AI Standards and Innovation (2025). CAISI Evaluation of DeepSeek AI Models Finds Shortcomings and Risks. NIST, 30 September 2025, updated 20 November 2025. (151, NIST, 2025)
  23. National Institute of Standards and Technology, Center for AI Standards and Innovation (2025). CAISI Evaluation of Kimi K2 Thinking. NIST, 12 December 2025. (149, NIST, 2025)
  24. Pan, J. & Xu, X. (2026). Political censorship in large language models originating from China. PNAS Nexus, 17 February 2026. (148, Pan & Xu, 2026)
  25. ANSSI and CERT-FR (2026). L'IA générative face aux attaques informatiques: synthèse de la menace en 2025 (CERTFR-2026-CTI-001). ANSSI, 4 February 2026. (169, ANSSI, 2026)
  26. The White House (2025). Winning the Race: America's AI Action Plan. The White House, July 2025. (159, White House, 2025)
  27. National Institute of Standards and Technology, Center for AI Standards and Innovation (2026). CAISI Evaluation of DeepSeek V4 Pro. NIST, 1 May 2026, updated 2 May 2026. (147, NIST, 2026)
  28. Office of Management and Budget (2025). M-26-04, Increasing Public Trust in Artificial Intelligence Through Unbiased AI Principles. The White House, 11 December 2025. (158, OMB, 2025)
  29. Hubinger, E. et al. (2024). Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training. arXiv:2401.05566, 10 January 2024 (v3, 17 January 2024). (154, Hubinger et al., 2024)
  30. Souly, A., Rando, J., Chapman, E. et al. (2025). Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samples. arXiv:2510.07192 (preprint), 8 October 2025. (150, Souly et al., 2025)
  31. Open Source Initiative. The Open Source AI Definition, version 1.0. 28 October 2024. (39, OSI, 2024)
  32. Bruckner, T. (2026). One Token Is Enough: Fingerprinting and Verifying Large Language Models from Single-Token Output Distributions. arXiv:2607.10252 (preprint), 11 July 2026. (146, Bruckner, 2026)
  33. European Parliament and Council of the European Union. Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data (General Data Protection Regulation). Official Journal of the European Union, 4 May 2016. (2, European Union, 2016)
  34. European Parliament and Council of the European Union. Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). Official Journal of the European Union, 12 July 2024. (1, European Union, 2024)
  35. European Parliament and Council of the European Union. Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA). Official Journal of the European Union, 27 December 2022. (3, European Union, 2022)
  36. Security Management (2026). Kabinet blokkeert Amerikaanse overname van DigiD-leverancier Solvinity. Securitymanagement.nl, 27 May 2026. (165, Security Management, 2026)
  37. TechCrunch (2026). Mistral raises €3B as sovereign AI becomes big business. TechCrunch, 8 September 2026. (161, TechCrunch, 2026)
  38. Cohere and Aleph Alpha (2026). Cohere and Aleph Alpha sign agreement to become the first transatlantic sovereign AI solution. PR Newswire, 16 September 2026. (160, Cohere & Aleph Alpha, 2026)
  39. EPFL AI Center (2025). Apertus: a fully open, transparent, multilingual language model. EPFL, 2 September 2025. (164, EPFL, 2025)
  40. EPFL AI Center (2026). Apertus 1.5: Building the next generation of open AI infrastructure. EPFL, 24 July 2026. (163, EPFL, 2026)
  41. University of Edinburgh School of Informatics (2025). Europe takes another step toward AI sovereignty with the launch of EuroLLM-22B. University of Edinburgh, 16 December 2025. (166, University of Edinburgh, 2025)
  42. OpenEuroLLM consortium. Deliverables. OpenEuroLLM, undated web page. (167, OpenEuroLLM, n.d.)
  43. EuroHPC Joint Undertaking. AI Factories. (25, EuroHPC JU, n.d.)
  44. EuroHPC Joint Undertaking (2026). Call for tenders for the selection of Artificial Intelligence Gigafactory Consortia and the establishment of AI Gigafactories (EUROHPC-2026-CEI-AIGF-01). EuroHPC JU, opened 30 July 2026. (162, EuroHPC JU, 2026)
  45. Gaia-X European Association for Data and Cloud AISBL. Gaia-X: A Federated Secure Data Infrastructure. (26, Gaia-X, n.d.)
  46. Amazon (2026). AWS Launches AWS European Sovereign Cloud and Announces Expansion Across Europe. Amazon press release, 15 January 2026. (118, Amazon, 2026)
  47. OWASP Foundation. CycloneDX Machine Learning Bill of Materials (AI/ML-BOM). (43, OWASP, n.d.)