\cleardoublepage \part{Sovereignty and Suppliers} \setbookpart{Sovereignty and Suppliers}

Part II: Sovereignty and Suppliers

Very few European organisations train the models they depend on. They obtain them from model providers, cloud platforms, software vendors and open-weight releases. Every route creates a dependency, and every dependency is a governance decision whether or not anyone records it as one.

Chapter 6 treats geopolitics and model origin, because where a model was trained and what happens if a supplier is withdrawn are questions a board or a public auditor can now ask. It separates the origin of the weights from the location of hosting and the nationality of the provider, and records model origin as a repeatable assessment.

Chapter 7 treats buying AI as an architectural and governance act: how to evaluate providers, which contract clauses carry the AI Act's allocation of roles and the GDPR's processor duties, how DORA reaches AI providers in the financial sector, how public procurement law shapes what an authority can require, and how to plan for exit before signing. It also weighs open models against closed services.

What you will learn in this part:

• How to assess and record the origin, jurisdiction and withdrawal risk of the models an organisation relies on
• How the AI Act, the GDPR, DORA and public procurement law shape what a buyer must ask of a supplier
• Which contract clauses, evaluation criteria and exit plans turn vendor dependence into a managed risk
• When open-weight models change the balance of control and accountability

The infrastructure engineering behind these choices lies outside the scope of this part.