Geopolitics and Model Origin

Chapter 5 asked whether an organisation is ready to commit to AI; this chapter, which opens Part II, asks whose AI it will commit to. Most capable models available to a European organisation in 2026 were developed in the United States or China, and the law, politics, and trade policy of those countries travel with the model into the European estate. The chapter applies one set of criteria to every origin, distinguishes a foreign provider's hosted service from a foreign open-weight model run on European infrastructure, and ends with a risk-tiered position, expressed as code, that avoids both the blanket ban and the blanket trust. Because the facts move quickly, every figure carries its month and year, and legal statements are architectural implications, not legal advice.

Sovereignty is usually discussed as a property of infrastructure: where data is processed, who operates the platform, and who holds the keys. Those properties remain necessary, but they do not settle three questions specific to models. Who can be compelled to hand over prompts and outputs? Who can withdraw the service or the next model version? And what was the model trained to say, refuse, or omit, by whose rules?

The dependency is concentrated. The European Commission's proposal for a Cloud and AI Development Act, published in June 2026, records that the market share of EU cloud providers fell from 29% in 2017 to 15% in 2022 and that "three non-EU hyperscalers control over 70%" of the European market (111, European Commission, 2026). The Dutch General Intelligence and Security Service warned in April 2026 that technology can be a geopolitical lever and that smaller countries must recognise their strategic dependencies (168, AIVD, 2026).

Primary topics explored

1. Why model origin is a separate question
2. Five categories of geopolitical risk
3. Hosted service versus open weights on European infrastructure
4. European alternatives in 2026
5. A risk-tiered position
6. Keeping the position current