Supply, Sovereignty and Jurisdiction

On a Monday morning a claims handler in Hansa Mutual's Swiss subsidiary opens a motor claim and asks the claims assistant what the policy wording says about a hire car. The answer appears within a second. She would say it came from the group tool. The longer answer is this. The assistant runs on the group's shared AI platform in Germany. The model that drafted the answer is served from the group data centre in Frankfurt, with a fallback to a general-purpose model provider outside the EU under a recorded exception. Her question and the claim details crossed a border to get there, out of a country that belongs neither to the EU nor to the EEA (the European Economic Area, which adds Norway, Iceland and Liechtenstein to the EU) and into Germany, and the answer crossed back. Nothing on the screen says so. Hansa Mutual is one of the two fictional organisations this book uses and the scene is illustrative, but its shape is ordinary: the person in one place, the application in a second, the model in a third, and the supplier who operates it all perhaps in a fourth.

This chapter teaches the third of the six standard views of Contour, the notation this book uses: V3 The supply and sovereignty view. Chapter 14 taught V1 The one-page landscape, in which every AI use in an organisation, every unit, is drawn as one mark on a grid of autonomy against reversibility; Chapter 15 taught V2 The landscape over time. V3 keeps the same marks and moves them off the grid into the container of whoever runs them: the organisation's own boundary, a supplier named by its role, or a jurisdiction outside the EU and the EEA. It answers the question her screen could not: where does this run, and under whose law.

Chapter 5 named the box instinct, which draws the supply of AI as one cloud. The supply behind one AI use is a stack, and for any unit there are four answers to "where does it run", which can be four organisations in four countries. The model: who trained the weights the unit calls, and where they are served. The hosting: on whose computers, in which country, the unit's software runs. The application: who built and supplies the software around the model. The operations: who runs the service day to day, holds the credentials and answers the telephone when it fails. For an AI feature a vendor switched on inside a licensed product, all four are the vendor, and the organisation may know none of them.

Primary topics explored

1. Where it runs
2. Roles, not brands
3. Jurisdictions: solid, dashed, dotted
4. What the law adds
5. The evidence
6. Reading a supply view