Sovereignty, Dependency and Strategic Choice

An organisation that uses AI broadly depends on providers: for models, for the platforms that serve them, for the accelerators beneath, for the security and operations services that watch them and for the software in which AI is already embedded. Chapter 24 set out the duties that law attaches to such use. This chapter treats the choice that law leaves open and that nobody else can make for the leader: how much dependency to accept, on whom, on what terms of leaving and at what cost. Three of the five leadership functions are concerned. L1 Orient sets the direction: which dependencies the organisation is willing to carry in order to reach its strategy, and which it is not. L2 Decide takes the decisions, of strategy, budget and procurement, and records them with their exit conditions. L5 Answer is the test at the end: when a provider fails, changes its terms or changes its model, a named leader must be able to say why the organisation was in that position and what it can do next.

The chapter takes over conclusions from the earlier volumes. Model origin is a risk question separate from hosting, and it is decided by a risk-tiered position that is reviewed and not made once (AI Governance, Chapter 6) (221, Nordqvist, 2026). Digital sovereignty is a set of verifiable properties and not a location: knowing where workloads run, which law governs them, being able to move them and being able to continue if a provider fails (AI Platform and Security, Chapter 13) (222, Nordqvist, 2026). A contract right is a promise until the first sample, seed or stop request shows that it works (AI Blue, Chapters 16 and 28) (227, Nordqvist, 2026), and procurement buys the right to learn, to stop and to leave (AI Purple, Chapter 19) (228, Nordqvist, 2026). AI Operations, Chapter 24, treated the same boundary as an operations problem: concentration, outage, register, exit and switching (229, Nordqvist, 2026). Those volumes say how to test a dependency. This chapter says who decides to have it, and it follows the open question that the series carried over: how digital sovereignty, concentration risk and the switching rules of the Data Act shape who can operate a service when a provider fails, and what an exit test shows.

A dependency is not a fault. Every organisation depends on suppliers, and the reason to buy a capability instead of building it is that someone else can provide it better or cheaper. The leader's task is to know which dependencies are strategic, meaning that they bind the organisation's options for years, and to accept those deliberately. The book uses three questions to separate a strategic dependency from an ordinary supplier relationship. Can the organisation substitute the provider within a period it can survive? How many of its decision classes and services pass through the provider? And can the effect of a failure or a change of terms be undone? The answers are the book's own working criteria, not a finding, and they are cheap to apply: the first needs a tested exit, the second a dependency map, the third the reversibility judgement that the delegation ladder already uses (Chapter 4).

Primary topics explored

1. Dependency as strategy
2. Exit
3. European alternatives
4. Procurement as a leadership act
5. Sovereignty tested
6. The strategic dependency decision record