By André Franco, in collaboration with the GIE Foundation
In July 2026, the Chinese frontier model developer Moonshot AI released Kimi K3 under open weights. The model outperformed every American system then publicly available, with the exception of Claude Fable 5 and ChatGPT 5.6. A system close to the cutting edge of AI capability was suddenly downloadable by anyone, at a fraction of the cost of the closed American models it was comparable to. For observers tracking the US-China technology competition, the release was remarkable: It wasn’t to say that China had surpassed the United States per se, but the distance had narrowed to the point where the trailing edge of that competition was now freely available to anyone with a laptop (Bloomberg, 2026; CNBC, 2026a).
The distance to the “cutting edge” of this tech is something we can measure. Epoch AI found that since 2023, Chinese models have trailed the US frontier by an average of seven months (Epoch AI, 2026a), and that the best open-weight models now lag the best closed ones by around four months (Epoch AI, 2026b). The two findings connect: most top Chinese models are open-weight, while the leading American ones are closed. This means the time for a new capability to travel from frontier to laptop is now shorter than the time for a European public body to complete a procurement cycle. The McNair Center puts the lag somewhere between three and nine months, depending on how you measure it (McNair Center, 2026), but the procurement side is less contested: EU open-procedure tenders average roughly 125 days from publication to award, restricted and negotiated procedures routinely exceed seven months, and roughly half of all contracts run beyond their planned start dates (Carril-Caccia and Goemans, 2023).
Figure 1: Frontier trend of AI models by country
Source: Epoch AI
Despite this progressive narrowing, the gap between the US and other countries in terms of model development still exists and it is hard to fully close. American models being closed compounds this: They are not freely available to build on, which removes one route by which others might shortcut the distance. Therefore, the US is likely to hold that position for some time, even with China catching up.
The European Union - and for that matter, all of the other major democracies on the planet, from Japan and South Korea, to Brazil and India, to the UK, Australia and Canada, and beyond - are so far behind that they cannot be considered true major players in the frontier AI development race, and pretending otherwise represents a significant mistake in its AI strategy. Every month spent trying to catch up with the latest AI developments is a month not spent on a more pressing question: What happens if the models that public and economic systems rely on fail or become unreliable? This is not a theoretical question. On 12 June this year, Europe faced a real test of exactly this scenario, and it was not prepared. The focus should be on identifying the essential public and economic functions that need to keep working even if the models beneath them become compromised, and on what it would take to ensure their continuity - not on chasing a race Europe or the other democracies cannot win on those terms.
The question of who controls the systems underpinning public administration is not a procurement question, per se. It is most usefully understood as a question about whether democratic institutions retain the capacity to function, to be held accountable, and to serve the citizens who depend on them - on terms those citizens can scrutinise. When that capacity can be suspended by a decision made in a distant capital, whether Washington or Beijing, without notice and without appeal, the answer is already partly no.
Europe's Lag
Europe is struggling to keep up with the latest advancements. A recent report from Stanford's 2026 AI Index shows that the United States is far ahead in terms of private investment in AI, with a whopping $285.9 billion in 2025, compared to just $12.4 billion in China . When it comes to generative AI, the combined investment from China and Europe is a mere $4.7 billion (Stanford HAI, 2026). This is a significant gap, and it's not just about the money; the top five hyperscalers in the world hold around 71% of the total AI computing power, and most of them are based in the US (Epoch AI, 2026c). The European Union is also heavily reliant on American companies for its cloud computing needs: Amazon, Microsoft and Google together account for roughly 70 per cent of European cloud infrastructure spending, leaving all European providers combined with approximately 15 per cent of their home market (Synergy Research Group, 2024). On semiconductors, the EU produced less than 10 per cent of global output as of 2022; the Chips Act set a target of 20 per cent by 2030, but the European Court of Auditors concluded in 2025 that the target is very unlikely to be achieved, projecting an actual share of around 11.7 per cent by that date (European Court of Auditors, 2025; TechPolicy.Press, 2026).
Figure 2: Market share of cloud providers serving Europe
Source: Synergie Research Group
What needs to change, first, is how Europe thinks about this competition. The goal is not to win it - at least not in any short or medium-term sense - because framing it that way produces expectations and targets that don’t correspond to anything achievable. The more useful frame is reducing dependence and building digital independence. The K3 weight release illustrates how that dependence is currently forming. At the time of release, none of the major cloud providers - AWS Bedrock, Azure Foundry, Google Vertex AI - had integrated it or any comparable Chinese open-weight model (Quartz, 2026). Yet the models were reaching European developers and public bodies anyway, through online platforms and direct downloads rather than official procurement channels. The institutions using them are therefore exposed to any policy shift from Washington or Beijing, precisely because these dependencies are forming outside the procurement processes that exist to surface and manage them.
The Reckoning
On 9 June 2026, Anthropic released Claude Fable 5, heralding it as the newest frontier model, available worldwide. Three days later, an Amazon research report identified a jailbreak that exposed software vulnerabilities and generated exploit code in some cases. The US Department of Commerce ordered Anthropic to suspend access for all foreign nationals, regardless of location - including non-US employees working inside the United States (Forbes, 2026a). Since verifying nationality in real time was not feasible, Anthropic disabled the models worldwide.
The consequences were immediate, particularly for enterprise customers in critical sectors - finance, healthcare, infrastructure - who found themselves without tools embedded in their production workflows, without warning. After nineteen days, the controls were lifted and access was reinstated on 1 July (CNBC, 2026b). The episode set a precedent for how governments might apply export controls to commercially available models accessed through web interfaces. The final sentence about far-reaching implications has been cut - the three paragraphs that follow make that case concretely, so stating it in the abstract here added nothing.
Three features make this the defining case for European policy:
It was not adversarial: The most capable publicly available model was switched off by a (supposedly) allied government acting on a domestic security finding, through an instrument designed for exports. No European institution was consulted.
It took effect immediately: There was no transition period for regulated deployers to migrate, and continuity planning.
It was indiscriminate: It hit sectors that operate under EU obligations of operational resilience, in some cases the very sectors covered by NIS2 and DORA, without either framework having anything to say about model-layer dependency.
For example: When a hospital loses a diagnostic tool, a benefits agency loses a case-processing system, or a court loses a drafting assistant without warning and without a fallback, the salient issue is how the institution they depend on can still function - and also who bears responsibility when it cannot.
The European Commission’s Executive Vice-President Henna Virkkunen stated clearly that the main goal of the sovereignty package introduced in June was to prevent any single entity from having control over critical services - essentially, a "kill switch" that could be used to disrupt them (CNBC, 2026c) . However, just nine days later after this announcement, such a switch was actually used, and this incident was cited by members of the European Parliament when they discussed the package on June 16 (AK EUROPA, 2026). This episode highlights a crucial lesson: Relying on another country's security processes can be a significant strategic risk, and it's essential to find ways to avoid or mitigate this dependency. By doing so, we can ensure that our critical services are protected and not vulnerable to external control.
The Cyber Threshold
Capability diffusion also carries severe security consequences. The demonstration came in November 2025, when Anthropic disclosed that a Chinese state-sponsored group it designated GTG-1002 had run what it assessed as the first largely AI-orchestrated cyber espionage campaign against roughly thirty entities. What distinguished it was the division of labour: the AI executed an estimated 80 to 90 per cent of tactical operations independently, from vulnerability discovery through exploitation and exfiltration, with humans intervening at a handful of decision points (Anthropic, 2025). The account rests on the vendor's own disclosure, which is itself part of the European problem. The Union learned about a campaign against European-relevant targets from a single company report.
Figure 3: Scheme of the GTG-1002 cyberhacking operation
Source: Anthropic
The trend line is more revealing than any single campaign. The UK AI Security Institute measures the length of cyber tasks frontier models can complete autonomously against expert human completion times. In November 2025 it estimated a doubling time of eight months; by February 2026 that had halved to 4.7 months (AI Security Institute, 2026). If frontier capability reaches open weights in roughly four months and autonomous cyber task horizons double on a similar timescale, the operational capability available to anyone willing to download and run a model trails the best-resourced state programmes by a short and shortening margin. Safety mitigations built into a hosted API do not survive weight release: research has demonstrated that alignment can be stripped with as few as ten adversarial fine-tuning examples at negligible cost, and that even benign fine-tuning datasets degrade safety properties to a measurable degree (Qi et al., 2023). There is no recall mechanism.
The Commission has said as much. Its Action Plan on Cybersecurity and Artificial Intelligence of 7 July 2026 states that frontier capabilities will become increasingly accessible to malicious actors as open-source models improve, and its diagnosis is sharper than a general expectation that attacks will increase: AI-enabled vulnerability discovery is outpacing AI-assisted remediation, and the bottleneck is patch deployment across estates never designed for this cadence (European Commission, 2026a; CERT-EU, 2026). For a Union that neither builds frontier models nor controls the infrastructure they run on, this compounds into an assessment problem. It cannot independently judge how dangerous the next release is, and it learns about both threat and remedy from announcements made elsewhere. Regulatory authority without evaluation capacity is authority exercised on someone else’s evidence. It is also, in a more immediate sense, a democratic problem. Citizens and elected representatives cannot meaningfully oversee systems whose risks are assessed elsewhere, or disclosed selectively, or remediated on a timeline set by a likely foreign vendor. Accountability requires the capacity to evaluate independently. Without it, the oversight is little more than formality.
The Costs of Dependency
Beyond access and cyber exposure, two further risks deserve attention.
Research in PNAS Nexus found that models originating from China refuse politically sensitive prompts at markedly higher rates than non-China models, whose refusal rates ranged from zero to under three per cent, within a regime in which the Cyberspace Administration of China audits model responses (Pan and Xu, 2026). Testing by the Central European Institute of Asian Studies, using the versions actually available, found the pattern extended to questions unconnected to China and involved insertion of aligned framing as well as omission (CEIAS, 2026). Distilled derivatives do not reliably inherit that behaviour, but techniques that strip political guardrails may strip other guardrails alongside them (Semafor, 2026). The risk may be less that Europe inherits Beijing’s politics than that removing them yields systems with no reliable safety properties at all.
The second risk is to epistemic trust - that is, trust in what we can know. When administrations, courts, benefits agencies and regulators deploy systems whose behaviour they cannot inspect, produced under a legal regime they cannot see into and evaluated in other jurisdictions, they lose the ability to answer the most basic question a citizen can ask: why did the system decide that? Under the AI Act, a public authority deploying a high-risk system owes affected persons an explanation. This does not mean the public authority has the capacity to deliver a meaningful one. Without it, institutional trust erodes: the 2026 AI Index found that global publics trust the EU to regulate AI more than they trust Washington or Beijing (Stanford HAI, 2026), and a Pew Research Center survey across 25 countries found that 53 per cent of respondents trusted the EU to regulate AI effectively, against 37 per cent for the United States and 27 per cent for China - the EU was the most trusted regulator across every region surveyed (Pew Research Center, 2025).
That trust is an asset with a specific foundation: The EU’s regulatory framework is perceived as more independent of commercial and state interests than its American or Chinese counterparts. It is worth asking what happens to that perception if the systems European institutions depend on are built elsewhere, evaluated elsewhere, and can be withdrawn elsewhere - and if the frameworks meant to govern them keep slipping their own deadlines.
Compute, Minerals and Power
Sovereignty debates tend to begin and end with data centres. This is a mistake, as it treats scale as the only measure of compute strategy and ignores the materials and electricity without which no facility operates.
The governing assumption behind Europe’s compute push - that massive data centres are a prerequisite for AI-driven advances - has received less scrutiny than it warrants. Buhler, Pérez and Boettiger make the straightforward point that public administrations are not consumer platforms: they do not need frontier-scale throughput serving millions of simultaneous users; they need auditability, data residency and continuity (Buhler, Pérez and Boettiger, 2026). For those requirements, open-weight models on institutional servers are not a compromise. They are, after June 2026, the more resilient choice. Yet Europe’s flagship compute programme carries a risk its advocates rarely name: The Future Society finds that under certain conditions of ownership, access and governance, the AI Gigafactory Initiative could deepen rather than reduce foreign dependency (The Future Society, 2026), a conclusion Bruegel reaches independently (García-Herrero and Martens, 2026). Sovereign capacity built on foreign chips, foreign software and foreign-owned operating entities is a change of location, not of control.
The same holds below the silicon and above it. China’s export controls now cover gallium, germanium, tungsten, bismuth and rare earths, and the European Parliament’s research service concluded that they exposed EU supply chain vulnerabilities that remain hard to mitigate (European Parliament, 2025a). The Critical Raw Materials Act projects real if slow effects (Council of the EU, n.d.), but the problem is midstream: Refining a material inside Europe does not remove dependence if the input still comes from a single non-European supplier. On power, as Eurelectric put it, Europe is not short of electricity in the near term; it is short of time, with connection queues in the Frankfurt, London, Amsterdam, Paris and Dublin cluster averaging seven to ten years against a data centre build window of eighteen to twenty-four months (Eurelectric, 2026; Euronews, 2026). Planning for data centres that the EU cannot power is not a compute strategy.
What Is Already There
Europe has moved faster over the past eighteen months than its reputation might suggest. The Technological Sovereignty Package of 3 June 2026 spans semiconductors, cloud, open source and AI (European Commission, 2026b). Its centrepiece, the Cloud and AI Development Act, would create a single sovereignty framework on four assurance levels, require sovereignty risk assessments before procurement, introduce “Union added value” as a non-price criterion, and target a tripling of EU data centre capacity within five to seven years (European Commission, 2026c). The Commission selected the Domyn-led EUROPA consortium in June to build an open-source model across all 24 official languages (European Commission, 2026d), and the Action Plan on Cybersecurity and AI sets out an EU evaluation capacity by 2027, a Blueprint for structured access to frontier capabilities and an ENISA and JRC testing platform (European Commission, 2026a).
Alongside this sits Europe’s one asymmetric instrument, which is not compute but market access. The AI Act establishes a risk-based framework across four tiers, prohibits a defined set of unacceptable practices, imposes obligations on high-risk systems, and binds providers placing general-purpose models on the Union market irrespective of where they are established (European Commission, n.d.). Obligations for general-purpose models have applied since August 2025, and from 2 August 2026 the Commission exercises supervisory and enforcement powers over models presenting systemic risk, with authority to demand model access, require mitigation, fine up to 3 per cent of global turnover and order withdrawal from the market (European Commission, 2026a; Cooley, 2026). This is how a bloc that cannot build the leading model can nonetheless shape it, since it is cheaper to build one compliant model than two.
The weaknesses in that architecture are of timing, sequencing and credibility. The evaluation capacity may arrive in 2027, by which time three or four further open-weight generations will likely have shipped. The Blueprint creates no obligations on providers, so it depends on voluntary cooperation from firms whose incentives run the other way, and EUROPA’s one-year allocation funds a training run rather than a programme (Economist Impact, 2026).
Most seriously, the Digital Omnibus published on 24 July 2026 deferred high-risk obligations for standalone Annex III systems to December 2027 and for product-embedded systems to August 2028 (Cooley, 2026). The reasons were honest and legitimate - harmonised standards were not ready - but the signal received by industry and third-country governments is that European deadlines move under pressure. A bloc whose principal instrument is regulatory credibility cannot afford many demonstrations that its regulation is negotiable.
Credibility should here be understood as an institutional property. It is what allows citizens, firms and third-country governments to plan on the assumption that European law means what it says. Every deferred deadline narrows the distance between a binding framework and a set of aspirations. The AI Act was a signal that Europe intended to govern this technology on its own terms; enough deferrals, and it becomes proof that the emperor has no clothes.
The Rulebook's Internal Problem
External reach, however, is only half the question. The AI Act also has a design problem that the sovereignty debate rarely engages, and Mario Mariniello’s recent Bruegel analysis sets it out with unusual clarity (Mariniello, 2026a).
The Act was conceived as a traditional ex-ante product safety regulation, under which systems must conform to a set of requirements before being placed on the market. Yet AI escapes the product definition. A toy’s hazards are fixed at manufacture. An AI system’s behaviour changes with model updates, fine-tuning, prompt engineering and deployment context, so a system classified as minimal risk at deployment can become high risk with no new product and no deliberate act by anyone. Risk tiers assigned by reference to a list drawn up in advance cannot track that. Mariniello’s conclusion is that an ex-ante regime cannot efficiently safeguard against harm that is unforeseeable by construction.
Four further weaknesses follow. Compliance costs do not scale with firm size: Haataja and Bryson estimated roughly 9 to 17 per cent of development cost for an average system, which risks replicating the GDPR outcome of entrenching incumbents by disproportionately burdening smaller firms (Haataja and Bryson, 2021). Enforcement is fragmented across more than 2,000 sectoral national market surveillance authorities - a figure confirmed by the Commission’s own Article 70 notification process, which received returns from all 27 member states by August 2025, totalling around 2,200 authorities including 208 fundamental rights bodies (CMS Law, 2025) - most designed for physical product safety rather than for assessing whether a system exhibits discriminatory patterns in dynamic deployment. Standard-setting carries a democratic deficit, since CEN-CENELEC’s JTC 21 standards are largely written by industry experts behind closed doors and encode value-laden judgements about fairness and safety as technical ones. There is no liability backstop either: the Commission withdrew the AI Liability Directive proposal in early 2025, leaving victims of immaterial harm to national tort law and the near-impossible task of proving causation against an opaque system.
Mariniello’s remedy is a recalibration towards a hybrid of ex-ante and ex-post instruments: multitiered requirements keyed to expected deployment scale, a revived tiered liability framework, ex-post detection infrastructure modelled on the US Food and Drug Administration’s Sentinel Initiative, structured researcher access, non-punitive near-miss reporting on the aviation model, and a public incident registry. The timing objection is sharp. The Commission is not required to begin evaluating the Act’s effectiveness until August 2028 and may propose amendments by August 2031, which by the standard of AI markets is a horizon set for a different technology.
This sits in apparent tension with the argument that Europe must stop deferring its deadlines, and the tension should be resolved rather than left to sit. The two are compatible if the distinction is between credibility and design. Deferral is a signal about whether European law binds at all, and every deferral discounts the only instrument Europe holds. Recalibration is a question about whether the law works, and it can be answered on schedule rather than by delay. The defensible European position is therefore to enforce the current deadlines without further movement, while bringing the effectiveness review forward from 2028 and using it to shift regulatory weight towards ex-post tools for the lower-damage segment, preserving strict ex-ante control where harm is large or irreversible. Enforce now, recalibrate deliberately, defer nothing.
The Human Condition
Any resilience strategy worthy of its name should not limit itself to regulatory frameworks and infrastructure. European citizens, too, must be a central pillar of EU AI policy.
Under Article 4 of the AI Act, providers have been required to ensure a sufficient level of AI literacy among staff since February 2025. The Digital Omnibus Regulation Proposal turned the clock backwards, adding that there is no obligation to guarantee any specific, measurable literacy level for any individual - converting an obligation of result into an obligation of means (Law and Technology, 2026). This leaves the EU without any real legal requirement that people using AI systems understand what those systems do, at the same moment the high-risk regime is being asked to rest on human oversight. Europe has better instruments than it is using, from the AILit framework to the AI Skills Academy, but all of them are voluntary and disconnected from the architecture that would give them force (European Commission, 2026e). The capability at stake is narrower and harder than digital skills: the disposition to ask whether a fluent output is true, and the domain knowledge to tell.
The evidence on AI’s impact on employment is still mixed, with aggregate employment levels steady. For entry-level jobs, though, the shift may be starting. In the UK, job adverts in occupations exposed to automation showed a 38 per cent decline (Futurum Group, 2026). Across the EU, the youth unemployment rate reached 15.1 per cent in Q1 2026, up 0.6 percentage points from 2023, with employment of young workers in ICT and professional services falling 18.6 per cent over the same period - though the ECB cautions that causes remain mixed and attribution to AI is not yet established (ECB, 2026).
Figure 4: Number of jobs ads for entry-level graduate roles, 3-months rolling average (June 2022 = 100)
Source: Financial Times
Although the evidence is still limited, such early signs are worrying. Junior positions are where expertise is built and where careers begin. Without them, many young Europeans risk being shut out of the labour market before they have entered it. A workforce that cannot interrogate AI outputs is also an electorate that cannot evaluate AI-assisted government decisions. The disposition to ask whether a fluent output is true, and the domain knowledge to tell, matters as much in a citizen reading a benefits determination as in a civil servant producing one. Treating AI literacy as a workforce issue while ignoring its civic dimension leaves half the problem unaddressed - and the half that is harder to recover once lost (Illingworth and Iorio, 2026).
Meanwhile, the Omnibus Regulation Proposal deferred high-risk obligations for employment systems - covering recruitment, evaluation, task allocation and termination - to December 2027 (European Commission, 2026f). The Parliament has already asked for more: its resolution of 17 December 2025 requests a legislative instrument on algorithmic management covering human oversight, consultation before deployment and protection against automated dismissal (European Parliament, 2025b; ETUC, n.d.). Labour is also the one domain in this commentary where Europe’s capability shortfall is irrelevant. Social policy is a shared competence under Article 153 TFEU. The Union can legislate here at full strength, without needing a single additional gigawatt or gigafactory.
Policy Recommendations
The objective is not autonomy, but sovereignty. Sovereignty, however, should not be confused with self-sufficiency (Forbes, 2026b). The realistic goal is derisking: creating a framework in which foreign models can be used - including Chinese open-weight models where they are the right tool - without any critical function becoming unable to operate if a model becomes unavailable or compromised, whether by American, Chinese or third-party action. To that end, the following policy recommendations should be implemented.
Enforce the AI Act on the current deadlines and bring the effectiveness review forward. No further deferral should be entertained, and the Commission should commit publicly to December 2027 and August 2028 as final. The missing harmonised standards should be treated as an emergency programme, with CEN and CENELEC resourced accordingly and civil society participation funded so that value-laden choices are not settled by industry alone. The general-purpose regime should be enforced visibly from August 2026, including at least one systemic-risk assessment published in enough detail to show third-country providers what compliance requires. A standard nobody has seen applied is not a standard.
Use that review to recalibrate towards ex-post instruments rather than to deregulate. Adopt scale-based tiering of ex-ante obligations, with lighter conformity requirements for SMEs and small deployments where harm is reversible, and mandatory third-party assessment replacing self-certification at the top tier (Mariniello, 2026a). Pair that with the ex-post package: revive the withdrawn AI liability proposal on a tiered basis, with strict liability for prohibited and high-risk systems and a rebuttable presumption of defectiveness and causation for the rest; establish a public EU AI incident registry with universal reporting, built on the OECD common reporting framework rather than a bespoke one (OECD, 2025); add non-punitive near-miss reporting to an authority without enforcement powers; and create structured researcher access modelled on Article 40 of the Digital Services Act, with safe-harbour protection for independent red teaming. The package lowers aggregate compliance cost while raising the expected cost of causing harm, which is the trade that makes it politically viable.
Accelerate the EU evaluation capacity, fund it multi-annually, and publish what it finds. The EU Action Plan concedes that most leading pre-deployment evaluators sit outside the EU (European Commission, 2026a). It should be a standing institution with a permanent budget line inside DG CONNECT, jointly staffed with member state institutes and with personnel experienced in AI evaluation and alignment. The Union should also maintain a public register of evaluation results for the models its institutions actually use, tested on the versions available through routing platforms (CEIAS, 2026).
Move fast on labour law, ahead of the evidence. Include the algorithmic management instrument the Parliament requested in December 2025 (European Parliament, 2025b; ETUC, n.d.). It should cover meaningful human oversight of decisions on recruitment, evaluation, task allocation, pay and discipline; a right to human review and to an explanation of automated employment decisions; a prohibition on fully automated dismissal; and consultation of workers before deployment of systems that materially affect working conditions. Three accompanying measures:
Given the December 2027 deferral for employment systems, member states should use national labour law to hold the line in the interim.
The Skills Guarantee should reach workers in restructuring sectors before displacement rather than after, and public support for AI adoption in large firms should be conditioned on demonstrated maintenance of entry-level intake and career development pathways.
The Union should build a standing short-time work backstop on the SURE precedent, so that if job displacement in a given role arrives faster than retraining can reliably follow.
Restore the AI literacy obligation in substance and extend it beyond the workplace. Reinstate the obligation of result diluted by the Omnibus Regulation Proposal. Adopt the AILit framework as the reference standard for national curricula, and require proof of competence for public officials operating high-risk systems as a condition of the human oversight the Act demands (European Commission, 2026e). Fund media literacy oriented toward evaluating machine-generated content, given the documented capacity of foreign models - Chinese ones in particular - to shape framing on questions of European security interest (CEIAS, 2026).
Treat model dependency as a continuity-of-service risk with tested fallback obligations. The Cloud and AI Development Act’s sovereignty risk assessments address cloud dependency; LLMs are still absent from that framework. Any AI deployment in an essential or important entity under NIS2, or in an Annex III category, should carry a documented and periodically exercised fallback to an alternative model, including at least one self-hostable open-weight option - to avoid a repeat of the June 2026 scenario.
Require model provenance disclosure in public procurement. The Cyber Resilience Act established that software supply chains must be declarable through bills of materials, and the same logic applies with greater force to models, where a derivative may sit several steps from a base model whose training regime the deploying authority has never examined (Quartz, 2026). A model bill of materials should be mandatory: base model identity and version, licence, fine-tuning and distillation lineage, hosting jurisdiction, and evaluation results relied upon. An institution that cannot say what it depends on cannot plan for its unavailability.
Optimise compute policy for governed access and local deployment, and treat grid capacity and materials processing as AI infrastructure. Ownership and governance conditions should be specified before capacity is contracted: who holds operational control, who allocates access, under whose jurisdiction the operating entity sits, and what happens if a supplier withdraws support (The Future Society, 2026). A defined share of allocation should be reserved for public-interest use, and a parallel programme should fund locally deployed open-weight models on institutional servers for universities, hospitals and administrations (Buhler, Pérez and Boettiger, 2026). On the physical layer, strategic AI projects should receive priority grid connection and connection queues should move from first-come-first-served to readiness-based allocation. On materials, a supply chain in which Europe mines domestically and refines in China leaves the EU vulnerable. The priorities are midstream refining and separation, permanent magnets and recycling, with Union-level stockpiles for the materials with the shortest substitution horizons (European Parliament, 2025a).
Formalise AI security cooperation with the UK and coordinate access terms with other middle powers. The Commission’s own Action Plan names the network coordinated by the UK AI Security Institute as an important platform for common evaluation methodologies (European Commission, 2026a), which means Europe’s flagship cyber-AI strategy depends on a non-EU institute for a function EU capacity will not perform before 2027. A formal arrangement should cover mutual recognition of pre-deployment evaluations, reciprocal secondment, shared cyber ranges and coordinated threat intelligence linking AISI, NCSC, ENISA and CERT-EU. Individually no European state has leverage over the release schedules of frontier developers; collectively the EU with the UK, Japan, South Korea, Canada and Australia represents a substantial share of the regulated market. The achievable agenda is narrow: common criteria for structured access so the European Blueprint is not a document providers can route around, and a shared position on pre-release evaluation above defined capability thresholds.
Beyond Europe
Europe is examined here in detail because it has moved furthest down the path of trying to regulate what it cannot control, and because its choices will shape the governance frameworks other democracies are offered, or will adopt, or reject. But the structural problem is not European.
Japan hosts frontier AI on American infrastructure; South Korea’s semiconductor industry feeds chips into systems whose training and deployment it does not direct. India’s digital public infrastructure, built at extraordinary scale, runs on cloud services ultimately governed by US terms of service. Canada, Australia, the United Kingdom - none of them occupy a meaningfully different position. Brazil’s AI governance debate is conducted in the shadow of the same infrastructural facts.
Any democracy that did not build frontier AI capacity - which is almost all of them - faces a version of the same exposure: Critical systems running on infrastructure it does not own, governed by contracts it did not write, subject to decisions made in boardrooms and legislatures it cannot reach. Europe is the case study, but the condition is general.
Conclusion
To put it plainly and starkly: The arms race framing is a trap. It produces either paralysis or expenditure aimed at a competition Europe, Japan, Canada, Brazil and all of the others cannot win on those terms, while the actual problem goes unaddressed. June 2026 was not a warning, or a fluke; it was a demonstration - that European institutions lost access to systems embedded in their workflows, without notice, without a transition period, and without any framework that had anything to say about it. In this instance, the access returned; next time it may not.
Europe has built most of the institutional architecture required to sidestep the trap and engage on its own terms. The AI Act, the sovereignty package, the evaluation capacity being built toward 2027 - these are serious instruments, assembled faster than Europe's reputation for speed would suggest. What they are not is sequenced against the actual rate of change. Capability diffusion now moves in months. Autonomous cyber task horizons are halving on a similar timescale. A regulatory framework designed for four-year review cycles is running, structurally, behind the thing it is trying to govern. A rulebook nobody has seen enforced is not a rulebook. A deadline that moves under pressure is not a deadline. A sovereignty strategy running on foreign chips, foreign infrastructure, and foreign-owned operating entities has substituted location for control.
What June 2026 revealed is something more fundamental than a planning failure: The capacity of European democratic institutions to function - to deliver services, to adjudicate rights, to maintain continuity of governance - now depends in part on decisions made in jurisdictions those institutions cannot influence, by companies they do not regulate, on timelines they had no part in setting.
More broadly, citizens have a right to public institutions that can keep working. Securing that right, in the conditions that now exist, is the project for Europe, and for all of the world’s democracies that currently depend on U.S. technology. Europe has most of what it needs to pursue it. What has been missing is the will to treat the deadlines as real, the enforcement as serious, and the democratic stakes as the ultimate, clear-eyed goal.
References
AI Security Institute (2026) ‘How fast is autonomous AI cyber capability advancing?’, AISI Blog, 13 May. Available at: https://www.aisi.gov.uk/blog/how-fast-is-autonomous-ai-cyber-capability-advancing
AK EUROPA (2026) ‘Europe advances digital sovereignty as EU Commission unveils measures to strengthen technological independence’, 19 June. Available at: https://www.akeuropa.eu/en/europe-advances-digital-sovereignty-eu-commission-unveils-measures-strengthen-technological
Anthropic (2025) Disrupting the First Reported AI-Orchestrated Cyber Espionage Campaign, Threat Intelligence Report, November. Available at: https://anthropic.com/news/disrupting-AI-espionage
Bloomberg (2026) ‘Moonshot unveils Kimi K3 AI model, narrowing gap with US rivals’, 17 July. Available at: https://www.bloomberg.com/news/articles/2026-07-17/china-s-powerful-new-moonshot-ai-model-closes-gap-with-us-rivals
Buhler, C.K., Pérez, F. and Boettiger, C. (2026) ‘Why scientists should lead the shift away from AI mega data centres’, Nature, vol. 656, no. 8127, pp. 296-298, doi: 10.1038/d41586-026-02451-2. Available at: https://www.nature.com/articles/d41586-026-02451-2
Carril-Caccia, F. and Goemans, J. (2023) ‘Public procurement in Europe: evidence on costs and delays’, Empirica, vol. 50, pp. 481-509, doi: 10.1007/s10663-022-09551-x.
CEIAS (2026) ‘Chinese LLMs and the spillover effects of political alignment’, Central European Institute of Asian Studies, July. Available at: https://ceias.eu/chinese-llms-and-the-spillover-effects-of-political-alignment/
CERT-EU (2026) ‘AI is changing the economics of vulnerability discovery. Defenders should adapt now’, 21 April. Available at: https://www.cert.europa.eu/blog/ai-vulnerability-discovery-defenders-must-adapt
Christian Science Monitor (2026) ‘College grads face a global squeeze on entry-level jobs’, 29 July. Available at: https://www.csmonitor.com/Business/2026/0729/unemployment-youth-jobs-work-economy
CNBC (2026a) ‘China’s Moonshot AI unveils Kimi K3 that rivals OpenAI, Anthropic’, 17 July. Available at: https://www.cnbc.com/2026/07/17/moonshot-ai-kimi-k3-model-openai-anthropic-china.html
CNBC (2026b) ‘Anthropic says Trump admin has lifted export controls on Claude Fable 5 and Mythos 5’, 30 June. Available at: https://www.cnbc.com/2026/06/30/anthropic-says-trump-admin-has-lifted-export-controls-on-claude-fable-5-and-mythos-5.html
CNBC (2026c) ‘Europe unveils tech sovereignty package amid growing concerns over reliance on U.S. tech’, 3 June. Available at: https://www.cnbc.com/2026/06/03/europe-tech-sovereignty-us-tech-reliance.html
CMS Law (2025) ‘EU AI Act: market surveillance authorities notified under Article 70’, CMS Expert Guide, August. [No public URL confirmed - internal CMS client guide.]
Cooley (2026) ‘Digital AI Omnibus delays key deadlines, introduces new rules’, Cyber/Data/Privacy Insights. Available at: https://cdp.cooley.com/digital-ai-omnibus-delays-key-deadlines-introduces-new-rules/
Council of the European Union (n.d.) ‘Critical Raw Materials Act’. Available at: https://www.consilium.europa.eu/en/policies/the-critical-raw-materials-act/
ECB (2026) ‘Youth employment amidst cooling labour demand’, ECB Economic Bulletin, Issue 5/2026, 6 August. Available at: https://www.ecb.europa.eu/press/economic-bulletin/focus/2026/html/ecb.ebbox202605_04~faa9ef5955.en.html
Economist Impact (2026) ‘Europe risks irrelevance in the frontier AI race’. Available at: https://insights.economistenterprise.com/technology-innovation/europe-risks-irrelevance-in-the-frontier-ai-race
Epoch AI (2026a) ‘Chinese AI models have lagged the US frontier by 7 months on average since 2023’, Data Insights, 2 January. Available at: https://epoch.ai/data-insights/us-vs-china-eci
Epoch AI (2026b) ‘Open models lag state-of-the-art closed models by 4 months’, Data Insights, 29 May. Available at: https://epoch.ai/data-insights/open-closed-eci-gap
Epoch AI (2026c) ‘The geopolitics of AI: data and research’. Available at: https://epoch.ai/topics/geopolitics
ETUC (n.d.) ‘The EU needs a dedicated Directive on Algorithmic Management and AI at work’, European Trade Union Confederation. Available at: https://www.etuc.org/en/circular/eu-needs-dedicated-directive-algorithmic-management-and-ai-work
Eurelectric (2026) AI and the Era of Electric Intelligence, June. Available at: https://www.eurelectric.org/publications/ai-the-era-of-electric-intelligence/
Euronews (2026) ‘Europe is hungry for AI data centres, but its energy grid cannot feed them’, 5 May. Available at: https://www.euronews.com/next/2026/05/05/europe-is-hungry-for-ai-data-centres-but-its-energy-grid-cannot-feed-them
European Commission (n.d.) ‘Regulatory framework for AI’, Shaping Europe’s Digital Future. Available at: https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
European Commission (2026a) Action Plan on Cybersecurity and Artificial Intelligence, Communication COM(2026) 577 final, Strasbourg, 7 July. Available at: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A52026DC0577
European Commission (2026b) ‘Strengthening Europe’s tech sovereignty’, 3 June. Available at: https://commission.europa.eu/news-and-media/news/strengthening-europes-tech-sovereignty-2026-06-03_en
European Commission (2026c) ‘Proposal for the Cloud and AI Development Act’, Shaping Europe’s Digital Future. Available at: https://digital-strategy.ec.europa.eu/en/library/proposal-cloud-and-ai-development-act-cada
European Commission (2026d) ‘Commission selects EUROPA consortium as the winner of the Frontier AI Grand Challenge’, 19 June. Available at: https://digital-strategy.ec.europa.eu/en/news/commission-selects-europa-consortium-winner-frontier-ai-grand-challenge-project-build-european-open
European Commission (2026e) ‘AI talent, skills and literacy’, Shaping Europe’s Digital Future. Available at: https://digital-strategy.ec.europa.eu/en/policies/ai-talent-skills-and-literacy
European Commission (2026f) ‘The future of work’, Employment, Social Affairs and Inclusion. Available at: https://employment-social-affairs.ec.europa.eu/policies-and-activities/rights-work/future-work_en
European Court of Auditors (2025) The European Chips Act: Europe’s Bet on Semiconductors, Special Report SR/2025/08, Luxembourg.
European Parliament (2025a) China’s Rare-Earth Export Restrictions, EPRS At a Glance PE 779.220, Brussels. Available at: https://www.europarl.europa.eu/thinktank/en/document/EPRS_ATA(2025)779220
European Parliament (2025b) Resolution of 17 December 2025 with recommendations to the Commission on digitalisation, artificial intelligence and algorithmic management in the workplace, 2025/2080(INL). Available at: https://www.europarl.europa.eu/doceo/document/TA-10-2025-0337_EN.html
Forbes (2026a) Sircar, A., ‘Anthropic disabled Fable 5 and Mythos 5 after a U.S. export-control order. Here’s what happened’, 16 June. Available at: https://www.forbes.com/sites/anishasircar/2026/06/16/anthropic-disabled-fable-5-and-mythos-5-after-a-us-export-control-order-heres-what-happened/
Forbes (2026b) Bou, E., ‘Europe can’t recreate Silicon Valley. Here’s what it can build instead’, 26 August. Available at: https://www.forbes.com/sites/elenabou/2026/08/26/europe-cant-recreate-silicon-valley-heres-what-it-can-build-instead/
Futurum Group (2026) ‘AI isn’t coming for your job yet - and maybe never will’, 22 July. Available at: https://futurumgroup.com/insights/ai-isnt-coming-for-your-job-yet-and-maybe-never-will/
García-Herrero, A. and Martens, B. (2026) ‘Europe needs a strategy to close the artificial intelligence compute gap’, Analysis 13/2026, Bruegel, Brussels. Available at: https://www.bruegel.org/analysis/europe-needs-strategy-close-artificial-intelligence-compute-gap
Haataja, M. and Bryson, J.J. (2021) ‘What costs should we expect from the EU’s AI Act?’, SocArXiv, Center for Open Science. Available at: https://osf.io/preprints/socarxiv/8nzb4_v1
Illingworth, S. and Iorio, B. (2026) ‘Reclaiming human skills as core skills in the age of AI’, GIEF Commentary, Geopolitical Insight and Education Foundation, 15 June. Available at: https://www.giefoundation.net/drivers-of-instability-and-effects-on-our-democracies/reclaiming-human-skills-as-core-skills-in-the-age-of-ai
Law and Technology (2026) ‘AI literacy: the Digital Omnibus rewrites Article 4 of the AI Act’, 30 July. Available at: https://lawandtechnology.eu/en/ai-literacy-digital-omnibus-article-4-ai-act/
Mariniello, M. (2026a) ‘The right balance: how to fix European Union artificial intelligence regulation’, Policy Brief, Bruegel, Brussels. Available at: https://www.bruegel.org/policy-brief/right-balance-how-fix-european-union-artificial-intelligence-regulation
Mariniello, M. (2026b) ‘The case for a European Union digital enforcement authority’, Policy Brief, Bruegel, Brussels, 5 March. Available at: https://www.bruegel.org/policy-brief/case-european-union-digital-enforcement-authority
McNair Center (2026) ‘The US-China AI gap is very uncertain’. Available at: https://mcnair.center/china/
OECD (2025) Towards a Common Reporting Framework for AI Incidents, OECD Artificial Intelligence Papers, no. 34, doi: 10.1787/f326d4ac-en. Available at: https://www.oecd.org/en/publications/towards-a-common-reporting-framework-for-ai-incidents_f326d4ac-en.html
Pan, J. and Xu, X. (2026) ‘Political censorship in large language models originating from China’, PNAS Nexus, vol. 5, no. 2, pgag013. Available at: https://academic.oup.com/pnasnexus/article-pdf/5/2/pgag013/66929680/pgag013.pdf
Pew Research Center (2025) AI Regulation: Who Do People Trust? Results of a 25-Country Survey, October, Washington DC.
Qi, X., Zeng, Y., Xie, T., Chen, P.-Y., Jia, R., Lou, W. and Li, B. (2023) ‘Fine-tuning aligned language models compromises safety, even when users do not intend to’, arXiv:2310.03693, presented at NeurIPS 2023 Workshop on Socially Responsible Language Modelling Research. Available at: https://arxiv.org/abs/2310.03693
Quartz (2026) ‘Moonshot AI releases Kimi K3 open-weight model for download’, 27 July. Available at: https://qz.com/moonshot-ai-kimi-k3-open-weights-download-072726
Semafor (2026) ‘Censorship in Chinese AI models can be undone, new research shows’, 29 July. Available at: https://www.semafor.com/article/07/29/2026/censorship-in-chinese-ai-models-can-be-undone-new-research-shows
Stanford HAI (2026) The 2026 AI Index Report, Stanford Institute for Human-Centered Artificial Intelligence, Stanford. Available at: https://hai.stanford.edu/research/ai-index-report
Synergy Research Group (2024) ‘European cloud providers’ local market share now holds steady at 15%’, Market Intelligence, Reno NV. Available at: https://www.srgresearch.com/articles/european-cloud-providers-local-market-share-now-holds-steady-at-15
TechPolicy.Press (2026) ‘EU unveils sweeping tech sovereignty push, balancing autonomy with openness’, 4 June. Available at: https://www.techpolicy.press/eu-unveils-sweeping-tech-sovereignty-push-balancing-autonomy-with-openness/
The Future Society (2026) Beware of Geeks Bearing Gifts: Building True EU Frontier AI Sovereignty, 17 April. Available at: https://thefuturesociety.org/eu-frontier-ai-sovereignty-report