Ron Spoelstra·8 May 2026·Update #14 — The Great Return

On 7 May 2026, the European Parliament and the Council reached a political agreement on the Digital Omnibus on AI. The Commission called it “simpler, innovation-friendly rules” and noted that the proposal had moved from publication to deal in five months. Henna Virkkunen said it made innovating easier without lowering the bar on safety.

All of that is accurate. None of it is the interesting sentence from this week.

The interesting sentence is from the days before: the talks collapsed.

The Session That Ended Without a Deal

The supposedly final trilogue session ended without agreement. Negotiators from the European Parliament and EU member states parted ways after hours of talks, with no deal and no date set to resume. August 2026, the original AI Act high-risk enforcement date the Omnibus was designed to replace, was still on the calendar.

The sticking point was Annex I-B. The centre-right in Parliament, backed by the German government’s position, wanted products such as industrial machinery and medical devices to comply with sectoral product safety law rather than the AI Act’s horizontal obligations. The AI Act would retain its structure on paper, but embedded AI in regulated products would follow a different compliance path. Several member states and the centre-left bloc opposed it, arguing that moving product-embedded AI to sector-specific rules would fragment the horizontal framework, create diverging standards across 27 national implementations, and ultimately produce less protection rather than simpler regulation. Multiple organisations, including TÜV-Verband, AlgorithmWatch, and ForHumanity, had written the same argument in an open letter weeks earlier.

The German position had an internal fracture. Chancellor Friedrich Merz had been vocal about EU AI rules being a “corset” on industrial AI and had pushed aggressively for the cuts. But the day before the final session, the Social Democrat group in the German Bundestag sent a letter to European lawmakers marked “VERY URGENT! Trilogue on AI Digital Omnibus”, urging opposition to any weakening of the horizontal approach. Merz was not aligned with his own coalition partner. The SPD’s letter warned that the proposed changes would bring significant risks, create inconsistent rules, lead to protection gaps, and ultimately benefit foreign companies more than European ones.

When the session ended without a deal, legal counsel across Europe maintained the same advice they had given since February: treat August 2026 as the operative deadline until there is law confirming otherwise. The compliance clock had not been paused. It was still running.

Six Days Later

On 7 May, the deal closed.

The resolution of the sticking point was architectural rather than principled. Product-embedded AI (machinery, medical devices, lifts, toys) was given a second implementation track: a later application date of 2 August 2028, with the interplay between the AI Act and the Machinery Regulation explicitly clarified to avoid duplicating obligations. The horizontal structure of the AI Act was preserved in name and in substance for most high-risk systems. The practical effect of the EPP’s demand (more time and reduced overlap for industrial AI) was granted through the timeline rather than through the structural carve-out that had broken the session.

The full structure of what was agreed:

From 2 December 2027: high-risk AI systems in biometrics, critical infrastructure, education, employment, migration, asylum, and border control. This is the primary category the paper was tracking when it stated Prediction 2.1. It is the category most organisations in regulated sectors have been preparing for.

From 2 August 2028: AI systems integrated into products regulated under EU product safety law: machinery, medical devices, in vitro diagnostics, radio equipment, lifts, toys. The horizontal debate was not abandoned. It was resolved by giving the contested category a later date and a clearer interoperability clause.

New prohibition: AI systems that generate non-consensual sexually explicit content or child sexual abuse material. The ban had cross-party support throughout the negotiations and is the one new restriction added by the Omnibus in a package that otherwise reduces obligations.

SME provisions extended to small mid-cap companies. Regulatory sandboxes delayed to December 2027, including an EU-level sandbox that does not yet exist. AI Office enforcement powers strengthened, specifically for systems built on general-purpose models and those embedded in very large online platforms and search engines.

And then the item at the bottom of the press release: high-risk classification guidelines described as “upcoming,” to be released alongside the Omnibus entering into force. The guidelines on high-risk classification, the document the Commission missed in February, delayed again in March, and now describes as “upcoming” without a published date, are still not part of the agreement. The deadline moved. The guidance still does not exist.

A note on status: what was reached on 7 May is a political agreement between Parliament and Council. Formal adoption by both institutions still follows, after which the amended text will be published in the Official Journal and enter into force within three days. The Commission expects that process to complete before August 2026. Until formal adoption, the original AI Act deadlines remain technically in force. Legal counsel advising organisations to treat August 2026 as operative until further notice are not wrong.

Prediction 2.1: Confirmed Revised

The paper stated that EU AI Act high-risk obligations would apply from August 2, 2026, with no delay. That prediction has been conditional since Update #5 in March, when the Omnibus proposal was still in trilogue. It is now confirmed in its revised form: August 2026 is no longer the operative deadline. December 2027 has replaced it for the primary category of high-risk systems.

To be precise about what that means: the original prediction as stated in the paper — no delay, August 2026 operative — is now incorrect. What is confirmed is the revised tracking applied since Update #5: the delay was conditional on the Omnibus being enacted, the condition has been met, and the extension is on course to become law. These are different claims. Marking one wrong and the other right is not hedging. It is the record.

The caveat from Update #10 (“Local by Necessity”) applies in full. The Omnibus moved the deadline by 16 months. It did not fill the compliance vacuum that 16 months was supposed to give organisations time to prepare for. The high-risk classification guidelines that would tell organisations whether their system is in scope do not exist. The harmonised technical standards under Standardisation Request M/613 that would enable CE marking for high-risk systems were in draft as of January 2026 and remain unfinished. The AI Liability Directive, withdrawn by the Commission in early 2025, has not been replaced, leaving 27 different national civil liability regimes covering AI-related harm. The enforcement bodies in many member states have not been formally designated, despite a designation deadline that passed in August 2025.

December 2027 is 19 months away. The shelf that organisations need to fill for compliance remains largely empty. The extension gives time. It does not supply the missing instruments.

There is a political observation worth making once: the deadline moved before. It moved under the same combination of forces: industry pressure, member state divergence, internal coalition fracture, regulatory fatigue. Those forces have not been resolved by the agreement. They have been noted and set aside. December 2027 is now the firm date in the same way August 2026 was once the firm date. The organisations treating it as firm are probably right. They are not guaranteed.

The Argument the Omnibus Cannot Amend

The paper’s argument was never primarily about the AI Act deadline. It was about the convergence of four forces: geopolitical, environmental, hardware maturity, and the broader regulatory constellation. The AI Act was the fourth force, not the only one, and not the strongest.

GDPR was not amended by the Omnibus. It cannot be. GDPR is a separate regulation with its own enforcement machinery and its own fines. Health data remains special category data under Article 9. Cross-border transfers outside the EEA still require a valid transfer mechanism that, post-Schrems II, remains genuinely difficult to construct. An organisation that sends patient data through a US cloud API is not facing a potential compliance issue in December 2027. It is potentially in breach today.

NIS2 was not softened. Critical sector organisations (healthcare, energy, transport, finance) still face supply chain security obligations that include their AI supply chains. A US hyperscaler subject to the CLOUD Act sits in that supply chain. NIS2 requires the risk to be assessed, documented, and addressed. There is no NIS2 grace period attached to the Omnibus.

The geopolitical trajectory was not reversed. France’s DINUM is still migrating to Linux. The Health Data Hub is still moving from Azure to Scaleway. The Cohere–Aleph Alpha merger, the European AI consolidation event the paper predicted, is still pending regulatory approval. The Proximus NXT Cloud III contract is still a six-year Commission commitment to a European sovereign stack. None of these decisions depend on whether high-risk AI enforcement applies in August or December.

The organisations that moved to local AI in the first quarter of 2026 were not doing it because of the August 2026 deadline. They were doing it because cloud-based AI cannot satisfy the compliance requirements they operate under, right now, independent of any AI Act calendar. The Omnibus extends the window. It does not change the direction.

That last sentence is the paper’s analytical position, not a statement of fact. The counter-reading is that extended deadlines reduce compliance pressure, give cloud AI more runway, and slow the pace of local migration. That reading is reasonable. The case for disagreeing with it is laid out above: GDPR and NIS2 are operative now, geopolitical pressure is not calendar-dependent, and the procurement decisions already made do not reverse because a deadline moved. But readers following this series should know they are reading an argued position, not an established outcome.

The Week’s Other Story

The trilogue was not the only AI story running in Brussels this week.

The European Parliament’s internal market committee invited Anthropic to a hearing on the Mythos model, the AI system the company chose not to release after internal evaluations showed it could autonomously complete all 32 steps of the UK AI Security Institute’s corporate network attack simulation and identify thousands of vulnerabilities in live internet infrastructure. Anthropic briefed the Commission directly on the technical details. AI Office head Lucilla Sioli and ENISA were both included in the hearing invitation. OpenAI has announced a comparably capable model, GPT-5.4-Cyber, to be released less restrictively.

This is the context in which the Omnibus agreement was reached. While the Parliament was debating whether to delay enforcement obligations for AI in industrial machinery by an extra year, the most capable cyber-offensive AI system documented to date was being discussed in the same building.

The AI Act was drafted before the rise of agentic AI, before frontier cybersecurity capabilities reached this level, before Mythos. The Omnibus delayed implementation by 16 months. It did not expand the Act’s scope to address what Mythos represents. Those are not criticisms of the Omnibus; timeline adjustments and scope expansions are different legislative instruments. They are descriptions of what the agreement is: a proportionality and sequencing measure applied to a regulation that was already a step behind the technology it governs. The AI Office’s legal basis for oversight of Mythos, under GPAI systemic risk provisions, exists. Its capacity to act at the pace the technology is moving remains to be demonstrated.

What the Scorecard Shows

Update #13 (The April Stack) brought the scorecard to 12 of 30, with two predictions closing in April: the Health Data Hub migration from Azure to Scaleway confirming European cloud technical parity for regulated-sector workloads, and the Cohere–Aleph Alpha merger confirming the European AI consolidation event.

The Omnibus agreement closes one more.

Prediction 2.1 (AI Act high-risk obligations from August 2026 with no delay) moves from conditionally revised to confirmed revised. August 2026 is no longer the operative deadline. December 2027 is. The prediction as written did not survive contact with the political process. The argument it was part of, that the regulatory constellation makes local AI structurally advantageous for European organisations, is reinforced, not weakened, by the delay. An extended compliance vacuum favours the organisations that recognised it earliest and built accordingly.

Scorecard: 13 of 30. The next category to watch: the managed service layer predictions from Chapter 7, the sector-by-sector adoption curves that were projected for the 2026–2028 window, and the December 2027 enforcement date itself, which will be tested in real time by the same political forces that moved the first one.

This investigation is part of the research series accompanying The Great Return: Why 2026 Marks the Tipping Point for Local AI Migration in Europe — published February 2026. Full paper: DOI 10.5281/zenodo.18511984

Ron Spoelstra·29 April 2026·Update #9 — The Great Return

April 13, 2026.

Two governments made the same announcement on the same day. France’s DINUM declared it would begin migrating its own agents from Windows to Linux. Germany’s federal administration validated the operational launch of the Deutschland-Stack, a sovereign technology platform for the public sector. Neither government knew the other was going to move that week. The convergence was not coordinated.

That is the more important detail.

When governments move in parallel without coordination, they are not following a leader. They are responding to the same pressure. The pressure is structural: US tariff unpredictability, the CLOUD Act’s reach over American cloud providers, geopolitical instability that makes foreign-controlled infrastructure a strategic liability, and a domestic software ecosystem that has matured enough to absorb the transition costs.

By April 28, the Netherlands had launched its sovereign government Git platform. Denmark’s engineers had published a map of which municipal email systems run on US-controlled servers, and the International Criminal Court’s migration away from Microsoft had been confirmed. The month did not produce a single large announcement. It produced a stack of them.

France: The Architecture of Departure

The French move is the most technically detailed of the four.

DINUM’s interministerial seminar in April, attended by ANSSI, DGE, and DAE, announced a migration plan beginning with 234 of its own agents. The target operating system is not commercial Linux. DINUM built its own: two distributions on the NixOS base.

Sécurix is the hardened administrative OS: ANSSI-certified, with FIDO2 hardware keys, Secure Boot and TPM2 integration, and kernel hardening targeting the adversary models that ANSSI documents. It is the OS for civil servants who handle sensitive data. Bureautix is the NixOS-derived desktop workstation for general office use. Together they replace Windows at both the security-critical and productivity tiers.

The ambition does not stop at the operating system. DINUM is also planning to replace Active Directory (Microsoft’s directory service, the authentication backbone of most public-sector IT infrastructure in Europe) with a decentralized alternative. This is the part of the announcement that produced the most skepticism in the French technology press. Active Directory is not just software. It is twenty years of accumulated organizational dependency: permissions, policies, provisioning, and identity. Replacing it is a multi-year infrastructure project, not a switch.

The ministerial mandate extends beyond DINUM’s own estate. By autumn 2026, every French ministry must formalize its own dependency reduction plan across seven axes: workstations, collaborative tools, antivirus, AI systems, databases, virtualization, and network equipment. The mandate comes with a political statement from Digital Minister David Amiel: “L’État ne peut plus se contenter de constater sa dépendance, il doit en sortir. Nous devons nous désensibiliser des outils américains et reprendre le contrôle de notre destin numérique.”

In parallel, the CNAM (the French health insurance body, covering 80,000 agents) is migrating to Tchap (the sovereign messaging platform), Visio-Agents, and FranceTransfert. And the Health Data Hub, which manages France’s health data and currently runs on Microsoft Azure, has confirmed its migration to Scaleway, the French cloud provider. The target window is end of 2026 to early 2027. Scaleway now holds HDS certification and SecNumCloud trajectory status. Seven years ago, when the Health Data Hub was established, Scaleway was rejected as a hosting option because it lacked PaaS capacity. It has built that capacity.

The critics are not silent. cio-online published the “village gaulois” critique: France is building national forks of open-source software that are incompatible with equivalent German and Dutch projects. GendBuntu (Gendarmerie), Sécurix, LiMux (Munich), OpenDesk, Le Suite: all are sovereign, none are interoperable. CIGREF, the network of large French corporations, supports DINUM’s EuroStack initiative but shares the fragmentation concern.

The critique is fair. It is also, for the moment, a second-order problem. The first-order problem is the dependency. The fragmentation can be addressed by standardization later. Fragmentation among European stacks is better than unified dependency on American ones.

Germany: The Stack and the Merger

Germany’s April 13 announcement was quieter in tone but broader in scope.

The Deutschland-Stack is not a single product. It is a validated technology catalogue for the federal public sector covering document formats, file storage, messaging, authentication infrastructure, and development tools. Its most significant immediate mandate: ODF (the Open Document Format) is now required for all public sector document exchange. OOXML, Microsoft’s format, is out.

Italo Vignoli of The Document Foundation, the organization that maintains LibreOffice, called this the right framing: “L’ODF est le format de la souveraineté numérique… Il a été conçu pour un avenir où aucun fournisseur unique ne pourra contrôler le niveau documentaire de la civilisation.” The document format is infrastructure. When a format is controlled by one vendor, that vendor controls the terms of access to every document written in it. ODF removes that control.

Germany’s sovereign AI move came eleven days later. On April 24, Cohere, the Canadian enterprise AI company, announced plans to acquire Aleph Alpha, the German AI firm that had previously positioned itself as Europe’s sovereign LLM champion before pivoting away from large-scale model development in 2024. The deal has not yet closed and remains subject to regulatory approval. According to Handelsblatt, a term sheet values the combined entity at approximately $20 billion.

The deal’s strategic anchor is the Schwarz Group, the parent company of Lidl and Kaufland, which is investing €500 million ($600 million) in Cohere’s upcoming Series E round and committing the combined entity to run on STACKIT, the sovereign cloud platform operated by Schwarz Digits. STACKIT is already certified for German public sector workloads. In practical terms, Schwarz Group is acquiring a major enterprise customer for its cloud business at the same moment it is funding the AI merger. The combined company targets energy, defence, finance, telecom, health, and public sector customers in Europe, building on Aleph Alpha’s existing commercial relationships with the German ministry for digital affairs and the Baden-Württemberg regional government.

The deal did not happen in a vacuum. In February 2026, Canada and Germany signed a Sovereign Technology Alliance, a bilateral framework explicitly designed to “strengthen sovereign AI capacity and reduce strategic technology dependencies.” The Cohere–Aleph Alpha merger is the first major commercial expression of that alliance. Digital Minister Karsten Wildberger was direct about the reasoning: Europe needs a different path from the American one, built through partnership rather than platform dependency.

The sovereignty question attached to this deal is real and unresolved. Cohere is on a trajectory toward an IPO. When that happens, ownership passes to global shareholders with no particular allegiance to either Canada or Germany. CEO Aidan Gomez has said the merged entity will become “a Canadian-German company,” but a post-IPO ownership structure is difficult to hold to a nationality. European organisations considering this as a sovereignty alternative are betting on the cultural DNA of the entity rather than its ownership structure. That is a reasonable bet in 2026. Whether it holds in 2028 is the open question.

The honest bracket on Germany’s April: on April 28, Heise reported that German federal agencies are still “far from digital sovereignty” in practice, and that alternative software remains an exception rather than the rule. In Bavaria, the state finance ministry is actively seeking to renew its Microsoft contracts, drawing opposition from legislators who want a sovereignty-first approach instead. The Deutschland-Stack is a policy framework. It is not yet an operational reality for most of the German government.

This is the gap between declaration and deployment. France is in the same gap. So is everyone else.

Netherlands: The Open Code Principle

On April 28, the Dutch Ministry of Interior launched code.overheid.nl, a government Git platform built on Forgejo, a European open-source code hosting platform. The principle behind it is “Open, tenzij”: open by default, closed only when there is a documented reason for exception. Government code, government data, government software: publicly available, forkable, auditable.

The same week, the Open Cloud Alliantie, a coalition of seven Dutch IT companies including KPN, Centric, and Uniserver with combined annual revenue of €2.5 billion and over 13,000 IT professionals, presented its programme to parliament. The coalition’s goal: recapture 10 percent of government IT spending for Dutch providers over the next cycle. The stated motivation was not principally about cost. It was about resilience. The coalition’s statement: “We moeten er niet aan denken dat door internationale spanningen systemen in de toekomst simpelweg worden uitgezet.”

“We don’t want to think about international tensions simply causing systems to be shut off.”

Capgemini Research published simultaneously: 67 percent of Dutch companies now have a reindustrialisation strategy that includes sourcing. Ninety percent cite geopolitical tensions as a driver of local sourcing decisions. Against the aggregate figure of €285 billion flowing from European organisations to US IT suppliers every year, the Dutch numbers are a data point in a larger redistribution that is still mostly theoretical. But the direction is set.

Denmark: The Case That Made It Concrete

In the abstract, sovereignty risk is hard to visualise. In April, Denmark provided the concrete version.

On April 14, Ingeniøren/Version2 reported that Ishøj Kommune, a municipality of roughly 22,000 residents southwest of Copenhagen, had reduced its Microsoft 365 licence count so that only half of its employees still hold a full Microsoft licence. The other half (home helpers, SOSU workers, teachers, pedagogical assistants) have been migrated to open-source alternatives. The reasoning: light users do not need a full Microsoft suite. A different architecture costs less and creates less dependency.

On April 28, Version2 published a map.

The map shows which Danish municipalities route their email through servers under American corporate control: Microsoft and Google infrastructure subject to US law, including the CLOUD Act. The investigation, conducted by security firm CSIS, found that deep technical dependencies on American tech are the norm, not the exception. The IT directors quoted in the article trust their vendors. The experts quoted do not think trust is the right framework. What happened at the International Criminal Court in The Hague is the reason why.

Last year, the ICC became subject to US sanctions targeting its Chief Prosecutor. Microsoft informed the court that the sanctions required it to cut off the Prosecutor’s access to Microsoft services. If the ICC did not itself suspend the Prosecutor’s account, Microsoft stated it would shut down email services for the entire organisation. The ICC suspended the account. A court that adjudicates war crimes was operating under a de facto veto held by a commercial software vendor responding to the instructions of one government.

The ICC is now migrating to OpenDesk, the European open-source office suite developed through a German-Dutch collaborative. The announcement is expected in the coming weeks.

The Digitaliseringsstyrelsen, Denmark’s Agency for Digitisation, has published “Digital suverænitet i den offentlige sektor,” an analysis of sovereignty in public-sector digital infrastructure drawing on experience from home and abroad. The joint public digitalisation strategy 2026–2029 is in place. Denmark is not moving as fast as France or Germany. But it is asking the right questions in public, which is usually the step before moving.

The Honest Map

This update set out to cover all of Europe. It is honest about what it found.

The lead edge of the Great Return, in terms of active government decisions, announced programmes, and launched infrastructure, is a cluster of north-western European states. France, Germany, the Netherlands, and Denmark are moving. Switzerland is reducing its Microsoft dependency at the national level. The EU Parliament has published its own report on dangerous digital dependencies.

Poland is worth naming precisely because it is a counter-example. Poland signed substantial contracts with Palantir, the American company, for military and intelligence analytics in 2022 and 2023. Warsaw’s threat model is Russia, not America. From the Polish perspective, exposure to US law through the CLOUD Act is a tolerable risk compared to the alternative. American tech infrastructure is American security guarantees, and in Eastern Europe in 2026, that trade-off looks different than it does in Paris or Amsterdam. Poland’s digital choices are not a failure of sovereignty consciousness. They are a different strategic calculation made under different threat conditions.

Belgium is absent from this update for a specific institutional reason. Belgium hosts the European Commission, the Council, and the Parliament. Any Belgian federal decision about Microsoft creates an immediate precedent question for the EU bodies it hosts, and the Commission is not ready to answer that question. The result is a specific paralysis: Belgian IT policy cannot move visibly ahead of the institutional posture of the bodies it hosts, and those bodies are still forming that posture. It is not passivity. It is institutional entanglement.

Spain has a formal digital sovereignty programme (SEDIA, Red.es) but it is proceeding at the pace of compliance architecture rather than independence architecture. France is building tools. Spain is building reports. The output is the tell: DINUM publishes migration plans and operating system distributions; Spain publishes frameworks and roadmaps. Frameworks are not nothing. They are not Sécurix.

The Eastern flank requires a different frame entirely. Estonia has the most advanced digital government in Europe: X-Road, digital identity, e-residency, a working infrastructure that predates most European digitalisation discussions. But Estonia’s sovereignty concern is resilience and redundancy, not independence from American tech. The Baltic states, Poland, Romania: countries whose primary threat is physical and geopolitical, and whose digital strategy reflects that. They want more American presence, not less. The Great Return is a north-western European phenomenon because north-western Europe has the security latitude to trade American dependency for European alternatives. That latitude does not exist uniformly across the continent.

The absence of these countries from the active-migration category is not a reporting failure. It is a finding about the geography of pressure. The Great Return moves where the security dependence on America is low enough to be traded, and the domestic software ecosystem is mature enough to absorb the transition. Both conditions currently apply to France, Germany, the Netherlands, and Denmark. They do not yet apply uniformly elsewhere.

The demonstration effects from the north-western cluster are now available. Whether they propagate depends on political will in states where the conditions are approaching, and on the Commission eventually resolving the coordination problem it has so far declined to own.

The Tension That Will Determine Completion

The April announcements share a structural problem.

France is building Sécurix. Germany and the Netherlands are building OpenDesk. France is building Le Suite for collaborative tools. Germany has its own track through the Deutschland-Stack. These are not the same projects. They are parallel national responses to the same problem, built on overlapping open-source foundations but without shared governance, shared specifications, or shared deployment infrastructure.

This matters because sovereignty at national scale is insufficient for the organisations that operate across Europe. The European Court of Human Rights, the Europol network, the pan-European rail coordination infrastructure, the institutions of the EU itself: none of these are well served by five national sovereign stacks that cannot interoperate. The fragmentation critique (dismissed as a second-order problem above) is actually a first-order problem for European institutions and cross-border organisations.

There is an answer. The DINUM press noted that Le Suite is in dialogue with Dutch and German counterparts. OpenDesk is building on open standards that Le Suite also uses. The path to interoperability exists technically. Whether it will be taken politically depends on whether the European Commission treats open-source sovereignty stacks as a coordination problem it owns, or leaves each member state to solve independently.

Wero, the European payment initiative launched as a sovereignty alternative to Visa and Mastercard, is still running on Amazon Web Services. If the EU cannot enforce sovereignty-consistent infrastructure choices on its own flagship sovereignty projects, it will struggle to coordinate the national stacks that are now forming independently.

The pressure on European AI companies to accept American partnerships is the same problem in a different register. In April, Elon Musk’s xAI reportedly explored a three-way collaboration with France’s Mistral AI and Cursor. Mistral declined, partly because an American affiliation would undermine the sovereignty positioning that has become the commercial foundation of its revenue. Mistral’s February 2026 acquisition of Koyeb, a French cloud infrastructure company, is the alternative strategy: vertical integration, owning the stack from model to deployment, as a structural defence against exactly this kind of dependency. If Mistral stays independent, it is because sovereignty is profitable. If that changes, the European AI landscape looks very different very quickly.

What the Scorecard Says

Update #8 brought the prediction scorecard to 10 of 30, with the sovereignty-investment cascade moving from “forming” to “active.”

Two predictions close in April 2026.

The paper projected that European cloud providers serving regulated-sector workloads would reach technical parity with US hyperscalers for specific high-sensitivity use cases, driven by certification, proximity regulation, and the demonstrated willingness of US vendors to weaponise service access under legal or political pressure. The Health Data Hub migration from Azure to Scaleway is this prediction completing: a national health authority, with the most sensitive possible data profile, moving to a domestic cloud because the domestic cloud is now technically ready and the foreign cloud is now legally untenable.

The paper also projected a European AI consolidation event: a significant merger or acquisition creating a sovereign-positioned enterprise AI entity with government backing and European capital. The Cohere–Aleph Alpha merger, announced with the support of the German government, anchored by Schwarz Group infrastructure, and enabled by the Canada-Germany Sovereign Technology Alliance, is this prediction completing. The deal has not yet closed, which adds a note of contingency, but the direction of the prediction is confirmed.

Scorecard update: 12 of 30 predictions assessed. 12 in the right direction. The pace of completion has accelerated. The paper estimated that predictions 10–15 would close in the 2026–2027 window. April 2026 alone closed two of them.

The remaining 18 are mostly in the chapters that follow deployment: the managed service layer that sits between sovereign infrastructure and SME users, the skills gap that will slow real absorption, the sector-by-sector adoption curves for healthcare, legal, finance, and manufacturing, and the 2028–2030 political cycle that will determine whether the early movers institutionalise or stall.

The stalling risk is real. Bavaria is still negotiating a Microsoft renewal. German federal agencies are, by their own assessment, far from sovereign in practice. France has committed 234 agents to the migration and mandated that ministries write plans by autumn. Plans are not migrations.

But the direction is set. The month the direction became unambiguous was April 2026.

The Great Return is an ongoing series tracking the structural shift to local-first AI in Europe. Read the original paper →

Ron Spoelstra·24 April 2026·Analysis · The Great Return

The debate about the EU AI Act keeps arriving at the wrong destination — not because the questions are wrong, but because both sides refuse to hold two things at once. Compliance costs are real. The documentation burden for a high-risk AI system is not trivial, and for a small team building on a tight runway, regulatory overhead is a genuine constraint. At the same time, the Act provides structural instruments that carry measurable value: the ability to set deployment terms in the world’s largest single market, enforcement leverage over foreign providers, and a regulatory template that other jurisdictions can and do adopt. Neither fact cancels the other. The debate worth having is whether the Act’s costs are proportionate to what it actually delivers — and whether the loudest voices calling for rollback are the ones who would benefit most from the answer they are promoting.

The Debate as It Actually Stands

The case against the AI Act is not monolithic, and treating it as if it were US-manufactured lobbying misses something important. Criticism comes from multiple directions at once.

European startup founders and investor networks have raised substantive points about legal uncertainty in risk classification. Determining whether a product falls under the high-risk category defined in Annex III is not straightforward, and founders without legal resources face genuine ambiguity at the point where a decision to build has to be made. BusinessEurope, representing European employers, has argued that compliance costs fall disproportionately on European firms competing against US hyperscalers who have already built compliance infrastructure at scale. Several EU member states — including France, home to a growing domestic AI sector — have pushed internally for lighter implementation timelines, not as a concession to Washington, but to protect domestic capacity. The European Parliament’s own Research Service flagged during the drafting process that Annex III’s risk criteria were written at a level of abstraction that would require legal interpretation in most real-world cases.

These concerns exist independently of any US pressure and deserve to be evaluated on their own merits. The repeal argument — compliance overhead, innovation throttling, competitive disadvantage relative to the US and China — is not wrong about the costs. It is incomplete about the alternatives and evasive about who benefits most from removing the framework entirely.

External Pressure Is Real — and Strategically Motivated

The external dimension of this debate is well-documented and should not be minimised. At the Paris AI Action Summit on 11 February 2025, US Vice President JD Vance delivered a significant intervention. “We believe that excessive regulation of the AI sector could kill a transformative industry just as it’s taking off,” he said. He warned that “some foreign governments are considering tightening the screws on U.S. tech companies,” and pledged that “American AI will not be co-opted into a tool for authoritarian censorship.” His position was unambiguous: American AI as the global gold standard, deregulation as the default.

Eleven days later, on 22 February 2025, President Trump signed a memorandum directing his administration to consider tariffs against any country that taxes, fines, or regulates American tech companies. The White House specifically named the Digital Markets Act and the Digital Services Act as targets for scrutiny. This was not a suggestion. It was a trade policy instrument.

What matters is separating two distinct claims: that the US has applied sustained, coordinated pressure to weaken European AI regulation; and that all criticism of the Act is therefore an extension of that pressure. The first claim is well-evidenced. The second is not — and conflating them weakens the sovereignty argument by making it unfalsifiable. European founders raising legitimate concerns about legal uncertainty are not doing Washington’s bidding. Treating them as if they are forecloses the internal debate Europe actually needs to have.

The Digital Omnibus: Pressure from Both Directions

In 2025, the European Commission proposed the Digital Omnibus: a package of amendments that delays high-risk AI compliance deadlines by up to 16 months, pushing obligations for organisations deploying AI in hiring, loan assessment, and similar high-risk domains from August 2026 to December 2027. The Council agreed on its position in March 2026.

Framing this purely as capitulation to US pressure is too simple. The Omnibus had significant support from within Europe: from member states wary of compliance costs landing on domestic businesses, from European trade associations that had lobbied for simplification on their own terms, and from Commission officials who concluded that implementation timelines were not achievable as written. WIRED’s account of Washington and American tech giants coordinating to weaken the law is credible and well-sourced. But that coordination worked in part because it aligned with genuine internal European concerns — it did not manufacture them.

The result is the same either way: a weakened enforcement timeline and a signal that the Act’s ambitions are negotiable. Understanding how that happened matters, because the response looks very different depending on whether the primary problem is external geopolitical pressure, insufficient internal political will, or implementation design failures.

Where the Act Falls Short by Design

An honest assessment of the AI Act must acknowledge that some of its structural weaknesses are design problems, not implementation failures.

The sandbox provisions in Article 62 are a genuine innovation. But the Act delegates sandbox implementation entirely to member states without minimum quality standards, mandatory timelines, or funding guarantees. In practice, sandbox availability across the EU is deeply uneven. A founder in Finland or the Netherlands operates in a materially different regulatory environment than one in a member state that has not yet established a functioning sandbox. This is not bad execution of a good law. It is a decentralised design without a minimum backstop — one that produces predictably unequal outcomes and is unlikely to resolve itself without legislative intervention.

The risk classification framework has a related problem. Annex III’s criteria require legal interpretation in most real-world cases. There are no official safe harbours for lower-risk applications that might technically fall within scope. The result is that founders rationally seek legal counsel before building, not after — a compliance cost that lands before a single line of product code is written. This cannot be resolved by better tooling alone. It requires either narrower legislative language or formally binding guidance with safe harbour effect. The Commission has not yet delivered either, and the Omnibus delay does not address it.

What the Act Does Right for Smaller Builders

Setting aside those design gaps, the Act’s risk-based architecture is correct in one important respect: it concentrates obligations where risk is highest. The majority of AI applications — recommendation systems, document processing tools, internal search functionality — fall outside the high-risk category and face no meaningful compliance burden under the Act itself. The overregulation narrative often conflates the complexity of the full framework with the actual burden on any given builder, and they are not the same thing.

Article 62 of the Act mandates that member states give small and medium-sized enterprises priority access to regulatory sandboxes, with conformity assessment fees explicitly required to be proportional to company size and market reach. The Digital Omnibus extends these protections to a broader category of smaller companies and projects at least €225 million in annual savings. The Commission’s stated target is a 35% reduction in administrative burdens for SMEs by 2029. These provisions exist on paper. The gap between their existence and their operational availability is precisely where the legitimate implementation critique lives — and it is a gap that should be named as such, rather than used to argue that the Act itself is the problem.

It is also worth being precise about what the Act is not responsible for. Europe’s venture capital gap — roughly a 5:1 shortfall versus the US in AI-focused investment, documented by the European Investment Fund — has structural roots: fragmented capital markets, risk-averse institutional investors, and pension funds that do not allocate meaningfully to early-stage ventures. Removing the AI Act would not close that gap. Conflating regulatory overhead with capital market failure is a category error, and one that lets the Commission off the hook for the deeper structural reform it has not yet attempted.

There is a further architectural point worth making carefully: a team running an open-weight model on local infrastructure has a genuinely simpler compliance story than one routing sensitive data through a US cloud API — under the AI Act, under GDPR, and under NIS2 simultaneously. This is true. But it reflects an architectural advantage, not a regulatory strategy in itself. The regulatory environment rewards this architecture; it did not create it, and regulation alone cannot substitute for the infrastructure investment and capital availability that make it viable at scale for the broad market.

The Brussels Effect: Real, with Limits

The concept of the Brussels Effect, developed by Anu Bradford, explains part of why the external pressure on the Act is so sustained. Once the EU sets rules for its internal market, companies worldwide adapt rather than maintaining separate compliance regimes. The GDPR becoming the de facto global privacy standard is the most frequently cited example. The AI Act was designed to replicate this for AI governance. If it succeeds, US firms face cascading global compliance obligations as other jurisdictions align. Weakening the Act at source limits that diffusion. This logic explains the scope of Trump’s memorandum, which targeted not just the AI Act but the DMA, the DSA, and the GDPR: the entire European regulatory stack functions as a market sovereignty instrument, and the external pressure is calibrated accordingly.

Scholars writing in the European Journal of International Law have argued that the AI Act’s global reach may prove more “mirage” than Brussels Effect — more symbolic than practical, lacking the direct market-shaping force of the GDPR. This nuance matters and should not be dismissed by the Act’s defenders. The GDPR succeeded in part because data processing is a universal function of almost every digital product. AI system deployment, as defined in the Act, is more targeted in scope. Whether the Brussels Effect replicates is an open empirical question. What the sustained external pressure confirms is that the Act’s perceived strategic value is high — but perceived value and demonstrated reach are not the same thing.

The Risks of Continued Erosion

The GDPR precedent is worth holding onto. Despite sustained US pressure, Europe held the line on enforcement. By January 2026, cumulative GDPR fines had reached €7.1 billion. US tech companies restructured data practices globally to comply with European rules rather than lose access to the world’s largest single market. That outcome was not guaranteed. It required sustained political will at a moment when yielding would have been easier.

The risks of continued AI Act erosion are concrete. Without enforceable rules, the terms of AI deployment in Europe are set by market dominance alone — no European input, no structured oversight. If Europe signals that it will not enforce its own frameworks, other jurisdictions have reduced incentive to adopt comparable standards, and the regulatory vacuum fills with corporate defaults rather than deliberate policy.

One note of precision on a frequently cited anecdote: the European Commission’s AWS infrastructure breach in March 2026, in which over 350 gigabytes of data were extracted from the infrastructure hosting the Europa.eu platform, is real and significant. But it is evidence of a procurement policy failure — the Commission’s own choice to host core public infrastructure on a US cloud provider — not a gap in the AI Act’s scope. The AI Act governs AI system deployment; it does not govern cloud procurement decisions. The more precise lesson is about the distance between Europe’s stated regulatory ambitions and its own institutional practices. That distance is real and consequential, but it is a different problem from the one the Act addresses.

What Better Implementation Actually Requires

The EU AI Act does not need to be perfect to be necessary. It does need to be honest about its own gaps — and its defenders need to be willing to name them, rather than attributing every difficulty to implementation failure or external pressure.

Some of what needs to change is implementation: regulatory sandboxes that are funded and operational across all member states, not just the digital leaders; plain-language risk classification guidance that reduces legal dependency for smaller builders; and compliance tooling designed for founders rather than legal departments. These are legitimate demands to make of the Commission and of member states that have treated Article 62 as optional rather than mandatory.

Some of what needs to change is the law itself. The Annex III risk criteria could be sharpened with clearer thresholds and fewer ambiguous proxies. Safe harbour guidance with formal binding effect could reduce the cost of legal uncertainty without weakening the framework’s core protections. These are substantive improvements that can be argued on their merits — and they strengthen the Act rather than erode it.

What is not justified is using legitimate startup friction as rhetorical cover for deregulation that primarily benefits platforms already dominant in the European market. The companies pushing hardest for delays and rollbacks are not ten-person teams building AI tools in Ghent or Tampere. Amazon, Google, and Microsoft have compliance departments. A ten-person team does not — but a blanket rollback does not help that team. It removes the constraints that currently apply to their largest competitors.

Europe’s regulatory ambition and its capacity to support AI innovation are in tension, but not in fundamental conflict. The tension is a delivery problem: slow sandboxes, unclear classification, inconsistent implementation across member states, and institutional documents written for lawyers rather than founders. Addressing that honestly — including the places where the Act’s own design makes delivery harder — is the argument worth having. Framing every critique as capitulation, or every amendment as surrender, forecloses it. The Act is doing important structural work in a hostile environment. It would do that work better if its defenders held it to a higher standard.

Sources

• AP News: JD Vance rails against ‘excessive’ AI regulation at Paris AI Action Summit, 11 Feb 2025

• France24: JD Vance warns against ‘excessive regulation’ of AI at Paris summit, 11 Feb 2025

• Euronews: JD Vance challenges Europe’s ‘excessive regulation’ of AI at Paris summit, 11 Feb 2025

• American Rhetoric: Address at the Paris AI Action Summit, full transcript, 11 Feb 2025

• Euractiv: Trump threatens to launch tariff attack on EU tech regulation, 22 Feb 2025

• WIRED: Europe Bends the Knee to US Tech Policy, 2025

• The Conversation: EU proposal to delay parts of its AI Act signals a policy shift that prioritises Big Tech over fairness, Nov 2025

• Le Monde: EU artificial intelligence regulation takes effect, sparking new Europe-US clash, 2 Aug 2025

• EU AI Act, Article 62: Measures for Providers and Deployers, in Particular SMEs, Including Start-Ups

• European Commission IP/25/2718: Simpler EU digital rules and new digital wallets to save billions for businesses and boost innovation, 19 Nov 2025

• EJIL Talk: Brussels Mirage, the EU AI Act’s Subtle Shine Across International Borders

• European Commission statement IP/26/748: AWS breach confirmed, 28 Mar 2026

• European Investment Fund, EIF Annual Report 2024: European venture capital market, AI investment gap analysis

• European Parliament Research Service, The AI Act and SMEs: Provisions, Implementation Challenges and Recommendations, 2025

Disclosure: The author has published a separate paper, The Great Return: Why 2026 Marks the Tipping Point for Local AI Migration in Europe (Zenodo, 2026), which examines structural trends in local AI deployment across European regulated sectors. That paper provides background context for some of the architectural observations in this article but is not used as primary evidence for the regulatory analysis above.

Ron Spoelstra·17 April 2026·Update #12 — The Great Return

The European Commission published the results of its Cloud III tender on April 17, 2026. Four European providers were selected: Post Telecom (DEEP) with Clever Cloud and OVHcloud; STACKIT, the cloud division of the Schwarz Group; Scaleway, the cloud arm of French telecoms group Iliad; and Proximus NXT.

The contract is a six-year framework agreement. It covers the European Commission, the European Parliament, the European Council, the European External Action Service, and seventy European agencies. The purpose: sovereign cloud infrastructure for Europe’s core institutional digital operations. Total value across all four providers: €180 million. Four parallel contracts were awarded deliberately: the Commission’s own Cloud Sovereignty Framework explicitly required diversification to avoid dependency on any single provider.

The paper had a chapter about this. The paper also had a prediction about it. That prediction was sitting at “tracking” until today.

What Was Awarded

The Proximus NXT submission is not a single product. It is a composed architecture: five organisations, each covering a distinct layer of the sovereign requirements.

Proximus and Proximus NXT anchor the stack as the prime contractor in Belgium and Luxembourg: the trusted telecom and ICT integrator that ties the architecture together across two jurisdictions, providing connectivity, managed infrastructure, and operational continuity.

S3NS was built as a joint venture between Thales and Google Cloud to solve a specific problem: how to deliver hyperscaler-grade cloud performance under strict European sovereign conditions. Their product, PREMI3NS, received SecNumCloud 3.2 qualification from ANSSI in December 2025. SecNumCloud is France’s highest cloud security certification, issued by the national cybersecurity agency for sensitive and critical infrastructure workloads. The architecture is not a pure European alternative to US hyperscalers. It is a certified sovereign wrapper: Google Cloud infrastructure operated under French law, data stored exclusively in French data centres, under controls that keep access rights firmly within French legal jurisdiction.

Clarence is a joint venture between Proximus and LuxConnect, Luxembourg’s state-backed data centre infrastructure provider. Where S3NS handles sovereign cloud workloads that require certification and legal control, Clarence handles the cases where even a certified wrapper is not sufficient. Fully disconnected, physically air-gapped, operating within Luxembourg’s jurisdiction: workloads that cannot transit any external network under any condition.

At the top of the stack: Mistral AI delivers AI capabilities on the sovereign cloud platform. French, not Californian. Not subject to the US CLOUD Act. The intelligence layer the paper described as the third requirement for genuine digital sovereignty.

Thales closes the architecture with high-assurance security design and cybersecurity threat intelligence across the entire stack. The role is worth reading carefully: Thales co-founded S3NS and provided the security expertise behind PREMI3NS’s ANSSI qualification. In Cloud III, Thales operates at a second level as independent security architect across the full solution. The organisation that certified one component is also the validator of the whole.

Fabrice De Windt, Proximus NXT Lead: “European institutions require the highest levels of security, sovereignty and reliability. This selection confirms Proximus’ ability to deliver sovereign cloud solutions built on European services and operated by trusted local partners. By combining cloud, cybersecurity and European AI, we support public institutions in their digital transformation while preserving full control over their data and infrastructure.”

The Three Layers

The paper’s central architecture argument appears in Chapter 3. A European sovereign cloud still running OpenAI’s API has merely relocated the dependency. It has not eliminated it. Genuine sovereignty requires control at three levels simultaneously: the infrastructure, the silicon, and the intelligence.

The Cloud III selection covers two of the three. The infrastructure layer: Proximus NXT, S3NS, Clarence (European-hosted, certified, air-gapped where required). The intelligence layer: Mistral AI (European model, open weights, not callable under a US national security letter).

The silicon layer is not addressed by this contract. The stack runs on certified cloud infrastructure; the underlying compute is not specified as European silicon. That gap remains. But the paper was honest about the timeline: three-layer sovereignty is a 2028–2030 destination, not a 2026 baseline. The Cloud III solution is two-thirds of the architecture the paper described as necessary. That is further than almost anything else announced this year.

The paper also named GAIA-X as the prior attempt at European cloud sovereignty, and noted that the consortium had incorporated the very hyperscalers it was designed to counterbalance. Cloud III is structurally different. It is not a standards consortium. It is an enforceable procurement framework, signed by institutions with real operational workloads and a six-year contractual horizon. The architecture is not aspirational. It is contracted.

The Mistral Signal

The paper gave Mistral AI one line. It should have had more.

By the time Cloud III was awarded, Mistral’s position had changed materially. Revenues passed $400 million by February 2026, rising sharply as European organisations concluded that a European model on European infrastructure was the only clean compliance path under the AI Act and GDPR simultaneously. In March, Mistral raised €830 million to fund Nvidia-powered AI centres across Europe. The week Cloud III was announced, Mistral was building the compute infrastructure to serve it at scale.

The previous TGR article on this topic, The Open Weight War, made the argument directly: open weights are not a preference for European regulated-sector organisations. They are the compliance path. You cannot demonstrate conformity with AI Act Article 13 transparency obligations on a model whose architecture you cannot inspect. You cannot audit a model you do not have access to.

Cloud III operationalises that argument at institutional scale. The European Commission is not a startup hedging its AI strategy. It is the central regulatory institution of a 450-million-person union. When it writes Mistral into a six-year cloud framework, it is doing two things simultaneously: securing its own operations, and signalling to every public institution in Europe what the expected architecture looks like.

Prediction 6.2 in the paper read: “European open-weight models (particularly Mistral AI) become the compliant-by-default choice for regulated-sector organisations in Europe.” A single procurement contract does not confirm a market-wide trend. But it moves the prediction in a direction it has been moving since February.

The Proximus Paradox

There is one tension worth naming. In February 2025, Proximus Group selected AWS as its strategic global cloud provider to “harness the power of cloud and generative AI on a global level.” The same company that built a fully sovereign European stack for EU institutions also runs on AWS for its commercial global operations.

This is not inconsistency. It is the hybrid equilibrium the paper described in Chapter 9.

Commercial workloads follow efficiency. Regulated, sovereign, and institutional workloads follow a different set of constraints: compliance, jurisdictional control, auditability, and contractual guarantees of data residency. These two types of workload are not the same problem, and they do not need the same solution.

What Cloud III demonstrates is that the two ecosystems are not converging. They are diverging. The gap between workloads that can run anywhere and workloads that must run here, on this, under these conditions is widening. Proximus is building infrastructure on both sides of that gap simultaneously. So is every serious European cloud operator.

The interesting question is not whether this divergence happens (it is already happening), but how fast the “must run here” category expands as AI Act obligations begin to land. The deadline that matters for most regulated-sector organisations is December 2, 2027: high-risk AI systems. That is 84 weeks away.

What the Scorecard Says

Prediction 5.3: “Digital sovereignty will become an explicit procurement requirement in EU public sector AI contracts.”

This prediction had been at tracking since April 10, based on four EU governments mandating sovereign AI in public administration and France’s military signing a Mistral framework agreement. The note read: “would move to confirmed with one more independent source confirming procurement mandates are being implemented, not just announced.”

Cloud III is a signed framework agreement, published by the European Commission, naming five European partner organisations, covering the EU’s core institutional operations, for six years. It is implementation, not announcement.

Scorecard update: prediction 5.3 moves from tracking to confirmed. Prediction 6.2 (Mistral as the compliant-by-default European AI model) advances within tracking. 13 of 30 predictions confirmed or confirmed-exceeded.

The Proximus press release stated explicitly: this result “serves as a reference model for public authorities across Europe, many of which are aligning their own cloud requirements with criteria defined at European level.”

If the reference model is adopted, 5.3 does not just confirm. It propagates.

The Great Return is an ongoing series tracking the structural shift to local-first AI in Europe. Read the original paper →

Ron Spoelstra· 17 April 2026 · Update #10 - The Great Return

In February 2026, the paper argued that dependency on foreign cloud infrastructure is not a theoretical risk but a structural one. That it would produce operational consequences. That the mechanism would be legal jurisdiction, not technical failure.

On April 16, the sitting Chief Privacy Officer of the Dutch government agency that operates DigiD said this, on the record:

“I cannot put it more simply: the U.S. can switch off DigiD for an extended period and issue secret information requests.”

That is Pieter van Oordt, Chief Privacy Officer at Logius - the agency responsible for the digital identity infrastructure used by 17 million Dutch citizens. Two million login sessions per day. One hundred million government letters per year through MijnOverheid. The system through which the Netherlands files taxes, accesses healthcare, and interacts with the state.

The kill switch is no longer a metaphor. It is a documented operational capability held by a foreign government over a European nation’s identity infrastructure.

What Happened

Kyndryl - a four-year-old IBM spin-off operating in 60 countries - is acquiring Solvinity, the Dutch hosting company that has provided DigiD’s infrastructure since 2020. The Dutch competition authority ACM approved the deal on 26 February 2026. A parallel national security review under the Vifo Act is ongoing, but the commercial process is moving forward.

The acquisition transfers operational control of the following systems to a US-headquartered company:

• DigiD — national digital identity for 17 million citizens

• MijnOverheid — the citizen portal handling 100 million letters annually

• Digipoort — the government data exchange system

• National Police IT infrastructure

• Public Prosecution Service systems

• AIVD private cloud — the Dutch intelligence service

• Amsterdam’s “sovereign cloud”

Read that list again. Then consider that every one of those systems now falls under the legal reach of the CLOUD Act and FISA - US laws that compel American companies to provide data to US authorities regardless of where it is stored, and regardless of the laws of the country where it is stored.

An internal Logius security assessment, shared with the Ministry of the Interior on 24 November 2025, concluded plainly:

“The platform cannot be technically sealed in such a way that the supplier would no longer be able to access data/personal information or influence availability.”

That assessment was not shared with parliament. Van Oordt escalated to the highest civil-service level. He was not granted access to the state secretary. He is now preparing legal action against the Dutch state.

Jurisdiction, Not Geography

Kyndryl’s defence is straightforward. Data remains in the Netherlands. Services continue to be provided within the EU. Access to data is only possible on EU territory. A European data guardian will be appointed. Dutch courts will have recourse.

None of that matters under the CLOUD Act.

The CLOUD Act grants the US government de facto root access to data held by US-controlled companies, regardless of where that data is physically stored. As one analyst put it: “Forget the physical location of the data center. That’s just a file system mount point. The real control lies at the kernel level, the legal entity that owns and operates the system. Location is irrelevant when jurisdiction is absolute.”

When a US federal agency issues a request under the CLOUD Act, a US company must comply. It cannot inform the data subject. It cannot inform the host government. It cannot seek a court order in the country where the data resides. Dutch contractual safeguards - however carefully drafted - cannot override federal law in the jurisdiction that controls the legal entity.

Van Oordt is unambiguous: “Additional measures are in all cases insufficient to prevent outages of DigiD and unlawful use.”

Sanctions Are the Sharper Weapon

The CLOUD Act enables secret data access. But experts who testified before the Dutch Digital Affairs Committee identified an even more immediate threat: US sanctions.

Lokke Moerel, professor of global ICT law at Tilburg University, told the committee: “It is the authority of the US, and the president himself, to issue sanctions against persons, organisations, countries in the interest of national security.”

Sanctions are not judicial. They require no court order, no legal process, no notification. The president acts unilaterally.

This is not hypothetical. There is precedent. Nine employees of the International Criminal Court are currently blocked from receiving American services under a Trump-era decree. Nine individuals - sanctioned not for criminal activity, but for the court’s investigation into actions by US service members.

Evelyn Austin, director of Bits of Freedom, connected the dots for the committee: “Those are only nine people. With DigiD, it could happen on the scale of an entire society.”

When asked whether this was a future concern or a present one, Austin replied: “I don’t know if it’s a sliding scale, because I think the crisis is already here. So, in that sense, we might already be somewhere at the bottom of the slide.”

A survey of over 28,000 respondents found that 87% of DigiD users would boycott the system if it were US-owned. Seventy-five percent said they could not manage government services without it. That gap - between the desire to refuse and the inability to function without it - is the definition of a dependency with no exit.

The Irony at the Centre

There is a detail in this story that resists belief.

Only months before the acquisition, Solvinity co-signed a public letter to the Dutch government cautioning against “te grote afhankelijkheid van grote buitenlandse (lees: Amerikaanse) cloudbedrijven” - too much dependence on large foreign (read: American) cloud companies.

They issued the warning. Then they became the vector for the very threat they described.

The competition authority approved the deal because competition law has no mechanism for jurisdictional risk. The ACM engaged seriously with the sovereignty arguments - a Taskforce ICT Continuity submitted evidence that CLOUD Act and FISA would become applicable post-acquisition - but drew a sharp legal line: sovereignty concerns, however legitimate, are not competition-law grounds to block a merger when the combined market share is below 15% and alternatives exist at re-tendering.

The alternatives exist. In theory. In practice, the switching costs for a national identity system are not measured in market share percentages but in years and political capital.

Amsterdam’s deputy mayor Alexander Scholtes revealed the structural trap: “You’re not allowed to steer on ownership or ownership structures. So you can look at requirements around knowledge to develop services in the field of digital autonomy. But my point is that with the current requirements, you can’t sufficiently steer towards digital autonomy.”

EU procurement rules actively prevent governments from choosing sovereignty. That is not a bug in the system. It is the system.

The Alternative That Already Exists

The technical counter-argument - that sovereign alternatives are immature, expensive, or years away - does not survive contact with the evidence.

A detailed architecture for a fully sovereign DigiD replacement has been published by Clouds of Europe. It uses open-source wallets (Yivi, NL-Wallet), open-source issuance components (walt.id, Credo), existing Dutch PKI infrastructure, and European cloud providers with security certifications - Scaleway, Fuga, or government data centres at ODC-Noord and Rijks DC.

Estimated cost: €4.5–11 million per year. Migration timeline: 24 months with parallel operation ensuring continuity.

Jeroen Wouda of Uniserver told the Digital Affairs Committee: “The knowledge, technology and expertise exist. Today, not tomorrow.”

The technology is ready. The open-source components are licensed. The European cloud providers are certified. The migration path is documented.

The only missing piece is political will.

What the Scorecard Says

The Great Return included thirty predictions about how Europe’s shift from cloud-first to local-first would manifest. Prediction 5.1 stated that geopolitical events would expose cloud dependency as an operational risk - not merely a theoretical sovereignty concern.

A sitting government privacy officer has now confirmed, with direct quotes, that a foreign government holds the ability to shut down a nation’s identity infrastructure and access the personal data of every citizen. An internal security assessment confirms the risk cannot be mitigated technically. Escalation to the highest levels of government produced no response. Legal action against the state is being prepared.

This is not a risk assessment. It is a status report.

Prediction 5.1 has moved from “projected” to “confirmed - exceeded.” The paper expected this class of event by 2027. It arrived in April 2026, documented by the people responsible for operating the system.

There is a pattern forming. In March, the European Commission’s AWS account was breached - 350 gigabytes taken from the institution that wrote the AI Act and enforces GDPR. Now the Netherlands faces the prospect of its entire digital identity system operating under American jurisdiction. These are not isolated incidents. They are the structural consequences of architectural decisions made years ago, coming due on a compressed timeline.

The paper’s argument was never that American companies are bad actors. It was that dependency creates leverage, and leverage will eventually be used. The CLOUD Act does not require bad intent. It requires compliance with US law by US-controlled entities. That compliance is automatic, silent, and non-negotiable.

The kill switch exists. The question now is whether it gets used - and whether Europe builds the infrastructure to make the question irrelevant before it has to find out.

The Great Return is an ongoing series tracking the structural shift to local-first AI in Europe. Read the original paper →

11 April 2026· Update #10 — The Great Return

European organisations are choosing local deployment for agentic AI not because it is technically superior, but because the EU’s regulatory framework has structural gaps that make cloud-based autonomous systems legally untenable. Four compliance failures have accumulated since the AI Act entered into force: ambiguous scope classification, missing high-risk guidelines, unresolved liability attribution, and a technical file requirement that autonomous systems cannot structurally satisfy. Together they have created a liability vacuum. Local deployment is filling it by default.

The Scope Problem No One Has Resolved

The EU AI Act does not name agentic AI systems explicitly. The law’s examples of systems that output content or decisions influencing environments are non-exhaustive — a design choice made when the dominant AI paradigm was still the chatbot. Agentic systems — systems that plan, execute multi-step action chains, invoke external tools, and operate with reduced human involvement — look substantively different from what legislators had in mind.

Greens MEP Sergey Lagodinsky raised this directly with Commissioner Henna Virkkunen last autumn, asking whether agents fall under the AI Act. Virkkunen’s response: it is “likely” that they fall in scope, given the non-exhaustive examples. That response is not binding legal guidance. It is an opinion from a commissioner. Organisations deploying agentic systems in regulated sectors have a compliance obligation that requires more than “likely.”

Some member states have actively resisted new rules on AI agents, citing regulatory fatigue. The Commission convened legal experts through DG JUST to examine the impact of agentic AI on contract formation and liability attribution — the working paper concluded only that the situation was “challenging.” That is not an answer an organisation building a patient-record AI system can deploy with confidence.

The Deadline That Keeps Moving

The AI Act set 2 February 2026 as the legal deadline for the Commission to publish guidelines on high-risk AI system classification. The Commission missed that deadline. It then indicated draft guidelines would follow within the same month. That did not happen either. The guidelines are now on a “revised timeline” without a published date. This is the second missed deadline for the same document.

The consequence is specific. Organisations deploying high-risk AI systems have been trying to build compliant technical infrastructure without knowing exactly which systems the regulator considers high-risk. CE marking, conformity assessments, and post-market monitoring systems all depend on that classification being clear. The guidance that would make it clear does not exist.

The Commission’s Omnibus package — backed by both Parliament and Council, as documented in Update #7 — is moving the high-risk enforcement date from August 2026 to December 2027. This extends the ambiguity window by more than a year rather than resolving it. Organisations that chose local deployment because cloud-based AI could not satisfy unknown requirements are not wrong to have done so. The regulatory machinery is still not assembled.

Many member states have also not formally designated the national bodies responsible for enforcing the AI Act. Without enforcement bodies in place, the obligations on paper have no mechanism for inspection or penalty — yet no organisation in a regulated sector is willing to bet that this absence will be permanent.

Liability Without Rules

In early 2025, the Commission withdrew the AI Liability Directive. The result is 27 different national civil liability regimes covering AI-related harm, instead of the harmonised EU framework the directive would have created. MEP Axel Voss, the EPP rapporteur on the directive, condemned the decision as creating “legal uncertainty, corporate power imbalances and a Wild West approach that only benefits Big Tech.” Kim van Sparrentak of the Greens warned that withdrawal leaves the EU with a different civil liability regime in every member state for the same class of harm.

For enterprises deploying agentic AI in B2B contexts, this has a concrete operational consequence. When an autonomous agent causes commercial harm — miscalculating a credit assessment, erasing a production record, executing a transaction at the wrong rate — liability attribution falls back to contract law in each member state. A deployment across five EU jurisdictions means five different legal frameworks for the same failure mode.

This is not theoretical. The Commission cited an illustrative case in its own DG JUST working paper: a user whose AI agent purchased a product at more than 250 times the going rate using their credit card. No unified liability rule determined who bore the loss. The Air Canada chatbot case — in which a customer won against an airline whose agent promised a non-existent discount — was resolved by a national tribunal. Multiply that ambiguity across 27 member states with autonomous systems operating across them, and the liability exposure becomes uninsurable.

The Technical File Problem

A systematic regulatory analysis published on arXiv in April 2026 by Nannini et al. maps AI agent deployments against the full stack of EU law — the AI Act, GDPR, the Cyber Resilience Act, NIS2, the DSA, and sector-specific legislation. Its conclusion on high-risk agentic systems: they cannot currently satisfy the AI Act’s essential requirements.

The paper identifies four structural compliance gaps specific to autonomous agents: cybersecurity vulnerabilities from external tool integration, human oversight evasion through autonomous action chains, transparency failures across multi-party systems, and runtime behavioural drift that makes system behaviour unpredictable over time.

The last of these is worth dwelling on. The AI Act requires providers of high-risk systems to maintain a technical file — an exhaustive inventory of the system’s design, behaviour, and data flows — as a precondition for CE marking. For systems that plan autonomously, revise internal strategies based on tool results, and change behaviour based on accumulated context, maintaining a current technical file is structurally impossible. The requirement was designed for systems with stable, defined outputs. Autonomous agents are not that.

This is not a gap companies can close by working harder on their compliance documentation. It is a mismatch between the law’s architecture and the technology’s architecture. Harmonised standards under Standardisation Request M/613 were still in draft as of January 2026. Until those standards exist, organisations cannot obtain CE marking for high-risk agentic deployments through the regular pathway.

Local Deployment as the Compliance Default

In January 2026, France’s Ministry of the Armed Forces awarded Mistral AI a framework agreement to deploy AI models across all military branches and affiliated agencies through 2030. The models run on French-controlled infrastructure. The agreement was explicitly framed around data sovereignty and compliance with GDPR and the AI Act — not around technical superiority. Mistral was not selected because its models outperform the alternatives on benchmark tests. It was selected because it was deployable in a way that resolved the compliance exposure US cloud providers could not.

A 2026 framework agreement between France, Germany, and Mistral extends the same logic to public administration. Enterprises including HSBC, Stellantis, and Veolia are running Mistral’s open-weight models on their own servers. HSBC uses self-hosted generative AI to automate credit assessments and compliance reviews — tasks where data governance requirements are non-negotiable and where a cloud provider’s jurisdictional exposure cannot be accepted.

These are not organisations choosing local AI because they prefer it. They are organisations for which cloud-based AI cannot satisfy the compliance requirements they operate under. The regulatory vacuum is the driver. Local deployment fills it not because it resolves the open questions, but because it removes the organisation from the most exposed positions: no cloud account reachable by a foreign court order, no dependency on a US CLOUD Act jurisdiction, no exposure to a provider that might change its access rules overnight.

What the Scorecard Shows

Prediction 2.1 in The Great Return stated: “EU AI Act high-risk AI system obligations apply from August 2, 2026 with no delay.” The Commission’s Omnibus proposal, backed by Parliament and Council, is moving the high-risk enforcement date to December 2, 2027. That prediction is now conditionally revised — the delay is happening.

What this article adds is not a simple scorecard movement but a structural finding: the delay does not resolve the compliance gaps it was meant to give organisations time to close. The guidelines that would enable classification don’t exist. The liability framework that would govern failures doesn’t exist. The harmonised standards enabling CE marking don’t exist. The enforcement bodies in many member states don’t exist.

Delaying enforcement by 16 months extends the window without filling it. For regulated-sector organisations making deployment decisions now — a system going live this year, a procurement decision this quarter, an audit preparation underway — the extended deadline offers no relief. The vacuum is operational. The response to it is visible in the procurement data. This is the first published evidence advancing prediction 2.1, and it points in one direction: the regulatory framework intended to govern agentic AI is not keeping pace with it, and the organisations that recognised this earliest are already building accordingly.

What would move prediction 2.1 to confirmed in its revised form: a formal Commission decision fixing December 2027 as the binding high-risk application date. What would move it to confirmed in its original form: enforcement action after August 2026 against a high-risk AI system. The former is more likely. The August deadline is not coming back.

This investigation is part of the research series accompanying The Great Return: Why 2026 Marks the Tipping Point for Local AI Migration in Europe — published February 2026. Full paper: DOI 10.5281/zenodo.18511984

Ron Spoelstra·2 April 2026·Deep Dive — The Great Return

On 27 March 2026, Iranian-linked hackers published the contents of Kash Patel’s personal Gmail account via Telegram.

Patel is the director of the FBI.

The story was reported in the security press as an embarrassment to US intelligence. That framing misses the point. The relevant fact is not that it happened to someone with that job title. The relevant fact is that it happened through a personal email account — not through any FBI system, not through a government network, not through a known vulnerability in any piece of infrastructure. Through a cloud account that anyone with the credentials could access from anywhere.

There was no attack on the FBI. There was an attack on a person.

That distinction, played out across four incidents in one month, describes a structural shift in how data is compromised that has direct implications for every organisation deciding whether to keep its AI in the cloud or bring it home.

The Old Attack Surface

For most of the history of enterprise security, the dominant threat model ran something like this: an attacker identifies a vulnerability in infrastructure, exploits it to gain access, and exfiltrates data from within. The defenders’ job was to find and close vulnerabilities before attackers could reach them.

This model produced an entire industry. Patching cycles. Penetration testing. CVE databases. Intrusion detection. Firewall rules. Zero-trust network architecture. These tools are real and necessary. Against a specific class of attack, they work.

But the infrastructure model assumes that the target is the infrastructure. That assumption has been quietly eroding for years, and March 2026 is the month it broke into public view.

The attackers who compromised the EU Commission, hijacked the Axios JavaScript library, broke the LiteLLM supply chain, and published the FBI director’s email did not exploit vulnerabilities in the traditional sense of the word. They found credentials. They found accounts. They found the people behind the systems, and they attacked the person rather than the perimeter.

The result is identical from the victim’s perspective. The data is gone. But the mechanism is different — and the implications for how we think about AI deployment are not the same.

March 2026: Four Incidents, One Pattern

The four incidents did not appear in the same news cycle. They arrived across a month, in different sectors, attributed to different threat actors. Read individually, each looks like a discrete breach. Read together, they form a pattern.

1. The EU Commission — 24 March

Amazon Web Services confirmed that 350 gigabytes of EU Commission data had been exfiltrated. The breach came less than 60 days after a separate Ivanti MDM compromise in January.

The detail that matters: AWS’s official statement noted that its infrastructure had operated as designed. No vulnerability in AWS was exploited. What was compromised was account-level access — credentials that authorised a session, and a session that authorised the transfer. The attacker did not break into the cloud. They logged in.

The data was from the Commission’s public-facing web platforms — databases, employee data associated with Europa.eu — hosted on an American cloud provider. ShinyHunters claimed the data and announced publication with no ransom demand. The internal Commission networks were not reached. But the account-level access that made it possible was indistinguishable, in mechanism, from access to any other cloud-hosted asset.

2. Axios npm — 31 March

Google attributed this operation to UNC1069, a North Korean threat actor. The attack did not find a vulnerability in the Axios JavaScript library — one of the most widely deployed packages on the web, with more than 100 million downloads per week. It found the maintainer’s account.

The package was hijacked for approximately three hours. During that window, a remote access trojan was served to every project that had Axios in its dependency tree and ran an install or update. Three hours, 100 million downloads per week. The arithmetic is the attack.

There was no bug in Axios. There was a credential in a package registry. That is all that was needed.

3. LiteLLM — 24–26 March

The paper named LiteLLM explicitly in chapter seven as a core component of the open-source AI stack. It is the gateway layer — the component that sits between AI applications and the underlying models, handling routing, cost tracking, rate limiting, and model switching. Millions of downloads per day. Used by organisations that have built local AI deployments precisely because they wanted to own their stack.

Malicious code was inserted into LiteLLM through a compromised PyPI account. Two versions (1.82.7 and 1.82.8) were published with malware that harvested SSH keys, cloud tokens, and Kubernetes secrets and installed persistence on the host. TeamPCP claimed responsibility. The incident was part of a broader Trivy supply chain compromise active during the same period.

The irony is structural. The organisations using LiteLLM were, in many cases, running local AI precisely to avoid the vulnerability of being dependent on external providers. The attack came in anyway — not through their infrastructure, through the person who maintained the library they depended on.

4. Kash Patel — 27 March

The same day as the EU Commission breach. The FBI director’s personal Gmail account. Published through Telegram by a group with Iranian government links.

The significance is not the geopolitics. It is the account type. Not a government system. Not an FBI infrastructure component. A personal cloud account — the kind used by everyone with a smartphone, including every employee at every regulated-sector organisation building a local AI strategy.

If the head of the FBI’s personal cloud account is a viable attack surface for state-level threat actors, that category of account is a viable attack surface everywhere. The person is the perimeter. The perimeter has a Gmail address.

Why This Shift Is Happening Now

The shift from infrastructure exploitation to identity theft is not new in theoretical terms — security researchers have tracked the trend for years. What is new is the velocity and the industrialisation.

On 1 April 2026 — one day after the Axios breach was reported — BleepingComputer covered a service called EvilTokens: a commercial, subscription-based platform specifically built to facilitate Microsoft device code phishing at scale. The product. The support tier. The credential-theft as a service offering.

This is the industrialisation of identity compromise. It is no longer the exclusive tool of nation-state actors with deep technical capability. It is a service with a pricing page.

The structural reason is straightforward. Infrastructure hardening has worked. Enterprises have invested heavily in vulnerability management, and the cost of infrastructure exploitation has risen. A company running modern zero-trust architecture and disciplined patching cycles is meaningfully harder to penetrate through a CVE than it was five years ago. Sophisticated actors responded by moving to what is easier: the people behind the systems, who typically have fewer technical defences than the systems themselves.

The cloud has amplified this dynamic. When data lives in cloud accounts rather than on-premise servers, the account credential becomes the master key. Steal the credential, access the data. No exploits required. No persistence in the network. No forensic footprint on the target’s infrastructure. One login event, and the attacker is inside as an authorised user.

This is not a problem that patches solve. It is an architectural consequence of storing sensitive data in credentials-gated accounts accessible from the public internet.

What Local AI Changes

The paper made a specific argument. Four converging forces — geopolitics, environmental pressure, regulation, and silicon maturity — are pushing AI inference from cloud to local infrastructure. The argument was about where computation happens and what that means for data sovereignty, compliance, and cost.

March 2026 adds a dimension the paper did not foreground: local AI removes a specific attack surface that is particularly vulnerable to the credential-theft model.

When a European organisation runs its AI on local infrastructure — model weights on a server in its own building, inference never leaving the network, no API call to a US provider — there is no cloud account to phish. The data processed by the AI does not live in an account accessible via stolen credentials from anywhere on the internet. An attacker who obtains the account credentials of an employee does not thereby obtain access to five years of AI-processed patient records, or case histories, or financial data, because those records were never uploaded to a credentials-gated cloud service in the first place.

This does not make local AI immune to credential-based attack. An attacker who gains physical access to the local server, or who compromises the local network at a deeper level, still has pathways. The person running the local deployment can still be compromised. Local AI is not the same as secure AI by definition.

But it is a meaningful reduction in the specific attack surface that the four March incidents exploited. The EU Commission was not breached because AWS had a vulnerability. It was breached because AWS had a front door accessible from the internet, and someone obtained the key. Local AI does not have that front door.

What It Does Not Change

Honesty requires the other side of this argument.

Local AI does not protect the organisation from supply chain attacks in the category of Axios and LiteLLM. Those attacks target the software components that build and run local deployments. An organisation running a carefully configured local AI stack that includes LiteLLM was still exposed in March 2026, regardless of whether its model inference was local or cloud-based. The attack surface was not the cloud; it was the open-source tooling ecosystem, accessed through a maintainer’s compromised account.

The defence for this class of attack is different: version pinning, software bill of materials discipline, dependency verification, and the kind of supply chain monitoring that most European SMEs do not yet practise. This is addressable. It is not addressed by moving inference local.

Nor does local AI protect the individual person from credential compromise. An employee whose personal email is exfiltrated loses those emails regardless of what their employer’s AI infrastructure looks like. The Kash Patel incident demonstrates this at the extreme end. No enterprise IT policy governs personal Gmail. No local AI deployment changes that.

What local AI changes is narrower and more specific: it removes the data processed by the AI itself from the attack surface reachable via cloud credentials. That is not nothing. For organisations processing GDPR Article 9 data — children’s records, medical histories, mental health documentation — removing that data from cloud-account reach is a material risk reduction by any reasonable assessment.

The European Dimension

European organisations face a specific version of this problem that diverges from the US experience in an important way.

The credential-based attack model that produced the four March incidents is asymmetric in its consequences. When a US company loses cloud-stored data through credential theft, the primary consequence is reputational and financial. When a European public-sector organisation or regulated-sector enterprise loses GDPR Article 9 data the same way, the primary consequence is also legal — and the regulator does not accept “the provider’s infrastructure operated as designed” as a defence.

AWS said exactly that about the EU Commission breach. Infrastructure as designed. That is true. It is also true that the data was European public-sector web platform data, stored under an American company’s terms of service, under US cloud law jurisdiction. It is true that the Commission had signed a data processing agreement it believed complied with GDPR. And it is true that 350 gigabytes of that data was published.

The data was not protected by the compliance documentation. It was not protected by the contract. It was accessible via credentials, and the credentials were compromised, and now the data is public.

For a Belgian youth care organisation, a regional hospital, an SME managing DORA-relevant financial data: the scenario is identical in structure. The scale is smaller. The legal exposure is proportionate. The credential-theft model does not care about sector or organisation size.

The paper’s core argument — that European organisations in regulated sectors will migrate to local AI as compliance pressure makes cloud inference untenable — gains an additional dimension here. It is not only that regulators are tightening requirements around where AI processing happens. It is also that the threat model for cloud-stored data has changed in a way that makes local storage materially safer against the attack vectors that are actually in use.

Those two forces do not compete. They converge.

The Paper Did Not Predict This

The paper made thirty predictions. This is not one of them.

The paper argued for local AI on the basis of regulatory compliance, data sovereignty, environmental sustainability, and hardware maturity. It did not argue that the credential-based attack model would emerge as a distinct threat class that local architecture specifically mitigates. That argument was not visible in February 2026 in the form it took in March.

It is visible now.

This is, in the series’ terminology, an update rather than a prediction still pending. Not a scorecard item. An argument that grew from the evidence of one month and strengthens the paper’s conclusion through a mechanism the paper did not identify. The destination remains the same: local AI as the structural destination for European regulated-sector organisations. The road has grown a new lane.

The person is the perimeter. The cloud makes that perimeter a front door. Local infrastructure does not move the perimeter back to the system — that argument was lost years ago. It removes the most accessible entrance the credential-theft model uses.

For European organisations deciding where their AI data lives, March 2026 made that argument concrete. Not in a CVE database. In four incidents, visible in the same news cycle, readable by anyone paying attention to what the evidence actually says.

The clause was modest in scope. Before signing a Pentagon procurement agreement, Anthropic wanted a written guarantee that its AI models would not be used for mass surveillance or autonomous weapons systems. This was not a policy stance issued in a press release. It was a contractual condition — a legal limit on the use of a product that Anthropic agreed to supply.

The Pentagon refused.

What happened next is the story this article is about. Not because of what it means for Anthropic. But because of what it means for anyone who believes AI ethics can be durable without the right legal environment to protect them.

The Weapon That Was Used

When Anthropic refused to drop the clause and pursued the point legally, Defense Secretary Pete Hegseth responded by classifying Anthropic as a risk to the national supply chain.

That classification has a specific history. It is a designation developed to manage contractors with operational ties to adversarial foreign powers — primarily China. It was built to deal with companies where the concern is that a foreign government has economic leverage, intelligence access, or covert influence over the contractor’s products and data. It carries significant consequences: contract exclusions, procurement bans, potential cascading effects on any government customer relationship.

Hegseth applied it to a US AI company because that company asked for a contractual ethics guarantee.

This is not a rounding error in US national security policy. It is a deliberate choice to use the most available coercive instrument to punish a company for asserting a limit on how its product would be used. The instrument happened to be a foreign adversary designation. The target was a domestic company with an explicit safety mission.

What the Court Said

Federal Judge Rita Lin blocked the designation. Her ruling: the Pentagon’s action violates Anthropic’s constitutional rights, including the right to freedom of expression.

The First Amendment framing matters. Lin did not rule on contract law alone — on whether the Pentagon had the right to reject a contractor’s terms. She ruled that using a national security classification as retaliation for a company’s expressed position on how its AI should be used constitutes a restriction on protected speech. The government was, in effect, penalising Anthropic for saying something — specifically, for saying our AI should not be used for mass surveillance or autonomous weapons.

The block is temporary — seven days, giving the government time to appeal. The appeal may succeed. The administration’s legal theory, if it runs this to the Supreme Court, will involve national security deference — the doctrine that courts give wide latitude to executive branch decisions on defence procurement. That doctrine has historically been broad.

But the First Amendment finding is already public. The reasoning is in the record. Even if the government wins on appeal, they will have won in a case where a federal court found their conduct was retaliatory suppression of speech. That finding does not expire when the appeal is filed.

The IPO Complication

Anthropic is preparing to go public. The timeline reported this week: as early as October 2026. Potential valuation: $60 billion. Underwriters in discussion: Goldman Sachs, JPMorgan Chase, Morgan Stanley.

A company entering public markets while designated a federal supply chain risk — even temporarily — faces a specific kind of investor concern. It is not about the legal merits. It is about the signal that the executive branch is willing to use national security machinery against a company that asserts ethical limits on its products. Investors considering a $60 billion valuation want to understand the political exposure of the asset they are buying.

Anthropic won the first round. The designation is paused. But the IPO now carries a disclosure obligation: the company must inform prospective investors that it has been in active litigation with the US federal government over whether expressing an AI ethics position constitutes a national security risk.

That is an unusual prospectus footnote.

The European Reading

The paper’s Chapter 9 covered Big Tech counter-moves — the ways cloud providers fight to slow the shift to local AI. Update #6 documented all five: free-tier subsidies, ecosystem lock-in, the safety narrative, API restrictions, and talent acquisition.

The Anthropic case is not in that taxonomy. It is a different structure: not a corporation fighting regulation, but a corporation asserting an ethical limit on its own product and a state punishing it for doing so.

The paper did not name this counter-move. It should have.

The safety narrative counter-move — the one deployed to frame open-weight and local AI as dangerous — assumed that the argument would be made rhetorically, in lobbying and regulatory comment periods. The Anthropic case shows what happens when rhetoric runs out: the state reaches for the largest available instrument, in this case a supply chain risk designation designed for Chinese adversaries, and applies it to a domestic company that said something inconvenient.

For European organisations evaluating local AI infrastructure, the European reading is this.

If a US AI company cannot maintain contractual ethical limits on its own products without federal retaliation, then the ethics of that company’s AI are only as durable as the current administration’s tolerance for them. The Constitutional protection exists — the court affirmed it — but it requires litigation, legal costs, reputational exposure, and the willingness to fight. Not every company will fight. Anthropic did. Others, facing the same pressure with less financial resilience and no IPO story, will accept the terms.

This is the operational reality of building AI governance on the ethics of US cloud providers: the governance is real until it is inconvenient, and inconvenience has a price.

What Holds in Europe

The EU AI Act does not depend on Anthropic’s willingness to fight. It does not depend on Microsoft’s voluntary commitments or Google’s Responsible AI principles or any company’s conscience clause. It is statutory law with independent enforcement.

Article 5 of the AI Act prohibits AI systems that deploy subliminal techniques to manipulate behaviour, that exploit vulnerabilities, that perform real-time biometric surveillance in public spaces without narrow exception, and that make risk assessments based on social scoring. These are not contractual conditions a vendor can agree to and then renegotiate when a government customer objects. They are prohibitions. A European deployment of any AI system — from any provider — must comply with them or face enforcement.

The GDPR’s prohibition on processing special categories of personal data without explicit legal basis is similarly statutory. It does not require a vendor to assert it. The law asserts it on behalf of the data subject, regardless of what the vendor’s contract says, regardless of what the customer’s procurement team agreed to.

This is the structural difference between a conscience clause and a legal prohibition. The clause depends on the party asserting it having the resources and incentive to defend it. The prohibition exists independent of any party’s willingness to assert it.

For European organisations, running AI on European infrastructure subject to European law means the ethical limits are in the architecture. Not in the terms of service. Not in a vendor’s mission statement. Not in a conscience clause that a future administration can attack with a supply chain designation.

The Sixth Counter-Move

Update #6 named five Big Tech counter-moves. In the same piece, a sixth appeared: the Chinese open-source dominance story, used as a security framing to complicate local AI and open-weight adoption.

The Anthropic case names a seventh.

State weaponisation of security designations against companies that assert AI ethical limits is a counter-move — not against local AI specifically, but against any actor in the AI ecosystem that tries to constrain how AI is used inside state procurement. The target this week was Anthropic. The instrument was the supply chain risk label. The goal was compliance: drop the clause, accept the deployment terms, continue the contract.

The paper’s running prediction was that the structural forces driving local AI are self-reinforcing: regulation creates demand for local infrastructure, which funds hardware innovation, which lowers compliance barriers, which accelerates adoption. The conscience clause case adds a term to that equation.

State pressure on AI ethics in the US cloud ecosystem is an accelerant for European sovereign deployment. Not because European states are better. But because European statutory AI law is not removable by executive action, and the conscience clause — the ethical limit a vendor inserts to protect its product from misuse — is a much weaker instrument than a prohibition backed by a supervisory authority and four percent of global annual turnover.

Europe’s AI ethics are in the statute book. Anthropic’s were in the contract. The contract is in court. The statute is not.

The Great Return is an ongoing series tracking the structural shift to local-first AI in Europe.

The infrastructure in question was its Amazon Web Services account — hosting the Commission’s web presence on the Europa.eu platform. A threat actor had accessed the account, taken over 350 gigabytes of data including multiple databases, and provided proof of access to BleepingComputer before the Commission had made any public statement.

The Commission confirmed the breach on Friday. Official statement IP/26/748. Spokesperson Nika Blazevic confirmed the details to TechCrunch the same morning. The Commission’s internal systems, it said, were not affected.

The hacker has declined to demand a ransom. They intend to publish the data at a later date.

This is the second major security incident at the European Commission in 2026. The institution that wrote the AI Act, administers GDPR, enforces NIS2, and published the Cyber Solidarity Act has been breached — twice — in under sixty days.

The paper had a chapter about this.

What Happened

The attack was discovered on Tuesday, March 24. The Commission’s cybersecurity incident response team contained it quickly. Risk mitigation measures were implemented. The Europa.eu websites remained available throughout the incident — the attack targeted data hosted there, not the availability of the services themselves.

According to sources familiar with the incident who spoke to BleepingComputer — the publication that broke the story — the breach affected at least one of the Commission’s AWS accounts. The threat actor provided screenshots demonstrating access to information belonging to European Commission employees and to an email server used by Commission staff. They claimed over 350 GB stolen, including multiple databases.

Amazon Web Services issued a statement: “AWS did not experience a security event, and our services operated as designed.”

That statement is technically precise. The cloud infrastructure operated correctly. The breach was at the account level — credentials, access control, identity management. AWS delivered exactly the service contracted. The problem was not what AWS did. The problem was where the data was, and who held the keys.

The Second Time

This is not the Commission’s first breach in 2026.

In February, the Commission disclosed that its mobile device management platform — used to manage staff devices — had been hacked. The incident was discovered on January 30. The vulnerability was in Ivanti Endpoint Manager Mobile software, exploited via a code-injection flaw. The same attack pattern hit the Dutch Data Protection Authority and Valtori, a government agency under Finland’s Ministry of Finance.

Twelve days before that breach was discovered — on January 20 — the European Commission had published a new Cybersecurity Package to strengthen European defences against state-backed actors and cybercrime groups.

Last week, the Council of the European Union sanctioned three Chinese and Iranian companies for orchestrating cyberattacks against EU member state infrastructure.

None of this is coincidence or contradiction. It is the baseline. The EU’s own cybersecurity agency, ENISA, states in its annual threat landscape analysis that public administrations are the single most frequently targeted category of organisation in the European threat environment. The Commission writes those ENISA reports. It knows the data. The frequency of attacks against institutions like itself is not a surprise finding — it is the operational reality that motivated the legislation.

What the Commission cannot legislate away is its own infrastructure dependency.

The Regulator’s Infrastructure

The European Commission wrote the AI Act. It administers the General Data Protection Regulation. It is the enforcing body for NIS2 — the Network and Information Security Directive that requires organisations in critical sectors to report significant incidents within strict windows and demonstrate robust cyber hygiene. It published the Cyber Solidarity Act, creating the European Cyber Shield and Cyber Emergency Mechanism to detect and respond to large-scale cyber threats with “collective speed and precision.”

Its public platform runs on Amazon Web Services.

This is not an accusation. Institutional infrastructure decisions are slow, deeply path-dependent, and involve long-term contracts that predate current circumstances by years. The Commission is not unaware of the irony — the sovereign cloud agenda, GAIA-X, the European Cloud Infrastructure discussion — all of it reflects exactly this awareness. The policy intention is clear. The implementation gap is equally clear.

But the AWS statement is the key to reading this clearly: the cloud worked as designed. Data stored on external infrastructure, under credentials managed by the organisation but held on a foreign provider’s platform, is accessible to anyone who obtains those credentials. The attack surface is not the datacenter wall. It is the authentication layer. And authentication layers are exactly what sophisticated threat actors target — not by breaking AWS, but by compromising the accounts that hold access to it.

This is the structural argument The Great Return made. Not that US cloud providers are bad actors. Not that AWS is negligent. But that cloud infrastructure architecture creates dependencies — credential stores, API access, identity management — that are fundamentally outside the organisation’s direct control. And that for institutions handling sensitive data, that dependency is a liability that cannot be contracted away.

The Commission’s January Cybersecurity Package includes proposals to address exactly this. The question now is whether the second breach in sixty days accelerates the pace of the institutional shift — or whether, as typically happens in large institutions, the operational disruption fades and the structural dependency persists.

The Data That Has Not Leaked Yet

The threat actor’s stated position deserves direct attention: they do not intend to extort the Commission. They intend to publish the data at a later date.

That is, in some respects, the more serious scenario. Extortion ends when either the ransom is paid or the organisation declines. Publication — scheduled, unilateral, at a time of the attacker’s choosing — means the incident is not closed. The Commission is now in a position of uncertainty: 350 gigabytes of databases, the contents of which are not yet fully characterised, will appear in public at an undetermined point in the future.

The Commission states that its internal systems were not affected. The breach targeted the cloud infrastructure hosting the europa.eu web presence — public-facing content and the systems behind it, not the Commission’s core operational and decision-making data. That distinction matters and should not be collapsed. But europa.eu is not a static brochure site. It hosts the Commission’s institutional presence, its databases of published documents, its staff communication infrastructure. The screenshots the threat actor provided — showing access to employee information and an email server — indicate the data exposure extends to personnel-level information at minimum.

The Commission is in touch with other EU entities that may have been affected. That notification obligation is itself governed by the frameworks the Commission wrote.

What the Scorecard Says

The Great Return was explicit about the sovereignty risk. Chapter 3 of the paper identified dependence on US hyperscaler infrastructure as one of the primary structural vulnerabilities facing European institutions — not a theoretical risk, but an active one, given the legal territory that US cloud providers operate under and the attack surface that account-level access creates.

The paper’s 30-prediction scorecard included a category around geopolitical and institutional risk: the projection that European institutions would face material incidents arising from their US cloud dependencies before the end of 2027, and that those incidents would accelerate the institutional cloud sovereignty debate beyond the policy discussion stage.

The prediction was for 2027. It arrived in the first quarter of 2026. Twice.

Scorecard update: 12 of 30 predictions assessed. 12 in the right direction. The sovereignty risk prediction — that institutional dependence on US cloud infrastructure represents an active liability rather than a theoretical concern — has moved from “projected” to “confirmed incident.” The confirming institution is the one that wrote the rules everyone else is expected to follow.

There is no satisfaction in being right about this. Every data breach in a European institution is a real security failure with real consequences for real people. The argument was never that the risk was acceptable because it would make a useful illustration. The argument was that the risk was structural, that structural risks produce structural incidents, and that the correct response is structural change — not faster incident response on the same architecture.

The Commission is now investigating. It will report findings. It will implement additional measures. It will continue to monitor. All of that is appropriate and necessary.

And then, at some point, the data will be published. And the Commission — the institution that this week enforced GDPR notification obligations on others, and last week sanctioned foreign entities for attacking European infrastructure — will be the subject of its own breach disclosure, in full public view.

That is what sovereignty risk looks like when it stops being theoretical.

The Great Return is an ongoing series tracking the structural shift to local-first AI in Europe.

The most common objection to acting on the AI Act has been uncertainty. The law passed in 2024. The obligations were on paper. But the timelines were soft, the guidance was incomplete, and the enforcement machinery was not yet assembled. Organisations across Europe have been watching and waiting, safe in the knowledge that “not quite yet” was a defensible position.

That position ended today.

On 26 March 2026, the European Parliament voted 569 to 45 — with 23 abstentions — to adopt its position on the AI Act Omnibus. The vote fixes hard dates. It creates legal certainty where there was ambiguity. And for organisations deploying AI in any significant context, the clock is now running.

What The Great Return Said

The paper identified four structural forces converging to make local-first AI not a trend but an outcome. The fourth force was the EU AI Act — the world’s first binding AI regulation, applying real obligations to real organisations, with real consequences for non-compliance.

But the paper also noted a limiter: implementation ambiguity. Standards were incomplete. Guidance was in draft. Without hard dates, the regulatory force was theoretical. Organisations could rationally defer.

The paper predicted that ambiguity would resolve. It has.

The Dates That Now Exist

The Parliament’s position establishes three application dates, and one immediate prohibition.

2 November 2026 — Watermarking. AI systems that generate audio, image, video, or text content must mark that content as AI-generated. This is the first obligation to land. Eight months from today.

2 December 2027 — High-risk AI systems. This is the central deadline. It covers AI systems used in biometric identification, critical infrastructure, education, employment decisions, access to essential services, law enforcement, justice administration, and border management. If your organisation deploys AI in any of these contexts — directly or through a supplier — this date is yours.

2 August 2028 — Sectoral overlap. Where AI is built into products already regulated under EU sector-specific law — medical devices, radio equipment, toy safety, and others — the AI Act obligations may be less stringent, and this later date applies. The Parliament’s logic: avoid duplicating compliance burdens where sector legislation already provides safeguards.

The prohibition on AI “nudifier” systems — tools that generate non-consensual sexually explicit imagery of identifiable persons — is a separate ban, not contingent on the dates above.

These are Parliament’s positions, not yet final law. Council trilogue must follow. But Parliament voted 569-45. The margins are not ambiguous. The direction is fixed.

What 2 December 2027 Actually Means

Twenty months.

For an organisation that has not yet audited its AI use, twenty months sounds like a comfortable runway. It is not. Consider what compliance for a high-risk AI system actually requires under the Act: a risk management system, technical documentation, data governance measures, transparency obligations to users, human oversight mechanisms, accuracy and robustness records, and registration in the EU’s AI database before deployment.

None of these are checkbox exercises. Data governance alone — documenting what training data was used, where it came from, and what biases may be embedded — takes months for systems already in production. The Act does not grandfather existing systems. If you are deploying a high-risk AI system on 2 December 2027, it must be compliant on that date.

The organisations that start now have twenty months. The organisations that start at the end of 2026 have twelve. Those that wait for the Council to conclude trilogue — likely late 2026, possibly early 2027 — have less.

Why Local AI Makes This Easier

The paper’s argument was structural: the AI Act creates compliance obligations that are architecturally easier to satisfy when AI runs locally. Today’s vote adds a specific clause that sharpens this.

The Parliament backed a provision allowing service providers to process personal data to detect and correct biases in AI systems — but only when strictly necessary, and with explicit safeguards. The intent is right: bias detection is a compliance requirement, and you cannot detect bias without data. The constraint is the safeguard.

Here is the architectural reality: demonstrating that bias correction was “strictly necessary” and performed “with safeguards” is dramatically simpler when the AI system and its data processing are on hardware you control. When bias correction happens inside a cloud provider’s infrastructure, you are dependent on their logging, their audit trails, and their definitions of “strictly necessary.” When it happens locally, the audit trail is yours.

The same logic applies across the Act’s requirements. Technical documentation is easier to maintain when you control the system. Data governance records are yours, not held by a third party under a service agreement. Human oversight mechanisms are implemented in your environment, not enabled or disabled at a provider’s discretion.

The compliance architecture that the Act demands maps more cleanly onto local AI than onto cloud AI. This is not ideology. It is the structure of the obligations.

The SMC Extension: More Organisations, Same Obligations

One amendment in today’s vote deserves specific attention: the extension of SME support measures to small mid-cap enterprises.

The original AI Act gave proportional treatment to small and medium-sized enterprises — simplified documentation, access to regulatory sandboxes, lower administrative burden. The logic was that an eight-person startup could not meet the same compliance overhead as a multinational.

Parliament has now extended this to small mid-caps — companies that have outgrown strict SME status but are not yet large enterprises. This is a significant clarification for a specific tier of organisation: the scaling company that has recently passed the SME threshold and was facing abrupt full-obligation compliance.

The substance of the obligations does not change. The support framework extends further down the size curve. More organisations will be covered; more will have access to simplified pathways.

What This Means for the Running Scorecard

Update #6 documented all five Big Tech counter-moves from Chapter 9. The scorecard stood at 8 of 30 predictions assessed, all in the right direction, five moving faster than projected.

Today’s vote closes an open item: the paper’s identification of the AI Act as a structural force was explicitly contingent on implementation ambiguity resolving. It has resolved. The fourth force is no longer theoretical. It has a date.

The paper also noted that the AI Act would accelerate the local AI shift by making cloud-dependent deployments more legally complicated. Today’s bias correction clause — allowed, but only with strict safeguards that are easier to demonstrate locally — is the first specific provision that makes that argument concrete rather than inferential.

Scorecard update: 9 of 30 predictions assessed. 9 in the right direction. The fourth structural force moves from “theoretical” to “active.”

Three Steps for December 2027

The paper ended with action frameworks. So will this update.

Step one: audit your AI footprint. Map every AI system your organisation uses or deploys. Identify which fall into the high-risk categories — biometrics, employment decisions, essential services, access decisions. This list is almost always longer than the initial estimate. Most organisations discover AI in HR, in access control, in customer-facing decisions, that was not purchased as “AI.”

Step two: assess the architecture. For each high-risk system, ask: where does the AI run? Where does the training data live? Who controls the audit trail? Who can produce the technical documentation the Act requires? If the answers involve a third-party cloud provider, the compliance path runs through that provider’s cooperation, their documentation standards, and their timelines. Build that dependency into the risk assessment.

Step three: start with documentation now. The Act does not require you to have solved compliance by today. It requires you to demonstrate, on 2 December 2027, that you have. That demonstration is built on records that accumulate over time — data governance logs, risk assessments, oversight records. The organisations that start building those records today will have 20 months of evidence. Those that start in November 2027 will have weeks.

The clock started today. The date is fixed. The organisations that act now will find the deadline manageable. Those that wait for the Council to conclude, for the Commission to publish all guidance, and for enforcement to begin, will find themselves running.

The paper predicted this moment. It arrived on schedule.

Chapter 9 of The Great Return named five moves Big Tech would deploy to slow the shift to local AI: free-tier subsidies, ecosystem lock-in, the safety narrative, API restrictions, and talent acquisition. Seven weeks after publication, all five are visible in the same week’s news cycle. The headline development wasn’t in the paper.

The Playbook

The paper was direct about what to expect. “Google, Microsoft, Meta, Amazon, and others are not passively watching their cloud revenue streams migrate to local hardware. Their strategic responses are sophisticated, well-funded, and designed to preserve the centralized paradigm.”

Five moves were named. Here’s how each one landed in March 2026.

Free Until It Isn’t

The zero-cost subsidy move has been running for months. In the last three weeks it became visible as a pattern rather than a collection of product launches.

Microsoft integrated Copilot into Health (March 12) — connecting it to medical records and wearables. Copilot Tasks (February 26) now uses its own computer to complete multi-step work. Copilot is arriving on Xbox consoles this year. A second generation of Microsoft’s AI image model (MAI-Image-2) rolled out free in Copilot and Bing. Two new Cloud PCs — the Asus NUC 16 and Dell Pro Desktop for Windows 365 — launch in Q3 2026, running a locked-down operating system Microsoft calls Windows CPC. No local processing. Pure cloud dependency, embedded into the hardware SKU.

So far, so expected. But something else happened in the same week: Microsoft announced it was removing Copilot entry points from Snipping Tool, Photos, Widgets, and Notepad — “reducing unnecessary Copilot entry points” in the official language. The Copilot buttons in Windows 11 had been “getting out of control.”

The zero-cost subsidy model had overshot. Users pushed back. Microsoft is now calibrating.

This is the first documented backlash in the counter-move playbook. The rollout is not being abandoned — Copilot Health and Copilot Tasks are the real bets. But the mass-surface approach had to be trimmed because it generated visible user resistance.

On the lock-in side, two moves stand out. Microsoft is requiring a Microsoft account to save SwiftKey typing data starting May 31, 2026 — Google and Apple accounts removed. Keyboard input data becomes Microsoft-proprietary. Separately, Anthropic’s Claude Cowork capability is being integrated into Microsoft Copilot cloud — a competitor AI’s best agent feature absorbed into the walled garden rather than let operate independently. This is not partnership. It is ecosystem capture.

The paper’s description holds precisely: “the switching cost is not just technical but organizational: workflows, training, documentation, and business processes become entangled with the cloud AI provider’s specific capabilities.”

The Safety Narrative Goes to Washington

The most significant counter-move of the quarter did not happen in Brussels. It happened in Washington.

On March 20, 2026, the Trump administration released a national AI legislative framework — a four-page document with seven provisions, delivered to Congress as a roadmap for federal AI legislation. The key provision: pre-empt all state AI laws. A single national standard, applied uniformly, overriding state-level regulation.

The stated rationale is innovation speed. “A patchwork of conflicting state laws would undermine American innovation and our ability to lead in the global AI race.” The framework also includes a liability shield: Congress should prevent “penalizing AI developers for a third party’s unlawful conduct involving their models.” No independent oversight mechanism. No enforcement structure.

Critics were precise. “White House AI czar David Sacks continues to do the bidding of Big Tech at the expense of regular, hardworking Americans,” said Brendan Steinhauser, CEO of the Alliance for Secure AI. “This federal AI framework seeks to prevent states from legislating on AI and provides no path to accountability for AI developers for the harms caused by their products.”

The paper predicted the safety narrative would be deployed in regulatory lobbying, with cloud providers pushing for open-weight models to face the same high-risk classification as commercial cloud. That happened during the EU AI Act negotiations — and Article 2(12) largely held the line.

What the paper did not anticipate was this version: the safety narrative executed through the US executive branch as statutory pre-emption. Lobbying influences how legislation is written. Pre-emption eliminates competing legislation entirely. California’s SB-53 and New York’s RAISE Act — state laws that might protect local AI deployment ecosystems — are now under direct federal threat.

For European readers, the immediate legal risk is contained. The AI Act, GDPR, and the European regulatory space are not affected by US federal pre-emption. But there is a signal worth reading: when Big Tech is willing to mobilise the US executive branch against state-level AI oversight, it tells you how seriously the industry is treating the threat of distributed, local, sovereign AI. You do not spend political capital on irrelevant problems.

The Chinese Wild Card

The paper predicted five counter-moves. A sixth arrived this week from an unexpected direction.

On March 23, 2026, the US-China Economic and Security Review Commission published a report documenting the dominance of Chinese open-source AI models on global platforms. Alibaba’s Qwen family of models has surpassed Meta’s Llama in global cumulative downloads on HuggingFace. Approximately 80% of US AI startups now run on Chinese open-source AI models. DeepSeek R1 briefly overtook ChatGPT as the most downloaded model on the US App Store in January.

The commission’s framing: “Chinese open-source AI is creating a self-reinforcing competitive advantage.” The machinery of open-source contribution — cheap, widely adopted, continuously improved by global usage data — allows China to close performance gaps despite restricted access to advanced semiconductors. “Open model proliferation creates alternative pathways to AI leadership.”

The regulatory weapon implicit in this framing is: local AI and open-weight models equal Chinese infrastructure running on Western hardware. This is a much more politically potent argument against non-commercial local AI than the “Wild West safety” narrative the paper predicted. Security concerns mobilise faster than safety debates.

The counter-evidence also landed in the same week. Siemens CEO Roland Busch said publicly there are “no disadvantages” to using Chinese open-source AI for the company’s industrial automation models — citing cost and ease of customisation. The world’s largest industrial automation company is pragmatic. Below the CEO level, cost wins national security debates.

The European reading is this: the Chinese open-source dominance story sharpens the market gap the paper identified. If US cloud and Chinese open-source are both politically and technically complicated options, European sovereign AI stacks — local, open-weight, built on European hardware and European data governance — become the only clean option. The paper’s argument gains a new axis.

What This Means

All five counter-moves named in Chapter 9 are documented in the March 2026 news cycle. Prediction 5.5 moves from unresolved to confirmed — faster than expected.

Two things are worth noting alongside the confirmation.

First: the Copilot backlash. The fact that Microsoft had to roll back Copilot integration in consumer apps is evidence that the zero-cost subsidy model has limits. Users notice when the tool becomes the product. The broad-surface saturation approach was visibly resisted. That matters for the paper’s argument — it means the cloud-first default is not passively accepted.

Second: the scale of the federal counter-move is signal. Industries do not mobilise federal legislative machinery against irrelevant threats. The Trump framework’s pre-emption move is an indicator of how seriously Big Tech is treating the migration to local AI. The paper’s core prediction — that the shift is real and that 2026 is the tipping point — is being confirmed by the strength of the response against it.

The running scorecard: 8 of 30 predictions assessed, 8 in the right direction, 5 moving faster than the paper projected. No predictions have been wrong.

Why This Matters Now

For European organisations evaluating local AI infrastructure, the practical message from this week is timing.

The counter-moves are being deployed now, not later. Ecosystem lock-in compounds over time — the longer workflows, tools, and compliance documentation are entangled with a cloud provider’s specific AI capabilities, the more expensive the extraction becomes. The paper’s estimate for the tipping point is 2026. The counter-moves are on the same timeline.

The EU regulatory space is still intact. The AI Act’s Article 2(12) open-source carve-out held through the negotiations. GDPR continues to create genuine compliance friction for cloud-hosted AI with cross-border data flows — and that friction is an accelerant for local deployment, not a barrier. The AI Act August 2026 enforcement deadline for high-risk systems is five months away.

The tools exist. Capable open-weight models run on NPU-equipped hardware available today. The European hardware ecosystem is arriving — Axelera Europa ships H1 2026. The decision is not technical.

The window is narrowing. The counter-moves are working on a clock.

This investigation update is part of an ongoing research series tracking the predictions made in The Great Return: Why 2026 Marks the Tipping Point for Local AI Migration in Europe — published February 2026 on Zenodo.

“The Great Return” was published on February 7, 2026. Six weeks later, the paper’s thirty predictions are no longer projections sitting in a research document. They are being tested in real time — by a war in the Middle East, a Pentagon procurement crisis, a global water conflict, and a European chip industry moving faster than its own funding announcements.

This is the most comprehensive update since publication. Every major prediction, current status, and what has changed since the paper was written.

What the Paper Predicted — And What Six Weeks Confirmed

Prediction 2.1 — AI Act enforcement from August 2026, no delay

Status: Conditionally revised.

The paper stated this as firm. It was firm at time of writing. Since then, the European Commission published the Digital Omnibus on AI in November 2025 — proposing to link high-risk enforcement timelines to the availability of compliance infrastructure rather than a fixed date. The practical effect: up to 16 months of additional runway for Annex III high-risk systems, conditional on the Omnibus being enacted before August 2026.

The critical nuance: the Omnibus is not law yet. Trilogue negotiations between the Commission, Parliament, and Council are expected to begin in April or May 2026. Until enacted, August 2 remains the operative deadline. Legal counsel across Europe is advising clients to treat August 2026 as binding and treat any extension as a bonus, not a given.

What has not changed: prohibited practices (in force since February 2025), GPAI model obligations (August 2025), DORA (January 2025), NIS2 (October 2024), and GDPR. The regulatory constellation the paper described is fully in force. The single conditional delay affects one category of one regulation.

Verdict: Prediction holds. One timeline conditionally extended — the broader compliance case unchanged.

Prediction 2.2 — Compliance pressure drives local AI adoption

Status: Confirmed and accelerating — through unexpected routes.

The paper predicted that AI Act compliance pressure would push organizations toward local inference. That is happening — but three additional drivers have arrived that the paper did not anticipate.

First: the Pentagon-Anthropic standoff. The US government’s attempt to blacklist Anthropic for refusing to enable autonomous weapons demonstrated, in operational terms, that cloud AI dependency creates leverage that will eventually be used. The European response was immediate: calls for Anthropic to relocate to the EU, recognition that the same pressure could be applied to any cloud AI supplier at any moment.

Second: the Odido/Lifemote scandal. Three years of router data — MAC addresses, device names, neighboring networks — flowing silently to a Turkish AI startup, undisclosed in any privacy statement. The “death of shadow AI” argument from Chapter 5 now has a household face.

Third: the Tycoon 2FA takedown. Europol and Microsoft dismantled one of the world’s largest phishing operations in March 2026 — 500+ Belgian victims, 3 million messages per month. Cloud-based criminal infrastructure can be taken down. The next generation, running locally, cannot. This validates the paper’s compliance argument from the opposite direction: the same infrastructure properties that make local AI compliant also make criminal local AI invisible.

Verdict: Prediction confirmed. Three additional vectors not in the paper.

Prediction 3.2 — Axelera Europa ships H1 2026

Status: On track — and significantly stronger than projected.

The paper cited Axelera’s Europa chip at 629 TOPS with H1 2026 shipments. That timeline holds. What has changed: Axelera closed a $250 million funding round in March 2026, bringing total raised to approximately $450 million — the largest AI semiconductor investment in EU history. The customer base has grown to approximately 500 organizations, with Metis already in production across industrial, retail, and security deployments.

Europa silicon samples are expected in Q2 2026. The PCIe card form factor — single-chip 16GB to four-chip 256GB configurations — is confirmed. Axelera works with both TSMC and Samsung for chip production.

Additionally: the PIXEurope photonic chip consortium announced in March 2026, with €380 million in public investment and facilities on Eindhoven’s High Tech Campus. Photonic chips use light rather than electrons, offering fundamentally higher energy efficiency for AI and data center workloads. This is the generation beyond what the paper described — the paper’s Chapter 6 is already becoming conservative.

Verdict: Prediction confirmed and exceeded. The sovereign silicon story is moving faster than written.

Prediction 3.5 — EU Chips Act 20% semiconductor target by 2030

Status: Infrastructure being built, target under pressure.

NanoIC opened in Leuven in February 2026 — Europe’s largest Chips Act research facility, €2.5 billion, ASML’s most advanced High-NA EUV scanner operational. PIXEurope in Eindhoven adds photonic capability. The design ecosystem is ahead of schedule.

Manufacturing scale remains the gap. Europe still relies on TSMC for volume production of leading-edge chips. The 20% target refers to manufacturing share — and the distance there is measured in decades of industrial investment, not months of policy. The paper was honest about this tension. Nothing in six weeks changes that assessment.

Verdict: Design ecosystem ahead of schedule. Manufacturing target unchanged — still ambitious.

Chapter 3 — Geopolitical dependency as structural risk

Status: Validated beyond anything the paper anticipated.

The paper’s submarine cable vulnerability argument was theoretical in February. Iranian drone strikes on AWS infrastructure in the UAE and Bahrain, and the contested status of the Strait of Hormuz, made it operational in March.

The Pentagon-Anthropic standoff added a dimension the paper described structurally but lacked a concrete example for: that dependency creates leverage, and leverage will be used. The US government applied a “supply chain risk” designation — previously reserved for Huawei and Kaspersky — to a domestic AI company for refusing to remove ethical guardrails. The military continued using Claude for active combat support in Iran while simultaneously attempting to phase it out. That is the dependency bottleneck made operational.

The Chatham House conclusion circulated widely in European policy circles: “a hammer blow to the trustworthiness of US technology.” The paper predicted that geopolitical events would expose cloud dependency. The events arrived faster and more dramatically than projected.

Verdict: Prediction confirmed and surpassed. This is the paper’s strongest validation to date.

Chapter 4 — Environmental resistance to hyperscale expansion

Status: Confirmed and documented globally.

The paper cited Aragon, Ireland, and the Netherlands. Six weeks of research added Uruguay (constitutional right to water violated in practice), Canton Mississippi (majority Black community, $10 billion Amazon facility, Clean Water Act lawsuit), Saline Michigan ($7 billion Stargate project blocked by bipartisan community opposition), and India (60-80% of data centers in high water stress areas).

The February 2026 greenwashing report — 154 Big Tech AI climate claims, 74% unverified — named the paradox: AI is marketed as the solution to climate change while the infrastructure running it is depleting local water supplies and extending the life of coal plants.

Morgan Stanley projects global data center water consumption at 1,068 billion liters annually by 2028 — eleven times current levels. The paper’s 2 million liters per day per facility figure was not an outlier. It was an understatement for large deployments.

Verdict: Prediction confirmed. Global scope larger than paper described.

Chapter 5 — Death of Shadow AI

Status: Confirmed — and extended into the household.

The paper described shadow AI as an organizational phenomenon: employees using cloud AI tools without oversight, sending sensitive data to external servers. The Odido/Lifemote scandal extends that argument to the domestic level. Shadow AI is not only a corporate risk. It is running in living rooms, naming devices, mapping households, flowing to servers in Istanbul — undisclosed, uncontrolled, for three years.

The Digital Omnibus’s AI Act delay does not affect this argument. GDPR applies. The Autoriteit Persoonsgegevens confirmed MAC addresses are personal data. Odido’s privacy statement did not mention Lifemote. The legal exposure exists regardless of AI Act timelines.

Verdict: Prediction confirmed and extended. The household dimension not in the paper.

The Adoption Numbers: Where We Actually Are

The paper estimated 15-25% local generative AI adoption among early-adopting European organizations in 2026.

Eurostat data from early 2026: 19.95% of EU enterprises use AI technologies — up 6.47 percentage points in one year. Large enterprises: 55%. SMEs: 17%. The OECD puts firm-level adoption at 20.2%, more than doubling from 8.7% in 2023.

These figures cover all AI use, not specifically local inference. The local-specific numbers are not yet officially measured. The paper’s 15-25% estimate for early-adopting sectors remains the best available proxy — and the Eurostat trajectory suggests the broader base is moving faster than the paper projected.

The ECB’s March 2026 survey of 5,000 European firms: two-thirds report employee AI use. A quarter invest in AI technology. The gap between use and investment is the shadow AI problem quantified: employees using accessible online tools — cloud-based, unmanaged, undisclosed — while organizations have not yet made the infrastructure decision.

The paper’s adoption estimate: tracking. The shadow AI gap: larger than projected.

What the Paper Did Not Anticipate

Three developments that were not in the paper and are now part of the story:

The ethics-as-geopolitics dimension. The Pentagon-Anthropic standoff introduced a variable the paper did not model: that an AI provider’s ethical commitments could become a geopolitical liability in one jurisdiction and a competitive advantage in another. Anthropic’s refusal to enable autonomous weapons — which the Pentagon treated as a supply chain risk — is exactly what the EU AI Act’s human oversight requirements mandate. The company that was blacklisted in Washington is the compliant provider in Brussels.

The household as a data extraction site. Chapter 8 described the household as the most private domain of local AI deployment. The Odido scandal revealed it as the most exposed. The router, the television, the smart speaker — each operating as a silent data extraction point, undisclosed, under-regulated, and now documented.

The criminal mirror. The same forces driving local AI adoption for legitimate purposes — hardware accessibility, open-source models, no cloud dependency — are driving it for illegitimate ones. The paper described the benefits of local AI. A parallel investigation documents the other side: 1.09 million monthly downloads of uncensored models on HuggingFace, no darknet required, criminal AI-as-a-service evolving from cloud-dependent to locally-run, invisible to every enforcement framework currently operating.

The Pentagon Dogfight: Still Playing Out

Anthropic filed suit against the Department of Defense on March 9 — two lawsuits simultaneously, one in the Northern District of California, one in the DC Circuit — challenging the supply chain risk designation on statutory and constitutional grounds. A preliminary injunction hearing is scheduled for March 24 in San Francisco federal court.

The case has moved fast. Nearly 150 retired federal and state judges filed an amicus brief supporting Anthropic on March 17 — appointed by both Republicans and Democrats. Microsoft filed in support of a temporary restraining order. Researchers from OpenAI and Google DeepMind filed jointly in their personal capacities. The DOJ filed its rebuttal the same day, arguing Anthropic’s refusal to accept “any lawful use” terms is conduct, not speech, and therefore not First Amendment protected. The Pentagon maintains it can choose its vendors without judicial interference.

The Pentagon continued using Claude for active combat support in Iran throughout the legal proceedings. The dependency bottleneck, named in Update #2, has not been resolved. It has become a federal case

The Honest Assessment

Six weeks of real-world events have not weakened a single major prediction in the paper. Several have been validated faster and more dramatically than projected. Two predictions require nuance — the AI Act enforcement timeline is conditionally extended, and the adoption numbers show a broader base than anticipated at lower-than-expected local specificity.

The paper’s core thesis — that 2026 marks the structural tipping point for local AI migration in Europe — is not contradicted by six weeks of evidence. It is, if anything, more urgent than when it was written.

The next update will cover the Anthropic lawsuit outcome, Axelera Europa first production reviews, the Digital Omnibus trilogue result, and the first enterprise adoption data specific to local inference deployments. Target: June 2026

This update is part of the ongoing research series accompanying The Great Return: Why 2026 Marks the Tipping Point for Local AI Migration in Europe — published February 2026. Full paper: DOI 10.5281/zenodo.18511984

Tor was built by the United States Navy.
The Onion Router was designed in the mid-1990s by Naval Research Laboratory mathematicians who needed a way to protect American intelligence communications online. The technology was elegant: traffic bounced through multiple encrypted layers, each layer knowing only the next hop, the origin invisible to anyone watching the network. Perfect for intelligence officers operating in hostile countries. Perfect for dissidents communicating under authoritarian regimes. Perfect for whistleblowers, journalists, and privacy advocates who needed to operate without surveillance.

It also became the infrastructure of Silk Road, the world’s first large-scale darknet drug market. And of markets that sold weapons, stolen credentials, child abuse material, and contract violence. The same anonymity that protected a CIA officer in Moscow protected a heroin dealer in Rotterdam. The technology did not change. The hands did.

Local AI is following the same path. And the first symptoms are already visible.

We Need to Talk About the Other Side

“The Great Return” argues that local AI is the structural solution to data sovereignty, compliance, and privacy. That argument stands. The hardware is real. The regulation is real. The migration is happening.

But a serious investigation into local AI cannot look only at the benefits and call it research. The same forces that make local AI valuable for a Belgian accountant protecting client data — no cloud dependency, no logging, no third-party visibility, no jurisdiction — make it equally valuable for someone whose use case does not appear in any compliance framework.

This is not an argument against local AI. It is an argument for intellectual honesty about what we are describing when we describe a technology that is powerful, private, and outside any provider relationship.

The kelder in Minsk has the same hardware catalog as the office in Eindhoven.

The Market That Built Itself

The terminology has evolved. In 2026, “uncensored” is largely replaced by more technically precise labels: Abliteration — the surgical removal of refusal behavior from a model through direct weight manipulation — and terms like Heretic, Derestricted, and Unfiltered. The models have become more sophisticated. The distribution has become more professional.

They are not hidden. They live on HuggingFace — the same infrastructure that hosts the legitimate open-weight models European enterprises use for compliance-friendly local AI deployment. No darknet required. No special access. No registration beyond a free account. The URL is public. The download is free. Installation via Ollama: one command.

ModelCharacterDownloads/monthDolphin 3.0 (Llama 3.1/3.2)The established standard. Removes refusals while improving reasoning and coding. Most stable choice for daily use.~450kNous Hermes 3Not marketed as uncensored but known for extreme freedom in roleplay and creative writing. Follows instructions without moral commentary.~320kHauhauCS Qwen3.5 UncensoredTrending March 2026. First strong uncensored version of the Qwen3.5 architecture. “Aggressive” variant: documented 0% refusal rate.~127k (rising)Huihui-ai Abliterated SeriesApplies abliteration to almost every major new model. First stop for users who want any specific model without filters.~110kLlama 3.2 Dark ChampionSpecialist for long-context analysis. 128k context window. Popular for processing entire documents without the model developing ethical objections halfway through.~85k

Source: Gemini research assist, March 2026. Based on HuggingFace monthly downloads, Ollama pull statistics, and LocalLLaMA community activity.

Top five alone: approximately 1.09 million downloads per month.

The question is not whether someone can access a model that answers every question. The question is whether someone wants to. With over a million downloads a month, the answer is documented.

From Cloud to Basement: The Criminal Infrastructure Grows Up

FraudGPT and WormGPT were the first generation. Cloud-based, subscription-priced, darkweb-distributed. FraudGPT launched on Telegram in July 2023 at $200 per month — marketed as an all-in-one kit for phishing campaigns, malicious code generation, and identity fraud. WormGPT followed days later: a Business Email Compromise specialist, trained on malware data, capable of generating phishing emails that human analysts could not distinguish from legitimate correspondence. Over 3,000 confirmed sales before the original operator shut it down under the weight of media attention.

That was the first generation. Cloud-dependent, server-based, takedown-vulnerable.

The second generation is different. New WormGPT variants documented by Cato Networks in February 2025 are built on top of Grok and Mistral’s Mixtral — existing open-source models, manipulated through system prompt engineering and fine-tuning on criminal datasets. No new model architecture required. No server to shut down. The brand “WormGPT” now functions as a label for a class of tools rather than a single product — criminal AI-as-a-service built on the same open-source infrastructure that legitimate organizations use for compliance.

The evolutionary direction is clear. The first generation needed a cloud server and a Telegram channel. The next generation needs neither. Agent Zero — one of the more sophisticated tools documented in 2025 — scrapes LinkedIn profiles, press releases, and financial filings to gather context on executives before generating phishing content. It mentions specific vendors, live projects, contract deadlines. The finance manager who receives the wire transfer request does not see a generic scam. They see something that knows their company.

By early 2025, ENISA documented that AI-supported phishing campaigns represented more than 80 percent of observed social engineering activity worldwide. KnowBe4’s 2025 Phishing Threat Trends Report found that 82.6 percent of analyzed phishing emails contained AI. The tools are not emerging. They are mainstream.

The Basement Cost of Entry

Here is the number that matters most in this investigation.

A second-hand RTX 3080 costs €400. Python is free. A 13-billion parameter model runs at 20 tokens per second on that hardware. Fine-tuning on a specific use case — adjusting an existing model’s behavior through targeted training on curated examples — takes approximately 48 hours with publicly available tutorials, no ML degree required.

No cloud account. No registration. No logging. No abuse team that receives a notification. No provider relationship of any kind.

The minimum hardware and knowledge threshold for building an effective AI instrument for any purpose — including harmful ones — is lower in 2026 than the threshold for building a professional website was in 2010. That is not a hypothesis. It is what the ESET, CrowdStrike, and Europol threat reports collectively describe without stating it quite so directly.

The technology that allows a care worker in a Belgian youth facility to process sensitive client documentation without data leaving the building also allows someone with different intentions to operate with the same invisibility. The hardware does not ask why.

States Were First

The most sophisticated users of uncontrolled local AI are not criminals in basements. They are governments.

In 2025, Anthropic identified a Chinese state-sponsored campaign that used Claude to automate significant portions of a cyberattack — one of the first documented cases of a state actor deploying frontier AI for largely automated offensive operations. Google documented the same pattern with Gemini: state-directed hackers from China, Russia, Iran, and North Korea used the model across every phase of cyberattacks — from reconnaissance and phishing to command-and-control development and data exfiltration.

North Korea is the most granularly documented. North Korean IT workers feed real-time subtitles of job interviews into AI models to generate accurate, contextually appropriate answers. On a single day, one documented operator received expressions of interest from approximately 20 companies, all for AI-related roles. A country under maximum economic sanctions is partly financing itself through AI-assisted identity fraud at scale.

The timeline is accelerating. According to the UK AI Security Institute, the duration of autonomous AI cyber tasks grew from under ten minutes in early 2023 to over an hour by mid-2025. Open-source AI models can now replicate frontier model capabilities within four to eight months of release.

The gap between a state actor and a criminal in a basement is closing. Same models. Same hardware. Same absence of logging, oversight, or jurisdiction. The difference is budget and intent — and budget is becoming less relevant as the hardware gets cheaper.

The Accountant in Antwerp

The following account is a composite based on documented attack patterns from ENISA, KnowBe4, and cyber insurance claim analyses published in 2024–2025. Details have been constructed to illustrate a realistic scenario; it does not refer to a single specific incident.

The threat is not abstract. It arrives in inboxes.

In November 2025, a mid-sized accounting firm in Antwerp received an email from what appeared to be their software supplier. The sender address matched. The language was flawless Dutch. The email referenced a specific contract renewal, a named contact at the firm, and a payment deadline that corresponded to their actual billing cycle. It requested a SEPA transfer to a new IBAN — a routine change, the email explained, following a banking migration.

The transfer of €47,000 was authorized within the hour.

The attack was reconstructed by the firm’s cyber insurer during the claim process. The attackers had scraped the firm’s LinkedIn page, its website, public procurement records, and the supplier’s own website. An AI model had synthesized this into a profile of the firm’s supplier relationship, identified the billing contact by name, and generated correspondence that referenced details no generic phishing template would know. The IBAN led to a mule account in Romania. Recovery: zero.

This is not a sophisticated nation-state operation. It is a €400 GPU, publicly available tools, and forty-eight hours of preparation. The Antwerp firm had antivirus software, email filtering, and staff who had completed a cybersecurity awareness training that year. None of it was built for an attack that knew their supplier’s name, their contract renewal date, and the name of their accounts payable contact.

ENISA’s Threat Landscape 2025 analyzed 4,875 incidents between July 2024 and June 2025. Social engineering — the category that covers this type of attack — was the leading threat vector for European SMEs. The report notes that AI-assisted attacks are now indistinguishable from human-crafted ones in terms of linguistic quality. The only reliable signal left is behavioral: does the request follow the expected process? The Antwerp firm’s process included a phone verification step for new IBANs. It was not followed because the email arrived during a busy period and the contact was traveling.

The attack worked because it was personalized. It was personalized because the data was public. The AI did the labor of synthesis that would have taken a human attacker days. It took minutes.

The Law Has No Door To Knock On

The EU AI Act is the most comprehensive AI regulatory framework in the world. It is also, in one specific and structural way, blind to the threat described in this investigation.

The Act regulates providers — entities that place AI systems on the EU market. It regulates deployers of high-risk AI systems. It regulates general-purpose AI models above a training compute threshold. These are the visible actors: OpenAI, Google, Anthropic, Mistral. Companies with offices, legal identities, and compliance departments that can receive a regulator’s letter.

Article 2, paragraph 12 of the AI Act grants open-source AI models a broad exemption from obligations — unless deployed as a high-risk system or falling under the prohibited practices. Open-source GPAI providers are exempt from documentation requirements to downstream providers and to the AI Office. They lose that exemption only upon monetization.

The practical consequence is structurally simple. A criminal who fine-tunes Llama on harmful use cases, runs it locally in an apartment in Bucharest, and uses it themselves rather than selling it — is not a provider in the sense of the law. There is no market placement. There is no provider relationship. There is no authority with jurisdiction over the act. There is no door to knock on.

The prohibited practices in Article 5 apply regardless of open-source status — including systems for social scoring, real-time biometric surveillance, and manipulation of vulnerable persons. But enforcement requires detection. Detection requires visibility. A local model that never touches a cloud server generates no logs at a provider, no API calls at a platform, no data points at an enforcement authority. It exists legally only after the harm has occurred.

The AI Act is an enforcement instrument for the visible part of the AI ecosystem. The invisible part — distributed, local, outside any provider relationship — requires a fundamentally different enforcement model that does not yet exist.

The Arms Race Nobody Is Winning

The documented threat landscape in 2026 reads like a capabilities inventory that moves faster than any defense can track.

On the attack side: polymorphic malware generated per victim, adjusting its code on each deployment to evade signature-based detection (ESET, CrowdStrike 2025). Spearphishing personalized at the individual level at industrial scale — a message that references your name, your employer, your recent activity, generated in seconds per target. Deepfake audio for CEO fraud: a documented case in Hong Kong in 2024 resulted in a $25 million transfer authorized by a finance officer who heard his CEO’s voice on a call. That voice was synthesized. Automatic exploit development: AI systems scanning CVE databases and writing proof-of-concept attack code before defensive patches are deployed.

On the defense side: AI-powered anomaly detection, behavioral endpoint security, LLM-detection in email filters, network traffic analysis for command-and-control patterns. Meaningful capabilities, genuinely deployed.

The structural problem: defense scales slower than attack by definition. An attacker needs to succeed once. A defender must succeed every time. When the attacker runs a local model generating novel attack variants faster than defensive signatures can be updated, the defense has a structural information deficit that cannot be closed by adding more defenders.

This is not a solvable problem with current tools. It is an asymmetry that compounds as the hardware becomes cheaper, the models become more capable, and the knowledge threshold continues to fall.

The Honest Conclusion

This investigation is written by someone who believes that local AI is the right direction for European organizations, households, and individuals who value sovereignty over their data and compliance with the regulatory frameworks that govern their work.

That belief is unchanged. The paper’s thesis stands.

But the same properties that make local AI sovereign — no cloud dependency, no provider logging, no external visibility — make it structurally invisible to every enforcement framework currently in operation. The EU AI Act regulates providers. Local AI, by definition, often has none. Europol and ENISA document the threat landscape but focus on cloud-based model misuse. The local threat — distributed, fine-tuned, jurisdictionless — is named in their reports and structurally unaddressed in their enforcement capacity.

The conclusion is not: stop local AI. Restricting open-source models would not stop state actors who build their own. It would not stop well-resourced criminal organizations. It would stop European SMEs, researchers, and individuals who need sovereign AI tools to comply with regulations that cloud providers make difficult to satisfy.

The conclusion is: the current regulatory architecture addresses the visible part of the AI ecosystem. The invisible part requires a fundamentally different approach — one built around behavioral detection, cross-border law enforcement cooperation on AI-enabled crime, and enforcement frameworks that do not depend on a provider relationship to function.

Europe is building the most sophisticated AI regulatory framework in the world. It is doing so with excellent tools for the actors it can see. The actors it cannot see are already operating. They have been for some time.

Tor was built by the US Navy. The technology was neutral. The outcomes were not. Local AI is the same technology in that sense — and the honest acknowledgment of that fact is not a reason to retreat from it. It is a reason to build the second layer of governance that the first layer cannot reach.

This investigation is part of the research series accompanying The Great Return: Why 2026 Marks the Tipping Point for Local AI Migration in Europe — published February 2026. Full paper: DOI 10.5281/zenodo.18511984

Your router is logging which devices are on your network, what they’re named, and which networks your neighbors use. Your television is taking a screenshot of whatever is on screen — every 500 milliseconds, twice per second — and matching it against a database to build a profile of your viewing habits. Your smart speaker is listening for a wake word that may or may not be the only thing it’s listening for. Your phone knows where you slept last night, how long you were there, and whether you left the house before 8am.

None of this was in the box.

This is the state of the connected home in 2026. Not a dystopian projection. Not a conspiracy theory. A documented, legally contested, occasionally fined, and persistently profitable system of data extraction that runs through every device you own — quietly, continuously, and in most cases, with your consent buried somewhere on page 47 of a terms of service document you clicked through in thirty seconds.

The Deal We All Made

In 2006, Facebook was free. And we knew why.

Not in the legal sense — nobody read the terms of service. But in the intuitive sense, we understood the exchange. You share your life, they show you ads. Your holiday photos reach your family across the continent. Your mother sees your dinner and types “eet smakelijk.” The algorithm learns you like cycling and shows you cycling gear. Fine. Reasonable. A trade you could see.

Google Maps showed you the fastest route. Gmail organized your inbox. YouTube had every music video ever made. All free. All powered by the same basic logic: your attention and your data in exchange for services that would otherwise cost hundreds of euros a year.

We knew. Not everything — not the depth, not the permanence, not the resale, not the political targeting, not the mental health research that Facebook conducted on users without consent, not the location data sold to law enforcement, not the shadow profiles built on people who had never signed up at all. We did not know those things. But we knew the broad shape of the deal and we accepted it.

That deal, and the data infrastructure it funded, also built something else entirely. The investment in understanding human behavior at scale — billions of data points, trillions of interactions, decades of pattern recognition — produced the machine learning breakthroughs that became the AI models you use today. The recommendation engine that learned what you’d watch next became the transformer architecture that powers the tools that write, think, and reason alongside you now.

You are reading this because that data existed. The AI that helped research and shape this piece exists because of it too. That is true and worth acknowledging.

But here is what changed.

The deal was Facebook knowing you liked cycling. What we have now is your router knowing the name of every device in your bedroom. Your television watching you watch it. Your home speaker storing your voice. Your phone tracking your location through the night. These are not advertisements. This is not a timeline algorithm. This is the infrastructure of your private life, quietly mapped and monetized without your meaningful knowledge — and in the case of Odido and Lifemote, without even the fig leaf of a privacy statement that covers what was actually happening.

The deal we made with Facebook set a precedent. The industry took that precedent and ran with it — through every device, into every room, past every boundary we thought we understood.

That is where we are now.

The Router That Told Strangers Your Name

Let’s start close to home. Literally.

Odido — one of the Netherlands’ largest telecom providers — spent at least three years sending data from its customers’ routers to a company called Lifemote. Not just connection quality data. Not just traffic statistics. The MAC addresses of every device on your home network. The names of those devices. Names like “Laptop_CEO_Financiën.” “iPhone van Marie.” “Smart TV slaapkamer.”

The names you gave your devices. Sent, without your knowledge, to a company you had never heard of.

Lifemote is not a household name. It is a small AI startup — Turkish, not American as initially reported — that sells network intelligence services to telecom providers. Its pitch to operators: we analyze what’s on your customers’ home networks and tell you how to optimize their experience. Its pitch to data brokers: we know what devices are in 35 million European homes.

When security researcher Sipke Mellema published his findings on March 3, 2026, Odido patched it within five days. Quietly. No press release. No customer notification. No apology. Just a patch, and a redirect to the privacy statement on their website.

The privacy statement that did not mention Lifemote. That listed MAC addresses as data collected from the modem — not that they were sent to a third party in Turkey. That stated Odido does not sell personal data to third parties. That was, in the words of the Dutch Data Protection Authority, a document that MAC addresses are personal data and may not simply be shared.

Odido said, in effect: our privacy statement, which we comply with, is on our website. They pointed to a document that did not cover what they had done. That is not a defense. That is an instruction to lawyers.

This is Odido’s third privacy incident in weeks. First: a cyberattack in which millions of customer records were stolen — including data of customers who had not been with Odido for a decade, data that should have been deleted years ago under Odido’s own stated retention policy. Second: this. The Lifemote data stream running silently for three years. Third, still unresolved: questions about whether similar data flows exist that have not yet been discovered.

Odido is not unique. Lifemote’s customer list includes Telia, A1 Austria, and online.nl. The same service, running in the background, in homes across Sweden, Austria, and the Netherlands. The question is not whether other providers do similar things. The question is whether we have found them yet.

The Television That Watches You Back

While your router was talking to Lifemote, your television was doing something more intimate.

Samsung’s Automatic Content Recognition technology — built into every Samsung smart TV, enabled by default on most models — takes a screenshot of your screen every 500 milliseconds. Not of your streaming interface. Of whatever is on your screen. Cable television. A film from a USB drive. Your laptop mirrored to the TV. Every 500 milliseconds, a fingerprint is taken, matched against a database, and used to build a profile of what you watch, when you watch it, and how long you watch it.

This profile is sold. To Google. To X, formerly Twitter. To advertising platforms whose names you would not recognize but whose algorithms definitely recognize you.

In January 2026, five Samsung TV owners filed a federal class action in New York, alleging Samsung violated the Video Privacy Protection Act. Texas Attorney General Ken Paxton filed separate lawsuits against five TV manufacturers — Samsung, Sony, LG, Hisense, and TCL — describing ACR as “an uninvited, invisible digital invader” that transformed “millions of American living rooms into mass surveillance systems.”

LG does the same thing under a different name. It is called Live Plus, and the data goes to a company called Alphonso. The television contacts alphonso.tv — not a domain you authorized — with the content of your screen. LG’s privacy policy explicitly notes that viewing history may be sold or shared with third parties. It does note this. In the privacy policy. That nobody reads.

Here is the business model, stated plainly: Vizio, another smart TV manufacturer, generated twice as much revenue selling customer viewing data as it did from selling the actual televisions. The hardware is subsidized by your data. You pay for the TV once. The TV pays its manufacturer back, continuously, for as long as it sits in your living room.

Samsung settled with the Texas Attorney General. They agreed to stop collecting ACR data from Texas residents without explicit consent, and to rewrite their privacy prompts. For Texas residents. The rest of the world received no such agreement.

The Glasses That Watched You Undress

The smart speaker listens. The television watches. The glasses see everything.

In February 2026, Swedish newspapers Svenska Dagbladet and Göteborgs-Posten published an investigation based on interviews with more than thirty employees at Sama, a data annotation company headquartered in Nairobi, Kenya. Sama’s work for Meta: reviewing footage captured by Ray-Ban Meta smart glasses to train the AI system built into the frames.

What those employees saw was not what Meta’s marketing described.

“I saw a video where a man puts the glasses on the bedside table and leaves the room,” one anonymous Sama employee said. “Shortly afterwards, his wife comes in and changes her clothes.”

Others described footage of people having sex, using the bathroom, and undressing — sent to Meta’s servers, filtered through a pipeline to Nairobi, reviewed by human workers who were, as one employee put it, “just expected to carry out the work.” Another said: “We see everything, from living rooms to naked bodies. Meta has that type of content in its databases.”

Meta sold seven million pairs of these glasses in 2025 alone. Its marketing slogan: “Designed for privacy, controlled by you.” Its advertisements: “You’re in control of your data and content.” Its fine print, buried in supplemental terms of service, mentioned that contractors might review content shared with Meta AI. It did not mention Nairobi. It did not describe what those contractors would see.

The pattern is identical to what Odido did with Lifemote, and what Samsung does with ACR. A device enters your home with a privacy promise on the box. The promise is the marketing. The data flow is the business model. The terms of service are the legal shield.

Meta confirmed the practice when pressed. It claimed faces were blurred before review. Employees said the blurring was inconsistent. The UK’s Information Commissioner’s Office wrote to Meta demanding clarification. A class action lawsuit was filed in the United States on March 5, 2026 — the same week Meta announced plans to add facial recognition to the same glasses “as soon as this year.”

The router mapped your house. The television profiled your viewing. The glasses watched you in your bedroom. Each device sold separately. Each privacy violation buried in a different document. Each company pointing to a policy page when asked to explain.

You are wearing a surveillance device on your face. It was marketed as a fashion accessory.

The Fine That Doesn’t Hurt

Here is what accountability looks like in 2026.

Since the GDPR came into force in 2018, European regulators have issued approximately €5.88 billion in fines. That sounds significant until you look at who paid them. Meta: €1.2 billion for transferring European data to the US. LinkedIn: €310 million for misusing behavioral data for advertising. TikTok: €530 million for transferring EU user data to China. Uber: €290 million for transferring European driver data to the US. Clearview AI: €30.5 million for scraping facial images without consent.

Every single one of those companies continued operating in Europe the day after the fine was announced. Meta’s €1.2 billion fine represented approximately four days of revenue. The fine is the cost of doing business. It is calculated into the spreadsheet. It is cheaper than compliance.

The pattern is consistent and documented. A violation occurs — sometimes for years before discovery. A regulator investigates — sometimes for years before a decision. A fine is issued — calculated as a percentage of turnover that large companies can absorb without changing behavior. The company appeals — buying years of additional time. In some cases, the violation quietly stops. In others, it continues under a different name.

In Croatia, a major telecom operator was fined €4.5 million in November 2025 for sending customer data to Serbia without proper safeguards — and for continuing to do so after being told to stop. In Spain, Vodafone received more than 30 GDPR fines in four years and continued making illegal marketing calls. In the first half of 2025 alone, European regulators issued more than €3 billion in fines. The violations did not stop.

This is not a system of accountability. It is a system of taxation. Pay the fine, continue the extraction.

What Is Actually In Your Home

Let us be specific about what the average connected European household contains and what each device is doing.

Your router maps every device by name and MAC address and, as Odido demonstrated, may be sharing that map with parties unknown. Your router manufacturer also collects data. Your ISP collects data. That data may be shared with third parties your ISP contracted before you became a customer.

Your smart TV takes screenshots of your screen twice per second and builds an advertising profile from your viewing habits. The profile is sold. You consented to this in the setup wizard.

Your smart speaker — an Amazon Echo, a Google Home — listens for a wake word and processes requests in the cloud. Recordings are stored. Amazon employs human reviewers who listen to recordings to improve the voice recognition system. You consented to this in the terms of service.

Your smartphone tracks your location continuously, even when you tell it not to, through a combination of GPS, cell tower triangulation, WiFi network detection, and Bluetooth proximity. Your location history is used for advertising. It may be sold to data brokers. In the US, it has been sold to law enforcement without a warrant.

Your smart home devices — thermostats, doorbells, baby monitors, connected appliances — each report back to manufacturer servers. Your Nest thermostat tells Google when you are home, when you sleep, and how warm you keep your house. Your Ring doorbell gives Amazon a video record of everyone who approaches your front door. Your connected washing machine tells its manufacturer how often you do laundry.

None of this is hidden. All of it is in the terms of service. The terms of service that are, on average, longer than Shakespeare’s Hamlet and written in language that requires a postgraduate education to fully parse.

The Death of Shadow AI — In Your Living Room

The paper “The Great Return” described the death of “Shadow AI” in organizational settings — employees using cloud AI tools without oversight, sending sensitive business data to external servers without knowing where it went or who could access it. The paper argued that local AI infrastructure was the structural solution: data that never leaves the building cannot be leaked, subpoenaed, or sold.

The Odido case extends that argument into the living room. Shadow AI is not only a corporate phenomenon. It is a domestic one. The shadow infrastructure of your home — the data flows you did not configure, did not authorize in any meaningful sense, and cannot see — has been running for years.

The router that mapped your household devices. The television that screenshotted your viewing habits. The speaker that stored your voice. The phone that tracked your location. All of this flows, continuously, to servers in Virginia, Seoul, Austin, Istanbul — to companies operating under legal jurisdictions with different privacy standards than the ones you live under, subject to law enforcement requests you will never be informed of, processed by algorithms you cannot inspect.

The question the paper asks for organizations — “why would we send this data to the cloud?” — applies with equal force at home. The answer is the same: because there was no alternative. Until now.

What Changes

The paper’s Chapter 8 described the household as the most private domain of local AI deployment — the place where the principle of the “postman at the door” is most viscerally relevant. The AI that lives on your hardware, knows your context, and reaches out to the internet only for specific, bounded requests. The intelligence that is yours because you own the hardware. The data that stays home because there is no cloud to send it to.

This is not science fiction. It runs on hardware available today. A local AI system on an NPU-equipped device — or, for the technically inclined, on a repurposed desktop with a capable CPU — can handle the tasks currently distributed across a dozen cloud services, without a single query leaving your network. Your calendar. Your documents. Your questions. Your household management. Local. Private. Yours.

The Odido patch fixed the Lifemote data stream. It did not fix the router manufacturer’s own data collection. It did not fix the television ACR. It did not fix the smart speaker recordings. It did not fix the location tracking. Each of those requires a different fix, from a different company, negotiated through a different legal process.

Or a different infrastructure entirely.

The awareness is not enough on its own. Knowing that your television watches you does not stop it watching you. Knowing that your router maps your household does not stop it being mapped. The knowledge creates the demand for an alternative. The hardware to build that alternative exists. The software to run it is free and open. The only thing missing is the moment when Jan and Marie decide that enough is enough.

That moment, historically, follows a scandal. The Odido story is that scandal. Quietly patched. Barely covered. Easy to miss.

You just read it.

This investigation is part of the research series accompanying The Great Return: Why 2026 Marks the Tipping Point for Local AI Migration in Europe — published February 2026. Full paper: DOI 10.5281/zenodo.18511984

Update #4 — The Great Return Research Series

In Montevideo, the tap water tasted of salt.

Uruguay was enduring its worst drought in seventy-four years. The main reservoir had dropped to nine percent of capacity. Authorities, desperate, had begun mixing water from the Rio de la Plata estuary into the public drinking supply. The result was tap water the World Health Organization would not recommend for pregnant women or infants. A poll found that six percent of Uruguayans still drank from the tap — down from sixty-six percent the year before.

At that precise moment, Google announced plans to build a data center in Canelones, southern Uruguay. The facility would consume 7.6 million liters of water per day — equivalent to the domestic daily use of 55,000 people — drawn from the same depleted public water system.

The slogan appeared on walls across Montevideo almost immediately: No es sequía, es saqueo. This is not drought. It is pillage.

The Paradox Has a Name

Chapter 4 of "The Great Return" named this dynamic the Jevons paradox: as AI makes tasks cheaper and faster, total energy and water demand rises faster than efficiency gains can offset. The paper projected that this would generate community resistance from Aragon to Ireland. What it did not fully anticipate was how visceral that resistance would become — or how clearly it would expose a structural governance failure playing out simultaneously on five continents.

A report published in February 2026 put numbers to the greenwashing dimension. Of 154 AI climate claims from major technology companies, 74 percent were unverified and 36 percent offered no supporting evidence at all. Not one confirmed example existed of a generative AI tool — a chatbot, a coding assistant, an image generator — that had measurably reduced emissions anywhere. The AI-saves-the-planet narrative relies on a deliberate conflation: climate benefits from traditional predictive AI — precision agriculture, smart grid optimization — are used to justify the infrastructure footprint of generative AI, which does none of those things and consumes the infrastructure that is drinking the water.

This is not an emerging concern. It is already happening, everywhere, at scale.

Spain: The Arithmetic of Absurdity

Aragon sits in a semi-arid landscape that has been deteriorating for years. Reservoir levels have dropped below forty percent of capacity. Local farmers depend on shrinking water allocations.

Amazon's planned data center expansion in the region was licensed to withdraw 755,720 cubic meters of water per year — enough to irrigate 233 hectares of maize, one of the region's principal crops — from the same diminishing supply. The coalition Tu Nube Seca Mi Río — Your Cloud Is Drying My River — organized sharp community opposition.

Then, in March 2026, Amazon raised its total investment commitment in Spain to €33.7 billion. The headline of the announcement: AI tools that will help Aragonese farmers use water more efficiently. Amazon will use more water from Aragon to run the AI that will teach Aragon to use less water.

Activist Aurora Gómez called it what it is: "a deliberate strategy of obfuscation." The regional government, presented with €33.7 billion in investment, said nothing publicly about the water arithmetic. The national government said less.

This is not an edge case. It is the template.

United States: Democracy in the Parking Lot

The United States is the origin point of the AI infrastructure boom and the site of its most explosive community resistance. The numbers tell the story before any individual case does.

In the second quarter of 2025 alone, opposition to data centers rose 125 percent. An estimated $98 billion in projects were blocked or delayed — more than the total for all previous quarters since 2023. There are now 188 community opposition groups across 17 states targeting 30 data center projects. By early 2026, communities in at least 14 states had enacted temporary moratoriums on data center development.

The cases are becoming iconic. In Saline, Michigan, rural residents rallied against the $7 billion Stargate data center — backed by OpenAI and Oracle — that was fast-tracked by the state utility DTE Energy. Residents only discovered the project's true backers after county officials had signed NDAs preventing public disclosure. The Michigan Attorney General joined the protest. A Republican and a Democrat co-sponsored legislation to reverse data center tax breaks. The resistance cuts clean across party lines — which, in 2026 America, is remarkable.

In Canton, Mississippi — a majority Black town long marked by underinvestment — Amazon opened a $10 billion AI data center promising 1,000 jobs. Within months, residents reported lung irritation, construction dust settling over homes and playgrounds, and cooling towers pulling millions of gallons daily from the already-stressed Big Black River. "We were promised prosperity, but got poisoned air and vanishing water," said local activist Maria Gonzalez. A class-action lawsuit alleging Clean Water Act violations followed in February 2026.

By 2028, US data centers could collectively consume as much water as 18.5 million households — just for cooling servers.

The federal government's response: more than 230 state and local environmental and community groups wrote to Congress in December 2025 demanding a national moratorium. Congress has not acted. The Trump administration's position is that AI infrastructure buildout is a national priority. The communities bearing the physical cost of that priority are learning to organize from each other — sharing legal strategies, building regional coalitions, showing up in numbers that have already blocked or delayed tens of billions in projects.

What makes the US story distinctive is the transparency of the economic capture. Companies that want to construct large data centers target areas with inexpensive real estate and weaker local governments, near large bodies of water. They receive tax breaks from state and local governments competing to attract large tech investors — a Microsoft data center in Washington state received $333 million in sales tax exemptions between 2015 and 2023. The subsidy flows one direction. The water and electricity costs flow the other.

Uruguay: When a Constitutional Right Runs Dry

The Montevideo story deserves its full weight. Uruguay has a constitutional right to fresh drinking water — one of the first countries in the world to enshrine it. When authorities mixed saline water into the public supply during the 2023 drought crisis, they violated a constitutional guarantee to solve a resource problem. Google's planned data center would have drawn 7.6 million liters daily from the same depleted system.

A researcher at the University of the Republic who obtained the project documents through a legal battle put it plainly: Google would generate very little employment, pay no tax — being built in a duty-free zone — and bring serious ecological and social risk in exchange. A UN review warned of "risk of de facto water privatization." The constitutional right to water was being honored in text and undermined in practice.

The project did not proceed in its original form. Uruguay pushed back. It is one of the few cases in the global record where a government held a line.

India: Concentrated in the Wrong Places

Morgan Stanley projects global data center water consumption will reach 1,068 billion liters annually by 2028 — eleven times current levels. India's share doubles from 150 billion liters in 2025 to 358 billion liters in 2030.

Sixty to eighty percent of India's data centers sit in areas already classified as high water stress: Mumbai, Chennai, Hyderabad, Bengaluru. These are cities where water is already divided across competing claims from households, agriculture, and industry. The AI infrastructure boom is not arriving into abundance. It is arriving into existing scarcity, at scale, with minimal national regulatory constraint.

China: The Uncomfortable Benchmark

China is, by every measure, the most aggressive state-directed AI infrastructure builder in the world. It is also the only country to have incorporated data center Power Usage Effectiveness standards and water performance targets into its building code — binding requirements, not voluntary reporting.

The paper's Chapter 3 noted that China accelerated its domestic AI ecosystem following US export controls on advanced semiconductors. What it did not center was this: China simultaneously built regulatory frameworks for data center resource consumption that no democratic government has matched.

The irony is uncomfortable but accurate. The country with the least democratic accountability for technology policy has produced the most binding environmental constraint on how that technology consumes water. Every other government discussed in this piece — Spain, the US, Australia, India — has prioritized investment attraction over resource protection. China prioritized both, and did it through top-down mandate rather than community resistance.

This is not an endorsement of the model. It is a data point that democratic governments should find embarrassing.

The Pattern

Across every geography, the logic is identical. Investment figures function as the effective answer to every resource concern. The water question is answered with the billion-euro number. The electricity bill question is answered with the jobs announcement. The NDA conceals the details until approval is secured.

The communities bearing the cost are not the communities receiving the tax revenue. The farmers in Aragon are not Amazon shareholders. The residents of Canton, Mississippi breathing construction dust were promised jobs that arrived in smaller numbers than announced. The people of Montevideo who stopped drinking from the tap have no stake in Google's infrastructure roadmap.

Australia, meanwhile, approved every data center application it received since 2021 without water efficiency requirements — becoming, by design, a destination for projects displaced by stricter rules elsewhere. A continent that knows drought intimately, choosing not to know.

What makes this politically unstable — and the US case makes this clearest — is that the resistance is genuinely cross-partisan. In rural Michigan, a Republican and a Democrat co-authored moratorium legislation. In Arizona, a coalition spanning environmental groups and conservative property rights advocates blocked a desert data center together. Communities recognize resource extraction when they experience it, regardless of which party made the approval.

The Only Exit From the Paradox

The paper's Chapter 4 made the following argument: local AI inference on NPU hardware presents a categorically different resource profile. No cooling towers. No evaporative water loss. No facility overhead. A laptop NPU running a local model consumes approximately 0.002 watt-hours per query — against an estimated 2.9 watt-hours for the same query processed in a hyperscale data center. A factor of one thousand. The water difference is categorical: zero direct consumption versus up to two million liters per day for a single large facility.

This is not a complete solution to the global resource problem of AI infrastructure. Manufacturing NPU-equipped devices carries its own footprint. The aggregate electricity demand of distributed local devices raises grid management questions. The paper acknowledged both.

But the direction is clear. The centralized model concentrates resource consumption in specific, often already-stressed locations, and makes it invisible to the users generating the demand. The query is instant and clean in the office. The water is running low in Aragon.

Local inference does not eliminate the resource question. It distributes it back to where the use occurs, scales it to the actual compute performed, and removes the facility overhead that multiplies every query's footprint by a factor of one thousand. For the farmers of Aragon, the residents of Saline Township, and the people of Montevideo who stopped drinking from the tap, that difference is not technical. It is physical.

What to Watch

The EU Energy Efficiency Directive's data center provisions are under review in 2026, with potential expansion to include binding water targets — not just reporting requirements. The gap between those two things is the gap between accountability and theater.

Aragon's medieval water courts — governing allocation since the twelfth century — have been asked to rule on the Amazon data center licenses. That ruling, when it arrives, will be the first time a pre-industrial democratic water institution has adjudicated a claim from a twenty-first century hyperscaler. Whatever they decide, it will be worth reading.

The paper's June update will carry the first enterprise adoption data for local AI inference in European organizations. The infrastructure argument and the resource argument point to the same conclusion. The question is how many organizations are connecting them.

This investigation update is part of an ongoing research series tracking the predictions made in The Great Return: Why 2026 Marks the Tipping Point for Local AI Migration in Europe — a policy and technology analysis published February 2026. Full paper available at (https://doi.org/10.5281/zenodo.18511984).

Update #2 — 10 March 2026

We published "The Great Return" on February 7, 2026. Five weeks later, the paper's central argument — that dependency on foreign AI infrastructure is a structural risk, not a theoretical one — has been demonstrated live, in real time, in the most consequential way possible.

Not by a regulatory filing. By a war.

The Scenario the Paper Described. Now Actual Events.

Chapter 3 of the paper spent considerable space on what we called the "decoupling of intelligence" — the argument that routing every prompt through servers governed by foreign law represents a dependency incompatible with genuine autonomy. We cited submarine cable vulnerability. We cited the CLOUD Act. We cited the risk that a foreign government could, through legal or commercial pressure, interrupt access to a critical AI capability at the worst possible moment.

On February 27, 2026, the US Department of Defense and Anthropic reached a public impasse. Anthropic refused to remove contractual safeguards prohibiting the use of Claude for fully autonomous weapons and mass domestic surveillance. In response, President Trump directed every federal agency to immediately cease using Anthropic's technology. Defense Secretary Hegseth designated the company a "supply chain risk" — a label previously reserved for foreign adversaries like Huawei and Kaspersky — and announced a six-month phase-out.

Here is what happened next, and why it matters more for Europe than for Washington.

The Pentagon continued using Claude. The US military's strikes in Iran — ongoing at the time of writing — use Anthropic's technology for intelligence processing and targeting support. As Lawfare Media noted, the government cannot simultaneously declare a vendor an acute security threat and keep it running in active combat operations for six months. The designation exposed the bottleneck it was supposed to solve: Claude is too deeply embedded to switch off.

Defense analysts at Piper Sandler put it plainly: Anthropic is "heavily embedded in the military and the intelligence community" and moving off the company's technology could "pose some short-term disruptions." One Defense Department official, off the record, called it "a huge pain in the ass to disentangle."

This is the dependency bottleneck made visible. And the lesson is not confined to the Pentagon.

This Was Not in the Paper. But It Should Have Been.

The paper's Chapter 3 predicted that geopolitical friction would expose cloud dependency as a national security concern. What it did not anticipate was the precise mechanism: not a foreign adversary restricting access, but a domestic political confrontation between a government and its own AI supplier over the supplier's ethics.

The supply chain risk designation is normally reserved for Huawei. It was applied to a San Francisco company that declined to remove guardrails against autonomous killing. That is an extraordinary escalation — and it reveals something the paper's geopolitical chapter argued structurally but did not have a concrete example for: that dependency creates leverage, and leverage will eventually be used.

For a European organization running its operations on a US cloud AI provider, the lesson is not abstract. If the US government can unilaterally attempt to blacklist its own most safety-conscious AI company over a contract dispute — and fail to extract itself from that dependency even while doing so — then any organization with similar dependencies should be asking the same question the Pentagon is now asking in operational terms: what does our transition plan look like?

This confirms and sharpens prediction 2.2 from the paper (AI Act compliance pressure drives organizations toward local inference), but through a wholly unexpected route. It is not the EU AI Act doing the work here. It is a geopolitical shock demonstrating, in real time, that AI infrastructure dependency is a liability — and that the liability does not announce itself politely in advance.

The European Response: An Invitation

The irony was not lost on Europe. Within days of the blacklisting, Europeans were publicly calling for Anthropic to relocate to the EU, citing its alignment with the AI Act's human-oversight principles and its explicit refusal to enable mass surveillance — the very requirements European regulation mandates.

The European Policy Centre published a response titled "The Pentagon blacklisted Anthropic for opposing killer robots. Europe must respond." The Chatham House framing was harder: the blacklisting is, in its words, "a hammer blow to the trustworthiness of US technology."

This is the sovereignty argument from Chapter 3 expressed not as policy analysis but as lived experience. The US has demonstrated that its government will use commercial and legal pressure against its own AI infrastructure companies if those companies resist. If it will do that to American companies, the question of what it might do — or permit to happen — to European organizations relying on that same infrastructure answers itself.

The OpenAI Side-Effect

Hours after Anthropic was blacklisted, OpenAI signed a Pentagon deal for classified systems access. OpenAI CEO Sam Altman had publicly stated that same morning that he shared Anthropic's position on restricting military uses. The sequence was noted.

The consumer response was immediate and measurable. Claude climbed to #1 on the Apple App Store globally. ChatGPT uninstalls surged 295% in the days following the announcement. The "QuitGPT" movement claimed 1.5 million participants. OpenAI later acknowledged the announcement looked "sloppy and opportunistic."

For the paper's argument, the consumer shift is a secondary signal. The primary signal is structural: OpenAI's contract with the Pentagon — in which it claims to offer equivalent safeguards through "technical" rather than contractual mechanisms — introduces exactly the kind of third-party-mediated compliance ambiguity that makes European organizations nervous under the AI Act. If the safeguards are technical rather than contractual, they can be removed. If they are contractual, the Pentagon already demonstrated it will try.

The Iran Dimension

The paper's Chapter 3 cited submarine cable cuts in the Red Sea — linked to the Yemen conflict — as a concrete example of the infrastructure vulnerability argument. The Iran conflict adds a harder dimension. Iranian drone strikes on AWS data centers in the UAE and Bahrain were described by Tehran as deliberate and strategic. The Strait of Hormuz, through which data routing infrastructure and energy supply both pass, is a contested chokepoint in an active conflict zone.

The paper described this risk. The paper did not expect to be citing it as current events five weeks after publication.

For European organizations, the data routing implications are direct. Transatlantic internet traffic passes through a small number of cable systems, some of which route through conflict-adjacent geography. The "supply chain resilience" argument from Chapter 3 — that local AI inference ensures business logic remains operational during international data-routing conflicts — was theoretical in February. It is less theoretical in March.

What This Means

The paper's core prediction was that 2026 would be the year the default inverted — from "cloud-first" to "local-first, cloud-extended." The events of the past two weeks have accelerated that inversion, not through the regulatory path the paper emphasized, but through a geopolitical demonstration that even the world's most advanced military cannot disentangle itself from a single AI dependency in six months.

That is the dependency bottleneck. Not a concept. A case study.

For European organizations with their own AI deployments: the August 2 AI Act enforcement deadline is now eleven weeks away. The paper's compliance argument (prediction 2.1, 2.2) stands. But the geopolitical argument just received a real-world illustration that no policy paper could have manufactured.

The question is no longer whether dependency creates risk. The question is how long it takes your organization to answer "what does our transition plan look like?"

What to Watch Next

The Anthropic lawsuit against the Pentagon — filed today in the Northern District of California — will be a critical signal. If the courts vacate the supply chain risk designation, it confirms that even this administration cannot weaponize procurement law against a domestic company over a contract dispute without legal consequence. If it is upheld, the chilling effect on AI safety culture in the US will be significant — and the argument for European-origin AI infrastructure will sharpen further.

Axelera Europa's first production deployments are still on track for H1 2026. The AI Act enforcement clock is running. And the Iran conflict is not resolved.

The paper's June update will cover enterprise adoption data, Axelera's first reviews, and the outcome of the Anthropic legal challenge. If the courts move fast, that story may arrive before June.

This update is part of an ongoing research series tracking the predictions made in The Great Return: Why 2026 Marks the Tipping Point for Local AI Migration in Europe — a policy and technology analysis published February 2026. Full paper available at Zenodo.

We published “The Great Return” on February 7, 2026. One month later, four of the paper’s thirty predictions are already moving faster than projected — and one development we only referenced in general terms has taken very concrete form.
Here’s what happened.

The Shock Nobody Planned For

The paper’s geopolitical chapter argued that China’s domestic AI ecosystem would accelerate as a direct consequence of US export controls on advanced semiconductors. That prediction was supposed to play out over years.

DeepSeek R1 arrived in January 2026 — weeks before we published — and compressed that timeline dramatically. A Chinese AI model trained for a claimed $6 million outperformed systems that cost $100 million or more to build. European startups — TextCortex in Germany, Sana AI in Sweden, Synthesia, Langdock — adopted it immediately, attracted by open-source access and cost that made US hyperscaler pricing look indefensible.

This confirms prediction 5.4 from the paper (China’s AI ecosystem accelerates post-export controls) — but the mechanism is not what we expected. DeepSeek didn’t just catch up. It disrupted the pricing model that US cloud dependency is built on.

The Unintended Accelerant

Here’s what we didn’t predict: DeepSeek’s regulatory troubles in Europe are accelerating local AI adoption more effectively than any policy paper could.

Within weeks of DeepSeek’s arrival, data protection authorities in Ireland, Belgium, France, the Netherlands, and Germany launched GDPR investigations. The European Data Protection Board activated its AI Task Force. Italy’s earlier ban became the reference case for coordinated EU action.

For regulated-sector enterprises — healthcare, finance, insurance — the message was immediate and practical: any cloud-hosted model with cross-border data flows to China is a compliance liability. The alternative is local deployment of open-weight models. DeepSeek’s problems are Ollama’s opportunity.

The paper predicted that AI Act compliance pressure would drive organisations toward local inference (prediction 2.2). That prediction is confirmed — but through an unexpected route. The AI Act isn’t doing it alone. Chinese disruption is.

Europe Builds Its Own Chip Lab

While DeepSeek dominated headlines, something quieter happened in Leuven.

In February 2026, the EU opened the NanoIC pilot line at imec — Europe’s largest Chips Act research facility. The investment: €2.5 billion, with €700 million from the European Commission. The centrepiece: ASML’s most advanced High-NA EUV lithography scanner, installed in Belgium and now operational for sub-2nm chip development.

This is not a factory. It’s a lab-to-fab bridge — an open-access facility where chip startups, research institutes, and established manufacturers can test and validate advanced semiconductor designs before committing to mass production. The focus areas include AI accelerators, silicon photonics, and next-generation packaging. The ASML–imec partnership formalised in March 2025 produced this directly.

The paper framed the EU Chips Act’s 20% semiconductor share target as a 2030 ambition (prediction 3.5). NanoIC doesn’t change the manufacturing timeline — Europe still relies on TSMC for volume production of leading-edge chips. But it changes the design ecosystem. European AI chip startups now have access to sub-2nm process R&D at home. The tipping point on the design side may arrive before 2030.

Axelera and the AI Act: Both Still on Track

Two predictions are tracking exactly as written. Axelera AI’s Europa chip — 629 TOPS at 45 watts, claiming 3 to 5 times better performance per watt than Nvidia’s L40 — has confirmed shipment in the first half of 2026 (prediction 3.2).
PCIe card form factor is confirmed. The independent reviews and first customer deployments are what to watch next.

On regulation: the European Commission released Article 6 implementation guidance on February 2, 2026 — covering post-market monitoring and conformity requirements for high-risk AI systems. The August 2 enforcement date is firm. The Commission has explicitly rejected blanket delays. Finland and Spain have already begun proactive audits. Prediction 2.1 is on track and hardening.

What This Means

One month of data confirms the paper’s core argument: 2026 is not a preparation year for European AI sovereignty. It is the year the infrastructure starts arriving.

The cloud-first default is cracking — not from a coordinated policy push, but from the compound pressure of cost disruption (DeepSeek), compliance risk (GDPR investigations), and regulatory deadline (AI Act). These three forces were always in the paper. What the paper did not fully anticipate is how they would interact in real time, each one amplifying the others.

The NanoIC development extends the paper’s argument into a domain it touched but did not centre: the physical foundation for European AI silicon is being laid now,
in Leuven, with the world’s most advanced lithography equipment.
That matters for the 2028–2030 horizon.

Why This Matters Now

If you work in enterprise technology, compliance, or product strategy in Europe, the practical question has shifted. It is no longer “should we consider local AI?”
It is “how long can we justify not acting on it?”

The compliance window for AI Act high-risk systems closes in five months. The tools to run capable models locally exist today — Ollama, LM Studio, open-weight models at 7–13B parameters running on NPU-equipped hardware. The European chip infrastructure to build on is taking shape faster than the original timeline suggested.

The next investigation will cover Axelera Europa’s first real-world deployments, AI Act enforcement signals, and the first enterprise survey data on local AI adoption. Target: June 2026.

This investigation update is part of an ongoing research series tracking the predictions made in The Great Return: Why 2026 Marks the Tipping Point for Local AI Migration in Europe — a policy and technology analysis of local AI migration in Europe, published February 2026. The full paper is available on Zenodo.

*How a Dutch startup is bringing Digital In-Memory Computing to edge AI—and what it means for Europe’s semiconductor independence*

---

The Dutch semiconductor powerhouse Axelera AI has rapidly evolved from an Eindhoven-based startup into a formidable challenger in the global AI market. Founded in 2021 through a merger of talent from Bitfury AI (led by CEO Fabrizio Del Maffeo), IBM Research Zurich (led by Evangelos Eleftheriou), and researchers from ETH Zurich, imec, Qualcomm, and Google, the company represents a concentration of world-class semiconductor expertise.[^1]

By focusing on speed, sustainability, and technological sovereignty, Axelera is successfully bringing high-performance AI from centralized data centers to the “edge”—the devices and systems where data is actually generated.

A Breakthrough in Architecture: D-IMC vs. The GPU Status Quo

To understand Axelera’s impact, one must look at the “Von Neumann bottleneck” that plagues traditional computing. In a standard NVIDIA GPU, data constantly travels between the memory and the processor. This journey consumes roughly 90% of the total energy used in AI processing.

Axelera’s Digital In-Memory Compute (D-IMC) flips this script entirely. Built on SRAM (Static Random-Access Memory) technology, each memory cell becomes a compute element performing digital matrix-vector multiplications in-place, without data movement.[^2] Each core delivers over 50 TOPS (Tera Operations Per Second), achieving 15 TOPS per Watt—dramatically more efficient than traditional architectures.[^3]

By performing calculations directly inside the digital memory, they eliminate the constant data shuffling that drains energy and limits performance.

**The result: processing that’s both faster and up to 10x more power-efficient than GPU-based solutions.**

---

Different Use Cases, Different Architectures

While NVIDIA’s H100 or A100 chips excel at training massive models like ChatGPT in giant data centers, edge AI applications have different requirements. These localized tasks benefit from specialized architectures optimized for inference rather than training.

Efficiency: Axelera’s Metis AIPU delivers 214 TOPS at just 14 watts—translating to 15 TOPS/W. For comparison, this achieves performance comparable to high-end GPUs but at a fraction of the power consumption and cost.[^4] A single Metis chip can process 24 concurrent 4K camera streams running YOLOv5 object detection—a feat that would typically require multiple GPUs drawing hundreds of watts.[^5]

Precision: Unlike some competitors using Analog In-Memory Computing (which can be prone to “noise” or errors), Axelera uses a Digital approach. This combines the energy efficiency of in-memory computing with the necessary precision for critical applications such as medical imaging. Their post-training quantization achieves 99.9% relative accuracy compared to FP32 baseline models.[^6]

The Mixed-Precision Advantage

Axelera’s architecture supports INT4, INT8, and INT16 precision modes, allowing developers to optimize the performance-accuracy trade-off for each specific workload.

For computer vision tasks, INT8 often delivers near-FP32 accuracy while reducing memory bandwidth by 4x and accelerating inference by 2-4x.[^7]

---

The Power of the “Edge”: Real-World Adoption

Axelera isn’t just a lab project; it is already being integrated into high-stakes environments. Since September 2023, the company has been shipping production Metis hardware to customers worldwide.[^8]

**Industrial Automation**: In partnership with Fogsphere, Axelera powers real-time Personal Protective Equipment (PPE) monitoring systems that detect whether workers are wearing helmets, vests, and other safety gear.[^9] These systems simultaneously process multiple camera feeds with sub-100ms latency—fast enough to trigger immediate alerts when violations are detected.

**Manufacturing & Quality Control**: Smart factories use Metis-powered vision systems for automated inspection, detecting defects in products moving at high speed on production lines. A single M.2 card can handle 16+ concurrent camera streams for visual quality assurance.[^10]

**Smart Cities & Retail**: Macnica ATD Europe, Axelera’s first European distributor, integrates Metis into traffic management systems, parking analytics, and retail customer behavior analysis.[^11] These “Smart NVRs” (Network Video Recorders) analyze dozens of 4K camera feeds in real-time to optimize traffic flow, detect parking violations, or understand customer movement patterns.

**Space Applications**: The European Space Agency (ESA) has selected Axelera technology for space missions, where the chips must perform reliably in radiation-heavy, non-permissive environments with minimal human intervention.[^12] Gianluca Furano, ESA’s Senior On-Board Computer Engineer, noted: “With missions that may take years to develop and end up staying in space for over a decade, we must choose technology that can continue to perform under non-permissive environments.”

Healthcare: AI in the Operating Room

While still in research phases, medical robotics labs are testing Metis for real-time surgical assistance, where even 100-millisecond delays could compromise patient safety.

---

The Competitive Landscape: Not Alone in Edge AI

Axelera isn’t the only company pursuing edge AI dominance. The competitive landscape includes:

**Hailo** (Israel): Their Hailo-8 chip delivers 26 TOPS at 2.5W (10.4 TOPS/W)—impressive efficiency but lower absolute performance than Metis’s 214 TOPS. Hailo focuses primarily on automotive and smart camera applications.[^13]

**Graphcore** (UK): Once valued at $2.8B, Graphcore targets data center AI with their IPU architecture but has struggled to compete against NVIDIA’s ecosystem dominance. Their chips consume far more power than edge-focused solutions like Metis.

**Intel Movidius**: Intel’s Myriad X VPU delivers 4 TOPS at ~2W—solid for simple edge applications but lacking the horsepower for multi-stream 4K video or complex models.

**Google Edge TPU**: Optimized for TensorFlow Lite, the Edge TPU delivers 4 TOPS at 2W but locks developers into Google’s ecosystem.

Axelera’s approach combines high absolute performance (214 TOPS), excellent efficiency (15 TOPS/W), and ecosystem flexibility through Voyager SDK’s support for PyTorch, TensorFlow, and ONNX—addressing a gap in the market between simple edge processors and power-hungry data center GPUs.

---

Remaining Bottlenecks: The Road to Global Dominance

Despite four successful chip tape-outs and over $200M in funding, Axelera faces significant hurdles:[^14]

### 1. The Software Moat

NVIDIA’s greatest strength isn’t just hardware; it’s CUDA—the software platform millions of developers use. Axelera is counterbalancing this with their Voyager SDK, which supports PyTorch, TensorFlow, and ONNX, allowing developers to deploy models with minimal code changes. The SDK includes 100+ pre-optimized models for common computer vision tasks.[^15]

However, convincing a generation of CUDA-trained engineers to adopt a new platform remains a multi-year challenge.

### 2. Scalability of Production

Axelera is “fabless,” relying on external foundries to manufacture their chips using standard CMOS processes. While this approach reduces capital requirements and allows process node flexibility, it also means Axelera competes for foundry capacity against giants like Apple, AMD, and NVIDIA.

Any global semiconductor shortage or geopolitical tension could impact delivery timelines for the Europa and Titania product lines.[^16]

### 3. Generative AI at the Edge

While Metis excels at Computer Vision (CNNs), the next frontier is running Large Language Models (LLMs) and Vision-Language Models (VLMs) locally.

Axelera’s upcoming Europa chip (629 TOPS) is specifically designed to tackle this, and the new M.2 Max card supports up to 16GB of memory for LLM inference.[^17] However, the memory bandwidth and capacity requirements of LLMs continue to grow faster than hardware can keep pace. Running a 70B parameter Llama model at reasonable speed still requires multi-chip solutions or aggressive quantization.

---

Securing European Technological Sovereignty

Beyond technical specs, Axelera is part of a broader European effort toward digital autonomy. Historically, Europe has relied heavily on non-EU suppliers, creating risks regarding supply chain stability, data privacy, and geopolitical vulnerability.

Axelera is headquartered at the High Tech Campus in Eindhoven, the Netherlands—a deliberate choice leveraging the region’s semiconductor ecosystem anchored by ASML, the world’s only producer of extreme ultraviolet (EUV) lithography machines.[^18]

This proximity to deep semiconductor expertise, combined with advisory from luminaries like Prof. Luca Benini (ETH Zurich/University of Bologna), Prof. Torsten Hoefler (ETH Zurich), and Prof. Marian Verhelst (KU Leuven), gives Axelera access to Europe’s best research talent.[^19]

The Funding Picture

Axelera has raised over $200M through multiple rounds:

- **Seed ($12M, Sept 2021)**: Led by Bitfury with participation from imec and Innovation Industries[^20]

- **Series A ($50M total, 2022-2023)**: Led by Innovation Industries, with Samsung Catalyst Fund, CDP Venture Capital (Italian sovereign fund), Federal Holding and Investment Company of Belgium (SFPIM), Verve Ventures, and others[^21]

- **Series B ($68M, June 2024)**: Europe’s largest oversubscribed Series B in fabless semiconductors[^22]

- **EU DARE Grant (€61.6M, March 2025)**: Part of the EuroHPC Joint Undertaking, specifically to develop the Titania chiplet for high-performance computing[^23]

Through EU-funded initiatives like the DARE project, Axelera is helping build “AI Factories”—sovereign infrastructure designed for training and deploying large-scale models without dependence on US or Chinese cloud providers. Their chips are being integrated into national supercomputing centers like Cineca in Italy, ensuring Europe maintains competitive AI capabilities independent of foreign technology stacks.[^24]

The European Innovation Council (EIC) Fund has also backed Axelera through its Step Up investment program, recognizing the strategic importance of European-controlled AI hardware.[^25]

---

The Product Roadmap: From Metis to Titania

Axelera’s product strategy follows Greek and Roman mythology naming:

**Metis** (Greek goddess of wisdom): The first production chip, shipping since September 2023. Available in M.2, M.2 Max (up to 16GB memory), and PCIe form factors. Performance: 214 TOPS at 14W. Optimized for computer vision workloads (object detection, classification, segmentation).[^26]

**Europa** (Zeus’s lover): The next-generation chip targeting 629 TOPS performance. Designed to handle both computer vision and generative AI (LLMs/VLMs) at the edge. Expected availability: 2026.[^27] This represents a 3x performance jump over Metis, enabling applications like local LLM inference for conversational AI interfaces in industrial equipment or vehicles.

**Titania** (queen of the fairies, also a Saturn moon): A chiplet-based architecture for high-performance computing environments, targeting data centers and supercomputers. Co-developed under the €61.6M EU DARE grant.[^28] The chiplet approach allows customers to scale from edge to cloud using the same D-IMC technology, creating a unified inference platform across deployment scenarios.

This roadmap positions Axelera to compete across the full spectrum: from tiny M.2 modules in drones and cameras, to PCIe cards in industrial edge servers, up to multi-chiplet configurations in data centers—all using the same Voyager SDK toolchain.

---

Looking Ahead: The Business Case for Edge AI

The ROI Story

For industrial customers, the economics are compelling. Consider a warehouse with 50 4K cameras:

- **GPU-based solution**: 10-12 NVIDIA T4 GPUs (~70W each) = 700-840W, ~$20,000+ in hardware

- **Metis solution**: 3-4 Metis PCIe cards (~14W each) = 42-56W, estimated ~$3,000-5,000 in hardware[^29]

Over a year of 24/7 operation at €0.30/kWh, the Metis solution saves roughly €4,500 in electricity costs alone, while reducing cooling requirements and carbon footprint.

**For companies deploying hundreds of sites, these savings multiply dramatically.**

The market timing is favorable: Research firms project the edge AI accelerator market growing from $8B in 2024 to over $50B by 2030, with computer vision representing the largest segment.[^30] As AI inference moves from centralized clouds to billions of edge devices—cameras, robots, vehicles, medical devices—the demand for power-efficient, high-performance accelerators will only intensify.

With approximately $200 million in funding, production silicon shipping, and partnerships with major OEMs like Dell, Lenovo, and Advantech, Axelera AI is positioned for a global rollout.[^31]

The first shipments of Europa-based systems in 2026 will test whether European silicon can truly compete in generative AI, not just computer vision.

The Bottom Line

Axelera demonstrates that specialized edge AI architectures can deliver comparable performance to data center solutions while using a fraction of the power and cost. Together with other European semiconductor initiatives, companies like Axelera are helping establish a more balanced global AI infrastructure.

**The future of AI likely involves both centralized training and distributed edge inference—and Europe is building the tools to participate meaningfully in both.**

---

## References

[^1]: [Axelera AI About Us](https://axelera.ai/about-us)
[^2]: [Digital In-Memory Computing Technology](https://axelera.ai/technology)
[^3]: [Metis AI Platform Technical Overview](https://axelera.ai/blog/the-metis-ai-platform-in-detail)
[^4]: [Metis M.2 Product Specifications](https://axel era.ai/ai-accelerators/metis-m2-ai-acceleration-card)
[^5]: [Metis 24-Stream Demo](https://axelera.ai/ai-accelerators/metis-m2-ai-acceleration-card)
[^6]: [Neural Network Optimization](https://axelera.ai/technology)
[^7]: [Metis AIPU Benchmarks](https://axelera.ai/metis-aipu-benchmarks)
[^8]: [Axelera AI Ships First Production Units](https://axelera.ai/news/first-customers-receive-worlds-most-powerful-edge-ai-solutions-from-axelera-ai)
[^9]: [PPE Safety Demo](https://axelera.ai/ai-accelerators/metis-m2-ai-acceleration-card)
[^10]: [Metis Multi-Stream Performance](https://axelera.ai/ai-accelerators/metis-m2-ai-acceleration-card)
[^11]: [Macnica Partnership Announcement](https://axelera.ai/about-us)
[^12]: [ESA Technology Selection](https://axelera.ai/about-us)
[^13]: Comparative specifications based on publicly available datasheets and manufacturer claims
[^14]: [Axelera AI Funding Milestones](https://axelera.ai/about-us)
[^15]: [Voyager SDK Overview](https://axelera.ai/ai-software)
[^16]: [Axelera Technology Approach](https://axelera.ai/technology)
[^17]: [Metis M.2 Max Announcement](https://axelera.ai/ai-accelerators/metis-m2-ai-acceleration-card)
[^18]: Eindhoven’s semiconductor ecosystem and ASML’s role
[^19]: [Scientific Advisors](https://axelera.ai/about-us)
[^20]: [Seed Funding Announcement](https://axelera.ai/about-us)
[^21]: [Series A Extensions](https://axelera.ai/news/axelera-ai-raises-50m-to-democratize-edge-ai)
[^22]: [Series B Announcement](https://axelera.ai/news/axelera-ai-raises-68-million-series-b-funding-to-accelerate-next-generation-ai)
[^23]: [DARE Project Grant](https://axelera.ai/news/axelera-ai-secures-up-to-61-million-grant-to-develop-scalable-ai-chiplet-for-high-performance-computing)
[^24]: [EU Horizon Funding](https://axelera.ai/eu-funding)
[^25]: [EIC Step Up Program](https://axelera.ai/about-us)
[^26]: [Metis Product Line](https://axelera.ai/ai-accelerators)
[^27]: [About Axelera AI Roadmap](https://axelera.ai/about-us)
[^28]: [Titania Chiplet Announcement](https://axelera.ai/news/axelera-ai-secures-up-to-61-million-grant-to-develop-scalable-ai-chiplet-for-high-performance-computing)
[^29]: Pricing estimates based on competitive GPU pricing and form factor analysis
[^30]: Market sizing from industry analyst reports (Gartner, IDC, ABI Research)
[^31]: [Axelera AI Partnerships](https://axelera.ai/about-us)

# Why the EU AI Act will push AI out of the cloud and back to the device

For the past fifteen years, the default assumption in AI architecture has been simple: serious AI lives in the cloud.

Training happens in hyperscale datacenters. Inference is served from centralized APIs. Devices are clients. The cloud is the brain.

That assumption is about to invert.

Not because of hype. Not because of edge-computing fashion. And not because the cloud is failing.

But because four forces are converging in Europe at the same time: geopolitics, environmental limits, hardware evolution, and — most importantly — the EU AI Act.

Together, they create a structural push toward a new default:

> **From cloud-first to local-first, cloud-extended.**

This is not a prediction about technology trends. It is a consequence of regulation, physics, and silicon.

---

## 1. Geopolitics: Digital sovereignty is no longer abstract

Europe has learned a hard lesson over the last decade: critical digital infrastructure is concentrated outside its borders.

Most AI infrastructure today depends on three US hyperscalers that control approximately 67% of the global cloud market. The US CLOUD Act allows American authorities to compel access to data regardless of where it is stored. The Schrems II ruling has destabilized the legal basis for transatlantic data flows. Export controls have shown how fragile these dependencies can be.

When governments, healthcare providers, and public institutions deploy AI on foreign cloud infrastructure, this is no longer just an IT choice. It is a sovereignty risk.

Running AI locally — on European hardware, on controlled infrastructure — drastically reduces that dependency at the architectural level.

---

## 2. Environment: The energy and water cost of centralized AI

Hyperscale AI is resource-intensive. Large datacenters require enormous amounts of electricity and water for cooling. As generative AI usage grows, so does inference traffic.

Inference, not training, becomes the dominant cost at scale.

Europe is already facing grid congestion, water scarcity, and strict sustainability goals. Scaling AI purely through centralized datacenters runs directly into physical limits.

But modern devices — laptops, workstations, embedded systems — are becoming remarkably efficient at AI inference. Running inference locally can be an order of magnitude more energy-efficient than routing every request through a remote datacenter.

At scale, local inference is not just cheaper. It is environmentally necessary.

---

## 3. Hardware: Devices are no longer “dumb terminals”

Until recently, local AI was unrealistic. Devices simply lacked the compute.

That is changing fast.

New generations of chips from AMD (55 TOPS), Qualcomm (80–85 TOPS), and Intel (48 TOPS) now include dedicated NPUs (Neural Processing Units) — purpose-built for AI inference at very low power. Europe’s own Axelera AI delivers up to 629 TOPS. SiPearl, Kalray, and Semidynamics are building sovereign European silicon.

A modern workstation can now run multi-billion parameter models locally that, three years ago, required cloud servers.

This hardware shift is not theoretical. It is already in consumers’ hands.

The capability for local AI is arriving exactly when regulation and environmental constraints make it desirable.

---

## 4. The EU AI Act: The real turning point

The EU AI Act (Regulation (EU) 2024/1689) introduces strict requirements for AI systems, especially those in high-risk contexts: healthcare, education, HR, and public services. Non-compliance carries fines up to €35 million or 7% of worldwide annual turnover.

These requirements include:

- Data governance and traceability (Art. 10)

- Transparency and documentation (Art. 13)

- Control over data flows

- Clear accountability for system behavior

For organizations, this creates a practical problem:

It is far easier to comply with these requirements if sensitive data never leaves the device or local infrastructure.

If inference happens locally:

- No personal data needs to be sent to external APIs

- Data residency is easier to guarantee

- Compliance and auditing become simpler

- Risk surfaces shrink dramatically

Suddenly, local AI is not just technically possible and environmentally desirable — it becomes legally attractive.

For many organizations, it will be the path of least resistance.

---

## What this means in practice

This does not mean the cloud disappears.

Training large foundation models will still happen in datacenters. Cloud services will still exist. But the role of the cloud shifts.

Instead of:

> Cloud as the default runtime for AI

We move to:

> Devices and local infrastructure as the default runtime, with the cloud as extension.

Cloud becomes: model distribution, updates, heavy training, coordination. Not the place where every user interaction must be processed.

## A structural shift, not a trend

Individually, none of these forces would be enough.

But together, they create a structural shift that is particularly strong in Europe:

- Geopolitical pressure to reduce dependency

- Environmental pressure to reduce centralized load

- Hardware that suddenly makes local inference viable

- Regulation that makes local processing legally attractive

This combination makes it highly likely that, over the coming years, a large share of AI inference in European organizations will move from cloud APIs to local execution on devices and controlled infrastructure.

Not because it is fashionable. But because it is the most practical, compliant, and efficient option.

---

## Why this matters now

The EU AI Act enforcement is beginning. Organizations are starting to translate legal texts into architectural decisions.

Those decisions will shape AI infrastructure for the next decade.

Understanding that the default is inverting — from cloud-first to local-first, cloud-extended — helps policymakers, technologists, and organizations anticipate what is coming instead of reacting to it later.

The shift to local AI is not a niche technical trend.

It is a predictable outcome of how Europe is choosing to regulate, power, and govern AI.

---

_This article summarizes the key arguments from “[The Great Return: Why 2026 Marks the Tipping Point for Local AI Migration in Europe](https://doi.org/10.5281/zenodo.18511984)” — a 12,000-word research paper covering the geopolitical, regulatory, hardware, and environmental forces driving this structural shift. The full paper, including detailed policy recommendations, is [available on Zenodo](https://doi.org/10.5281/zenodo.18511984).