AI Sovereignty ·
Frontier-model dependency is real. The answer is a dual strategy – and a clear focus on the capability that makes the difference.
On Friday, a reported US export-control directive barred foreign nationals – inside and outside the United States – from Anthropic’s most capable models, Fable 5 and Mythos 5. Rather than carve out a compliant subset, Anthropic disabled both entirely [1]. Within hours, ministers and parliamentarians across France, the UK and the Netherlands were calling it a sovereignty wake-up call [2].
They are right about the problem. Much of the response, though, draws the wrong lesson from it.
A reaction is not a strategy
In When Agents Go to War, discussing the earlier Anthropic-US government dispute, I argued that “access to American frontier models can be disrupted by a single political decision” [3], and that for allied nations this becomes a strategic vulnerability rather than merely a commercial inconvenience. Friday’s directive is a sharper instance of the same mechanism, not a new phenomenon.
But notice what the prevailing reaction actually is: build our own frontier models, and build them now. Two things should give us pause.
The first is that it is emotive, and emotive responses dissipate. If Washington relaxes the ban next week, the urgency drains away – and so do the budgets. A response that exists only while we are angry is not a strategy. The honest test is simple: does it still make sense the morning the ban is lifted?
The second is simple arithmetic. Europe’s strongest challenger, Mistral, has raised around $2.9bn. OpenAI has raised roughly $180bn; Anthropic around $59bn. Europe controls under 5% of the world’s frontier-scale AI infrastructure [3]. The scale disparity is structural. Beyond Mistral, Europe’s frontier model ecosystem is thin: Helsing (defence AI), Poolside (coding), and a handful of emerging players, none operating at the scale of the leading American or Chinese labs. This gap will not close on a political timetable, and treating frontier-model parity as the whole answer commits Europe to the one contest where the disparity is greatest.
China shows the gap is not destiny
There is a more instructive example close at hand. China has gained real ground despite a clear frontier-model disadvantage – on two fronts at once. PLA-linked researchers turned Meta’s open Llama into a military intelligence tool, ChatBIT, bypassing export controls entirely [4]; over the same period, commercial labs built frontier-competitive native models – DeepSeek [5] and Qwen [6] – on a fraction of the compute Western labs assumed necessary. The lesson is to copy not the application but the logic: a frontier-model disadvantage need not decide the outcome – what matters is what you build, what you build it on, and how fast.
A dual strategy
For Europe, the UK, and other Western powers (Australia, Canada, New Zealand), that points to two tracks running in parallel.
The first is to treat sovereign model capability as a national-level imperative – pragmatically. Europe will not become OpenAI or a hyperscaler on a crisis timetable, and it does not need to. The immediate move is to invest in fine-tuning and managing a vetted pool of capable open-weight models – Mistral and other European or allied weights for the sovereign tier, broader open models such as Llama for general work – the same logic China used to gain ground without matching the leading labs.
The capability cost is smaller than the panic implies: open weights now trail the closed frontier by only about four months – UK AISI’s Frontier AI Trends Report puts the gap at four to eight months [7], and Epoch AI’s latest estimate is around four [8]. Here “vetted” means managed risk – provenance control, evaluation, runtime monitoring – not a clean bill of health, since the weights themselves cannot be fully audited. Behind that bridge, build genuine ownership where it matters most: the critical use cases a nation cannot afford to have switched off.
The second, and increasingly the decisive one, is advanced agentic capability – and here Europe can compete on its own terms. The hard part of agentic systems is not raw model power; it is making them dependable enough to act: orchestration, runtime attestation, adaptive trust, the quality and control that let an autonomous system be relied on with a real task. Build that layer well and the model beneath it becomes a component you can change at will. Quality and control are not a brake on capability – at agentic scale, they are the capability.
None of this means abandoning sovereign compute – it means sequencing: build it deliberately for the long term while competing now on the agentic capability that turns models into dependable systems.
There is no dependency-free option
It is tempting to answer all this by going fully sovereign – run open models, self-host, own the stack. The instinct that portability matters is right, but the clean escape it promises does not exist.
Every route just relocates the dependency.
Closed frontier models carry the switch-off risk we have just watched play out. Open models look like the answer – until you notice the frontier-class open weights are now overwhelmingly Chinese: when Anthropic went dark, the prominent open alternative was MiniMax’s M3 [9][11], whose operators fall under China’s 2017 National Intelligence Law [10], which obliges Chinese firms to support state intelligence work. For defence- or intelligence-adjacent work that swaps a dependency set in Washington for one set in Beijing – and you still cannot fully audit a multi-billion-parameter model for what is in it. Building your own data centres is infeasible at company scale and a slow, costly bet even nationally; abandoning the hyperscalers would cost more in capability and security than it buys in independence.
So the goal is not autarky – Europe cannot, and need not, own the whole stack. But nor is it permanent tenancy on someone else’s infrastructure; that way lies digital colonisation. The realistic answer is both at once: managed, diversified dependency now – use the hyperscalers while architecting against lock-in, keep vetted fallbacks, spread risk so no single directive is ever fatal – while building genuine ownership where it is non-negotiable. That means tiering by sensitivity, with the same trusted agentic layer running across all tiers – itself no escape from the model layer, but the thing that lets you swap the model rather than be captured by it. Portability buys the time and the leverage; ownership of the critical tier is what it buys time for. Not independence from everyone – but dependence on no one for the things that matter most.
| Tier | What runs there |
|---|---|
| Routine work | Commercial frontier models and hyperscalers |
| Critical / defence | Owned, vetted, allied or sovereign capability |
The trusted agentic layer runs across both tiers.
What this means in practice depends on who you are.
Resilience is for everyone; sovereignty of the things that matter most is a national responsibility, because it is nations, not companies, that bear the cost of digital colonisation.
The race that matters
The thesis of the paper holds [3]. The decisive question is no longer who builds the most capable model, but who can field agentic systems that are dependable, interoperable, and trusted to act. Friday’s ban does not change that – it sharpens it.
No single frontier model is permanent, and access to them will rise and fall with politics. That is why a stake in your own matters – but the advantage that lasts will belong to whoever can turn the models they can reach into systems people can rely on, built to a standard of quality and control that is hard to match and harder to fake.
References
[1] Euronews. (2026). Why Anthropic is halting access to its Fable 5 and Mythos 5 AI models. https://www.euronews.com/2026/06/13/why-anthropic-is-halting-access-to-its-fable-5-and-mythos-5-ai-models
[2] Euronews. (2026). ‘Wake-up call’: Europe reacts to Anthropic halting access to its Fable 5 and Mythos 5 AI models. https://www.euronews.com/2026/06/13/wake-up-call-europe-reacts-to-anthropic-halting-access-to-its-fable-5-and-mythos-5-ai-mode
[3] Sotiropoulos, J. (2026). When Agents Go to War: Military AI, Governance, Competition, and Strategic Advantage in the Autonomous Era (Working paper edition). Deep Cyber Ltd. Zenodo. https://doi.org/10.5281/zenodo.19730946
[4] Pomfret, J. & Pang, J. (2024). Exclusive: Chinese researchers develop AI model for military use on back of Meta’s Llama. Reuters. https://www.reuters.com/technology/artificial-intelligence/chinese-researchers-develop-ai-model-military-use-back-metas-llama-2024-11-01/
[5] Fortune. (2026). DeepSeek unveils V4 model (reporting DeepSeek-V3, released December 2024, trained on roughly $5.6M of processors). https://fortune.com/2026/04/24/deepseek-v4-ai-model-price-performance-china-open-source/
[6] Alibaba Cloud. Qwen (Tongyi Qianwen) model family. https://qwen.ai
[7] UK AI Security Institute. (2025). Frontier AI Trends Report. https://aisi.gov.uk/frontier-ai-trends-report
[8] Epoch AI. (2026). Open models lag state-of-the-art closed models by 4 months. https://epoch.ai/data-insights/open-closed-eci-gap
[9] MiniMax. (2026). MiniMax M3: Frontier Coding, 1M Context, Native Multimodality – All in One Model. https://www.minimax.io/blog/minimax-m3
[10] TechTimes. (2026). MiniMax M3 Open-Weight Coding Model: Frontier Claims, Unverified Benchmarks. https://www.techtimes.com/articles/317532/20260601/minimax-m3-open-weight-coding-model-frontier-claims-unverified-benchmarks.htm
[11] VentureBeat. (2026). Anthropic blocks all public access to Claude Fable 5, Mythos 5 following US government order – what enterprises should do. https://venturebeat.com/technology/anthropic-blocks-all-public-access-to-claude-fable-5-mythos-5-following-us-government-order-what-enterprises-should-do
John Sotiropoulos is Founder of Deep Cyber Ltd and author of the official Implementation Guide for the UK’s AI Cyber Security Code of Practice, now the basis for the ETSI baseline standard. He is a Board Member of the OWASP GenAI Security Project and Co-lead of the Agentic Security Initiative, where he chairs the OWASP Top 10 for Agentic Applications. The full argument is in the working paper When Agents Go to War.
