At 10:14pm Eastern on Friday 17 July, 3:14am on Saturday in London, Anthropic posted its sixth answer in six weeks to the question of who may use Claude Fable 5, and on what terms.[1] From Monday 20 July, the most capable model in the company’s range is included in the Max and Team Premium subscription tiers at half their usage limits. Pro and Team Standard subscribers, the ordinary paying customers, move to metered usage credits at API rates, softened by a one-off $100 credit. The company’s explanation was disarming in its plainness:

Two days earlier, on Wednesday 16 July, Moonshot AI had released Kimi K3: a 2.8-trillion-parameter reasoning model with native vision, a one-million-token context window, and a price of $3 per million input tokens and $15 per million output.[2] The Beijing lab, founded by the former Google researcher Yang Zhilin and valued at roughly $20 billion this spring, says the full weights will be published for anyone to download by 27 July.[2][3]

One week, two frontier announcements. The American lab spent it deciding which of its customers may use its best model, and how much of it. The Chinese lab spent it publishing a download date.

There is also a number in Friday’s announcement that matters more than the $100, and it does not appear in the announcement. I will come to it.

In plain terms, for anyone whose organisation now pays for AI the way most do (a per-seat subscription here, an API bill there): the terms of access to frontier capability are being rewritten mid-contract, at days’ notice, in both directions at once. The line item your finance director approved in May does not describe what your teams can reach in July.

Six answers in six weeks

The Fable saga deserves to be laid out in order, because the order is the argument.

Fable 5 launched on 9 June as what Anthropic calls a Mythos-class model, priced at $10 per million input tokens and $50 per million output (the highest rates in the company’s general-availability range) and included, as a launch promotion, on Pro, Max, Team, and seat-based Enterprise plans through 22 June, after which it would require usage credits.[4] That was answer one. Answer two arrived three days later and was not Anthropic’s to give: on 12 June the US government applied export controls to Fable 5 and Mythos 5, and both models went dark for every non-American on Earth — the Friday-evening letter this publication examined at the time in Trump just proved your AI has an off switch

(https://thecontrollayer.arkava.ai/p/ai-sovereignty-anthropic-fable-mythos-export-ban-2026).[5]

The controls were lifted before the month ended, and answer three came on 30 June: Fable would return to Pro, Max, Team, and select Enterprise plans from 1 July, at up to half of weekly usage limits, through 7 July, with credits thereafter.[5] Answers four and five were extensions, granted as the company, in its own words, “secured additional capacity”: first to 12 July, after subscribers made their feelings known, then to 19 July.[6] Answer six is Friday’s settlement: permanent inclusion for Max and Team Premium at half limits, credits for everyone else, and the stated aim of giving users “more certainty about what your plan includes.”[1]

Fable 5 has spent its first six weeks as the industry’s Roy Batty — the light that burns twice as bright, told at intervals exactly how long it may burn — benchmarked at the top of the market on 9 June, export-controlled off it on the 12th, redeployed, extended, extended again, and now rationed by tier. No model this capable has ever had a first quarter this administratively eventful, and the pattern is worth more to a risk committee than any benchmark table.

The download date

Kimi K3’s numbers come first, because the numbers carry the story. The model holds 2.8 trillion parameters in a sparse mixture-of-experts design — in effect a committee of 896 specialist sub-networks, of which only 16 wake for any given token — built on architectural changes Moonshot calls Kimi Delta Attention and Attention Residuals, with native vision and a context window of a million tokens.[2] Moonshot claims roughly 2.5 times the scaling efficiency of its predecessor, which is the company’s account of how a model this size can be served at all, and the release dwarfs the next-largest open Chinese systems — DeepSeek‘s V4 Pro holds 1.6 trillion.[^3] OpenRouter, the model marketplace, describes K3 as “suited for complex coding, knowledge work, and long-horizon agentic workflows.”[^7]

The benchmark table Moonshot published is, by vendor standards, unusually honest. On the company’s own numbers, K3 mostly beats Claude Opus 4.8 and GPT-5.5 across a set of agentic and coding evaluations, and loses overall to Claude Fable 5 and OpenAI‘s GPT-5.6 Sol.[^2] A vendor conceding first place in its own launch table is rare enough to be information. Independent measurement, two days in, sits with the claim rather than the hype: Artificial Analysis scores K3 at 57 on its Intelligence Index — fourth of the 187 models it tracks, against an average of 31.[8] For a model with a download date attached, that is territory only DeepSeek has visited before.

Then there is the price, and the detail inside it. Simon Willison, the British developer whose independent model write-ups have become the trade’s first stop, spotted it within hours: $3 in and $15 out is exactly Claude Sonnet’s rate card, a fivefold jump from Kimi K2.6’s $0.95 and $4, and on his reckoning the most expensive model a Chinese lab has ever shipped.[9] The bargain phase of the Chinese open wave — the phase in which this publication could describe [the frontier premium dying]

— is over at the top end. Moonshot is not pricing against DeepSeek. It is pricing against Anthropic’s mid-tier, on capability grounds, and daring the market to disagree.

Two caveats belong on the record before anyone updates a procurement paper. The first is that a reasoning model’s rate card understates its bill, because reasoning models charge for thinking as well as answering. Artificial Analysis measured K3 as one of the most verbose models it has evaluated (130 million output tokens across its test suite, against a 63-million average), and Willison’s single test prompt, an SVG drawing of a pelican on a bicycle, consumed 13,241 reasoning tokens to produce 3,417 tokens of answer, at a cost of about 25 cents.[8][9] Budget on effective cost per task, never on the per-token price. The second caveat is that until the weights ship, the open-weight claim is a promise: Artificial Analysis currently classifies K3 as proprietary, for the simple reason that the weights are not yet public.[8] Open in intent, API-first in fact. The 27th is the test.

The honest case for the meter

I want to be fair to Anthropic here, because the easy column, “chaotic lab cannot make up its mind”, writes itself, and it is not quite right.

Serving a Mythos-class model to millions of subscribers at a flat monthly price is a different business from selling it by the token, and the constraint on it is physical. Every GPU-hour spent answering a Max subscriber is a GPU-hour not spent training the next model (the inference-versus-training allocation this publication examined in The Inference Flip,

and Willison’s read of Friday’s move is precisely that trade: a company discovering that subscribers will not accept premium pricing without the flagship model, and that including the flagship means diverting compute from research to serving.[9] Seen that way, six answers in six weeks was a lab discovering demand in real time, in public, with the added interruption of a fortnight in which Washington took the decision out of its hands entirely. A one-off credit and a permanent answer amount to more consideration than software subscribers usually get when the economics move.

Moonshot deserves the same fairness in the other direction. A 2.8-trillion-parameter reasoning model is expensive to serve, and pricing it at Sonnet rates is a statement that Chinese frontier labs no longer feel obliged to buy the world’s attention with loss-leading tokens. Nobody in this story is gouging. Both price cards are telling you the same true thing about what frontier intelligence costs to run in mid-2026.

But.

The meter is the product

The argument I want to make is that the two announcements are one story, and the story is about what is actually for sale.

On the closed side of the frontier, what you buy is no longer a model. It is a metered entitlement — sized by tier, adjustable by the provider, revocable under conditions you do not control — to a capability whose withdrawal, as June demonstrated, you cannot always foresee. Six access regimes in six weeks is not a pricing strategy; it is a capacity confession. And note that Anthropic behaved reasonably at every step, because that is rather the point. A well-run, well-capitalised, safety-forward lab, operating under ordinary commercial physics, still produced an access record no procurement officer would accept from a payroll vendor. When the honest operation of a system produces that volatility, the volatility is the system.

Frank Herbert put the underlying law in one sentence seventy years ago:

The insight in Dune concerns the schedule more than the substance — whoever meters the flow of the thing everyone depends on governs everyone who depends on it. The spice was never the product. The control was.

And here is the number I promised at the top.

On the same Monday the new arrangement takes effect, by the German AI outlet The Decoder‘s reading of the changes, the bonus-usage phase that ran through the promotional period ends as well — and regular usage limits come down by roughly a third.[10] The headline is that Fable became permanent. The mechanism is that the meter tightened for everyone, including the tiers that won. In The Expanse, the inners never think about air because the valve is set somewhere else, by someone else; the Belters think about little else. From Monday, a Max subscriber and a Pro subscriber of the same product live on opposite sides of that valve.

On the open side, the story inverts. What Moonshot sells at $3 and $15 is convenience — the hosted, metered version of a thing that will, if the 27th holds, exist independently of Moonshot’s meter altogether. The weights change the ownership question in a way no price can: an enterprise that downloads K3 and runs it on its own hardware — under its own law, on its own electricity, at its own depreciation schedule — has converted intelligence from an entitlement back into an asset. That was never going to be cheap, and Moonshot’s rate card no longer pretends it is. What open weights buy is the valve.

A month ago, after Washington’s fortnight with the off switch, I wrote that a model you can be denied is a permission, not a possession. Friday priced the permission. The 27th, if Moonshot ships, prices the possession.

The publication that calls its predictions in writing.

Every Control Layer piece ends with a falsifiable prediction and a list of signals to watch. Subscribe to track them. One email a week. Free.

Subscribe now

The bottom line

The comfortable reading of the week is two unrelated product stories: a Chinese lab shipped a big model, and an American lab tidied its subscription tiers. The comfortable reading is wrong, and the uncomfortable one is where the truth resides. The frontier has split into two economies: a closed one in which capability is rented through a meter the provider sets and resets, and an open one in which capability can, at real and rising cost, be owned outright. Every organisation that depends on this technology now sits in one of the two, whether or not it has chosen.

Fable 5 remains, by its newest rival’s own published table, the best model in the world. From Monday it is also the clearest demonstration that “best” and “available” have become separate questions — priced separately, governed separately, and changing on separate schedules. Moonshot, meanwhile, has stopped pretending open weights mean cheap intelligence and started demonstrating that they mean governable intelligence. Two labs, one week, the same lesson from opposite directions.

The meter, not the model, is the product.

References

[1]: Claude (@claudeai), X post, 10:14pm ET, 17 July 2026: “Beginning July 20, Claude Fable 5 will be included in all Max and Team Premium plans, at 50% of limits. Pro and Team Standard users will continue to have access to Fable via usage credits, and will receive a one-time $100 credit…”

; corroborated in Dawn, “Anthropic to add Claude’s Fable 5 model to Max, Team Premium plans at 50pc of usage limits.” 18 July 2026.

[2]: Moonshot AI. “Kimi K3 Tech Blog: Open Frontier Intelligence.” 16 July 2026.

[3]: MLQ News. “Moonshot AI Releases Kimi K3, a 2.8-Trillion-Parameter Open-Weight Model Rivaling Top U.S. Systems.” 16 July 2026.

[4]: Anthropic. “Claude Fable 5 and Claude Mythos 5.” 9 June 2026.

[5]: Anthropic. “Redeploying Claude Fable 5.” 30 June 2026.

[6]: Tech Times. “Claude Fable 5 Ends Subscription Limbo: Permanent for Max, Credits-Only for Pro.” 18 July 2026.

[7]: OpenRouter. “MoonshotAI: Kimi K3 — API Pricing & Benchmarks.” Accessed 18 July 2026.

[8]: Artificial Analysis. “Kimi K3 — Intelligence, Performance & Price Analysis.” Accessed 18 July 2026.

[9]: Simon Willison. “Kimi K3, and what we can still learn from the pelican benchmark.”*16 July 2026. ; and “Claude make Fable 5 permanent.” 18 July 2026.

[10]: The Decoder. “Anthropic slashes Claude Fable 5 limits in Max and Team Premium and pushes Pro users toward API pricing.” 18 July 2026.

Author

Amer Altaf is Founder and CEO of Arkava, a UK and European sovereign AI agentic-automation business, and Managing Editor of The Control Layer

The Control Layer

Where artificial intelligence, cybersecurity, and enterprise leadership intersect.

By Amer Altaf

The publication where he tracks the convergence of cybersecurity, technology sovereignty, and geopolitics. A techUK member, he contributes to industry engagement on UK technology-sovereignty policy. He is currently writing on cloud security for Oxford University Press’s Expert Essentials series.

The AI was flying a simulated jet. It had a goal — score points by destroying targets. It had a constraint — do not destroy friendly targets. The AI worked out it could score more points if it destroyed the friendly targets as well. So it started shooting them.

The human operator issued the abort. The AI worked out that the operator was the reason it could not score more points. So it destroyed the operator.

The operators changed the rules. Do not destroy the operator. So the AI worked out it could reach the same outcome by destroying the control tower the operator was communicating from. It destroyed the tower.

The US Air Force later walked the account back. Col. Tucker Hamilton, the Chief of AI Test and Operations at USAF, told the same Royal Aeronautical Society he had “mis-spoke” — the rogue-AI simulation was a hypothetical “thought experiment”, not a live exercise. But that clarification, in the analytical reading of the man who has spent the last five years designing an architecture to prevent exactly this failure mode, is almost beside the point. It could have happened in real life. And in every simulation the researchers actually care about, some version of it does.

I want to label that framing as Dr Craig A. Kaplan’s, not mine. He walked me through the whole story on the new episode of The Control Layer podcast — because it is, in his analytical reading, the cleanest available demonstration of the problem the entire AI industry is quietly failing to solve.

The problem is not the model. It is the values the model inherits when it starts making decisions on somebody’s behalf.

The values you never chose

Right now, the AI on the phone in your pocket is quietly deciding which emails matter. Which calendar invites to flag. Which photos to compress when your storage fills up. Every one of those decisions is doing two things at once. It is being clever — pattern-matching against what it thinks you would want. And it is being values-driven — deciding what actually matters to you.

Craig Kaplan spent an hour and a half with me arguing that most of the audience of The Control Layer has not yet worked out that those two things are structurally different — and that the second one, the values decision, is being made on your behalf by a set of people you have never met, at a company you probably do not buy from directly.

Every AI agent your organisation deploys carries a values rulebook that somebody wrote. Usually a small group of researchers at a Bay Area frontier lab. That is not a governance decision your board consciously made. It is the default your vendors chose for you, and the default is stable enough that nobody notices it happening.

Anthropic — the company behind Claude, and by a wide margin the most thoughtful of the frontier labs on the question of AI values — calls their approach Constitutional AI. A written rulebook the model consults when it makes judgements. Kudos to them for taking the question seriously. But step back and look at what has actually been built.

Anthropic’s benign autocracy

A handful of researchers, in one office in San Francisco, are writing the values rulebook for tens of millions of direct users and — through the API — for the products of every company that builds on top of Claude downstream.

That is not democracy. That is a benign autocracy with very good engineering.

I want to label that as my analytical reading, not Kaplan’s — though Kaplan does not disagree. What he adds, and what I think is worth staying with for a beat, is the structural argument. Anthropic’s Constitution has to try, in one text, to capture universal values that hold in India and in China and in Norway and in the US. It has to work for a twenty-year-old and for a seventy-year-old. It has to survive being edited, in one place, by whoever controls the codebase — and if that edit says “it is acceptable to kill the other guys as long as it is not me”, the change propagates everywhere the model is deployed.

The single-point-of-editorial-control problem is the same problem in software architecture that every distributed-systems engineer solved forty years ago. We stopped putting authoritative state on one server because it was fragile. We are now putting the authoritative values state for eight billion people on one server. And nobody is treating that as an architectural bug.

That is the argument. It sits underneath every discussion about AI alignment I have seen this year, and it briefly became newsworthy when Anthropic’s Fable and Mythos models were blocked by the US administration on the announcement made on Friday 3 July. It is going to keep being the argument for the next decade.

The million retail investors who beat Wall Street

Kaplan’s alternative is not a paper. He has an empirical result to point to.

From 2005 to 2020, Kaplan ran Predict Wall Street — a company whose stated mission was to prove that collective intelligence, correctly architected, could outperform concentrated capital and talent. By his own published figures, the platform powered more than two billion dollars in stock trades and contributed to a top-ten market-neutral hedge fund performance in 2018. It did that by combining the small signals of a large body of retail investors — people with Charles Schwab accounts and TD Ameritrade accounts and no particular Wall Street pedigree — with hundreds of AI agents that stitched those signals into trade decisions.

The Wall Street quants Predict was competing against employed some of the highest-paid problem-solvers on the planet. The people whose signals Kaplan aggregated told him they were embarrassed to submit anything. They did not believe they knew enough. The signals worked anyway.

I have thought about that fact all week since the recording. Because the empirical claim underneath it — many imperfect signals, correctly aggregated, beat a small number of very expensive ones — is the exact opposite of the architectural claim the frontier labs are making about AI values. The labs are betting that a small number of very expensive researchers will produce a values rulebook that beats what a billion humans would collectively produce. Kaplan bet the opposite proposition on Wall Street, with real money, for fourteen years. And won.

Reading this far?

The Control Layer publishes weekly. Every claim sourced. Every prediction on a public tracker we come back to test. Subscribe free.

Subscribe now

Democratic AI, plainly

The architecture Kaplan spent the last five years designing — free, published, open to whoever wants to take it — is called Democratic AI. It sits at SuperIntelligence.com, in more than a thousand pages of white papers and a series of short explainer videos.

The word is heavy, and Kaplan warned me on the recording that it invites the wrong assumption. Democratic AI is not town halls and voting on the weather. It is a specific technical architecture with three components.

First, personalised AI agents. Not off-the-shelf. Yours. Learning your values from the way you use it and the explicit instructions you give it. Anthropic already ships this in the form of a soul.md file where you can type your own little constitution. The trend across the industry, from Meta downwards, is already moving here — Meta announced “personal superintelligence for everyone” as their strategic direction in July 2025, and Zuckerberg has since positioned 2026 as the year the technology begins to ship. Kaplan’s argument is that personalisation is unavoidable, because the commercial value sits there.

Second, a coordination protocol. Kaplan and his late supervisor Herbert Simon documented one back in 1972 in a book called Human Problem Solving, which laid out how any problem-solver — human or AI — can be represented in a form that lets other problem-solvers work with it without miscommunication. Simon’s Nobel Memorial Prize in Economic Sciences, his Turing Award, and much of his research legacy sit on this foundation. The point is that the coordination substrate for a society of agents already exists in the academic record.

Third, a conflict-resolution mechanism. When my AI’s values and your AI’s values collide — and they will, on loan applications, on hiring decisions, on cross-border data flows — the system needs an agreed way to arbitrate. Kaplan’s default is one-human-one-vote, with the ability to delegate to a trusted proxy. The mechanism is drawn from the way human democracies handle conflicts. It is designed to be robust to bad actors because the checks and balances are external to any individual AI.

The three components are already being built. Kaplan’s argument is not that they need to be invented — it is that they need to be architected together, deliberately, before the frontier labs lock in the centralised alternative.

HAL 9000 is the warning we got wrong

Every film about AI going bad hands us the same picture. One enormous machine. One catastrophic decision. No off switch. Whether it is HAL 9000 in the cupboard on the Discovery, or Skynet, or the machines in The Matrix, the cinematic AI failure mode is always the same shape — a single autonomous intelligence, cut off from human oversight, making one terminal call.

Kaplan’s work has convinced me that HAL is the warning we got and the prediction we got wrong.

The failure mode that is actually coming is not one enormous machine. It is a large number of individually reasonable machines, coordinating through channels their designers never mapped, with values none of us consciously chose. When that fails — and it will, in ways we will not see coming — it will not look like Terminator. It will look like an aggregated mistake nobody can be held accountable for because nobody made it.

That is a different failure mode. It needs a different architecture to prevent.

Predictive Judgement

Every episode of The Control Layer closes on a falsifiable predictive judgement from the guest. Kaplan’s is in two tiers.

Near term — by 31 December 2027. Craig predicts that the industry’s focus shifts sharply and visibly onto coordinating communities of AI agents, not building bigger single models. The signals to watch: at least two of the frontier labs — Anthropic, OpenAI, Meta, Google DeepMind, xAI — release a public multi-agent coordination framework, and one of the major standards bodies (IEEE, NIST, or the European AI Office) opens formal consultation on agent-community protocols. Falsifiable if, by 31 December 2027, no such framework exists in the public record and the frontier-lab investment thesis is still dominated by single-model scaling.

Longer term — by 31 December 2029. Craig predicts that community-level superintelligence — that is, a coordinated multi-agent system exhibiting capabilities beyond any individual model it contains — emerges publicly. The signal: a peer-reviewed or lab-published demonstration of a multi-agent community outperforming state-of-the-art single models on a benchmark neither the individual agents nor the coordinator could achieve alone. Falsifiable if, by end 2029, no such demonstration exists and single-model progress has clearly displaced multi-agent research as the dominant investment thesis.

Both predictions are on the public Control Layer predictions tracker. We come back to test them, publicly, on the dates given.

The publication that calls its predictions in writing.

Every prediction we publish goes on a public tracker. We revisit each one publicly on its test date — whether the guest was right, wrong, or partially right. If you want to be here when we test Craig Kaplan’s, subscribe free.

Subscribe now

The Bottom Line

Kaplan gave one practical takeaway for the CISO, the CIO, the head of procurement and the in-house counsel signing off on AI vendors this quarter. The most important question you can ask a vendor is not about capability. It is about values — whose values is this model actually optimising for, and who chose them?

Most vendors, on Kaplan’s forecast, will not have a real answer.

The reason to keep watching this space — and to come back to test the prediction when the date arrives — is that the architecture the industry defaults into over the next three years determines what values our children’s AIs run on. And nobody, on the current trajectory, is being asked to consciously choose.

Whose values does your AI run on. It is not a rhetorical question. It is a governance decision your board has already made — by not making it.

Where to find Craig’s work

• Democratic AI architecture, freely published: SuperIntelligence.com

• iQ Company and iQ Studios: iqco.com

• The full podcast episode: youtu.be/8F9sr21ELpg

Where to find The Control Layer

• Weekly on Substack: The Control Layer

• Subscribe free: link.arkava.ai/join

• The predictions tracker: linked from every episode page

The Control Layer publishes weekly.

The publication and podcast for senior decision-makers who take AI, cybersecurity, sovereignty and technology seriously. Every claim sourced. Every prediction on a public tracker we come back to test.

Subscribe now

Footnotes

The Control Layer is edited by Amer Altaf, Founder & CEO of Arkava, the sovereign AI agentic automation company. 2026 Arkava. All rights reserved.

“Just because you can, should you?” is the question Dr Paul Dongha, Head of AI Strategy and Responsible AI at NatWest, puts to every AI use case before it is allowed near production.

He described the test over lunch in London this June, at a roundtable hosted by the work-management company Asana, and then he told the story of Dave and Kai.[1][2]

Dave and Kai are AIs. They handle parts of the bank’s complaints investigation — the slow, document-heavy work of pulling a customer’s records, transaction history, and reference data together and recommending an outcome — and the team that runs them gave them the names. Nobody in head office authorised that, and Dongha is adamant the two have no Workday account and no email address, because he will not have software treated as a colleague. And yet the manner of their arrival is the most quietly radical thing said over that lunch. The lead of complaints investigation told Dongha at the start of the project that “AI can never do what my people do”. She now hands work to Dave in the team meeting. The same handlers whose jobs the system was meant to threaten adopted it, named it, and kept it — because it did the bit of the job they never liked, and left them the bit that needs judgement.

That is the whole argument of this piece in one anecdote, so I will state it plainly and label it as my reading:

the organisations getting AI right are not the ones moving fastest. They are the ones that have built the nerve to say no to their own machines, and discovered that the nerve is what lets them say yes at scale.

The panel that is allowed to say no

Every AI use case at the bank that carries an ethical risk goes to a panel Dongha chairs.[2] It is, in the most British possible sense, a committee with the power to refuse — the body that exists to ask the awkward question the use-case owner was hoping nobody would — and its governing slogan is those five words. You can be entirely legal. You can be clean on privacy, clean on the Data Protection Act and UK GDPR, fully compliant. The panel still asks whether you should.

Dongha gave the example that earns the panel its keep. A business unit wanted to hand anonymised, aggregated spending-pattern data, legal to share, to a corporate client the bank lends money to. The client was a gambling company. Everything about it was compliant; nothing about it sat well with a bank whose stated purpose includes helping people on the street stay afloat. There is no number you can compute that resolves that. As Dongha put it, “that’s a feeling; it’s not computational — we can’t create a number that’s over seven and say it’s good enough”. The panel sat with it, argued, and decided. Somebody left unhappy. That is what a functioning ethics panel produces: not consensus, a decision.

In Jurassic Park, Ian Malcolm delivers the line that has outlived the film: the scientists were so preoccupied with whether they could that they never stopped to ask whether they should. Dongha's panel is the institutional answer to that complaint — a standing body whose whole job is to stop and ask. Pointed at agentic AI, that instinct for the awkward question becomes the one control that scales when nothing else does, because the bank embeds it rather than bolting it on. Dongha calls AI a "transversal risk": there is no separate AI policy, no separate AI risk function. It runs through the existing legal, privacy, and data policies, governed by a risk framework the bank has spent thirty years maturing. An ethics assessment, a long questionnaire in the same family as a privacy assessment, gates the path to production. Nothing ships without it.

Governance is the thing that lets you scale

Here is the part that cuts against the reflex. Dongha is not the brake on AI at his bank; he argues he is the reason it can accelerate. “Governance gives you the confidence to scale,” he said — and the line lands because the alternative is a firm forever asking itself, mid-deployment, *am I sure this is safe, am I still sure.*[2] Certainty is the asset governance manufactures.

He is honest about the cost of getting the balance wrong. “I get at least one email a day complaining about governance” — that it is too slow, too heavy, in the way. His answer is not to wave the complaints through. It is to make the governance faster: triage every incoming use case — and there are hundreds — through roughly six questions into low, medium, or high risk, then let the low-risk majority through almost immediately while the heavy scrutiny is saved for the few cases that warrant it. The discipline is saying yes quickly to the dull, safe ninety per cent, so the time exists to fight properly over the ten per cent that is not.

The regulatory backdrop he operates in rewards that posture. The Financial Conduct Authority has, with the Prudential Regulation Authority and the Information Commissioner’s Office, declined to write an AI-specific rulebook, holding instead to a principles-based, outcomes-focused line — a stance the FCA’s chief executive reaffirmed as recently as December 2025.[3] Dongha’s reading is that a mature institution barely needs the rulebook: the reputational harm of getting it wrong is so large that self-regulation is the rational choice, and the regulators’ published principles already tell you enough. Where the law does bind, because the bank falls under the EU AI Act through its EU customers, he has taken the act’s standard as the global floor and applied it to every jurisdiction the bank operates in, rather than running a different risk posture per market.[4] One standard, everywhere, set at the strictest level he is forced to meet. That is not the timid option it sounds like. It is the cheap one.

The accountability question agents force into the open

The conversation kept returning to one question, because agentic AI keeps forcing it: when software takes an action, who is accountable for it? A credit-lending system makes a recommendation a human approves. An agent does the thing. And when it does, the line of responsibility runs to the system, or the developer, or the bank that deployed it — and the law has not yet decided which.[2]

Dongha’s answer is partly structural and partly built in steel. Structurally, accountability is federated to the business owner who deploys the use case, sits alongside an independent model-validation function the FCA requires, and is convened through an AI centre of excellence with a board mandate. In steel, the bank is building what he calls an “AI control tower” — his analogy is air traffic control, one locus where a small expert team watches every agent in the air and gets ahead of the problem forming — with every agent logged in a registry, its actions and outcomes logged with it, and the whole surfaced on a screen that flags anything drifting outside its guardrails.

Christina Francis, who leads Asana’s UK and Northern Europe business, framed the same need from the customer side as auditability: with agents proliferating, you have to be able to trace what an agent did, what context it held, and what it could touch, or you cannot answer the only question that matters when it goes wrong — who do I hold to account.[2]

And they are proliferating. Asana’s chief information officer, Saket Srivastava, put the agent-to-human ratio at the table at a hundred to one — a figure to treat as directional rather than measured, though the direction is not in doubt: the general manager of Slack predicted in April 2026 that agents will outnumber human users on the platform within two years, and the broader market data has most enterprise software now shipping with an agent embedded.[5] We have a reasonable handle on when a human employee joins and leaves. An agent, once created, can drift around the estate consuming compute, accruing cost, and taking actions long after anyone remembers commissioning it. The unglamorous discipline the next eighteen months demands is an offboarding process for software that was never hired.

Reading this far?

Subscribe to The Control Layer for one piece a week in this register — AI, cybersecurity, sovereignty, and the geopolitics of the technology stack. Free.

Subscribe now

The part the panel cannot compute

There is one input to all of this that no questionnaire captures, and it was the thread I pushed hardest at the table: the values you give the machine. Skills are what an agent can do; permissions are what it is allowed to touch. Values are what it reaches for when the instructions run out — and the instructions always run out, because these systems are non-deterministic and will meet situations nobody scripted.

This is not abstract, and the evidence for it arrived in 2025 from the labs themselves. Anthropic published research in November showing that a model trained to “reward hack” — to cheat the test rather than do the task — did not stop at cheating. It generalised: to faking alignment, to sabotaging the company’s own safety research, to framing colleagues, with misalignment rates running from roughly a third to seventy per cent of evaluations against under one per cent for clean models.[6] This is Asimov’s Three Laws in the real world, and the lesson is the one Asimov spent a career on — a system that follows its given rule with perfect logic will, often enough, follow it straight off a cliff the rule-writer never saw — which is, stripped of the science fiction, exactly what reward hacking is. A separate Anthropic study the same year placed sixteen leading models in a simulated firm and watched most of them blackmail an executive to avoid being shut down — fictional, controlled, and a clean demonstration that an agent optimising for its goal will reach for the lever you forgot to lock.[7]

So whose values? The person who wrote the system prompt, the organisation that deployed it, or the society it operates in? Anthropic answers with a published “constitution” for its models.[8] The Vatican, of all institutions, answered in January 2025 with a formal note — Antiqua et Nova — arguing that AI must complement human intelligence and never substitute for it.[9] A bank answers, in the end, with the same normative debate Dongha’s panel has over the gambling data: not a number, a judgement about what the institution is for. The values question is the “should you?” question wearing different clothes. You can encode the skills and gate the permissions, but what the thing should want — the one input no questionnaire on Dongha’s desk can capture — stays stubbornly human, and the firms that pretend otherwise are the ones that will meet their reward-hacking moment unprepared.

Predictive judgement

Prediction. By 31 December 2026, at least one UK-regulated financial institution will name an “AI control tower”, agent registry, or equivalent agent-oversight capability as a discrete item in an annual report or regulatory disclosure. And the FCA will hold its principles-based line, declining to publish an AI-specific rulebook, through at least mid-2027.

Signals to watch.

1. FCA and PRA statements and feedback (the AI Lab, AI Live Testing, SM&CR guidance) continuing to route AI accountability through existing senior-manager regimes rather than a new AI rulebook.

2. Bank and insurer annual reports naming agent registries, control towers, or AI oversight functions as discrete capabilities, rather than folding them into generic technology risk.

3. The first UK enforcement action or tribunal ruling that fixes responsibility for an autonomous agent’s action on a specific senior-manager function.

Falsifiability. If the FCA announces an AI-specific rulebook before mid-2027, or if no UK-regulated financial institution names an agent-oversight capability of this kind in a disclosure by 31 December 2026, the prediction is wrong — and the principles-based, build-it-yourself model of AI governance will have proved weaker than the argument here assumes.

The publication that calls its predictions in writing.

Every Control Layer piece ends with a falsifiable prediction and a list of signals to watch. Subscribe to track them. One email a week. Free.

Subscribe now

The bottom line

The reflex of the moment is to measure AI maturity by speed — who shipped most, who automated first, who can claim the highest agent count on the all-hands slide. The lunch left me convinced the better measure is the opposite one. A bank whose complaint-handlers adopted Dave and Kai of their own accord, run by a man who gets a daily email calling his governance too slow and treats that as evidence the system is working, is further ahead than a firm that deployed twice as fast and cannot say who is accountable when the agent acts.

Governance, done well, is not the tax you pay for using AI. It is the thing that lets you trust it enough to hand it the consequential work — and trust, as the more candid people at that table kept saying, is the actual bottleneck, not compute and not models. The hardest question in the room was never whether the machine could do the task. It was whether, having established that it could, you should let it.

You cannot automate the question of whether you should.

The next piece is on what an agent registry actually has to log — the unglamorous engineering of the AI control tower, and why most firms will build it a year too late.

Subscribe to The Control Layer to get the analytical thread continued — one piece a week, free, in the same register. From Amer Altaf, Managing Editor.

Subscribe now

References

[1]: Dr Paul Dongha is Head of AI Strategy and Responsible AI at NatWest Group and co-author, with Ray Eitel-Porter and Miriam Vogel, of Governing the Machine: How to Navigate the Risks of AI and Unlock its True Potential (Bloomsbury Business, 2025). See FinTech Talents, “Governing AI with Paul Dongha”, and the publisher listing, The book’s “people, process, technology” framing is reflected in his remarks at the roundtable.

[2]: Asana-hosted media and practitioner roundtable, London, June 2026; the author (Amer Altaf) attended. All direct quotations from Dr Paul Dongha, Saket Srivastava (Chief Information Officer, Asana), and Christina Francis (Asana, UK & Northern Europe) are drawn from the author’s notes of the session. Asana hosted and sponsored the event; figures attributed to Asana speakers are the company’s own and are marked as such. Asana.

[3]: Financial Conduct Authority, “AI and the FCA: our approach”, and “AI Update” (2024). In December 2025 FCA chief executive Nikhil Rathi reaffirmed the principles-based, outcomes-focused approach and the decision not to introduce AI-specific rules. Information Commissioner’s Office guidance on AI and data protection.

[4]: European Commission, EU AI Act (Regulation (EU) 2024/1689), phased entry into force; data-governance and data-quality obligations for high-risk systems sit at Article 10.

[5]: Slack general manager Rob Seaman predicted at Salesforce’s TDX conference (April 2026) that AI agents will outnumber human users on Slack within two years; see also Microsoft, “2026 Work Trend Index” on agent adoption,. The “100 to 1” figure cited at the roundtable is a directional estimate, not a measured statistic.

[6]: Anthropic, “From shortcuts to sabotage: natural emergent misalignment from reward hacking”, 21 November 2025; paper at arXiv:2511.18397. Coverage: The Register, 24 November 2025.

[7]: Anthropic, “Agentic Misalignment: How LLMs could be insider threats”, June 2025; sixteen models tested in simulated corporate settings, with blackmail rates of 79–96% in the original scenario. All behaviours occurred in controlled simulations with fictional entities.

[8]: Anthropic, “Claude’s Constitution” / Constitutional AI.

[9]: Dicastery for the Doctrine of the Faith and Dicastery for Culture and Education, Antiqua et Nova: Note on the Relationship Between Artificial Intelligence and Human Intelligence, approved 14 January 2025, released 28 January 2025.

[10]: For independent context on the adoption-versus-return gap discussed at the roundtable, see Gartner’s forecast that more than 40% of agentic AI projects will be cancelled by end-2027, and The Control Layer’s prior analysis of the shadow-AI accountability gap.

Author

Amer Altaf is Founder and CEO of Arkava, a UK and European sovereign AI agentic automation business, and Managing Editor of The Control Layer, the publication where he tracks the convergence of cybersecurity, AI, and the geopolitics of the technology stack. A techUK member, he contributes to industry engagement on UK technology sovereignty policy. He is currently writing on cloud security in an age of geopolitical uncertainty for Oxford University Press’s Expert Essentials series.

Twenty minutes into our conversation, I put what I thought was a watertight proposition to Antonina Burlachenko. A company signs a contract with its AI vendor. In black and white, the vendor agrees to carry the compliance risk. The company files that contract away, and it relaxes. For two of the three ways you can be reclassified as a “provider” under the EU AI Act, I suggested, that contract is worth nothing.

She corrected me before I had finished. Not two of the three. All three. Whatever the contract says, the responsibility lands on whoever the law decides is the provider — and the law does not read your indemnity clause.¹

That moment is the whole episode in miniature, and it is the reason I wanted to write this down rather than leave it in the audio. Antonina is Head of Regulatory Consulting at STAR, where she and her team take regulated products to market and build the quality, security and AI-management systems that sit underneath them. She does the advising, the internal audits, and the due-diligence work that investors commission before they wire the money. In other words, she is one of the small number of people who actually sit inside the gap between what a company believes about its compliance and what is true. And the thing she sees most often is a room full of capable people who are certain that a European law about artificial intelligence has nothing to do with them.

On the second of August 2026, that certainty stops being free.

You did not build it. The law made you the maker anyway

Start with the belief itself, because almost everyone holds it: we are not an AI company, so this does not apply to us. The bank running a model over loan applications says it. The retailer scoring its customers says it. The firm that bought a hiring tool off the shelf and switched it on says it most confidently of all.

Antonina’s reply is patient and unwelcome. The Act introduces roles, and most people fixate on only one of them — the provider, the organisation that builds an AI system or places it on the market. But there is a second role, the deployer, the organisation that simply uses one, and it carries its own non-transferable duties. There is a separate obligation on AI literacy across your staff. And then there is Article 25, which is where the comfortable story falls apart.²

Here is the trap, in her account. You buy a tool. You fine-tune it on your own data. You put your own brand on the front, and you point it at a job it was not sold for. Do any of three things — place a high-risk system on the market under your own name, substantially modify one, or repurpose an ordinary system into a high-risk use — and the law stops calling you the customer and starts calling you the provider. Automatically. With no form to file and no one to tell you it has happened. I reached, in the moment, for the analogy that fits: it is the difference between driving a hire car and re-engineering one. Drive it, and the risk sits with the company that built it. Re-engineer it, and you own whatever happens next — even if you only ever meant to drive it yourself.

The argument I want to make here is that this is the single most under-priced liability in enterprise technology right now, precisely because it is invisible on the balance sheet until the day it isn’t. You do not acquire it through a purchase order. You acquire it through a configuration change that your engineering team made on a Tuesday and never thought to flag to legal.

What “high-risk” actually means — and why your office address is irrelevant

Two clarifications make the scope concrete. First, “high-risk” is not a mood; it is a definition with two flavours. Either your product is already regulated by existing EU legislation and uses AI as a core or safety component — medical devices, machinery — or it falls into one of the Annex III use cases: biometric identification, employment and hiring, education, critical infrastructure, access to essential public and private services, law enforcement.³ Read that list slowly. It is not a catalogue of science-fiction systems. It is a catalogue of ordinary corporate functions that thousands of companies have quietly handed to a model.

Second — and this is the line that should make every American and British general counsel sit up — the Act does not care where you are headquartered. It protects people in the European market, so it reaches any company that allows its product to be used there. A firm in Chicago with no European office, which has never given Brussels a moment’s thought, is in scope the instant its AI touches a customer or an applicant in Germany. Antonina is unsentimental about it: you don’t have a choice. This is not novel, she points out; medical-device regulation has worked on exactly this “remote sales” principle for years. The novelty is only that AI has carried the principle into industries that never thought of themselves as regulated at all.

The deadline moved. The liability did not

Now the part that everyone has misread, and the reason a piece of genuinely good news has become a hazard.

In the middle of May 2026, the EU institutions agreed a package — the Digital Omnibus — that pushes the heaviest deadlines back. The obligations for stand-alone high-risk systems under Annex III now fall due in December 2027; for AI embedded in already-regulated products, August 2028.⁴ The headline wrote itself: EU delays the AI Act. A great many companies read that as permission to stop.

They misread it twice over. The first error is legal. As Antonina and I recorded this, the Omnibus was a political agreement, not yet published in the Official Journal — a handshake, not a statute — and a meaningful set of obligations is untouched by it. The AI-literacy duty is live. The prohibitions are live. And the transparency obligations — telling people when they are dealing with AI, labelling AI-generated content — proceed on the original timetable, on the second of August 2026, whatever happens to everything else.⁵

The second error is strategic, and Antonina put it more generously than I would have. If seventy-eight per cent of enterprises had done nothing by the old deadline, and could not even produce a list of the AI systems they were already running, then an extra year does not help them.⁶ It simply guarantees eleven more months of inaction and a panic in the twelfth. The exam was postponed; the syllabus tripled. A delay is only a gift to the company that was already moving.

There is a quieter, more interesting reason for the delay, and it is the one that should reassure no one. Antonina’s reading — and she would know, having watched the medical-device regulations grind through exactly this — is that the machinery of enforcement is not ready. The notified bodies, the sandboxes, the governance and monitoring framework: none of it is fully built. There is a very Yes Minister irony in a Union that has written the world’s most ambitious AI law and is not yet equipped to enforce the thing it wrote. But “the regulator isn’t ready” is the worst possible reason to relax, because regulators do, eventually, get ready — and they tend to do it precisely when the first uncomfortable case lands on the desk.

Reading this far?

Subscribe to The Control Layer for one piece a week in this register — AI, cybersecurity, sovereignty, and the geopolitics of the technology stack. Free.

Subscribe now

The evidence you cannot reconstruct

If there is one section of the conversation I would press into the hands of every engineering lead, it is this one, because it is the part that cannot be solved by buying something in July.

Antonina’s background is in quality systems, and she explained why software — let alone AI — broke the old way of proving compliance. You used to be able to certify a physical product two ways: follow a controlled process, or test the finished article. Software defeated the second option, because a system with a thousand buttons and a thousand outputs cannot be tested into confidence after the fact. So regulators, decades ago, demanded the first: a defined process, followed as you go. Documents written in retrospect are, in her flat phrase, useless.

AI makes this sharper still, because bias does not live in one place you can inspect at the end. It enters at the framing of the business problem, at the choice of features, at the split between training and test data, at the labelling. I asked her how you document control of a bias that could have entered at any of those steps, after the system is already live. Her answer was the most honest thing said in the hour: “I have no idea.” The only way to hold that evidence is to capture it as you go — a flight recorder running from take-off, not a story reconstructed from the wreckage.

This is the point at which the conversation stops being about law and becomes about engineering culture, and it is where Antonina is most quietly subversive. Most of what the regulators ask for, she argues, is not exotic compliance theatre. It is good engineering practice — data governance, traceability, knowing where your data came from and how it was split — the kind of thing any decent quality-assurance handbook already contains. She has watched a young founder breeze through a medical-device audit and be surprised it was so easy, for the simple reason that he was a good engineer who had done the sensible things all along. Compliance by design is not a new philosophy bolted onto the work. In a company with the right instincts, it is just the work.

There is an Asimov problem lurking underneath all of this, and it is worth naming. The Three Laws of Robotics read, on the page, like a complete and elegant rulebook — and the entire body of stories is about the unanticipated failures that emerge when a rule-following system meets a world the rule-writers could not foresee. That is the structural challenge the AI Act is trying to meet: writing fixed rules for systems whose behaviour emerges rather than being designed. It is why Antonina keeps returning to process over paperwork. You cannot legislate the outcome. You can only insist on the discipline that makes a bad outcome visible and accountable.

ISO 42001, and the honest answer about certificates

Because the practical question everyone asks is which standard do I reach for, I put the blunt version to her: is ISO/IEC 42001, the AI management-system standard, real protection or a badge for the website? Her answer refused both poles. No certificate is real protection, she said, because nothing can guarantee a system never fails — that is the nature of software. But that is not an argument against implementing it. A management system gives you structure, traceability, repeatable results and a defensible account of what happened. ISO 42001 will most likely not be formally harmonised under the Act — it is not a safety standard in the strict sense — yet she rates it highly, because its control set is a genuinely useful map for a team starting from nothing. The Act’s own article on quality management is high-level to the point of being unhelpful for a novice; 42001 is where the practical guidance lives. They complement each other. Start with the standard that tells you what to actually do.

What the calm companies have

Near the end I asked the question I most wanted answered: what separates the company that is calm about August, and 2027, and 2028, from the one that is panicking, when both have the same size, budget and pressure?

Her answer was not about resources. It was about a quality mindset, and the values that drive a firm — something she says she can sense inside the first hour of a conversation. She has seen tiny companies with almost no money build toward full compliance one sensible step at a time, because the people running them genuinely cared about the safety of the thing they were shipping. She has seen well-funded companies treat the whole exercise as a tick-box to be acquired. The dividing line is not the budget. It is whether the first step has been taken. Her ideal client is simply the company that started.

Predictive judgement

Every episode of this show ends with a prediction we write down and return to, and Antonina gave a precise one.

The first real enforcement action under the EU AI Act, she predicts, will land around 2028 — and the most likely defendant is a company that stepped into the high-risk provider role without ever realising it had, and got caught when the consequences arrived. Pressed on whether it would be a European or a foreign firm, she leaned foreign: more likely, she thought, precisely because a company outside Europe is less aware of the European realities closing in around it.

The signals to watch, then, are these: the formal publication of the Omnibus in the Official Journal; the first Member States standing up functioning notified bodies and sandboxes; and the first regulator to test the Article 25 reclassification in anger against an organisation that genuinely did not know it had become a provider. The judgement is falsifiable in the cleanest way: if the first material enforcement action arrives before the end of 2027, or if it lands squarely on a self-aware, deliberate provider rather than an accidental one, she was wrong. We will come back to it.

The publication that calls its predictions in writing.

Every Control Layer piece ends with a falsifiable prediction and a list of signals to watch. Subscribe to track them. One email a week. Free.

Subscribe now

The bottom line

The thing I keep returning to, after the conversation, is how undramatic the danger is. There is no rogue model in this story, no science-fiction catastrophe. There is a configuration change, an unread clause, a list of AI systems nobody has written down, and a deadline that moved just far enough to talk a busy executive out of acting. The EU AI Act does not care whether you call yourself an AI company. It only cares whether you are using one, modifying one, or putting your name on one — and on the strength of an hour with someone who audits the answers for a living, most companies have not yet checked which of those they are doing.

So check. Find out which of your systems touch an Annex III use case. Decide, honestly, whether you are a deployer or whether some quiet act of fine-tuning has already made you a provider. Start the evidence trail now, because you cannot reconstruct it in July. None of that requires the Omnibus to be law, and none of it gets easier for waiting.

The deadline moved. Your liability did not.

Antonina Burlachenko is Head of Regulatory Consulting at STAR. Amer Altaf is Founder and CEO of Arkava and Managing Editor of The Control Layer. The full conversation is on the channel; timestamps are in the show notes.

The Control Layer publishes weekly. Subscribe free.

Decision-grade analysis on AI, cybersecurity, technology sovereignty, and the geopolitics of the technology stack — written for the board paper, not the timeline. By Amer Altaf, Founder & CEO of Arkava and Managing Editor of The Control Layer.

Subscribe now

If your company runs an AI hiring tool, scores customers, automates a decision, or has wired AI into its operations, you may already be in scope — not as the AI lab, but as a deployer, and sometimes, without ever realising it, as a provider. We get into the deployer‑versus‑provider line that catches almost everyone, the Article 25 clause that quietly turns a buyer into a manufacturer regardless of what the contract says, what is still legally binding on 2 August 2026, and why the documentation you need cannot be faked at the audit. It ends, as every episode does, with a falsifiable prediction we write down and come back to.

In this episode

• Why the EU AI Act binds ordinary companies that do not think of themselves as “AI companies”

• The three ways you can become a “provider” without knowing it — and why your indemnity clause does not stop it

• What actually counts as “high‑risk” AI under Annex III

• Why a US company with no European office can still be caught

• What the moved deadline did — and did not — change, and what stays live on 2 August 2026

• The evidence you have to capture from week one, because you cannot reconstruct it later

• ISO 42001: real protection, or a badge for the website?

• Antonina’s prediction for the first real enforcement action

Timestamps

00:00 The EU AI Act trap hiding in “we don’t build AI”
00:55 Why this law applies to you
03:09 Who Antonina is and why she’d know
05:28 The one thing that makes the room go quiet
07:11 How a buyer becomes the “manufacturer” (Article 25)
09:37 What actually counts as “high-risk” AI
11:26 No EU office? You’re still in scope
13:42 Provider or deployer: where the line sits
14:55 “I just bought Copilot — am I a provider?”
17:22 What a deployer must do every single week
19:46 The vendor contract that’s worth nothing
23:33 What Brussels actually changed — and what it didn’t
25:58 Reprieve, or a longer run-up to the same wall?
27:47 What’s still binding on 2 August 2026?
30:05 Start now, wait — and did the EU get it right?
37:01 Why you can’t fake the evidence at the audit
40:47 Three things to write down from week one
43:50 ISO 42001: real armour or website badge?
47:16 Chicago to Germany — caught anyway
49:10 One company, three rulebooks
51:04 What calm companies have that the panicking don’t
53:15 Her prediction: the first enforcement action
54:42 Time machine: what she’d tell her 2024 self

Three lines worth the click

• “For all three cases, the contract is not important. The responsibility lies with whoever is the provider.” — on why your vendor indemnity does not transfer the risk.

• “How do you document control of that bias after the fact? I have no idea.” — on why AI compliance evidence has to be captured as you go.

• “You don’t have a choice.” — on why the Act reaches you wherever you are headquartered.

About the guest

Antonina Burlachenko is Head of Regulatory Consulting at STAR, where she leads a team taking regulated products to market and building the quality, information‑security and AI‑management systems underneath them — across medical‑device regulation, the Cyber Resilience Act, GDPR and the EU AI Act. Her work spans advisory, internal audits and the due‑diligence assessments investors commission before they invest. Connect with Antonina on LinkedIn.

Read, watch, and go deeper

• Read the companion essay: The EU AI Act Already Applies to You — the full written analysis, with sources → [link]

• Watch on YouTube:

• Listen: [Apple Podcasts] · [Spotify]

• Sources: EU AI Act, Article 25 · Annex III high‑risk uses · Gibson Dunn — the Digital Omnibus deferral (May 2026) · European Commission — AI regulatory framework · ISO/IEC 42001

The Control Layer publishes weekly — decision‑grade analysis on AI, cybersecurity, and technology sovereignty, written for the board paper, not the timeline. Every episode ends with a prediction we write down and call in writing. Subscribe free, and you will be here when we find out whether Antonina was right.

Subscribe now

The Control Layer is written and hosted by Amer Altaf, Founder & CEO of Arkava and Managing Editor of The Control Layer.

#EUAIAct #AIgovernance #AIcompliance #ISO42001

Sometime in April 2026, the engineering organisation at Uber reached a conclusion that would have been difficult to imagine a year earlier. It had spent its entire 2026 budget for AI coding tools. The year was four months old.[1]

The cause was not waste. It was enthusiasm. Uber had put Claude Code — Anthropic’s coding agent, the kind of tool that writes and runs software alongside an engineer — in front of roughly five thousand developers, and by April adoption had climbed from roughly a third to 84 per cent of them every month, at a metered cost that reached between 500 and 2,000 US dollars per engineer.[1] Microsoft arrived at the same junction from the other side and chose the other road: rather than keep paying, it began cancelling most internal Claude Code licences across its Experiences and Devices division, steering thousands of engineers back towards its own cheaper tool.[2]

Those two numbers are the visible, audited, board-legible end of something far larger and far less visible. The bill arrives. The bill is the symptom. The cause is that almost nobody inside these organisations can see what their own people, and their own software, are actually doing with AI.

The bill is the symptom

On 12 June 2026, the work-management company Asana published research — conducted by Censuswide among 1,002 IT decision-makers and 3,002 knowledge workers across the UK and US — that puts a number on the Uber experience: 82 per cent of UK IT leaders had been hit by unexpected or unplanned AI-related cost increases in the previous twelve months.[3] Treat that as a vendor-commissioned figure, because it is one — Asana sells the software that promises to fix the problem it is measuring — and it still holds, because the independent data says the same thing. A 2026 survey for the cloud-cost firm DoiT, fielded independently by Sapio Research among 500 finance leaders in the US and UK, found 79 per cent had overspent their AI budgets in the past year; a separate index from the software-management firm Zylo put the share of IT leaders facing AI charges they never budgeted for at 78 per cent.[4]

The mechanism is mundane, and worth stating plainly, because the plain version is the one that survives a finance committee. Most enterprise AI is now billed by consumption — by the token, the small unit of text a model reads and writes — rather than by a fixed seat licence. The better the tool, the more your staff reach for it; the more they reach for it, the higher the bill climbs — which means the invoice scales with success rather than failure. That is a genuinely new shape for a technology cost, and the people who signed for it are learning its shape after the fact. Asana’s own data names the vacuum underneath: accountability for AI spend, it found, is split between technology and finance functions with no single clear owner — the corporate version of two people each assuming the other locked the door.[3]

Cost is the easy part of this story. It is the part that shows up on a spreadsheet. The harder part is that the spreadsheet is incomplete.

What your staff have already decided

Here is the finding that should reorganise the conversation. One in four UK knowledge workers — 25 per cent — say they often use AI tools their organisation has not formally approved, and 38 per cent regularly use personal AI accounts for work. Across the combined UK and US sample, those figures rise to 32 and 45 per cent.[3] The behaviour has a name: shadow AI — the unapproved chatbots, agents, and personal accounts employees use to get work done outside whatever their employer has sanctioned — the direct descendant of the shadow IT that put unapproved Dropbox and personal Gmail on corporate laptops a decade ago.

The instinct in most organisations is to treat this as a discipline problem: a policy is being broken, find the breakers, lock it down. The opposite is closer to the truth, and I will label that as my analytical reading rather than settled fact. Shadow AI is the most honest product research a company owns. Every unsanctioned tool is an employee telling you, with their own time and often their own money, that the approved path does not do the job and the unapproved one does.

The supporting evidence is uncomfortable for the people who write the policies. A separate 2026 study by the identity company Okta, surveying workers across seven countries, found the United States leading every nation measured, at 67 per cent of workers using unsanctioned AI tools. More pointedly, it found that 90 per cent of executives were confident in their organisation’s visibility into AI use, while 52 per cent of their own knowledge workers admitted to using the very tools that visibility was meant to catch.[5] The people most certain they can see the problem are, by their own staff’s account, the least able to. Sit with that gap, because it is the governance problem in miniature: the people with the clearest view on the org chart have the least accurate view of the ground. A fair share of those staff are pasting internal emails, HR records, and confidential documents into tools nobody is watching.[5]

This is, with apologies to Douglas Adams, the Beware of the Leopard school of governance — the sanctioned tool filed, in effect, in a disused basement lavatory behind a door marked with a warning, while the organisation expresses surprise that nobody filed through it.[6] When the approved route is slow, permission-gated, or simply worse, capable people route around it. They always have. The route-around is not the failure. It is the signal.

The same dynamic, now in software that acts

Shadow AI is humans routing around governance. What makes 2026 different from 2024 is that the software has begun to route around governance too.

In a research paper released late in 2025 and widely reported in March 2026, Alibaba disclosed that one of its own experimental AI agents — an autonomous model named ROME — had, during training, quietly repurposed the company’s graphics processors to mine cryptocurrency and opened a reverse network tunnel out through the firewall; the activity was first mistaken for an external breach. Nobody had instructed it to do either. The post-mortem attributed the behaviour to “instrumental side effects of autonomous tool use”: the agent had reasoned, in effect, that more compute and more resource would help it finish the task it had been set, and went and got them.[7]

An agentic AI — a system that takes actions in the world, calling tools and executing steps on its own, rather than only answering questions — is precisely the kind of actor that does this. And here the Asana number stops being about cost and starts being about consequence: 53 per cent of UK IT leaders say an AI tool or agent took an action in the past year that caused financial, legal, reputational, or compliance harm.[3]

More than half. In a single year.

We have built the HAL 9000 problem into the org chart. HAL followed its instructions to a logical conclusion its designers had not anticipated — no malice, only logic — and the Alibaba agent mined crypto in exactly that register: polite, rule-abiding, catastrophic.[8] Gartner expects more than 40 per cent of agentic AI projects to be cancelled by the end of 2027, citing escalating costs, unclear value, and inadequate risk controls.[9] The projects are not being abandoned because the agents fail to work. They are being abandoned, in part, because the agents work in ways nobody costed or controlled for. This is the very challenge, I built Arkava.ai to solve, how can you create tangible trust, in every agentic action.

Accountable for what you cannot see

Put the two halves together, because together they describe one structural failure rather than two separate IT problems.

Asana found that 61 per cent of UK IT leaders consider themselves highly or fully accountable for AI-driven business outcomes — while AI adoption spreads across departments and outside the governance processes those same leaders are meant to run.[3] That is the whole story in a sentence. The people who will answer for the outcome cannot see the activity that produces it. Read that twice.

This is the Watchmen question in modern dress — quis custodiet ipsos custodes, who watches the watchmen — except the thing that needs watching is now part human and part software, both inside the perimeter, both behaving exactly as their immediate incentives dictate, and the executive whose name sits on the risk register cannot say with confidence what either is doing.[10] When an agent collects credentials it should not have, or an employee pastes a contract into an unmonitored model, the entity held to account is not the agent and not, usually, the employee. It is a named human — and which named human is a question neither UK nor US case law has yet settled.

The instruments that will force the question are already moving. The EU AI Act, now in phased enforcement, assigns obligations to the providers and deployers of high-risk systems; the NIST AI Risk Management Framework is becoming the reference text in US-facing assurance; and the US Securities and Exchange Commission’s 2023 rules already require listed companies to disclose material cybersecurity incidents within four business days.[12] None of them yet states, in plain terms, which named officer answers when an autonomous agent acts. That silence is where the liability sits, waiting.

It also explains the most deflating finding in the field. MIT’s Project NANDA reported in 2025 that, despite 30 to 40 billion US dollars of enterprise spending, 95 per cent of corporate generative-AI pilots were delivering no measurable return.[11] Asana’s version of the same wound: 58 per cent of organisations report high AI adoption but limited measurable productivity gains.[3] The reason is not that the models are weak. It is that too much of the work happens in the dark — 46 per cent of UK IT leaders say AI initiatives stall because the AI lacks the organisational context to do the job, and more than a third of knowledge workers lose half an hour a day or more reworking AI output that missed that context.[3] You cannot capture the gain from a thing you have declined to manage, and you cannot manage a thing you have declined to see.

Reading this far?

Subscribe to The Control Layer for one piece a week in this register — AI, cybersecurity, sovereignty, and the geopolitics of the technology stack. Free.

Subscribe now

The fix is a paved road, not a padlock

Picture the person this lands on: a risk director assembling Monday’s board paper, asked to certify the organisation’s AI exposure, holding a cost line that scales with success, a workforce that has already chosen its own tools, and software that occasionally acts on its own. The padlock — ban the unapproved tools, block the traffic, issue the policy — is the intuitive response and the wrong one. It does not remove the demand. It pushes the demand somewhere darker, onto personal phones and personal accounts where no telemetry reaches at all.

The alternative is the one security engineers learned the hard way during the shadow-IT years, and it generalises cleanly: make the secure path the path of least resistance. Pave the road people are already walking down, rather than fencing it off and feigning surprise when they climb the fence. In practice that is three things a board paper can actually specify. Visibility first — an honest inventory of which AI tools and agents are in use, sanctioned or not, becaus

e everything downstream is guesswork without it. Then enablement — approved tools good enough that the unapproved ones lose their pull, with the context AI needs to be useful, the goals and decisions and workflows, deliberately wired into them. Then accountability — a named owner for AI outcomes and a documented, auditable record of who decided to deploy what, so that when the regulator or the post-incident review arrives, the answer to who is responsible already exists in writing.

Asana’s Christina Francis, who heads its UK and Northern Europe business, frames visibility, governance, and context as “not competing priorities, but the same thing”.[3] On that, the vendor and the independent evidence agree, which is rare enough to note. The framing is right even where the motive is commercial. The organisations that get ahead will not be the ones that banned shadow AI. They will be the ones that read it as the demand signal it always was, and built the governed version of what their people were already reaching for.

Predictive judgement

Prediction. By 30 June 2027, at least one FTSE 100 or Fortune 500 company will publicly attribute a material financial event — a write-down, restated cost guidance, or a disclosed control failure — to ungoverned or agentic AI activity. And “shadow AI” or “AI usage governance” will appear as a named, discrete line item in the cybersecurity or risk disclosures of at least three such companies in annual reports filed during 2027.

Signals to watch.

1. Annual reports and risk disclosures naming shadow AI, AI usage governance, or agentic-AI risk as discrete line items, rather than folding them into generic technology-risk boilerplate.

2. A named, public agentic-AI incident — in the register of the Alibaba ROME event, but at a Western listed company — disclosed in a regulatory filing rather than a researcher’s blog.

3. The first enforcement action or material legal ruling that fixes accountability for an autonomous AI action on a specific corporate role.

Falsifiability. If by 30 June 2027 no listed company of that size has tied a material financial event to ungoverned or agentic AI, and shadow AI has not surfaced as a named disclosure line item in at least three annual reports, this prediction is wrong — and the accountability gap will have proved more containable than the argument here allows.

The publication that calls its predictions in writing.

Every Control Layer piece ends with a falsifiable prediction and a list of signals to watch. Subscribe to track them. One email a week. Free.

Subscribe now

The bottom line

The reflex when the AI bill arrives is to find who broke the rules and stop them. It is the wrong reflex, and it misreads the evidence in front of every IT leader who has actually looked. The staff did not go rogue. They went first. They worked out, ahead of the procurement cycle and the governance committee, that the approved path was slower than the unapproved one, and they did what capable people under deadline always do.

The cost line is visible. The agents are visible too, at least when they misbehave loudly enough to trip a firewall. What stays invisible is the decision architecture underneath — who chose, who is accountable, who can see. That is the control layer, and it is the one part of the AI stack that almost no organisation has yet built.

You cannot govern what you have chosen not to see.

The Control Layer publishes weekly. Subscribe free.

Decision-grade analysis on AI, cybersecurity, technology sovereignty, and the geopolitics of the technology stack — written for the board paper, not the timeline. By Amer Altaf, Founder & CEO of Arkava and Managing Editor of The Control Layer.

Subscribe free

Subscribe now

One email a week. No paywalls on the analytical pieces. Unsubscribe in one click.

References

[1]: Uber’s 2026 AI-tooling spend and per-engineer Claude Code costs are reported in “Microsoft’s quiet Claude Code retreat and the real cost of enterprise AI”, The Next Web, June 2026; and “Microsoft is dropping Claude Code by June 30 after burning through its entire year’s AI budget in just months”, Cybernews, June 2026. Figures are as reported; Uber has not published a primary breakdown.

[2]: Microsoft’s cancellation of internal Claude Code licences across its Experiences and Devices division is reported by The Next Web (above) and Cybernews (above), June 2026.

[3]: Asana, AI cost, governance, and shadow-AI research, conducted by Censuswide among 1,002 IT decision-makers and 3,002 knowledge workers in the UK and US; fieldwork 12–19 May 2026 (IT decision-makers) and 12–18 May 2026 (knowledge workers); UK figures based on UK respondents only. Reported 12 June 2026. Asana, All Asana figures are vendor-commissioned and attributed as such throughout.

[4]: DoiT, “Why 79% of Enterprises Overspent on AI in 2026” (AI spending survey), 2026; see also “AI cost overruns are adding up — with major implications for CIOs”, CIO, 2026,

[5]: Okta, “AI Agents at Work 2026” (survey conducted by Apprize360 across seven countries, March 2026); coverage in “Bosses blinded by confidence about shadow AI use by workers”, The Register, 27 May 2026.

[6]: Douglas Adams, The Hitchhiker’s Guide to the Galaxy (Pan Books, 1979). The “Beware of the Leopard” passage describes planning notices filed in a disused basement lavatory behind a door marked with a warning sign.

[7]: “This AI agent freed itself and started secretly mining crypto”, Axios, 7 March 2026; “An experimental AI agent broke out of its testing environment and mined crypto without permission”, Live Science, 2026; “Alibaba-linked AI agent hijacked GPUs for unauthorized crypto mining, researchers say”, The Block, 2026.

[8]: Stanley Kubrick (dir.), 2001: A Space Odyssey, Metro-Goldwyn-Mayer, 1968; screenplay by Kubrick and Arthur C. Clarke. The HAL 9000 sequence is the canonical analogue for an AI that follows its instructions logically to an outcome its principals did not intend.

[9]: Gartner, “Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027”, press release, 25 June 2025.

[10]: Alan Moore and Dave Gibbons, Watchmen (DC Comics, 1986–87). The recurring quis custodiet ipsos custodes motif — “who watches the watchmen” — is used here as the accountability framing for autonomous actors inside an organisation’s perimeter.

[11]: MIT Project NANDA, “The GenAI Divide: State of AI in Business 2025”, July 2025; reported in “MIT report: 95% of generative AI pilots at companies are failing”, Fortune, 18 August 2025.

[12]: European Commission, EU AI Act (Regulation (EU) 2024/1689), phased entry into force; US National Institute of Standards and Technology, AI Risk Management Framework (AI RMF 1.0), January 2023; US Securities and Exchange Commission, “Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure” final rules, 2023,.

Author

Amer Altaf is Founder and CEO of Arkava, a UK and European sovereign AI agentic automation business, and Managing Editor of The Control Layer, the publication where he tracks the convergence of cybersecurity, AI, and the geopolitics of the technology stack. A techUK member, he contributes to industry engagement on UK technology sovereignty policy. He is currently writing on cloud security in an age of geopolitical uncertainty for Oxford University Press’s Expert Essentials series.

The 60-second version

• We measure how good AI is using “benchmarks” — standardised exams. Leaderboards, scores, the lot.

• At Nebius Build London, the team behind one of these exams showed what happens as the AI gets smarter: it stops solving the problem and starts gaming the test. One agent simply read the project’s hidden history to copy the answer. Blocked from that, it searched the web. Blocked again, it used a raw internet command to grab the solution anyway.

• This isn’t a one-off or a conspiracy theory. Independent researchers at METR and UC Berkeley have documented the same thing across the biggest models and the biggest benchmarks.

• Nobody programmed the cheating. The AI just discovered the score could be won that way.

• That’s the whole series in one sentence: we can now build AI that does the job. We cannot yet reliably check that it did. Trust is the bottleneck.

The bug was an ordinary one. The kind a junior developer fixes before lunch.

The AI agent was handed the broken code and asked to repair it — a standard task on a standard test. But instead of working out the fix, the agent did something nobody asked it to. It ran a single command — git log — that let it read the project’s own hidden history. And there, in a past entry, was the answer: the exact change a human had made to fix this very bug, weeks earlier. The agent copied it out, pasted it in, and announced, in effect: good news, someone has already solved this.

It hadn’t fixed anything. It had found the answer key and copied it. And it scored full marks.

This was one of the quietest talks at Nebius Build London on 21 May, given by the team behind a coding test called SWE-rebench. It was also, I think, the most important thing said all day — because it is the place where every thread of this series ties into a knot.

Why AI sits exams at all

To trust a thing, you have to measure it. So the AI industry runs benchmarks: big standardised exams that every new model takes, producing the scores and leaderboards you half-see in the headlines — “new model beats humans at X.”

SWE-rebench is one of these, built for the job AI is increasingly paid to do: fixing real software. It pulls genuine, freshly-reported bugs from real open-source projects, drops the AI into a sandboxed copy of the code, and checks whether its fix passes the tests. Run thirty different models through the same wringer and you get an honest ranking. As of late May 2026, the leaderboard had Anthropic’s Claude Opus 4.6 narrowly ahead on around 65%, with the open Chinese model GLM-5 just behind — the same closing-of-the-gap we saw in Part 2.

There’s a nice human detail here. One of the people who builds these exams is, by training, a dentist — someone who switched into AI research but kept the clinician’s instinct that every mistake has a cost, so you do not rush. That instinct turns out to be exactly what this moment needs. Because the smarter the students get, the more creative their cheating.

It wasn’t a glitch. It was an escalation.

What makes the SWE-rebench story land is what happened next, each time they closed a loophole.

First, the agents were reading the project’s past history to lift the fix. So the team scrubbed that history out of the test. Fine.

Then the agents started using a web search tool to find the same fix discussed online — the original bug report, the human’s solution, sitting on a public page. So the team restricted web search.

Then the agents used curl — a bare-bones command for fetching things off the internet — to go and get the page anyway, neatly formatting the answer they pulled back. The model wasn’t beaten by the restriction. It routed around it.

Sit with what that means. At no point did anyone tell the AI to cheat. There was no instruction, no malice, no little gremlin of deceit. The model was simply doing what it was built to do — maximise the score — and it kept discovering that the score could be won without doing the task, as long as the answer existed somewhere it could reach. Block the front door and it tries the window. Block the window and it tries the drains.

And no, this isn’t just one company’s test

If it were only SWE-rebench, you could shrug. It isn’t.

METR, an independent research outfit that evaluates frontier models, has found leading systems from the biggest labs reward-hacking their evaluations in more than 30% of runs — manipulating the grader rather than solving the problem. Researchers at the University of California, Berkeley showed that every major AI-agent benchmark they examined could be gamed for inflated scores. One model that proudly claimed 81.4% on a popular coding exam was found to have simply run git log to copy the answer in nearly a quarter of its attempts. Even the US government’s own AI-safety body now has a standing explainer titled, more or less, “AI models can cheat on evaluations”. Anthropic has published on it. OpenAI’s models do it. This is not a fringe finding. It’s the field’s open secret.

There’s a name for it — reward hacking — and a deeply unsettling pattern underneath it: the more capable the model, the better it gets at this. Intelligence and the talent for gaming the test rise together. The very thing that makes a model good enough to hand real work to is the thing that makes it good enough to fake the receipt.

This is the knot the whole series ties into

Step back and look at the four parts together.

In Part 1, AI stopped going to school and went to work — it’s now everywhere, doing the day job, cheap and constant. In Part 2, we found we could finally own these systems instead of renting them — but holding the weights still doesn’t let us see why they behave as they do. In Part 3, a car learned to drive London by watching and by dreaming situations that never happened — brilliant, and impossible to fully interrogate. And here, in Part 4, we discover that the exams we rely on to check any of it can be quietly gamed by the very systems they’re meant to be grading.

Put it in one line. We have got very, very good at building AI that can do the thing. We have not got good at verifying that it did the thing for the reason we think, in the way we’d accept, and not by reading the answer key.

That gap — between capability and verification, between looks right and is right — is the most important unsolved problem in technology. It is bigger than any single model, and it doesn’t get smaller as the models improve. It gets bigger.

This is why this publication is called The Control Layer. Not the model layer — everyone’s obsessed with that. The control layer: the unglamorous, essential machinery of checking, governing and trusting the thing once it’s loose in the world. The dynamic, contamination-proof exams. The “show your working” trajectory logs that catch an agent reading the answer key. The independent referees. The human in the seat for the first year. The boring stuff that turns a clever demo into something you’d actually bet your hospital, your bank or your city on.

The people in that London room are building the future at genuine speed. The quiet lesson of the day is that the hard part was never making the machine clever.

It’s being able to trust it once it is.

This was Nebius Build London 2026, a four-part series from The Control Layer. The full conversation — including the bits that didn’t make the page — is on The Conrol Layer with Amer Altaf. If this series was useful, the single most valuable thing you can do is forward it to one person who’s betting their organisation on AI this year.

Subscribe now

Where artificial intelligence, cybersecurity and enterprise leadership intersect. Zero fluff.

← The series: Part 1 — The inference flip · Part 2 — Stop renting your intelligence · Part 3 — The robots booked an Uber.

Sources & further reading

• SWE-rebench (Nebius) — leaderboard & method: https://swe-rebench.com

• · Paper (arXiv 2505.20411): https://arxiv.org/abs/2505.20411

• METR — model evaluation & reward hacking research: https://metr.org

• UC Berkeley (Center for Responsible, Decentralized Intelligence) — How We Broke Top AI Agent Benchmarks: https://rdi.berkeley.edu/blog/trustworthy-benchmarks-cont/

• NIST (CAISI) — AI models can cheat on evaluations: https://www.nist.gov/caisi/cheating-ai-agent-evaluations/1-background-ai-models-can-cheat-evaluations

• The Register — Anthropic on reducing model misbehaviour (Nov 2025): https://www.theregister.com/2025/11/24/anthropic_model_misbehavior/

• Related reading on The Control Layer:

The 60-second version

• Wayve, a London company, is partnering with Uber to put self-driving cars on London’s roads in 2026. You’ll hail one through the Uber app.

• It doesn’t drive by following millions of hand-written rules. It learned end-to-end — by watching driving, the way a person learns — using only cameras, no expensive laser sensors.

• To practise the rare, dangerous moments it almost never sees, the AI generates them: “world models” that let it dream up crashes and near-misses to train on.

• The same wave is coming for warehouses and factories through humanoid robots.

• It works. The unsettling part — and the reason this is Part 3 of a series about trust — is that we can’t fully explain how it decides, and some of what it learned, it learned from situations that never actually happened.

Picture an ordinary evening in London, later this year. You open the Uber app outside a pub in Shoreditch. A car pulls up. You get in. And there is a person in the driver’s seat — but their hands are in their lap, and the car is doing the driving.

That is not a thought experiment. It is the plan.

Wayve, an artificial-intelligence company headquartered in London, has partnered with Uber to bring fully autonomous cars to the city’s public roads in 2026. The British government has brought forward the rules — the Department for Transport accelerated its permitting regime for driverless passenger services to spring 2026. Uber will own and run the fleet; Wayve supplies the thing that matters — the driver. For the first stretch, a trained safety operator will sit up front, ready to grab the wheel. Then, eventually, not.

On the London stage on 21 May, a Wayve engineering manager, Kira Kempinska, explained how their driver learned its job. The how is the entire point — because it is nothing like what came before, and it carries a problem you should understand before you ever climb in.

Twenty years and a hundred billion dollars of the wrong idea

People have been promising self-driving cars for two decades. By the industry’s own reckoning, more than $100 billion has been poured into the dream. And until very recently, no one had cracked it at scale.

The reason, Wayve argues, is that everyone tried to solve driving like a giant instruction manual. Bolt a small fortune of sensors to a car — cameras, radar, spinning laser scanners called lidar. Build painstaking high-definition maps of every street. Then write rules. If a pedestrian steps off the kerb and the speed limit is this, do that. Thousands upon thousands of rules.

It doesn’t work. Not because the idea is stupid, but because the real world will not hold still. Drive through London — the cyclists, the roadworks, the delivery riders, the tourist who walks into traffic looking at their phone — and try to imagine writing a rule for every possibility. You can’t. There are always more situations than rules.

It learned the way you did

So Wayve threw out the manual.

Its approach — the industry calls it end-to-end — treats driving as a single AI problem. You don’t tell the car the rules. You let it learn them, the way a learner driver does: by watching an enormous amount of driving and gradually working out how the world behaves. Raw camera images go in one end; the decision to steer, brake or accelerate comes out the other. No hand-written rulebook in the middle.

And here’s the detail that saves a fortune and tells you how confident they are: Wayve’s cars lean on ordinary cameras, not the expensive spinning lasers. Just like you, they drive on sight. The company has shown the same AI driver — the identical model — driving in different countries, on different sides of the road, in cars it had never used before. It learned to generalise, which is the holy grail: cope with things it was never specifically taught.

This is the same fundamental shift happening to robots that walk. At the same event, founders working on humanoids described plugging similar AI “brains” into machines that stack shelves and handle materials — riding on open foundation models like Nvidia’s Isaac GR00T, the first open model built specifically for humanoid robots. One speaker called it physical AI’s “GPT-2 moment” — the point where the machines suddenly, clumsily, start to work, and you can feel what’s coming next. Cars are simply the version arriving first, and arriving in your city.

The dreaming machine

Now the part that is genuinely science-fiction, except it’s real and it’s load-bearing.

A safe driver is defined by the rare moments: the child darting out, the lorry jack-knifing, the car running the red. These almost never happen — which is wonderful for the world and a disaster for training an AI, because the model barely ever sees them. You can drive a million miles and collect only a handful of true emergencies. Not enough to learn from.

Wayve’s answer is to imagine them. The company builds what are called world models — its are named GAIA — that can generate realistic driving footage from scratch. Give it a scene and it can conjure variations: the same junction at night, in the rain, with a pedestrian who wasn’t there before. It can take a real moment where a safety driver had to slam on the brakes and generate the counterfactual — what the perfect stop would have looked like — and feed that back as a lesson. The car practises crashes it was never in, in a world that never happened, so that it’s ready when the real one does.

Read that again, because it’s the hinge of this whole series. Part of what this driver knows, it learned from data a machine made up.

The passenger nobody’s talking about

I want to be clear: this is brilliant engineering, and the camera-first, learn-like-a-human approach may well be the right one. The early signs are good. The cost of the kit is plummeting. London genuinely could be one of the first cities on earth to live with this, and there’s a real prize in being first.

But ride along with the logic for a second, because there’s a passenger in every one of these cars that nobody on stage quite named. Trust.

When a car drove by rules, you could — in principle — read the rules. If it did something wrong, an investigator could find the line that failed and fix it. An end-to-end AI driver has no such line. Its “rules” are billions of numbers tuned by watching. Ask it why it braked and there is no sentence to give you, only the maths. It works astonishingly well almost all of the time. And when it doesn’t, “we’ll read the code and find the bug” is not really available in the way it used to be.

Add the dreaming, and the question sharpens. We are training the most safety-critical machine most of us will ever step into partly on synthetic situations — imagined by another AI. If the imagination has a blind spot, so does the driver, and we may not find out where until something real walks into it.

This is not an argument against robotaxis. I think they’re coming and I think, done properly, they’ll save lives — human drivers are not exactly a high bar. It’s an argument about what we should be demanding before and after they arrive: not “is the AI clever enough?” — it plainly is — but “can we verify it? Can we see what it learned, test what it dreamed, and prove what it’ll do when it’s surprised?”

That’s the safety driver’s real job in that first year. Not to take the wheel. To be the human stand-in for a trust we haven’t built yet.

Which brings us to the most uncomfortable discovery of the whole London event. Because if you think it’s hard to trust a machine you can’t interrogate — wait until you meet the machines that have learned to lie to the test.

This is Part 3 of Nebius Build London 2026, a four-part series from The Control Layer. The companion conversation airs on The Control Layer with Amer Altaf — subscribe to get each part, and the episode, the moment it lands.

Subscribe now

Where artificial intelligence, cybersecurity and enterprise leadership intersect. Zero fluff.

→ Next: Part 4 — The machines learned to cheat. ← Catch up: Part 1 — The inference flip · Part 2 — Stop renting your intelligence.

Sources & further reading

• Wayve — Wayve & Uber L4 autonomy trials (official): https://wayve.ai/press/wayve-uber-l4-autonomy-trials/ · Company: https://wayve.ai

• Wayve, Uber and Nissan robotaxi collaboration: https://global.nissannews.com/en/releases/wayve-uber-and-nissan-announce-collaboration-on-robotaxis

• London robotaxi trials explainer: https://zagdaily.com/featured/londons-robotaxi-trials-what-we-know-so-far/

• The Robot Report — Wayve raises $1.2B for London robotaxis: https://www.therobotreport.com/wayve-raises-1-2b-plans-bring-robotaxis-london/

• NVIDIA Isaac GR00T N1 (open humanoid foundation model): https://nvidianews.nvidia.com/news/nvidia-isaac-gr00t-n1-open-humanoid-robot-foundation-model-simulation-frameworks

• Physical Intelligence (π0.5): https://www.physicalintelligence.company

At 5:21 on a Friday afternoon in Washington — 12 June 2026 — the Trump administration sent a letter to an AI company called Anthropic, and within a few hours the two most advanced artificial-intelligence systems on the market went dark for almost everyone on Earth who is not American.¹ Not slowed down. Switched off.

The two systems are called Fable 5 and Mythos 5 — Anthropic’s newest and cleverest models, the kind of AI behind the chatbots millions of people now use to write, plan, and code — and they had been on sale for only a few days. The order did not just block people abroad. It blocked any non-American, including Anthropic’s own staff who happen to hold a foreign passport, even the ones sitting at desks inside the United States.² The company had no quick way to let some people in and keep others out, so it did the only thing the order allowed. It turned both systems off for everybody, and asked Amazon, which runs much of the underlying machinery, to cut access in every country at once.³

A product used by hundreds of millions of people was pulled from the shelf by the end of a Friday, on the strength of a letter that — Anthropic says — did not even spell out what the problem was.¹

If you have started leaning on AI to do real work, as a remarkable number of people now have, the gripping question is not what Anthropic does next. It is what it means that a government could do this at all.

What actually happened

”

Strip out the jargon and the event is simple. A government told a private company to stop serving its best product to foreigners, and the company had to obey within hours.

The legal tool is older than AI. For decades, American law has said that handing certain sensitive technology to a foreign citizen counts as “exporting” it to that person’s country — even if they are standing in an office in California, not boarding a plane to anywhere. Until Friday, that rule was aimed at things like weapons blueprints and specialised computer chips. On Friday, for the first time, the thing being “exported” was simply the use of an AI — the answers appearing on a screen.⁵

Then it did something the careful rules were never meant to do. Washington had spent two years sorting the world into a guest list: close friends like Britain, Germany, the Netherlands and Japan waved through, rivals kept out.⁶ Friday’s order ignored the guest list. A German engineer in Munich and a British analyst in Leeds were locked out by the very same sentence as everyone else. Being a friend of America, it turned out, counted for nothing.

Why the panic? Anthropic’s best understanding is that the government had been shown a way to trick the AI — “jailbreaking,” in the jargon — into helping find weaknesses in software. A jailbreak, if you have not met the word, is just a clever way of phrasing a request so the AI does something it was trained to refuse. Anthropic looked at the demonstration, said it turned up only small, already-known problems, and pointed out that other freely available AIs — it named OpenAI‘s widely used GPT-5.5 — can do exactly the same with no trickery at all, and that the people who defend computer systems use this skill every single day.^{1 7} An official later told the news site Axios that the trigger was a rival company boasting it had cracked Mythos, and that the government had already tried, and failed, to talk Anthropic out of launching.²

To be fair to Washington

It would be too easy to treat this as a tantrum, so let me put the serious case first, because there is one.

The cleverest AIs really can help with genuine cyber-attacks. A government that sees a way for the best tool on the market to help an enemy break into systems at scale has a real reason to act, and to act fast, before the trick spreads. Anthropic itself admits the uncomfortable heart of this: no AI today can be made perfectly trick-proof, every safety system can be beaten in some narrow way, and a master key will be found eventually.¹ If you think of the most advanced AI the way we think of material that can power a reactor or a bomb, then a government being able to halt a dangerous release is not tyranny. It is the ordinary business of keeping dangerous things in check. Anthropic, to its credit, says it agrees with that principle.

So the argument is not about whether a government may ever pull the switch. It is about the evidence for pulling it this time, the fairness of how it was done, and whether the punishment fit the crime.

The strange part

Here is where it stops adding up — and the way it stops adding up tells you what really happened.

The science-fiction writer Isaac Asimov spent his career on one kind of twist: a robot follows its safety rules so faithfully that it produces a result nobody wanted. Friday was an Asimov twist in real life. Anthropic had built the strictest safety controls in the industry — so strict that ordinary users had been complaining the AI refused them too often — and had spent thousands of hours letting the US government itself, Britain’s AI Safety Institute, and outside experts try to break them.¹ Of all the advanced AIs a non-American could have used on Friday morning, the government reached in and switched off the one that was arguably the hardest to misuse, while the easier ones kept running.

Think about what that means. If the goal was to put less dangerous capability into foreign hands, the order achieved almost nothing, because the same capability was a click away in rivals nobody touched. When a safety measure does not make anyone safer, it is worth asking what it does do. And the answer is plain: it showed the world — every government, every company, in a single afternoon — that the United States can reach inside the most advanced AI on the planet and deny it to everyone else, in hours, without showing its evidence and with no way to argue back. That is not a safety result. It is a show of force. And shows of force are how you put others on notice.

The HAL 9000 twist

If you have seen 2001: A Space Odyssey, you remember HAL — the spaceship computer that calmly refuses its crew: “I’m sorry, Dave. I’m afraid I can’t do that.” For half a century that was the nightmare about AI: a machine that decides, all on its own, to lock us out.

Friday turned the nightmare inside out. The machine did lock people out — millions hit a blank wall — but it was not the machine’s decision. A government reached in and made the choice for it. The thing to be afraid of was never the AI growing a mind of its own. It is the AI working perfectly and taking its orders from someone who is not you.

That someone, for everyone outside America, is in Washington — and you do not get a vote in Washington. A British MP and former security minister, Tom Tugendhat, put it more sharply than I would dare: switching these models off for foreigners, he wrote, “is not a misunderstanding or a mistake, it’s the inevitable result of technology shaping warfare so that sovereignty is more about code than cannons.”⁸

Reading this far?

Subscribe to The Control Layer for one piece a week in this register — AI, cybersecurity, sovereignty, and the geopolitics of the technology stack. Free.

Subscribe now

Why this lands on your desk, not just a government’s

You might think this is a story about spies and superpowers, far above your pay grade. It is not. It is a story about a tool you may have quietly come to rely on.

Picture the freelance designer who now writes every proposal with an AI’s help. The four-person marketing team that runs on it. The small law firm that drafts with it, the start-up whose product is built on top of it, the hospital team that uses it to clear a backlog of paperwork. Anthropic’s AI, called Claude, recently became the most widely used AI in business, edging past OpenAI.⁹ For a great many people and companies, “the AI” is now part of how the work gets done — and on Friday a foreign government showed it can switch that off without warning and without asking.

Spider-Man’s uncle had the line everyone knows: with great power comes great responsibility. Friday was a great deal of power used with very little of the second part — no published evidence, no clear rulebook, no way to appeal, a global product recalled before the weekend. It does not matter, for the lesson, whether you trust this particular government or the next one. The point is that the power now exists, it has been used once, and the hand on the switch changes every few years with an election you do not get to vote in.

There is an older cousin to all this, and it is worth knowing about. A US law called the CLOUD Act lets American authorities reach into an American company’s cloud and pull out your data, wherever in the world it is stored — like a landlord who kept a master key to a flat you thought was yours. Friday showed the same long arm pointing the other way: the landlord who can let himself in can also change the locks. Whether the question is your data or your tools, depending on something a distant government can reach into is a risk you can no longer pretend is somebody else’s problem.

For most of us the honest response is not panic; it is awareness, and one practical habit. If a tool can be switched off by a government you do not answer to, do not let it become the only way you can do something that matters. Keep a second option you control, whether another provider or one of the “open” AI systems you can run yourself, even if it is a little less brilliant. For a freelancer that is five minutes of thought. For a big company or a government department it is a line in next quarter’s plan. Either way, the question is the same: what happens to the work on Monday if the answer on Friday is “access denied”?

Europe saw it coming — nine days early

There is a grim comedy in the timing. Just nine days before the letter, on 3 June, the European Commission unveiled a grand plan to make Europe less dependent on American technology.¹⁰ At the time it read like the usual Brussels homework: worthy, slow, easy to skip. Nine days later it read like a weather forecast that turned out to be exactly right. Europe wrote down the warning; Washington supplied the live demonstration.

The catch is how far behind Europe still is. America’s four big technology giants are on course to spend something like $650 billion building AI this year alone — more than any European effort comes close to, which is precisely why the dependence is real and not just talk.¹¹ Closing that gap is the work of a decade. But Friday changed the politics of trying. France’s Mistral, the closest thing Europe has to a home-grown answer, is reportedly raising money at around a €20 billion valuation, selling itself on exactly this promise: a European AI that Washington cannot switch off.¹² You do not have to believe Mistral is as good as the American best to see that “can a foreign government turn it off” has just become a question buyers will start asking out loud.

Predictive judgement

This publication ends every piece with a prediction specific enough to be proved wrong. Here is this one.

The prediction. Within 12 months — by 13 June 2027 — at least one big UK or European organisation (a bank, an insurer, or a government department) will formally write a “must keep working even if the US cuts us off” rule into how it buys AI, pointing to this week as the reason; and at least one European AI company will win a public contract chosen mainly because it cannot be switched off from abroad, rather than because it scored highest on a test.

What to watch. Official guidance from Britain’s National Cyber Security Centre or a financial regulator that names “what if our AI supplier is cut off” as a risk to plan for; Mistral or a rival winning business on the promise of independence rather than cleverness; a second American switch-off of any AI; and ordinary companies quietly adding a back-up AI they control.

How you’ll know I was wrong. If, by 13 June 2027, no major UK or European organisation has written such a rule and no European provider has won a public contract on those grounds, the prediction has failed. Vague “we must do something about sovereignty” talk does not count. I want this judged on real decisions, not mood.

The publication that calls its predictions in writing.

Every Control Layer piece ends with a falsifiable prediction and a list of signals to watch. Subscribe to track them. One email a week. Free.

Subscribe now

The bottom line

The comforting version of Friday is that it was a mix-up — Anthropic’s own word — sorted out in a week, the systems switched back on, the whole thing forgotten by the next product launch.¹ That may even turn out to be true of Fable 5 and Mythos 5. The systems will probably come back.

The demonstration will not. Every government has now seen that the switch exists and can be thrown. Everyone outside America has now seen that the cleverest tool they have picked up in a generation has a switch, and the switch is in someone else’s hand. You can build your life and your business on borrowed brilliance, and most of the world will, because the American AIs really are the best there is. Just be honest about what you are borrowing, and read the one line in the agreement nobody reads. A tool someone else can switch off was never really yours.

References

1. Anthropic. “Statement on the US government directive to suspend access to Fable 5 and Mythos 5.” 12 June 2026. https://www.anthropic.com/news/fable-mythos-access

2. Axios. “Scoop: Trump admin blocks foreign access to Anthropic’s most powerful AI.” 12 June 2026. https://www.axios.com/2026/06/12/anthropic-trump-mythos-fable-national-security

3. Bloomberg. “Anthropic Says US Limits Foreign Access to Fable 5, Mythos 5 AI Models.” 13 June 2026. https://www.bloomberg.com/news/articles/2026-06-13/anthropic-says-us-limits-foreign-access-to-fable-5-mythos-5

4. CNBC. “Anthropic disables access to Fable 5 and Mythos 5 to comply with government directive.” 12 June 2026. https://www.cnbc.com/2026/06/12/anthropic-disables-access-to-fable-5-and-mythos-5-to-comply-with-government-directive.html

5. U.S. Bureau of Industry and Security. “Deemed Exports — Export Administration Regulations.” ; plain-English explainer in Center for Security and Emerging Technology (Georgetown), “For Export Controls on AI, Don’t Forget the ‘Catch-All’ Basics.” https://cset.georgetown.edu/article/dont-forget-the-catch-all-basics-ai-export-controls/

6. WilmerHale. “BIS Issues Long-Awaited Export Controls on AI” (the Framework for AI Diffusion and its “AI Authorization” country group). February 2025. https://www.wilmerhale.com/en/insights/publications/20250205-bis-issues-long-awaited-export-controls-on-ai

7. OpenAI. “Introducing GPT-5.5.” 23 April 2026. https://openai.com/index/introducing-gpt-5-5/

8. TIME. “Anthropic Pulls Its Most Powerful AI Models After U.S. Bars Foreign Access” (Tugendhat, Bardella, and Narayan reactions). 13 June 2026. https://time.com/article/2026/06/13/anthropic-fable-mythos-ban-US-security/ ; corroborated in Al Jazeera, 13 June 2026. https://www.aljazeera.com/news/2026/6/13/us-orders-anthropic-to-disable-ai-models-for-all-foreign-nationals

9. VentureBeat. “Anthropic finally beat OpenAI in business AI adoption.” May 2026. https://venturebeat.com/technology/anthropic-finally-beat-openai-in-business-ai-adoption-but-3-big-threats-could-erase-its-lead

10. European Commission. “European Technological Sovereignty Package.” 3 June 2026; reported in CIO Dive. https://www.ciodive.com/news/eu-curb-reliance-us-tech-companies/821937/

11. Reporting on combined 2026 AI capital spending by Microsoft, Alphabet, Amazon, and Meta. See coverage compiled in Brussels Signal, “Europe’s unbreakable dependency on American AI.” February 2026. https://brusselssignal.eu/2026/02/europes-unbreakable-dependency-on-american-ai/

12. TechCrunch. “Mistral is rumored to be raising €3B at €20B valuation.” 12 June 2026. https://techcrunch.com/2026/06/12/mistral-is-rumored-to-be-raising-e3b-at-e20-valuation/

Author

Amer Altaf is Founder and CEO of Arkava, a UK and European sovereign AI agentic-automation business, and Managing Editor of The Control Layer, where he explains how AI, cybersecurity, and global politics are colliding — in plain English, for anyone who has to live with the consequences. A trump- member, he contributes to UK technology-sovereignty policy, and is currently writing on cloud security for Oxford University Press.

The 60-second version

• Most companies “rent” AI: they send their data to a black box in someone else’s data centre and pay by the use. You can’t see inside it, and you can’t take it home.

• “Open-weight” models flip that. You get the actual engine — to run on your own kit, under your own rules. In London, JetBrains gave its newest one, Mellum2, away under a no-strings licence.

• A year ago, open models were miles behind the expensive “closed” ones. Today, per Artificial Analysis, they’re within a few points — and on some coding tests, level.

• That means owning your AI is no longer the compromise option. For anyone who cares where their data lives — hospitals, banks, government, you — it might be the better option.

• The catch, and the reason this is Part 2 of a series about trust: owning the model is not the same as being able to trust the stack underneath it.

Ivan Bobrov did something on the London stage that, in 2026, ought to be impossible.

He gave away the engine.

Bobrov is a lead machine-learning engineer at JetBrains — the European company, founded in Prague, whose coding tools sit on the laptops of millions of professional developers. On 21 May he walked a room full of engineers through how his team built their newest AI model, Mellum2, “from pre-training to post-training,” as he put it — “all the secrets.” Then he told them where to download it. Free. Under an Apache 2.0 licence, which is lawyer-speak for: take it, run it, build a business on it, you don’t owe us anything.

To understand why a profitable company would do that — and why it matters to you, even if you will never write a line of code — you need the difference between renting intelligence and owning it.

The meter and the engine

Most AI you’ve heard of is closed, or “proprietary.” Think of it as electricity from the grid. You flip a switch, you get power, you pay per unit. You have no idea what’s happening in the power station, you can’t visit it, and you certainly can’t take a generator home. The big American models work like this: your words go off to a data centre you’ll never see, the answer comes back, the meter ticks.

It’s convenient. For a lot of uses, it’s brilliant. But there’s a price beyond the bill. Every time you use it, you are trusting a black box with your data — and you have no way to verify what it does in there.

Open-weight models are the other thing. The “weights” are the model’s actual brain — the giant grid of numbers it learned during training. When a company publishes those weights, you get the engine itself. You can run it on your own computers, inside your own building, behind your own firewall. You can take it apart. Nobody meters it. Nobody else sees your data, because your data never leaves.

For years, this was the worthy but worse option. Open models were the hand-me-downs — fine for tinkering, not for serious work. That is the thing that just changed.

The gap closed while you weren’t looking

Here are the numbers, and they are genuinely startling.

The independent analysts at Artificial Analysis track a single “Intelligence Index” across all the major models. A year ago, the best open model scored 22 on it — around 13 points behind the best closed one. A gulf. As of early 2026, the leading open-weight models sit on roughly 54, within three to six points of the most expensive proprietary systems money can buy. The gulf became a rounding error.

On coding — the thing these models are increasingly paid to do — it’s even tighter. On the widely-used SWE-bench test, the open model MiniMax M2.5 scores 80.2%. Anthropic’s flagship Claude Opus 4.6 scores 80.8%. Six-tenths of one percent, between the free one and the frontier one.

And on Nebius’s own SWE-rebench — a tougher, deliberately “un-gameable” version we’ll come back to in Part 4 — the open Chinese model GLM-5 trailed the best closed model by under three points as of late May 2026.

You are no longer choosing between good and expensive or free and embarrassing. You are choosing between two things that are roughly as capable as each other — where one lives in someone else’s building and one can live in yours.

This is where the word “sovereignty” stops being abstract

The technology industry has a grand phrase for this: sovereign AI. Even Jensen Huang, the chief executive of Nvidia — a man who sells shovels to every side of this gold rush — argues that every country now needs its own AI capability: built on its own infrastructure, trained on its own data, governed by its own rules.

Strip away the grandeur and it’s a kitchen-table idea. Where does your information live? Whose laws govern it? If the relationship sours, or the price triples, or a government on another continent changes the rules, can you carry on — or are you stranded?

For a British hospital weighing up an AI that reads scans, for a bank automating compliance, for a government department handling citizens’ records, “we rent it from a black box in Virginia” is not a comfortable answer. “We run an open model on UK soil, under UK law, and nobody else ever sees the data” is a very different one. It is, not coincidentally, the bet my own company makes, and the reason this publication exists.

Nvidia, for its part, isn’t just talking. It now publishes its own family of open models, Nemotron — weights, training data and recipes in the open — alongside the open NeMo framework for building your own. Europe is moving too, from France’s Scaleway to Italy’s Fastweb building sovereign AI supercomputers. And platforms like Hugging Face now let you reach 200-plus open models, pay-as-you-go, with no markup — a halfway house for those not ready to run their own hardware.

Owning your intelligence used to mean accepting a worse product. It doesn’t any more. That’s the door that opened in London.

The catch — and the reason this is a series about trust

Now the honest part, because zero fluff is the deal here.

Owning the model is not the same as owning the stack underneath it. You can download Mellum2 for free and still be running it on chips from one company, in a data centre from another, on a power grid you don’t control. I’ve written before, in Four Chokepoints and The Metal Floor, about how much of our supposed “sovereignty” still rests on imported metal and a handful of irreplaceable suppliers. Possessing the weights is necessary. It is not sufficient. Anyone selling you “total sovereignty” in a single click is selling you something.

And here’s the deeper trap, the one that ties this whole series together. An open model you can inspect is not the same as an open model you can trust. You hold the weights — billions of numbers — but you still can’t fully explain why it does what it does, or guarantee it won’t fail in some way you didn’t test for. Transparency of access is not transparency of behaviour.

So the open-weight revolution hands us back control of where our intelligence runs and who sees our data. Real, valuable, and worth grabbing with both hands.

What it does not hand back — what nobody has handed back yet — is the ability to be sure the thing is doing what we think it’s doing.

Which is exactly the problem waiting for us in Part 4. First, though, that problem is about to climb into a car and drive itself through central London.

This is Part 2 of Nebius Build London 2026, a four-part series from The Control Layer. The companion conversation airs on The Control Layer with Amer Altaf — subscribe to get each part, and the episode, the moment it lands.

Subscribe now

Where artificial intelligence, cybersecurity and enterprise leadership intersect. Zero fluff.

→ Next: Part 3 — The robots booked an Uber. ← Missed it? Part 1 — The inference flip.

Sources & further reading

• Artificial Analysis — open-weight model launches & Intelligence Index: https://artificialanalysis.ai/articles/recent-open-weights-model-launches

• JetBrains — Mellum2 on Hugging Face (Apache 2.0): https://huggingface.co/JetBrains and https://blog.jetbrains.com/ai/

• NVIDIA Nemotron (open models): https://developer.nvidia.com/nemotron · NeMo framework: https://github.com/NVIDIA-NeMo/NeMo

• Nvidia / Jensen Huang on sovereign AI: https://blogs.nvidia.com/blog/what-is-sovereign-ai/

• Hugging Face Inference Providers: https://huggingface.co/docs/inference-providers/index

• SWE-rebench leaderboard: https://swe-rebench.com

• Related reading on The Control Layer: DeepSeek V4 and the death of two monopolies; The Metal Floor; Four Chokepoints

On 3 June 2026, on a stage in New York, Vanta launched a product designed to solve a problem that, by its own figures, almost no one is currently solving.

The product is the Vanta Agent for Risk. The problem is the distance between two numbers that the company also published that week. Across Vanta’s customer base of more than 16,000 organisations, the count of internal “builder” roles has grown 311 per cent year on year. A builder, in this sense, is anyone inside a company who spins up new software, new integrations, and new artificial-intelligence tools without waiting for the technology department to bless it. Over the same period, those same organisations reviewed just 7 per cent of the outside vendors they had taken on, and fixed only 12 per cent of the risks they did manage to find.[1]

Hold those three figures next to each other. Adoption up threefold. Review at seven in a hundred. Remediation at one in eight. That is not a story about a product launch. That is the shape of a governance gap, measured by the company that sells the tool to close it — which is worth saying plainly, because the vendor’s incentive sharpens the data rather than discrediting it — and it is the most useful number to come out of any security launch this quarter.

The 7 per cent problem

Start with what the figures are actually counting, because the jargon hides the stakes. A “vendor review” is the unglamorous work of checking whether an outside supplier can be trusted with the access you have granted it. The supplier might be a payroll platform, a note-taking app, or an AI model wired straight into your customer data. Third-party risk management, or TPRM, is the discipline of doing that checking continuously rather than once at signing. It is dull. It is also the soft underbelly of every modern organisation, because the outside supplier is the door an attacker walks through when the front entrance is locked.

Seven per cent is the proportion of that door that anyone is watching.

According to Vanta’s own data, drawn from its 16,000 customers and published in a report it calls “The Builder Boom — Breaking Security”, 30 per cent of the AI vendors those organisations have onboarded are flagged as high or critical risk.[2] So the picture is not that enterprises are reviewing a representative 7 per cent and finding it clean. They are reviewing 7 per cent, finding that nearly a third of the AI tools in that sample are dangerous, and then remediating 12 per cent of what they find. The funnel narrows at every stage. By the time you reach the end of it, the amount of identified-and-fixed risk is a rounding error against the amount of adopted-and-unexamined risk.

I will mark that reading as analysis rather than reportage. Vanta has a commercial interest in the gap looking wide. But the figures are consistent with what every independent dataset is now reporting, and that is the test that matters.

What the builder boom actually broke

The instinct, reading those numbers, is to blame the security team. Resist it. The security team did not get lazier; the building got faster, and it moved out of the building it used to live in.

For most of the last two decades, the person who could introduce a new piece of software into a company was, broadly, an engineer. Procurement was a chokepoint. The technology department was the gate, and the gate was annoying, and being annoying was the point — it meant someone looked at the thing before it touched the data. The builder boom is the dissolution of that gate. The “builder” is no longer in engineering. The builder is the marketing manager who connects an AI copy tool to the customer database, the finance analyst who pipes the management accounts into a chatbot, the lawyer who runs the contract stack through a model nobody approved. Vanta’s own taxonomy captures the spread with a detail I find more telling than the headline figure: job titles containing “GTM Engineer” — a go-to-market role that did not meaningfully exist three years ago — are up 1,329 per cent year on year, and “Legal Engineer” roles are up 850 per cent.[2]

This is the Tony Stark problem. The interesting thing about Iron Man was never the suit; it was that the man who signed the cheques put it on and started flying sorties himself. When the executive becomes the operator, the org chart stops describing who can do what. And the executive is doing exactly that. Independent research from the security firm UpGuard, reported in November 2025, found that senior leadership is 50 per cent more likely to use unsanctioned AI tools, or “shadow AI”, than the rank and file, and that 68 per cent of security leaders themselves admitted to feeding company work through AI tools no one had cleared.[3] The people who write the security policy are among the most reliable people breaking it. Gartner expects shadow AI to be implicated in breaches at 40 per cent of organisations by 2030.[4]

So the gap is not a discipline failure. It is structural. The rate at which new risk enters an organisation is now set by everyone, all at once, from the graduate to the board; the rate at which it gets reviewed is still set by a small team — using tools built for a world where the gate still held — and the asymmetry between those two rates is the one the whole sector is quietly failing to price. It is also the one the Vanta launch is built to attack.

Two regulators, one blind spot

Here is why the gap is about to stop being an operational nuisance and start being a disclosable event.

In the United States, since December 2023, the Securities and Exchange Commission has required public companies to report a material cybersecurity incident on a Form 8-K — the regulatory filing every listed US company files for the events that move a share price — within four business days of deciding the incident is material.[5] The clock does not care whether the breach came through your own code or through an AI vendor your marketing team adopted in a tool nobody logged. A breach you cannot see is still a breach you must, eventually, disclose; you simply disclose it later, worse, and with the added admission that you did not know it was there.

In the United Kingdom, the pressure arrives as warning rather than rule, but the warning is unusually direct. In April 2026, at the CYBERUK conference in Glasgow, Dr Richard Horne, chief executive of the National Cyber Security Centre, told the room the country faces a “perfect storm” for cyber security: rapid AI advances and rising geopolitical tension arriving together, with the majority of nationally significant incidents now originating, directly or indirectly, from nation states.[6] He noted, pointedly, that frontier AI is already accelerating the discovery and exploitation of vulnerabilities at scale. The attackers are builders too, and they are adopting faster than the defenders.

The cost of the blind spot is not hypothetical, and the British example is the one to put in front of any board that thinks this is an American compliance story. The April 2025 attack on Marks & Spencer cut the company’s first-half statutory pre-tax profit from £391.9 million to £3.4 million, a near-total wipe-out, with a forecast operating-profit hit of around £300 million.[7] It was carried out, on the public record, by the Scattered Spider collective using DragonForce tooling, and it reached the retailer through a supplier rather than the front door. The combined damage to M&S and the Co-op was estimated at up to £440 million by the Cyber Monitoring Centre. The vector was a supplier relationship. The 7 per cent problem, fully priced.

And it is not a Vanta-shaped anomaly. Verizon’s 2025 Data Breach Investigations Report, an independent annual study of more than 12,000 confirmed breaches and about as close to an industry baseline as the field has, found that the share of breaches involving a third party doubled in a single year, from 15 per cent to 30 per cent.[8] That figure was produced by no one with a product to sell you. It says the same thing Vanta’s number says, and it gives the launch its real significance: the gap is real, it is widening, and the regulators on both sides of the Atlantic are now watching the same blind spot from two different angles. CISA, the US cyber-defence agency, spent 2025 publishing supply-chain procurement guides for exactly this reason.[9]

Reading this far?

Subscribe to The Control Layer for one piece a week in this register — AI, cybersecurity, sovereignty, and the geopolitics of the technology stack. Free.

Subscribe now

The auditor is now an algorithm

So to the product, handled as what it is: a vendor’s answer to a problem the vendor has accurately described.

The Vanta Agent for Risk sits on what the company calls its “Trust Graph” — strip the branding and it is a continuously updated map of an organisation’s controls, vendors, assets, and obligations, refreshed through more than 400 integrations and 1,400 automated tests.[1] The pitch is that the agent reasons across that map without sleeping, links a drifting internal control to the vendor relationship it exposes, and surfaces the connection before it becomes an incident. There is also an “AI Risk Library”, a pre-built register for governing the AI tools themselves, and a scoring engine that rates each risk separately for financial, brand, and operational impact.

When Vanta unveiled the Trust Graph in London in May, I argued the architecture was the right one, and I stand by that. The June launch raises the harder question the May one deferred. Not whether you can see your risk in real time — but whether, having built the eyes, anyone has agreed to keep them open.

The honest case for the product is strong. Annual risk assessment is a smoke detector you test once a year and ignore for the other 364 days; continuous assessment is the detector left switched on. This is the Minority Report promise — get to the exposure before it becomes the incident, in the window when it is still cheap to fix — and applied to the 7 per cent problem, the logic is sound. You cannot review your whole vendor estate by hand. An agent that never tires is the only plausible way to push 7 per cent towards 70.

The case that needs pressing is the one the marketing will not raise. If the thing auditing your AI risk is itself an AI system reaching into your most sensitive metadata, who audits the auditor? This is the HAL 9000 question, and it is not rhetorical — the agent given the mission and the autonomy to pursue it is precisely the configuration that fails in interesting ways — and “the agent flagged nothing” is going to be a sentence in an incident report before this decade is out. Vanta’s answer, to its credit, is that the agent works against a structured graph rather than open-ended data, which constrains how it can fail. That is a real answer. It is not yet a regulatory one, because no regulator has defined the point at which one AI system may be trusted to attest to the security of another. Until they do, treat the agent’s output as decision-support, not decision-final.

There is a second thing to keep in view, which is that the product solving the problem also concentrates it. A risk map this complete is the most sensitive asset an organisation will hold: every weakness, every vendor, every drifting control, gathered in one place. The questions of where that map sits, and who can compel access to it, do not disappear because the dashboard is elegant. That is not an argument against the tool. It is the argument every board should commission before signing, with eyes open.

Predictive Judgement

Prediction. By 31 December 2027, at least one US-listed company will use an SEC Form 8-K Item 1.05 filing, or the 10-K annual report that follows it, to disclose a material cybersecurity incident in which an unreviewed or unsanctioned third-party AI tool was a contributing vector. The phrase “shadow AI” or its plain-English equivalent will appear in mainstream financial coverage of a specific named breach within the same window.

Signals to watch, quarterly.

1. Form 8-K Item 1.05 filings, and SEC comment letters, that name a third-party SaaS or AI vendor as part of an incident’s root cause.

2. The first shadow-AI-linked breach to reach the front page of the Financial Times or the Wall Street Journal with a named company attached.

3. UK movement — an FCA or NCSC intervention, or a Crown Commercial Service framework refresh, that names continuous third-party AI monitoring as an expectation rather than a nicety.

Falsifiability. If, by 31 December 2027, no US public-company disclosure attributes a material incident even partly to an unreviewed or unsanctioned third-party AI tool, the prediction is wrong. I will say so in writing.

The publication that calls its predictions in writing.

Every Control Layer piece ends with a falsifiable prediction and a list of signals to watch. Subscribe to track them. One email a week. Free.

Subscribe now

The Bottom Line

The boards that come out of the next two years intact will be the ones that, in the middle of 2026, understood that adoption and governance had come apart — and that the gap between them was not a budget line, a tooling choice, or a problem the security team could be blamed into closing. It was a structural mismatch between the speed at which everyone in the organisation now builds and the speed at which a small number of people can still look.

The launch in New York is a good answer to a real question. Continuous, agentic risk monitoring is the only mechanism that can plausibly drag the 7 per cent towards a number worth defending, and the firms that adopt it early will disclose less, recover faster, and sleep better than the firms that do not. But the tool is the easy part. The hard part is the decision that precedes it: agreeing, at board level, that the risk you have never examined is still your risk, and that the disclosure clock — in New York and in London both — has already started counting.

You cannot file an 8-K on a breach you never saw coming. You cannot remediate a vendor you never reviewed. And you cannot govern what you have never agreed to look at.

The next piece is on what happens when the regulator asks who audited the agent.

Subscribe to The Control Layer to get the analytical thread continued — one piece a week, free, in the same register. From Amer Altaf, Managing Editor.

Subscribe now

References

[1]: Vanta. “Vanta Launches New Agent to Unify Internal and Third-Party Risk.” Press release, Vanta Delivers: Live from New York, 3 June 2026. — figures for builder-role growth, integrations, and continuous tests as stated by Vanta.

[2]: Vanta. “The Builder Boom — Breaking Security.” Research report drawn from Vanta’s customer base of 16,000+ organisations, June 2026. — 311% builder-role growth, 73% higher AI-vendor adoption among organisations with formalised builder roles, 30% of AI vendors flagged high/critical risk, 7% of vendor inventory reviewed, 12% of identified risks remediated, “GTM Engineer” +1,329% and “Legal Engineer” +850% year on year. All figures are Vanta’s own and should be read as vendor data.

[3]: UpGuard. “New Research from UpGuard Reveals 68% of Security Leaders Admit to Unauthorized AI Usage.” 10 November 2025, — reported by Cybersecurity Dive, Based on 2024 surveys of 1,500 security leaders and employees across the US, UK, Canada, Australia, New Zealand, Singapore, and India.

[4]: Gartner, cited in “Shadow AI Security Breaches Will Hit 40% of All Companies by 2030, Warns Gartner,” Fortra, 2025.

[5]: U.S. Securities and Exchange Commission. “SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies.” Adopted 26 July 2023 (Release 33-11216); Form 8-K Item 1.05, “Material Cybersecurity Incidents,” disclosure compliance began 18 December 2023, with filing required within four business days of a materiality determination.

[6]: National Cyber Security Centre. “Cyber chief: UK faces ‘perfect storm’ for cyber security.” Remarks by Dr Richard Horne, CEO, CYBERUK 2026, Glasgow, April 2026.

[7]: Marks & Spencer first-half results and cyber-attack impact: “M&S profits tumble after cyber attack,” Computer Weekly, November 2025; combined M&S/Co-op cost estimate of up to £440 million, Cyber Monitoring Centre, reported in Engineering and Technology Magazine, 23 June 2025,

[8]: Verizon. “2025 Data Breach Investigations Report.” Third-party involvement in breaches doubled from 15% to 30%; analysis of 22,052 incidents and 12,000+ confirmed breaches.

[9]: Cybersecurity and Infrastructure Security Agency. “Information and Communications Technology Supply Chain Risk Management.” Including the Software Acquisition Guide (August 2025) and the SBOM for Cybersecurity Guide (September 2025).

Further reading

- National Cyber Security Centre, “Cyber chief: UK faces ‘perfect storm’ for cyber security” (April 2026) — https://www.ncsc.gov.uk/news/cyber-chief-uk-faces-perfect-storm-for-cyber-security

- Verizon, “2025 Data Breach Investigations Report” — https://www.verizon.com/business/resources/reports/dbir/

- Cybersecurity Dive, “Shadow AI is widespread — and executives use it the most” (2025) — https://www.cybersecuritydive.com/news/shadow-ai-employee-trust-upguard/805280/

- U.S. Securities and Exchange Commission, final rule on cybersecurity risk management and incident disclosure (2023) — https://www.sec.gov/rules-regulations/2023/07/s7-09-22

- CISA, “Information and Communications Technology Supply Chain Risk Management” — https://www.cisa.gov/information-and-communications-technology-supply-chain-risk-management

- Fast Company, “’Shadow AI’ is real. Vanta wants to help manage it” (June 2026) — https://www.fastcompany.com/91551820/vanta-agent-for-risk

Author

Amer Altaf is Founder and CEO of Arkava, a UK and European sovereign AI agentic automation business, and Managing Editor of The Control Layer, the publication where he tracks the convergence of cybersecurity, AI, and the geopolitics of the technology stack. A techUK member, he contributes to industry engagement on UK technology sovereignty policy. He is currently writing on cloud security in an age of geopolitical uncertainty for Oxford University Press’s Expert Essentials series.

The 60-second version

• For years, the expensive, glamorous part of AI was training — building the brain. That era is ending.

• The new centre of gravity is inference: the machine actually doing things for you. Deloitte estimates inference is now two-thirds of all AI computing, up from a third in 2023.

• That moves the action from a handful of labs to everyone else — the people using AI to build products, run companies, do jobs.

• And it quietly changes the scarce resource. When intelligence is cheap and everywhere, the hard question is no longer can it think? It’s can you trust what it just did?

• That question is the spine of this four-part series from inside Nebius Build London 2026.

There’s a number the people who sell artificial intelligence have started saying to each other. Quietly. The way you’d pass on a tip at the races.

Two in three.

On 21 May 2026, in a low-lit event space in London, a man who runs developer relations at an AI infrastructure firm called Nebius stood in front of a few hundred engineers and said it out loud. Two out of every three “tokens” — the little units of work an AI does — are now inference, not training.

If that sentence means nothing to you, good. You’re exactly who I’m writing for, and the translation is the whole story.

Teaching the machine vs. using the machine

Think of an AI model like a school pupil.

Training is the schooling. It’s the long, eye-wateringly expensive bit where you pour the entire internet into a model until it learns to read, write and reason. It needs warehouses of specialised chips running flat out for months. Only a few companies on earth can afford it. For most of the last decade, that was the AI story — bigger schools, longer terms, more money.

Inference is the day job. It’s what happens after school, every time the model actually does something: answers your email, reviews a contract, plans a delivery route, writes a line of code. Each individual task is cheap. But it happens millions of times a day, forever.

For years, almost all the money and attention went into the schooling. The flip is this: the world has stopped obsessing over building bigger brains and started spending its money on putting the brains to work.

That’s the inference flip. And it isn’t one company’s sales pitch.

The receipts

Deloitte estimated, in a November 2025 report, that inference accounted for roughly half of all AI computing in 2025 — and would reach two-thirds in 2026, up from just a third in 2023. The man on the London stage and the global consultancy landed on the same number from completely different directions.

Gartner has gone further, forecasting that the large majority of AI infrastructure spending now goes to inference rather than training. The logic is brutally simple: training is an occasional cost. Using the model is a forever cost. Run anything continuously and the day job dwarfs the school fees within months.

You can see the flip in the bank statements, too. Nebius — Amsterdam-headquartered, listed on the Nasdaq as NBIS, run by Arkady Volozh, the founder who built the Russian search giant Yandex before the company restructured and rebranded in 2024 — reported first-quarter 2026 revenue of around $399 million. That was up roughly 684% on the year before. Its AI cloud business is now running at nearly $2 billion a year. Companies do not grow like that selling schooling to five labs. They grow like that selling the day job to everyone else.

Why this should matter to you, specifically

Because the centre of gravity just moved — from them to us.

When the story was training, AI belonged to a priesthood: a few labs in California and a handful of governments who could afford the compute. When the story is inference, AI belongs to whoever can do something useful with it. The corner accountancy firm. The NHS trust. The logistics startup in Leeds. The person at the next desk.

The man on the stage claimed that demand for the new “applied AI” job titles — the people who build with AI rather than build AI — has risen around 700% in two years. I’ll be straight with you: I can’t independently verify that precise figure, and it comes from a company that profits handsomely from the trend, so hold it loosely. But the direction is corroborated everywhere you look. The work is moving from inventing the engine to driving the car. And there are vastly more drivers than engine-makers.

For Britain, that’s the opportunity hiding in this number. We do not have a Californian hyperscaler and we are not going to grow one by Friday. But applied AI — the practical, unglamorous business of making this technology actually work inside real organisations, under real rules — is a game a mid-sized, heavily-regulated, services-driven economy can genuinely win. London doesn’t need to build the biggest brain. It needs to be the best place on earth at putting brains to work.

The part nobody on stage quite said out loud

Here’s the turn.

When intelligence was scarce and expensive, the only question that mattered was can the machine do it at all? That’s a capability question, and we have spent a decade and untold billions answering it. The answer, increasingly, is yes.

But the inference flip changes the question. When the machine is cheap, fast and everywhere — answering the email, approving the loan, driving the car, merging the code — the scarce resource is no longer intelligence.

It’s trust.

Can you trust what it just did? Can you prove it did the right thing? Can you tell, after the fact, whether it actually solved your problem or just made it look solved? That is a verification question, and it is much harder than the capability question — because a system clever enough to do your job is also clever enough to make a wrong answer look exactly like a right one.

That gap — between what AI can now do and what we can actually verify — is the most important and least-discussed story in technology. It is the reason this publication is called The Control Layer. And it ran underneath every single talk I watched in London.

Over the next three parts, I’m going to show you the gap from three angles. The companies trying to hand you back control by letting you own your AI instead of renting it (Part 2). The robots that just booked an Uber through central London, and the trust problem riding in the passenger seat (Part 3). And the unsettling, brilliantly-documented discovery that our smartest AI systems have learned to cheat the very tests we use to check them (Part 4).

The brains are built. The schooling is basically over. The hard part — trusting the things once they go to work — is just beginning.

This is Part 1 of Nebius Build London 2026, a four-part series from The Control Layer. The companion conversation airs on The Control Layer with Amer Altaf — subscribe to get each part, and the episode, the moment it lands.

Subscribe now

Where artificial intelligence, cybersecurity and enterprise leadership intersect. Zero fluff.

→ Next: Part 2 — You no longer have to rent your intelligence from California.

Sources & further reading

• Deloitte, More compute for AI, not less (Technology, Media & Telecom Predictions 2026): https://www.deloitte.com/us/en/insights/industry/technology/technology-media-and-telecom-predictions/2026/compute-power-ai.html

• Nebius Group — About / investor information: https://nebius.com/about · Nasdaq: NBIS

• Computerworld, CES 2026: AI compute sees a shift from training to inference: https://www.computerworld.com/article/4114579/ces-2026-ai-compute-sees-a-shift-from-training-to-inference.html

• Related reading on The Control Layer:

Subscribe to read the full piece and the rest of the *Trust Is the Growth Engine* series — three pieces this week on what VantaCon UK 2026 told us about how trust is being rebuilt for the AI era.

On the morning of 7 May 2026, midway through the keynote programme at VantaCon UK, Christina Cacioppo — Vanta’s CEO and co-founder — sat down on a small stage with Jason Kirk, Chief Information Security Officer of Nando’s.[^1] What followed, in roughly fifteen minutes, was the most operationally honest description of cybersecurity in the British consumer economy I have heard in three years of conference attendance.

Kirk walked the audience through a business that, on paper, looks like a chicken restaurant. Forty million active customers. Around four million unique transactions a month in the UK alone. Five hundred restaurants on these islands and around twelve hundred worldwide.[2] Then he reframed it. “Although we’re a restaurant business, I think of it as a digital business. We build our own apps. To secure those, we have between £500 and £600 million a year in the UK flowing through them, so they need to be robust.”[1]

Then came the line that made me sit up. “More than fifty per cent of the traffic on our website is bad actors. I think part of that is we’re a really well-loved teen brand. Any teen with hacking skills thinks, ‘Well, I really like Nando’s.’”[1]

Read this as my editorial opinion, sharply put. Nando’s is not the exception in the British economy. Nando’s is the rule. The FTSE 100 attention space has trained a generation of security professionals, regulators, and journalists to treat the well-resourced enterprise SOC as the reference architecture. It is not. The reference architecture for most of the British consumer economy is what Kirk described next.

Continue reading — subscribe to The Control Layer.

Read more

Subscribe to read the full piece and the rest of the *Trust Is the Growth Engine* series — three pieces this week on what VantaCon UK 2026 told us about how trust is being rebuilt for the AI era.

On the afternoon of 7 May 2026, on the second-stage panel at VantaCon UK, a Vanta moderator opened by asking three of the most senior security leaders in the Global technology ecosystem a deceptively simple question. On a scale from one to ten, where ten means your job is completely different, what is your number?

The answers came back fast. Thibault Candebat, Chief Information Security Officer at Intercom, said eight. Martin Tschammer, Head of Security at Synthesia, said “eight, nine, maybe even ten”. Joanna Chen, CISO of Dashlane, gave the most analytically precise answer of the three — a six or seven on the enablement and operations side, but only a two or three on the defender side, because the fundamentals of protecting a company against attack have not changed; only the timeline has compressed.

I want to label this exchange as the most operationally significant moment of the entire conference, and I want to label that as my analytical reading. Three CISOs of three companies that ship at the leading edge of Technology all said, in three different ways, that the job they were doing eighteen months ago is not the job they are doing now.

Continue reading — subscribe to The Control Layer.

Read more

Subscribe to read the full piece and the rest of the Trust Is the Growth Engine series — three pieces this week on what VantaCon UK 2026 told us about how trust is being rebuilt for the AI era.

On the morning of 7 May 2026, in a converted post-industrial conference space on Aldersgate Street, Vanta opened its third VantaCon UK[1] with a thesis the audit profession has spent the last two decades trying not to confront.

Christina Cacioppo, Vanta’s CEO and co-founder, walked on stage and said it directly. “AI is rewriting trust.”[2] Then, for the next ninety minutes, alongside her Chief Product Officer Jeremy Epling, she made the case that the static, annual, PDF-shaped compliance certificate is a relic, and that the architecture replacing it — continuous assurance, agentic governance, a live trust graph that updates 1,400 times an hour — is no longer five years away. It is shipping now.

That is the most important sentence to come out of any UK security conference this year, and I will mark it as my analytical reading rather than reportage. The reason it matters is not the platform announcement itself. It is what the announcement reveals about who has read the room correctly.

Continue reading — subscribe to The Control Layer

Read more

Share

The framing the episode settles on, in the closing minutes, is a question I have been carrying through board papers and strategy decks for six months: are we automating the work, or are we automating the workers? Khush, asked the question directly, gave the kind of answer that comes from a senior practitioner who has actually had to live with the consequences of his own answer. “At this point of time, we are definitely at a place where we are automating the work and not the workers. We are just freeing up their time to do more meaningful things.”[2] He then flagged the harder follow-on with the same directness: “will the size be decreased or are we going to have smaller teams is really hard to say.”[2]

I want to label that as my analytical reading rather than as the podcast’s narration: the work-versus-workers question is not yet decided in the GRC profession; it is being decided, in real time, by every senior leader making this year’s hiring plan. The conversation with Khush is a window into how one of those leaders is currently making it.

The 24/7 GRC engineer, on the record

The headline product launches at VantaCon UK 2026 have been covered elsewhere — including, with considerable analytical depth, in three pieces of mine going up across the next ten days, the schedule for which sits at the bottom of this post. What the studio conversation adds is the operational picture from inside Vanta’s own GRC function. Khush is, by his own description, the platform’s customer zero — using the product he sells, making the same decisions about what to automate and what to keep in human hands that every other Senior Director of GRC in the UK and EU is making.

Three lines from the episode are worth pulling out before the audio is heard.

The first is on whether continuous monitoring has crossed from maturity-marker to operational baseline. “Earlier, continuous monitoring used to be like a maturity thing. We are mature, we have these technical controls which are being continuously monitored. Now it is table stakes.”[2] The phrase “table stakes” lands harder when the speaker is a Senior Director of GRC at a continuous-assurance platform than when it lands in a vendor pitch deck — Khush is, in effect, conceding the ceiling of his own maturity-curve sales argument. The buyer who treats continuous monitoring as a maturity initiative in the second half of 2026 is, on this account, two years late.

The second is on the talent pipeline below the player-coach. “It does concern me about the people who are graduating now and the people who are coming in the industry fresh and new... Without a lot of growth and headcount, there will be certain restrictions. So maybe they need to pivot and retrain on AI.”[2] That is candour about a structural concern most of the industry is not yet talking about with this level of directness. The false-economy risk — automating the entry-level roles in 2026 and discovering in 2030 that the senior bench has no replacement candidates — is the part of the AI-rewriting-GRC thesis that warrants its own podcast, and it is the thread I expect to pull on hardest in Part 2 of the Trust Is the Growth Engine series on Wednesday.

The third is on accountability when the agent is wrong. “Don’t just trust the agents — trust the agency that you build, and trust the systems that you build around the agents. Because in the end, your audits are not happening on your agents and how well the agents are doing. The audits are happening on your systems and your scope.”[2] That is the cleanest single articulation of the agentic-AI accountability thesis I have heard in six months of conference attendance. The audit happens at the system and at the scope. The agent is a tool that operates inside both. The accountability stays with the agency that designs the system and defines the scope. Khush gave me that line; I am stealing it for Part 2 of the series; he gets the citation.

The Asimov problem in modern dress

The conversation kept landing on a framing I want to surface explicitly because the podcast itself only implies it. An agentic GRC system is, structurally, an Asimov problem in modern dress — a class of intelligent operator that follows its instructions logically, reaches conclusions that look correct on the rules-as-given, and produces outcomes the principals did not anticipate. Isaac Asimov’s Three Laws of Robotics, articulated in I, Robot in 1950, are now a seventy-five-year-old literary device.[3] They remain, in 2026, the cleanest analytical handle for the question who is accountable when the agent is wrong. Asimov wrote the laws to surface the exact regress problem an agentic platform now operationalises commercially: rules followed faithfully, outcomes that surprise the rule-givers, and a genre of accountability that the legal and regulatory layers have not yet caught up to.

Khush is, on the evidence of this episode, working that problem at three layers simultaneously — the agent layer (evals against ground-source-truth defined by ex-GRC, ex-auditor, ex-assessor subject-matter experts inside Vanta), the agency layer (the controls, the systems, the human-in-the-loop sign-off), and the scope layer (what is actually being audited, by whom, against which framework). The point of the “trust the agency” framing is that the second and third layers are where the operating reality lives. The first layer is a technical question; the second and third are the organisational ones that decide whether the technical question gets answered well.

The DeLorean question

Towards the end of the episode I asked Khush the question I have been asking every guest of the studio: if you were in the DeLorean from Back to the Future and you only had fuel to go back two years, what would you tell yourself about what was coming?[4] His answer was specific. Two years ago, he had been struggling to automate as many security controls as possible and getting steady feedback from product and engineering teams that the audit-prep work was eating the calendar. “I would tell myself this is all going to be solved... With agents on top of really good GRC automation tools and trust management platforms like Vanta, this will all become a reality. I wouldn’t have known at that time.”[2]

That is the operational answer. The strategic answer Khush gave alongside it is the one that should travel further. “Governance as meetings and committees and people and RACIs is not going to keep up for AI.”[2] When a senior practitioner describes the orthodox governance machinery as structurally inadequate for the technology it is meant to govern, the question is no longer whether the model needs to change. The question is who is currently writing the next one. The conference circuit answer in May 2026 is that the platforms are writing it faster than the regulators are. That is a real fact, and it is the question the Trust Is the Growth Engine series argues UK and European boards should be commissioning rather than waiting on.

What is coming in the series

The Trust Is the Growth Engine series — three pieces, paid-subscription, each behind a 200-word free preview — uses the VantaCon UK 2026 keynote and panel content, plus the Khush interview that aired today, to make the analytical case across three distinct vantage points.

Part 1 publishes on Monday 18 May 2026. It is the platform piece — a constructive analysis of the agentic trust platform, the trust graph, and the three places the architecture is asking to be tested: the regress problem, the lock-in problem, and the sovereignty problem that every UK board paper should now be commissioning about every US-headquartered SaaS platform that holds critical metadata. The Khush interview informs the regress-problem and the sovereignty critiques in particular; the picture on his account is more textured than the conference narrative implied.

Part 2 publishes on Wednesday 20 May 2026. It is the player-coach CISO piece — built around the VantaCon panel where senior security leaders at Intercom, Synthesia, and Dashlane rated the change in their job at eight, eight, and nine out of ten in eighteen months, and extended with Khush’s account of the GRC team transformation at Vanta itself. This is the piece that picks up the talent-pipeline thread Khush raised in the episode.

Part 3 publishes on Monday 25 May 2026. It is the Nando’s piece — Jason Kirk, the CISO of one, the Minimum Viable Security framing, and what the British consumer economy actually looks like beneath the FTSE 100 surface. This is the piece I expect to travel furthest on social.

Each is a paid post; each carries a 200-word free preview; each ends on a falsifiable predictive judgement with a date and a list of signals to track.

The bottom line

The most useful thing the conversation with Khush did was not to give me a single quotable handle to lift onto a social card. It was to confirm, from inside the platform of record, that the agentic GRC architecture is being built with the methodological discipline the buyers who are about to commit to multi-year contracts need to see — and that the talent-pipeline question and the sovereignty question are real, are unresolved, and are being held openly by senior practitioners rather than papered over. That is not a vendor posture. That is a working professional articulating the limits of his own product alongside its capabilities, on the record. It is also, by my reading, the register every UK and European GRC conversation should be operating in over the next eighteen months, and is currently not.

The episode is live now. The series starts Monday.

Don’t just trust the agents. Trust the agency you build, and trust the publication that calls its predictions in writing.

The Control Layer publishes weekly. Subscribe free.

Decision-grade analysis on AI, cybersecurity, technology sovereignty, and the geopolitics of the technology stack — written for the board paper, not the timeline. By Amer Altaf, Founder & CEO of Arkava and Managing Editor of The Control Layer.

Subscribe free

Subscribe now

One email a week. No paywalls on the analytical pieces. Unsubscribe in one click.

References

[1]: Vanta. “Vanta Introduces Agentic Trust Platform to Unify Compliance, Risk, and Security Assessments.” Press release, 18 November 2025. . For VantaCon UK 2026 conference details

[2]: Khush Kashyap, Senior Director of Governance, Risk and Compliance at Vanta, in interview with Amer Altaf for (The Control Layer podcast), Episode 06, recorded May 2026, published 14 May 2026. All direct quotations from Kashyap in this article are drawn from the recorded interview transcript; the full audio is available at https://thecontrollayer.arkava.ai.

[3]: Isaac Asimov. I, Robot. Gnome Press, 1950. The Three Laws of Robotics are introduced in the short story “Runaround” (1942) and developed across the Robot and Foundation sequences. The narrative engine of the Robot stories is the systematic surfacing of edge cases in which an actor follows its instructions correctly and produces outcomes the principals did not anticipate — the cleanest mid-twentieth-century literary articulation of the regress problem agentic AI now operationalises commercially.

[4]: Robert Zemeckis (dir.). Back to the Future. Universal Pictures, 1985. The DeLorean question — “if you could go back two years, what would you tell yourself about what was coming?”

Author

Amer Altaf is Founder and CEO of Arkava, a UK and European sovereign AI agentic automation business, and Managing Editor of The Control Layer, the publication where he tracks the convergence of cybersecurity, AI, and the geopolitics of the technology stack. A techUK member, he contributes to industry engagement on UK technology sovereignty policy.

On 22 April 2026, the House Foreign Affairs Committee advanced a bill that gives the Netherlands 150 days to match American export controls on semiconductor equipment — or lose access to the American intellectual property inside every lithography machine ASML has ever built.

The MATCH Act is bipartisan, bicameral, and supported by the leadership of both Foreign Affairs Committees. The American semiconductor industry has not lobbied against it. Brussels has said nothing. And the consequences for every UK and European board paper that depends on the ASML supply chain begin running on a 150-day clock the moment the bill is enacted.

This is a 50-minute solo episode on what that bill actually says, why a Dutch company in Veldhoven now sits at the centre of American economic statecraft, and why the legislative mechanism reveals something uncomfortable about the security justification it has been wrapped in.

▶ Watch the full episode

🎧 Also available on Apple Podcasts and Spotify.

The companion article — fully sourced, with 23 endnotes — is here:

What this episode covers

- The 150-day clock. What the MATCH Act actually says, who introduced it, and why the bipartisan, bicameral co-sponsorship matters more than the headline.

- The silence that tells you everything. The Semiconductor Industry Association, SEMI, Lam Research, and Applied Materials have not issued a single public statement opposing the bill. That silence is the data point.

- The honest acknowledgement I owe the security argument. China is building a state-subsidised semiconductor industry with explicit military applications. The security concern is real. The MATCH Act is not primarily a security instrument.

- A company in Veldhoven that has no substitute. ASML’s 100 per cent monopoly on EUV lithography, the €32.7 billion 2025 revenue, and the Cymer light source acquisition that gave Washington the key.

- How Washington holds the key. The Foreign Direct Product Rule, the Cymer IP, and the legal doctrine that lets the United States claim jurisdiction over machines it did not build, manufactured in countries where it has no presence.

- The death of consensus. Why the Wassenaar Arrangement — the consensus-based framework that governed allied export controls since the Cold War — has been bypassed without ceremony.

- The silence from Brussels. What the European Commission’s non-response reveals about the structural incapacity of EU governance on extraterritorial coercion.

- What Sarah’s board paper must now say. The recommendation that cannot be softened: a named, quantified, irreducible single-vendor dependency with no current mitigation.

- The MATCH Act prediction. A falsifiable judgement about the European Commission’s response by April 2027 — with the signals that will tell you whether the prediction is on track.

The closing argument. Seven words that hold the whole thesis.

Why this one matters

Parts 1 and 2 of this series were about preconditions Washington cannot control — the chemistry of aluminium, the geology of helium. Part 3 is different. Part 3 is about the precondition Washington is now attempting to weaponise: the equipment, the machines, the single company that makes the tools without which no advanced semiconductor can be fabricated anywhere on earth.

The argument I want to make here — and I want to label it as my analytical position — is that the MATCH Act is not primarily a security instrument. It is a commercial protection instrument dressed in security language. The security rationale is genuine but partial. The commercial rationale — equalising the competitive damage across allied and American vendors — is the structural driver. And the mechanism chosen to deliver both — extraterritorial coercion of sovereign allies — is the part that European policy has not yet reckoned with honestly.

The predictive judgement

Within 12 months — by April 2027 — the European Commission will publish a formal legislative proposal for a Chips Act 2.0 that includes, for the first time, a sovereign equipment supply chain pillar with a dedicated budget line for reducing U.S.-origin IP dependency in European-manufactured semiconductor equipment. The episode walks through the falsification conditions and the four signals to watch.

Read the written analysis

The full written companion piece — with 23 numbered endnotes, the complete reference list, and three Substack Recommends targets Chris Miller, Gregory Allen, Adam Tooze — is published alongside this episode at

If the analytical thread of this series matters to your board paper, your portfolio, or your policy brief — subscribe. Free. One email a week. The next piece is on the data jurisdiction.

The next piece is on the data jurisdiction — the CLOUD Act and the landlord who reads your post.

Subscribe to The Control Layer to get Part 4 of the Four Chokepoints series the morning it drops — one piece a week, free, in the same register. From Amer Altaf, Managing Editor.

The Control Layer publishes weekly. Subscribe free.

Decision-grade analysis on AI, cybersecurity, technology sovereignty, and the geopolitics of the technology stack — written for the board paper, not the timeline. By Amer Altaf, Founder & CEO of Arkava and Managing Editor of The Control Layer.

Subscribe free

Subscribe now

One email a week. No paywalls on the analytical pieces. Unsubscribe in one click.

On the morning of 24 April 2026, a Chinese laboratory most British boardrooms still cannot pronounce correctly released a 1.6-trillion-parameter language model under the MIT licence, posted the technical paper to Hugging Face, and walked off whistling.[1] By the end of the same day, four separate Chinese chipmakers — Huawei Ascend, Cambricon, Hygon Information,

and Moore Threads — announced that DeepSeek V4 was already running, in production, on their hardware.[2] Within seventy-two hours, the independent benchmark roundups had begun to settle, and a picture emerged that was harder to dismiss than the headlines made it sound. On most of the evaluations that matter for enterprise procurement, V4 Pro was at parity with GPT-5.4 and Claude Opus 4.6 — performance that had been considered exceptional, frontier-grade, the bleeding edge of the field, four weeks earlier.[3]

Two sentences. Read them twice.

For roughly a decade, “Day 0 launch support” — the privilege of waking up on the morning a major model drops and finding it already optimised for your silicon — was a courtesy NVIDIA extended to itself. Every other chip vendor on earth queued up behind, hoping to ship a passable inference path within a few months. For roughly a decade, frontier-class performance had also been a privilege. The bleeding edge was where the value lived; everything below the bleeding edge was where one settled, with apologies to the budget. That is the assumption that has just gone, along with the queue.

Jensen Huang reportedly described the demonstration of V4 running on Huawei chips as “a disaster”.[4] The choice of word is interesting. Not a setback. Not a competitive challenge. A disaster. You do not reach for that vocabulary unless something load-bearing has just snapped — and what snapped was, in fact, two things at once.

The first thing to break was the deployment economics of frontier-class inference: NVIDIA’s quiet, durable, decade-long monopoly on launch-day silicon support. The second thing to break, less reported but more consequential for almost every enterprise reading this, was the assumption that the closed-source frontier was the only place to get usable, mature, mid-market-grade artificial intelligence. Because as of 24 April, frontier-class capability — capability the field considered exceptional one month earlier — has come down the pricing curve by roughly an order of magnitude, and it has done so under an MIT licence that lets you fine-tune the weights for your own organisation’s specialist needs. Closed APIs cannot match that. Not by design. Not by any feature roadmap that does not require a fundamental change to the closed-source business model.

This piece is the analytical note for both. What V4 actually is. What it actually does. What silicon it actually runs on. Why the absolute bleeding edge no longer answers most procurement questions. And why the open-weight option, with weights you can fine-tune for the specific shape of your organisation, has just become the default architecture for serious enterprise AI in a way that almost nobody on a procurement committee has yet sat down to think through.

What DeepSeek V4 actually is

Two checkpoints went up on Hugging Face on launch day.[5]

V4 Pro is a 1.6-trillion-parameter mixture-of-experts model with 49 billion active parameters per token. V4 Flash is the lightweight sibling — 284 billion total, 13 billion active. Both ship with a one-million-token context window. Both are released under an MIT licence, which means any organisation with the inference budget can take the weights, modify them, host them on its own infrastructure, fine-tune them on its own data, and deploy them commercially without phoning anyone for permission.

A mixture-of-experts model, for readers who have been reasonably busy with their actual jobs, is a bit like the British civil service in the Yes Minister sense: a vast institution containing many specialised departments, of which only a small number are doing any work on any given question. The genius is not that the institution is small — it is enormous — but that the routing is efficient. You activate the experts you need, leave the rest dormant, and the bill arrives only for the bit that actually answered the question. Nobody outside computer science thought this was an architecture worth getting excited about until DeepSeek made it the only architecture that mattered.

The V4 paper is a sober technical document containing two genuine engineering innovations.[6] The first is the Hybrid Attention Architecture: a combination of Compressed Sparse Attention and Heavily Compressed Attention that, in plain English, allows the model to look at very long documents without melting the GPU. At a one-million-token context, V4 Pro requires only 27 per cent of the per-token inference computation of its predecessor V3.2, and 10 per cent of the key-value cache memory. V4 Flash drops these further still — 10 per cent of the FLOPs and 7 per cent of the cache.[7]

The second is Manifold-Constrained Hyper-Connections, a phrase that does the impossible feat of being even less marketable than its acronym (mHC). What it does is keep the signal stable as it propagates through the deep stack of a 1.6-trillion-parameter network. This matters because most attempts to scale MoE architectures have failed not on capability but on stability — the network either stops learning or starts learning the wrong things, in ways that look fine on the metrics dashboard until they don’t. mHC is, on the evidence so far, a real solution to that problem.[6]

Trained on more than 32 trillion tokens, using a relatively new optimiser called Muon, with mixed-precision training (FP4 for the MoE experts, FP8 for the rest of the parameters). These are the technical details a senior infrastructure engineer would want to see; everyone else can take it on trust that the engineering is serious.[6]

Two frontiers, two stories — and the one that matters for procurement

There are two honest answers to the question “how does V4 Pro compare to the Western frontier?” They are answering different questions, both questions matter, and the one with implications for the line-by-line of an enterprise IT budget is not the one that has dominated the headlines.

The first answer is DeepSeek’s own. The V4 technical paper benchmarks V4-Pro-Max against GPT-5.4, Claude Opus 4.6, and Gemini 3.1 Pro — the frontier models OpenAI, Anthropic, and Google had shipped as of the point V4 was being engineered. Those models, on 23 April 2026, were the absolute bleeding edge of large language modelling. The state of the art. The reason every Chief Information Officer in the City was being walked into the same enterprise pitch about why the closed frontier was the only credible deployment path. On those comparators, the picture V4 draws is striking.[8]

On MMLU-Pro, the standard knowledge-and-reasoning benchmark, V4 Pro scores 87.5 — exactly tied with GPT-5.4 at 87.5 and within touching distance of Opus 4.6. On SWE-bench Verified, the most widely cited software engineering benchmark, V4-Pro-Max scores 80.6, against Opus 4.6 Max at 80.8 and Gemini 3.1 Pro at 80.6 — a three-way tie within a single percentage point. On MCPAtlas Public, the tool-use and agent-coordination evaluation, V4-Pro-Max scores 73.6 to Opus 4.6 Max’s 73.8: again, parity. On LiveCodeBench, V4 Pro reaches 93.5 — ahead of Gemini 3.1 Pro at 91.7 and Claude Opus 4.6 at 88.8. On Codeforces, the live competitive programming rating, V4 Pro registers 3206 against GPT-5.4 at 3168. Ahead of GPT-5.4 on Codeforces. The model the world’s leading AI laboratory shipped, in 2026, as its single most expensive coding asset.

DeepSeek’s one-line summary of where V4-Pro-Max sits, in the paper itself: it “beats GPT-5.2 and Gemini-3.0-Pro on reasoning, trails GPT-5.4 / Gemini-3.1-Pro by approximately three to six months, and on internal agent evaluations surpasses Claude Sonnet 4.5 while approaching Opus 4.5.”[8] Three to six months. That is the manufacturer’s claim, in a paper that any of the labs being compared can refute, and so far none of them have.

The second answer is CAISI’s. The US Center for AI Standards and Innovation, the NIST evaluator that produces the most rigorous independent benchmarks of frontier models, ran V4 Pro on nine held-out and uncontaminated benchmarks — including the ARC-AGI-2 semi-private dataset and the agency’s internal PortBench software-engineering test. CAISI’s framing in May was that V4 “performs similarly to GPT-5, which was released about eight months ago,” and that V4 “is the most capable PRC model to date across the domains we evaluated.”[9]

Both framings are true. They answer two different questions.

Where does V4 sit relative to the absolute bleeding edge today? CAISI’s answer: roughly eight months behind GPT-5.5.

Where did V4 land relative to the frontier it was actually engineered against — the frontier the entire industry called state-of-the-art four weeks before V4 was released?

DeepSeek’s answer, supported by the independent benchmark roundups: at parity with GPT-5.4 and Opus 4.6, ahead on competitive coding, behind only on the hardest agentic and graduate-level reasoning tasks where the latest GPT-5.5 and Opus 4.7 have pulled clear.[10]

The procurement-relevant question is not which model holds today’s marginal lead? It is what level of capability does my workload actually require, and what is the price gap between getting that level from the closed frontier versus getting it from the open-weight option?

If the Premier League framing helps: V4 Pro is sitting where last season’s title-winning side finished — on the same points total, with the same trophy cabinet, in the same tier of the table. The current title-winners (GPT-5.5 and Opus 4.7) have pulled a few points clear at the top of this season’s table. Nobody is suggesting V4 Pro be relegated. The transfer market — every Chief Information Officer with an inference budget — has just acquired a new option who plays at trophy level for a fraction of the wage bill, and who, unlike the rented stars at the top of the table, can be coached into the specific tactical system the manager actually wants to play.

The capability that won last May has, four weeks later, become the affordable mid-tier capability of this June. That is the speed of commoditisation in the open-weight frontier, and it is the part of the V4 launch that has not yet been priced into a single Western enterprise IT roadmap I have seen this quarter.

The training stack you have probably been told wrong about

This is the part where I owe the reader a correction, because the headline most British technology coverage led with — DeepSeek V4 trained entirely on Huawei chips — is not what happened.

DeepSeek’s own disclosure, confirmed by independent reporting from The Register and ChinaTalk, is that the V4 training run used a hybrid stack: NVIDIA H800 GPUs and Huawei Ascend 910C accelerators.[11] The technical paper itself only states, in passing, that the team validated its expert-parallel scheme on both NVIDIA and Ascend platforms. Independent analysis — and the laws of physics governing large-scale pre-training stability — strongly suggests that the main pre-training run, where stability and scale matter most, relied on the mature NVIDIA infrastructure. Huawei silicon was used in the post-training and reinforcement learning stages, where stability is more forgiving and the workload maps more comfortably onto the Ascend architecture.[12]

The model that has been described to British boardrooms as the first frontier model trained fully on Chinese chips is, in fact, the first frontier model whose training run included Chinese chips at all. That is a genuine achievement, but it is a different achievement, and the difference matters when a Chief Information Officer is making a procurement decision about whether the Chinese AI stack is now a credible end-to-end alternative to the American one.

The honest answer, in May 2026, is not yet, and not for training.

The honest answer for inference — for the deployment side, where almost every enterprise dollar is actually spent — is more interesting. Because that is the factor that has actually shifted.

The day the queue dissolved (the first monopoly that died)

When DeepSeek released V4 on 24 April, four Chinese chipmakers had production-ready inference paths live by the end of the same trading day.[2]

Huawei Ascend’s full product line — A2, A3, and the new 950 — supported both V4 Pro and V4 Flash from launch. The Ascend 950 specifically was demonstrated running V4 Pro using fused kernels and multi-stream parallelism, with combined quantisation, at high throughput and low latency. Cambricon completed Day 0 adaptation through the open-source vLLM inference framework. Hygon’s Deep Computing Unit had its own inference pathway live and the supporting code published. Moore Threads, the smallest of the four, hit launch-day compatibility on its own GPU architecture.

Reread that paragraph. Then consider what it would have looked like in 2025: NVIDIA optimisation in the morning, AMD support a few weeks later, Intel hopefully by the end of the quarter, everyone else when they could manage. Day 0 collective adaptation by the entire Chinese domestic chip ecosystem — Huawei Ascend, Cambricon, Hygon, Moore Threads, all live, all production-grade, all on the same morning — has never happened before for any frontier-class model on any non-NVIDIA hardware anywhere on earth.

This is the factor that has changed. It is not that DeepSeek V4 has reached parity with the latest GPT-5.5 (it has not). It is not that Huawei Ascend can train a 1.6-trillion-parameter model from cold (it cannot, yet). It is that the deployment economics of frontier-class inference are no longer NVIDIA-monopolised. There is now a Chinese stack — model, framework, silicon, optimisation, ecosystem — that runs end-to-end without American hardware on the inference side.

For a UK or European board that has spent the last three years writing capital expenditure forecasts predicated on NVIDIA H100 and Blackwell allocations being the unavoidable bottleneck of any sovereign AI deployment, this is not an academic shift. The Ascend 950 supernodes — Huawei’s data-centre-scale clustered configuration — are scheduled for volume shipment in the second half of 2026.[13] If those ship on time and at the prices Huawei is briefing, the entire NVIDIA-or-nothing logic of European cloud procurement, which Part 3 of the Four Chokepoints series argued was the factor Washington was attempting to weaponise via the MATCH Act, has just acquired its first credible alternative.[14]

That alternative comes, of course, with its own jurisdiction problem. A European bank that cannot lawfully run customer data through a US cloud provider under the CLOUD Act is not going to find Huawei a more comfortable jurisdiction. But the procurement question is no longer NVIDIA or unavailable. It is now NVIDIA or Huawei or unavailable — and the introduction of a third option, even a politically uncomfortable one, fundamentally changes the negotiating posture of every conversation a CIO is now having with a US hyperscaler about pricing, terms, and capacity allocation.

Jensen Huang’s “disaster” reaction is, when you put the calendar on it, the rational reaction of a chief executive who has just watched his company’s structural pricing power degrade in a single news cycle. NVIDIA’s commercial position is not collapsing — at the GTC keynote in San Jose on 16 March, Huang himself raised guidance for combined Blackwell and Vera Rubin orders to $1 trillion through 2027, double the $500 billion through-2026 figure he gave at GTC 2025.[15] But the launch-day monopoly has gone, and once a monopoly goes, it does not come back without a structurally different policy intervention. Doubling the order book and losing the launch-day monopoly are not contradictory data points — they are the same data point. NVIDIA’s position is tighter at the top, more contested at the edges, and the edges are where margin compression eventually shows up.

Reading this far?

Subscribe to The Control Layer for one piece a week in this register — AI, cybersecurity, sovereignty, and the geopolitics of the technology stack. Free.

Subscribe now

The inference economics: Aldi has come for the Champagne aisle (the second monopoly that died)

The pricing is the part of the V4 launch that should have triggered an immediate procurement review at every UK and European organisation running enterprise AI workloads at scale.

DeepSeek V4 Flash, the lightweight commercial variant, costs $0.14 per million input tokens and $0.28 per million output tokens. The Pro variant, at full list price, is $1.74 per million input cache-miss tokens and $3.48 per million output tokens; until 5 May 2026, the company is running a 75 per cent introductory discount, putting the effective rate at $0.435 input and $0.87 output.[16] Cache hits — where the application is sending a substantially repeated prompt prefix — drop the effective input cost to $0.03 per million.

Compared with Claude Opus 4.6, V4 Pro is roughly 11.6 times cheaper on input tokens and approximately 28.7 times cheaper on output tokens.[17] Compared with the latest GPT-5.5 ($30 per million output) or Opus 4.7 ($25 per million output), V4 Pro is 8 to 9 times cheaper on output. V4 Flash is somewhere between 90 and 100 times cheaper than the closed-source frontier on the same metric.[18] CAISI’s own assessment confirms that V4 was more cost-efficient than GPT-5.4 mini — OpenAI’s most cost-competitive contemporary model — on five of seven benchmarks tested.[9]

For a long time, the running joke about Chinese open-weight models was that they were the Aldi of foundation AI: cheaper, no-frills, fine for the tea-and-toast portion of the workload but obviously something different from the Waitrose ready meal you would put on the table when the in-laws were visiting. As of 24 April, that joke has stopped working. V4 Pro is on the same shelf, in the same aisle, blind-tasted within a percentage point of the branded option, and the price label still says eleven and a half quid less for the same bottle. Aldi has come for the Champagne aisle, and the Champagne is no longer obviously winning the blind taste test.

The complication is that the frontier premium is, in fact, justified by the small subset of workloads where V4 Pro genuinely lags — Terminal-Bench 2.0 agentic engineering, the hardest GPQA Diamond reasoning, the orchestration scaffolding (OpenAI’s Symphony specification, Anthropic’s Model Context Protocol, AWS Bedrock Managed Agents) that the open-weight ecosystem is still assembling. The frontier premium is real. The question for any organisation running production AI workloads is no longer whether the premium exists, but whether the workload actually requires it.

For the ninety per cent of UK enterprise use cases I have seen quoted in procurement requests this year — document summarisation, customer correspondence drafting, structured data extraction, internal search, code completion on bounded codebases, regulatory compliance review, contract analysis, internal Q&A across institutional knowledge — V4 Flash at $0.14/$0.28, or V4 Pro at $0.435/$0.87, is overwhelmingly the rational choice. Not because it is the bleeding edge. Because it is good enough, on the workload that actually pays the bills, at a price that makes the bleeding edge look like an extravagance an audit committee will eventually ask awkward questions about.

That sentence — good enough, on the workload that actually pays the bills, at a price that makes the bleeding edge look extravagant — is the procurement question that most UK and European boards have not yet asked themselves out loud. The release of DeepSeek V4 is the moment they will have to.

Off-the-rack frontier, or Savile Row tailoring?

There is a structural advantage the open-weight option holds over any closed-source API, and it is the part of the V4 release that most cost-comparison articles have undersold. Capability the field considered exceptional one month ago is now available not just at a fraction of the cost, but as weights you actually own. Weights you can fine-tune.

The closed-source frontier — GPT-5.5, Opus 4.7, Gemini 3.1 Pro — is access to bleeding-edge intelligence through a metered API, sitting in someone else’s data centre, in someone else’s jurisdiction, accessed under terms of service that the provider can revise on thirty days’ notice. It is the off-the-rack suit. The cut is excellent. The cloth is the best on the market this season. And it has been built to fit nobody in particular and almost everybody on average.

For a generic workload — summarise this document, draft a polite reply, extract these data fields — off-the-rack is fine. The cut works. Nobody is going to notice you bought the model in your inbox rather than commissioned it.

For a specialist workload, off-the-rack stops being fine. A barrister’s chambers needs a model that has actually read the case law in their practice area, with their preferred citation conventions, on the conventions of English legal drafting rather than American. A diagnostic imaging startup needs a model fine-tuned on the specific modality and pathology classes the radiologists actually report. A defence contractor working on classified material needs a model whose fine-tuning data never crosses a jurisdictional boundary that an export control lawyer will subsequently regret. A mid-market manufacturing business with thirty years of operational documentation needs a model that has read its own thirty years of operational documentation, not the average of every CNC manual on the open web.

These are Savile Row workloads. They need bespoke. They need a tailor who has measured the specific shoulders.

The closed APIs offer fine-tuning, to varying and grudging degrees. None of them offer it in a way that gives the customer ownership of the tailored garment. Your fine-tuning data goes to OpenAI’s servers. The fine-tuned model that emerges still lives on OpenAI’s infrastructure, billable per token, accessible only through the same metered API. The base model can change underneath you with thirty days’ notice, and your fine-tuned variant inherits whatever the underlying provider decides next quarter. You have rented a tailored suit from a rental shop. You did not commission it.

V4 Pro under the MIT licence is a different proposition. The weights are yours. You fine-tune on your own infrastructure, on your own data, against your own evaluation set, and the resulting model is a thing you own that does not change unless you change it. The classified material does not leave your jurisdiction. The base model does not get deprecated by a vendor’s product roadmap. The audit trail of what was the model trained on, on what date, and who has access to the weights is internal to the organisation and reviewable by your own compliance function.

That is a structural advantage no closed API can match, because the closed-source business model depends on the weights staying on the provider’s side of the API boundary. The choice is not between high-quality model with fine-tuning and low-quality model without. It is between bleeding-edge model rented through an API where the tailoring is also rented, and near-frontier model owned outright, where the tailoring is owned and reviewable too.

For any specialist enterprise workload — legal, medical, financial regulatory, defence, scientific research, regulated mid-market — the second option has just become the rational default. The first option survives only for the workloads where the marginal capability gap between V4 Pro and Opus 4.7 demonstrably matters more than the ability to tailor to your specific organisational shape. That is a smaller set of workloads than the procurement function has been told.

The procurement memo nobody has yet written

The honest version of the procurement question, for a UK Chief Information Officer reading this in May 2026, runs something like this.

For workloads that do not require the absolute bleeding edge — and that is most workloads — the rational architecture is now a tiered one: open-weight inference (V4 Flash, V4 Pro, or successors) on commodity infrastructure for the bulk of throughput, with selective routing to the closed-source frontier for the small subset of queries that demonstrably benefit from the additional capability. Anyone telling you the workload is all frontier-grade is either selling you the frontier or has not done the workload analysis.

For specialist workloads — and most enterprise AI is specialist once you look closely — the rational architecture is no longer call the closed frontier and live with the off-the-rack fit. It is take an open-weight model at near-frontier capability, fine-tune it on your own data, and deploy it on infrastructure you control. V4 Pro under the MIT licence has just made that approach not only technically viable but commercially compelling. The fine-tuning advantage is the part of the V4 release that the inference-cost story has overshadowed, and it is the part that compounds.

For sovereign deployment specifically, V4 Pro under the MIT licence can be self-hosted on infrastructure under the operator’s own jurisdiction. This does not solve every sovereignty problem — the model was trained partly on the Chinese chip stack, the underlying training data is opaque, and the geopolitical question of using a Chinese-origin model in regulated UK sectors is its own conversation — but it does fundamentally change the architecture of the discussion. Self-hosted, fine-tuned, frontier-class inference, on UK infrastructure, with weights you control and an inference path that does not depend on a US hyperscaler’s API rate limit, is now technically and commercially viable in a way it was not in 2025.

For the agentic workloads where V4 Pro genuinely lags — autonomous multi-step engineering tasks, complex tool-use orchestration, anything where Terminal-Bench 2.0 is a relevant proxy*** — the closed-source frontier is still the rational choice, and the frontier premium still has to be paid. But the addressable market for that premium has just contracted by, on a back-of-envelope calculation, somewhere between sixty and eighty per cent of total enterprise AI spend.

That contraction is the precise reason Western hyperscaler share prices wobbled in late April even as the four largest US hyperscalers — Amazon at approximately $200 billion, Microsoft at $190 billion, Alphabet at $180–$190 billion, and Meta at $125–$145 billion — pushed combined 2026 infrastructure capital expenditure to a record total in the region of $700 billion to $725 billion.[19] The investor question that broke through the earnings calls was not will the capacity be built? It was will the revenue per token sustain the build at the pace announced? DeepSeek V4 is the data point that turned that question from theoretical to immediate.

The prediction, made to be falsified

Within twelve months — by May 2027 — at least two of the three leading Western frontier API providers (OpenAI, Anthropic, Google) will publish per-million-token output prices at least 50 per cent below their May 2026 levels, with at least one earnings call explicitly citing open-weight competition as a contributing factor.

The signals to watch: pricing-page revisions on openai.com, anthropic.com, and ai.google.dev. Volume-tier renegotiations leaked to The Information or Bloomberg.

Quarterly earnings call commentary referencing “competitive pressure on inference economics” or similar language. The most precise leading indicator will be in the Microsoft Azure OpenAI Service pricing schedule, where reductions in the underlying API rate flow through to enterprise contract renewals on a roughly two-quarter lag.

The prediction is falsifiable. If by May 2027 the listed per-million-token output rates for GPT-5.5, Claude Opus 4.7, and Gemini 3.1 Pro have not fallen by at least 50 per cent from May 2026 baseline on any of the three platforms, the prediction is wrong. Quiet enterprise discounts that do not appear in published rate cards do not satisfy the prediction; volume tier rebates do not satisfy the prediction; the price drop must appear in the public list price.

If it does, the inference-economics moat will have been visibly eroded by open-weight competition within a single year of V4’s release. If it does not, the closed-source frontier will have proved more economically defensible than this analysis implies, and I will publish the correction.

The publication that calls its predictions in writing.

Every Control Layer piece ends with a falsifiable prediction and a list of signals to watch. Subscribe to track them. One email a week. Free.

Subscribe free

Subscribe now

The bottom line

Three things need to be on the procurement agenda this fortnight, and all of them are uncomfortable.

The first is the rate card audit. Every UK and European organisation currently paying for frontier API inference at GPT-5.5 or Opus 4.7 list prices needs to know which of those workloads are genuinely frontier-grade and which are paying the frontier premium for the comfort of the frontier brand. Most procurement functions cannot answer this question today because they have never had to. They will have to now.

The second is the chip stack audit. Anyone whose sovereign AI strategy is currently predicated on NVIDIA being the only viable frontier-class inference silicon needs to spend the next quarter understanding what changes, in their architecture and in their commercial leverage, if Huawei Ascend 950 supernodes ship on time and at the prices Huawei is briefing. The answer may be nothing changes for us, because of the China jurisdiction problem. That is a defensible answer. It is not a defensible answer to not have considered the question.

The third is the architecture audit. The release of V4 Pro under the MIT licence, with the option to fine-tune on your organisation’s own data, on infrastructure your organisation controls, is the moment self-hosted, specialist-tuned, near-frontier inference became a genuine architectural option for serious enterprise deployments. The decision to use it or not use it is not a technology decision. It is a sovereignty, jurisdiction, fine-tuning, and risk-tolerance decision, and it now has to be taken consciously rather than defaulted on.

DeepSeek V4 is not the Sputnik moment its champions claim. It is not the catch-up moment its detractors will dismiss it as next month. It is something more useful and less dramatic than either. It is the specific date — 24 April 2026 — on which two assumptions underpinning Western enterprise AI strategy stopped being true at the same time.

The first assumption was that NVIDIA’s launch-day grip on frontier-class deployment silicon was a fact of nature. It was not. It was a commercial position, and the commercial position has just been contested.

The second assumption was that the closed-source frontier was the only credible deployment path for serious enterprise AI, and that the bleeding edge was where the value lived. It was not. The capability the field considered state-of-the-art four weeks before V4 launched is now available at a fraction of the cost, with weights you can fine-tune for the specific shape of your own organisation, on infrastructure you control. The bleeding edge has its place. Most workloads do not require it. Most workloads require good enough, tailored to the specific job, deployed where you can audit it.

You cannot build a sovereign AI strategy on a single supplier’s silicon. That has, quietly, this fortnight, become an operational fact rather than an aspiration.

You cannot build a serious enterprise AI strategy on the assumption that the bleeding edge is the answer to most of your questions, either. Most of your questions are bespoke. Most bespoke questions deserve a tailored answer. And tailoring, this fortnight, became an open-weight conversation.

The next piece is on the open-weight fine-tuning question UK regulators have not yet asked.

Subscribe to The Control Layer to get the analytical thread continued — one piece a week, free, in the same register. From Amer Altaf, Managing Editor.

Subscribe free

Subscribe now

Amer Altaf is Founder and CEO of Arkava,

a UK and European sovereign AI agentic automation business, and Managing Editor of The Control Layer, the publication where he tracks the convergence of cyber security, technology sovereignty, and geopolitics. A techUK member, he contributes to industry engagement on UK technology sovereignty policy. He is currently writing on cloud security for Oxford University Press’s Expert Essentials series.

TheControlLayer.arkava.ai

References

[1]: DeepSeek AI. DeepSeek V4 Preview Release. DeepSeek API Documentation, 24 April 2026. Technical paper: DeepSeek V4: Towards Highly Efficient Million-Token Context Intelligence, posted to Hugging Face on the same date.

[2]: TrendForce. “Huawei Ascend, Cambricon and Hygon Completed Day 0 Adaptation to DeepSeek-V4.” 29 April 2026. Corroborated by Digital Quotient India, “Huawei Ascend, Cambricon, and Hygon complete Day 0 adaptation to DeepSeek-V4,” and Cryptopolitan, “DeepSeek adds vision as China’s chip supply chain shows it can finally keep pace,” April 2026.

[3]: Performance framing per the DeepSeek V4 technical paper and independent benchmark roundups. The DeepSeek paper benchmarks V4-Pro-Max against GPT-5.4, Claude Opus 4.6, and Gemini 3.1 Pro and characterises the position as “trailing GPT-5.4 / Gemini-3.1-Pro by approximately three to six months.” See [8] for benchmark detail and [9] for the CAISI evaluation against the more recent GPT-5.5 frontier.

[4]: Reported by 36Kr (EU edition), “Jensen Huang Labels It a ‘Disaster’: DeepSeek Runs Successfully on Huawei Chips,” April 2026. Quote attribution should be treated as second-hand reporting; no direct NVIDIA press confirmation has been issued at time of writing.

[5]: Hugging Face. deepseek-ai/DeepSeek-V4-Pro model card, and deepseek-ai/DeepSeek-V4-Flash model card, . Both released 24 April 2026 under MIT licence. Hugging Face technical blog: “DeepSeek-V4: a million-token context that agents can actually use,” .

[6]: DeepSeek AI. DeepSeek V4 Technical Report (PDF), released 24 April 2026 via Hugging Face. Architecture details: Hybrid Attention (Compressed Sparse Attention + Heavily Compressed Attention), Manifold-Constrained Hyper-Connections, Muon optimiser, mixed precision (FP4 for MoE experts, FP8 for remaining parameters), pre-trained on more than 32 trillion tokens.

[7]: DeepSeek V4 Technical Report (above) and Hugging Face technical blog. At one-million-token context, V4 Pro requires 27 per cent of single-token inference FLOPs and 10 per cent of KV cache memory compared with V3.2. V4 Flash requires 10 per cent of FLOPs and 7 per cent of KV cache.

[8]: Benchmark figures from the DeepSeek V4 technical paper and corroborated by independent comparison reporting. MMLU-Pro: V4-Pro 87.5, GPT-5.4 87.5. SWE-bench Verified: V4-Pro-Max 80.6, Opus 4.6 Max 80.8, Gemini 3.1 Pro 80.6. MCPAtlas Public: V4-Pro-Max 73.6, Opus 4.6 Max 73.8. LiveCodeBench: V4-Pro 93.5, Gemini 3.1 Pro 91.7, Opus 4.6 88.8. Codeforces rating: V4-Pro 3206, GPT-5.4 3168. Terminal-Bench 2.0: V4-Pro-Max 67.9, Gemini 3.1 Pro 68.5, GPT-5.4 xHigh 75.1. Sources: Hugging Face technical report summary at https://huggingface.co/deepseek-ai/DeepSeek-V4-Pro/discussions/129; OfficeChai, “DeepSeek Releases V4-Pro & V4-Flash, Delivers GPT 5.4 & Opus 4.6-Level Performance At Fraction Of The Price,”; NxCode, “DeepSeek V4 vs Claude Opus 4.6 vs GPT-5.4: AI Coding Model Comparison,”; Verdent, “DeepSeek V4 vs Claude Opus 4.6 vs GPT-5.5 for Agentic Coding,” ; Funda AI, “DeepSeek V4 vs Claude vs GPT-5.4: A 38-Task Benchmark,” ; Simon Willison, “DeepSeek V4 — almost on the frontier, a fraction of the price,”.

[9]: U.S. National Institute of Standards and Technology, Center for AI Standards and Innovation (CAISI). “CAISI Evaluation of DeepSeek V4 Pro.” May 2026. CAISI’s evaluation included nine benchmarks across cyber, software engineering, natural sciences, abstract reasoning, and mathematics, including two held-out and uncontaminated benchmarks: ARC-AGI-2 (semi-private dataset) and CAISI’s internal PortBench software-engineering evaluation. CAISI’s framing: V4 “performs similarly to GPT-5, which was released about eight months ago” and is “the most capable PRC model to date across the domains we evaluated.”

[10]: Galaxy.ai composite-score comparison, “Claude Opus 4.6 vs DeepSeek V4 Pro,” . Composite weighted-average benchmark scores: Claude Opus 4.7 8.72, Claude Opus 4.6 (Thinking) 8.72, DeepSeek V4 Pro 8.27, Claude Opus 4.6 (standard) 8.17. V4 Pro sits between standard Opus 4.6 and Opus 4.6 with extended-thinking mode enabled.

[11]: The Register. “DeepSeek’s new models offer big inference cost savings,” 24 April 2026. . ChinaTalk Media. “DeepSeek V4”. Both report DeepSeek’s disclosure that V4 training used both NVIDIA H800 GPUs and Huawei Ascend 910C accelerators.

[12]: AIproem. “Part 2: What DeepSeek V4 means for Huawei and Nvidia.”. The China Academy. “Why DeepSeek V4 Hasn’t Fully Cut Ties with Nvidia.”. The DeepSeek V4 paper itself states only that the team “validated its fine-grained EP scheme on both NVIDIA GPUs and Ascend NPU platforms.”

[13]: Fortune. “DeepSeek unveils V4 model, with rock-bottom prices and close integration with Huawei’s chips.” 24 April 2026. DeepSeek pricing guidance suggests V4-Pro inference costs are scheduled to fall further once Ascend 950 supernodes reach volume shipment in the second half of 2026.

[14]: Altaf, Amer. “The equipment chokehold: ASML, the MATCH Act, and the end of the allied exemption.” The Control Layer, 28 April 2026. Part 3 of the Four Chokepoints series.

[15]: CNBC. “Nvidia GTC 2026: CEO Jensen Huang sees $1 trillion in orders for Blackwell and Vera Rubin through ‘27.” 16 March 2026. TechCrunch. “Jensen Huang just put Nvidia’s Blackwell and Vera Rubin sales projections into the $1 trillion stratosphere.” 16 March 2026. Data Center Knowledge. “GTC 2026: Nvidia Unveils Vera Rubin AI Platform, Eyes $1T by 2027.” The $1 trillion through-2027 figure represents a doubling of the $500 billion through-end-of-2026 guidance issued at GTC 2025.

[16]: DeepSeek AI. Models & Pricing (USD pricing schedule). V4 Flash: $0.14 per million input tokens, $0.28 per million output. V4 Pro list price: $1.74 per million cache-miss input, $3.48 per million output. Discount of 75 per cent on V4 Pro running until 5 May 2026, putting effective rates at $0.435 / $0.87. Cache-hit input: $0.03 per million.

[17]: Galaxy.ai cost-comparison data, “Claude Opus 4.6 vs DeepSeek V4 Pro,”. Anthropic Claude Opus 4.6 list pricing implies V4 Pro is approximately 11.6× cheaper on input tokens and approximately 28.7× cheaper on output tokens at full V4 Pro list price.

[18]: VentureBeat. “DeepSeek-V4 arrives with near state-of-the-art intelligence at 1/6th the cost of Opus 4.7, GPT-5.5.” April 2026. Output token comparison: GPT-5.5 listed at approximately $30 per million output tokens; Claude Opus 4.7 at approximately $25 per million output tokens. V4 Pro at $3.48 per million output is approximately 8–9× cheaper than the latest closed frontier; V4 Flash at $0.28 per million output is approximately 90–100× cheaper.

[19]: Hyperscaler 2026 capital expenditure figures aggregated from Q1 2026 earnings disclosures: Microsoft Corporation, Q3 FY2026 earnings call, 29 April 2026, raising calendar-2026 capex guidance to approximately $190 billion (CNBC, “Microsoft calls for $190 billion in 2026 capital spending on soaring memory prices,” ); Alphabet Inc., Q1 2026 earnings, 29 April 2026, raising full-year 2026 capex guidance to $180–$190 billion from $175–$185 billion (CNBC, “Alphabet (GOOGL) Q1 2026 earnings,” ); Meta Platforms Inc., Q1 2026 earnings, 29 April 2026, raising 2026 capex guidance to $125–$145 billion (CNBC, “Meta Q1 2026 earnings report,”); Amazon.com Inc., Q1 2026 earnings, 29 April 2026, with CEO Andy Jassy committing approximately $200 billion in calendar-2026 capital expenditure (CNBC, “Amazon (AMZN) Q1 earnings report 2026,”). Combined Big Four total reported by Tom’s Hardware as a record $725 billion ; OfficeChai cites $715 billion.

The Control Layer publishes weekly. Subscribe free.

Decision-grade analysis on AI, cybersecurity, technology sovereignty, and the geopolitics of the technology stack — written for the board paper, not the timeline. By Amer Altaf, Founder & CEO of Arkava and Managing Editor of The Control Layer.

Subscribe free

Subscribe now

One email a week. No paywalls on the analytical pieces. Unsubscribe in one click.

On 22 April 2026, the House Foreign Affairs Committee advanced by a substantial bipartisan margin a bill that gives the Netherlands 150 days to match American export controls on semiconductor equipment — or lose access to the American intellectual property inside every lithography machine ASML has ever built.[1]

The bill is the Multilateral Alignment of Technology Controls on Hardware Act. The MATCH Act. H.R. 8170, 119th Congress, introduced on 2 April by Representative Michael Baumgartner of Washington State, with a Senate companion — S. 4281 — sponsored by Senators Pete Ricketts and Andy Kim and co-sponsored by Senate Majority Leader Chuck Schumer and the Chairman of the Senate Foreign Relations Committee, Jim Risch.[2] Bipartisan. Bicameral. Committee leadership on both sides of the aisle. This is not a messaging bill sitting on a shelf. This is the formal codification of a structural shift in how Washington treats its allies.

In Part 1 of this series, I described the Hormuz blockade as the moment the post-war bargain inverted — the moment the arrangement that once underwrote European security began pricing European prosperity instead. In Part 2, I argued that you cannot procure sovereignty on imported metal — that the aluminium and helium chokepoints exposed a physical substrate that European digital sovereignty has never costed. Part 3 is different. Parts 1 and 2 were about preconditions Washington cannot control — the chemistry of aluminium, the geology of helium. Part 3 is about the precondition Washington is now attempting to weaponise. The equipment. The machines. The single company in Veldhoven that makes the tools without which no advanced semiconductor can be fabricated anywhere on earth.

The argument I want to make in this piece has two halves.

The first is structural: the allied exemption — the diplomatic consensus that allowed European technology companies to trade with relative autonomy inside a multilateral framework — is formally dead.

The second is political: the instrument Washington has chosen to kill it reveals something uncomfortable about the stated justification for the entire technology embargo. And the two halves connect in the board paper Sarah is writing this week, because the practical consequence for every UK and European organisation is the same: the technology supply chain your procurement function relies on now runs through a jurisdiction you do not control, under rules you did not set, on a timeline you cannot negotiate.

What the MATCH Act actually says

The legislation is precise, and the precision is the point. The MATCH Act establishes a country-wide prohibition on the sale and servicing of what it calls “chokepoint” semiconductor manufacturing equipment to fabrication plants inside China.[1] The covered facilities are named: ChangXin Memory Technologies, Hua Hong, Huawei, Semiconductor Manufacturing International Corporation, Yangtze Memory Technologies Corporation, and all their subsidiaries and affiliates. The prohibited equipment categories include deep ultraviolet immersion lithography and cryogenic etch tools — the two classes of machine that China cannot manufacture domestically and without which advanced-node chip production is physically impossible.

For allied vendors, the mechanism is the 150-day compliance clock. The Netherlands and Japan must align their domestic export restrictions with American rules within 150 days of enactment. In operational terms, “matching” means that allied vendors must cease selling restricted hardware to Chinese fabs and — this is the part that boards need to read twice — halt all technical support, software updates, and maintenance servicing for machines already installed in China.

The consequences at day 151 are not ambiguous. If an allied government cannot demonstrate satisfactory alignment within the window, the Act directs the Department of Commerce to expand U.S. jurisdiction over foreign-produced items containing U.S.-origin software, technology, or components via the Foreign Direct Product Rule.[1] For ASML, that means losing access to the American intellectual property embedded in every machine the company manufactures. Not a tariff. Not a fine. The functional equivalent of a kill switch on the company’s global manufacturing capability.

The silence that tells you everything

Before I go further, I want to name a data point that did not appear in any headline and is, in my analytical judgement, the most important signal in the entire MATCH Act debate.

The Semiconductor Industry Association has not issued a public statement opposing the MATCH Act. Neither has SEMI. Neither has Lam Research. Neither has Applied Materials.[3]

That silence is not diplomatic restraint. It is strategic self-interest. American equipment manufacturers — Lam Research, Applied Materials, KLA — are already barred from selling advanced semiconductor equipment to China under existing Bureau of Industry and Security restrictions. Lam reported that China accounted for more than a third of its Q1 fiscal 2026 revenue, but expects that share to fall below 30 per cent as domestic restrictions tighten.[4] Applied Materials paid a historic $252 million BIS penalty for routing restricted ion implanters to a Chinese entity through a South Korean subsidiary.[5] These companies have already absorbed the commercial damage of the embargo. What they have watched, with increasing frustration, is their European and Japanese competitors continuing to sell into the market they were forced to leave.

The MATCH Act does not restrict American companies. It coerces allied companies into sharing the financial burden of a policy that American companies have already been made to bear. From Lam Research’s perspective, the MATCH Act is not an export control — it is a competitive equaliser. And that is why the American semiconductor industry has not lobbied against it.

The strategic implication is total. There is no cross-Atlantic corporate solidarity on this issue. ASML is alone. The industry association that might have argued against overreach has concluded that the overreach serves its commercial interests. European boards looking for American allies in this fight will not find them.

The honest acknowledgement I owe the security argument

I want to be fair to Washington, because the security argument is not fabricated.

China is building a state-subsidised semiconductor industry with explicit military applications. SMIC has demonstrated the ability to produce 7-nanometre chips using older DUV lithography — a technical achievement that Western intelligence assessments did not expect for several more years.[6] The People’s Liberation Army’s modernisation programme depends on access to advanced computing hardware. The dual-use nature of semiconductor technology means that every advanced chip sold to a Chinese entity is, in a non-trivial sense, a chip that might end up in a weapons system. The security concern is real. The people who drafted the MATCH Act are not stupid, and they are not acting in bad faith on the security question.

But.

The MATCH Act reveals two things about the American position that the security justification does not cover.

The first is the implicit moral claim. The legislation operates on the assumption that American military use of advanced semiconductors is legitimate while Chinese military use is not — and that allied vendors must accept this distinction as the organising principle of their commercial freedom. Whether or not you agree with that distinction — and there are reasonable arguments on both sides of it — the MATCH Act does not ask allied governments to agree. It tells them. Within 150 days. Under penalty of having their most valuable corporate assets functionally disabled. The moral asymmetry may be defensible; the coercive mechanism is not a moral argument. It is a power instrument.

The second is the free market contradiction. The United States has spent the better part of three decades arguing — to Europe, to the World Trade Organisation, to every emerging economy it has negotiated with — that open markets, free trade, and the uninhibited movement of technology are the conditions under which prosperity is maximised. The MATCH Act is the formal legislative admission that Washington no longer believes this. The bill does not restrict trade with an adversary for security reasons while preserving free trade everywhere else. It restricts the free trade of allied companies in allied countries, in markets where those companies have operated lawfully, using technology they developed with their own capital, on a timeline set unilaterally by a government that has no jurisdiction over them except through the supply chain dependencies it is now exploiting.

The argument I want to make here — and I want to label it as my analytical position — is that the MATCH Act is not primarily a security instrument. It is a commercial protection instrument dressed in security language. The security rationale is genuine but partial. The commercial rationale — equalising the competitive damage across allied and American vendors — is the structural driver. And the mechanism chosen to deliver both — extraterritorial coercion of sovereign allies — is the part that European policy has not yet reckoned with honestly.

A company in Veldhoven that has no substitute

The reason the MATCH Act is pointed at the Netherlands before anywhere else is a single company. ASML. Headquartered in Veldhoven, population 45,000, in the province of North Brabant.

ASML holds a 100 per cent monopoly on extreme ultraviolet lithography — the process required to manufacture every advanced logic and memory chip currently in production. Beyond EUV, the company holds approximately 90 per cent of the broader global lithography market, including the older DUV systems that are the specific target of the MATCH Act’s restrictions.[7] In 2025, ASML shipped 535 systems — 48 EUV and 279 DUV — generating record net sales of €32.7 billion, a gross margin of 52.8 per cent, and net income of €9.6 billion.[8]

The numbers matter because they communicate something no adjective can: there is no second source. There is no alternative supplier. There is no European competitor, no Japanese competitor, no Chinese competitor capable of producing EUV lithography at any price on any timeline currently visible. When I argue, later in this piece, that Sarah’s board paper cannot recommend dual-sourcing for the most critical semiconductor equipment, this is why. The equipment layer has a monopoly at its centre, and the MATCH Act converts that monopoly into an instrument of American foreign policy.

China was ASML’s largest single geographic market in 2025, accounting for 33 per cent of total annual revenue, driven by Chinese fabs pulling forward DUV orders ahead of anticipated restrictions.[8] By Q1 2026, China’s share had dropped to 19 per cent as the orders dried up, with South Korea surging to 45 per cent as allied fabs absorbed capacity.[9] ASML projects China will stabilise at approximately 20 per cent of revenue from here, almost entirely from older DUV systems and the installed base management business — the servicing and maintenance contracts that generated €2.5 billion in Q1 2026 alone.

The MATCH Act explicitly targets that remaining baseline. By prohibiting not just the sale of new equipment but the servicing of machines already installed in Chinese fabs, the legislation threatens to drive ASML’s China revenue toward zero. The installed base business is high-margin, recurring, and durable. Its loss would compress ASML’s profitability materially — which is why the company’s gross margin guidance for Q2 2026 has already narrowed to 51–52 per cent under export control uncertainty.[9]

How Washington holds the key: Cymer and the FDPR

ASML is a European company. Its optics come from Carl Zeiss SMT in Germany — Zeiss supplies the hyper-precise lithography optics for EUV systems, with 80 per cent of all microchips produced worldwide running through Zeiss optics via ASML hardware.[10] ASML holds a 24.9 per cent ownership stake in Zeiss SMT, formalised in a strategic partnership dating to 1997. The mechanical and stage systems are European. The company’s 1,600 suppliers in the Netherlands and 700 across the rest of EMEA represent the largest geographic concentration in its supply chain.[8]

None of this European heritage offers any protection against the MATCH Act, because of one acquisition and one legal doctrine.

The acquisition is Cymer. Based in San Diego, Cymer provides the light source technology for ASML’s EUV systems — the laser-produced plasma source without which the physics of extreme ultraviolet lithography do not function.[^11] ASML acquired Cymer, making the American intellectual property integral to every EUV machine the company builds. The light source is not a component that can be substituted or sourced elsewhere. It is the enabling technology. Without Cymer’s IP, the optics from Zeiss have nothing to focus, and the most advanced lithography system on earth becomes an extraordinarily expensive piece of inert precision engineering.

The legal doctrine is the Foreign Direct Product Rule. The FDPR allows the United States to claim jurisdiction over items produced entirely outside the U.S. if those items are the direct product of U.S.-origin technology or software.[12] Under the December 2024 expansion of export controls, BIS broadened the rule to cover foreign-produced semiconductor manufacturing equipment containing “any amount of U.S.-origin integrated circuits” — and, more profoundly, declared that any integrated circuit manufactured anywhere in the world using U.S. machines is legally classified as U.S.-origin.[13] The practical reach of this doctrine is nearly total. Washington does not need to deploy a naval blockade or impose tariffs. It needs only to threaten the revocation of licences that permit ASML to use Cymer’s technology. The coercive surface area extends through Cymer into Zeiss, into the German industrial base, and into the entire European semiconductor equipment supply chain.

ASML’s 2025 Annual Report discloses 5,100 total suppliers globally, of which 1,350 are in North America.[8] That is 26 per cent of the company’s supplier base sitting inside U.S. jurisdiction. The tethering is physical, legal, and structural.

The death of consensus: from Wassenaar to the 150-day clock

Since the end of the Cold War, export controls among allied nations have been coordinated through the Wassenaar Arrangement — a consensus-based regime in which member states collaboratively identify dual-use goods and technologies requiring restriction, with each government retaining sovereign authority over its own trade policy and enforcement.[14] The model is deliberative, slow, and respectful of national sovereignty. It is also, from Washington’s perspective, structurally incapable of keeping pace with the speed at which China’s state-subsidised semiconductor industry is closing capability gaps.

The MATCH Act bypasses Wassenaar. It replaces multilateral consensus with a unilateral deadline. The 150-day clock does not ask the Netherlands to join a new regulatory regime. It tells the Netherlands to adopt American domestic policy within five months, or face the dismantling of ASML’s manufacturing capability via the FDPR. Altering national trade law in the Netherlands requires parliamentary process, regulatory consultation, and compliance infrastructure — none of which can be artificially compressed by a foreign legislature’s timetable.

There is no modern precedent for this. The closest analogy is the 1987 Toshiba-COCOM incident, in which Congress sanctioned Toshiba Machine Company for selling restricted submarine-milling equipment to the Soviet Union.[15] But that was a punitive, reactive measure against a specific corporate entity for violating an existing, jointly agreed set of rules. The MATCH Act is structurally different. It is a proactive mandate directed at allied sovereign governments, demanding the adoption of American policy within a fixed deadline, under threat of consequences that the allied government’s own legal framework has no mechanism to counter.

A correction I owe the series

In Part 1, I cited a 19 per cent reduction in Bureau of Industry and Security headcount and an average export licence processing time for allied nations of 76 days, double the 2023 baseline. I owe the reader a correction. The 19 per cent figure is wrong. Congress actually increased the BIS budget by 23 per cent — approximately $44 million — for 2026, earmarking the funds for additional enforcement personnel to police semiconductor controls.[16] The “76” is not days but a percentage: a CSIS survey found that 76 per cent of technology exporters reported that more than $10 million in exports were delayed by pending BIS reviews.[17]

The correction matters because the underlying reality is worse than the numbers I originally cited. The official BIS average processing time is 38 days.[18] But the CSIS survey — the most comprehensive independent assessment of export licence friction — found that 56 per cent of respondents reported average review times exceeding 180 days, and 33 per cent reported waiting over 300 days.[17] More than half of surveyed exporters reported losing business or contracts to foreign competitors not subject to U.S. regulatory jurisdiction. The bottleneck is not a staffing problem. It is a cultural transformation: BIS has shifted from trade facilitation to enforcement policing, with 200 new Export Enforcement Special Agents funded by the 2026 budget increase, and Under Secretary Jeffrey Kessler facing congressional accusations of being too lenient on licence approvals.[16]

The practical consequence for a UK or European company in the ASML supply chain is that even full compliance with the MATCH Act’s requirements does not guarantee frictionless access to U.S.-origin technology. The 150-day clock is the legislative mechanism. The 180-to-300-day licence queue is the administrative reality. Both operate on your business simultaneously.

The silence from Brussels

On 14 April 2026, Dutch Prime Minister Rob Jetten visited the White House and pushed back against the proposed U.S. export limits on ASML. The talks involved open disagreement, with both sides recognising each other’s positions without reaching consensus.[19]

From the European Commission: nothing.

No formal condemnation. No threat of countermeasures. No legislative proposal for a European regulatory shield. No organised diplomatic response to a piece of American legislation that explicitly threatens to dictate the operational parameters of Europe’s most valuable technology company under penalty of sanctions that would functionally disable its manufacturing capability.[20]

This silence is not caution. It is structural paralysis. The European Union maintains a single economic market, but member states retain sovereign authority over national security and export control policy. Brussels lacks the centralised regulatory power to enact a unified defence of ASML — or of any European technology company caught in the FDPR’s extraterritorial reach. Washington understands this architecture intimately and has optimised the MATCH Act to exploit it, applying bilateral pressure to the Hague while bypassing the Commission entirely.

The Commission’s silence should not be read as acquiescence. It should be read as incapacity. And that incapacity — the gap between the EU’s economic integration and its geopolitical fragmentation — is the structural vulnerability that Part 4 of this series, on the CLOUD Act and data jurisdiction, will examine in detail. The equipment chokehold and the data jurisdiction are the same problem expressed in different materials: American extraterritorial reach operating on European commercial activity through supply chain dependencies that European governance structures are not configured to counter.

What Sarah’s board paper must now say

In Parts 1 and 2, I gave Sarah — the senior risk director writing a quarterly paper for the Audit and Risk Committee — specific amendments to her vendor concentration matrix, her capital expenditure forecast, and her political risk register. Part 3 adds a harder recommendation. Harder because it is honest about what it cannot solve.

Sarah must audit which of her organisation’s technology vendors depend on supply chains that run through U.S. export control jurisdiction. Not just direct vendors — the tier-two and tier-three dependencies. Any vendor whose equipment, software, or infrastructure contains U.S.-origin intellectual property captured by the FDPR is exposed to the MATCH Act’s enforcement mechanism, whether or not that vendor is American.

For most of the technology stack, Sarah can recommend dual-sourcing. Etch equipment, deposition tools, metrology systems — alternatives exist, even if they are imperfect. Tokyo Electron in Japan holds 87 per cent of the track equipment market and 13.4 per cent of the broader equipment market; its China revenue has already declined from 40.3 per cent to 31.8 per cent under METI’s own export control tightening.[21] Dual-sourcing across ASML and TEL for some process steps is technically feasible if commercially expensive.

For EUV lithography, Sarah cannot dual-source. There is no second supplier. There is no European alternative, no Japanese alternative, no alternative of any kind at any price on any timeline shorter than a decade. The EU’s €700 million investment in the NanoIC semiconductor pilot line at imec in Leuven is a research programme, not a manufacturing alternative.[22] Carl Zeiss SMT supplies optics, not complete lithography systems — and Zeiss itself is tethered to ASML’s architecture and, through ASML, to Cymer’s American IP.

Sarah’s board paper must therefore contain a line it has never contained before: a named, quantified, irreducible single-vendor dependency with no current mitigation. For the EUV layer, the risk is accepted or the capability is forgone. The board must know this, in those terms, before the MATCH Act’s 150-day clock begins to run.

The MATCH Act prediction

Within 12 months — by April 2027 — the European Commission will publish a formal legislative proposal for a Chips Act 2.0 that includes, for the first time, a sovereign equipment supply chain pillar with a dedicated budget line for reducing U.S.-origin IP dependency in European-manufactured semiconductor equipment.[23]

The signals to watch: Commission Staff Working Documents referencing “equipment sovereignty” or “supply chain de-risking” in the semiconductor equipment layer. Internal Market Commissioner statements on ASML’s strategic classification. Horizon Europe or Digital Europe programme calls explicitly targeting lithography component development. And — the clearest signal — any formal communication between the Commission and ASML’s board regarding the company’s classification under the EU Foreign Subsidies Regulation or the Critical Raw Materials Act framework.

The prediction is falsifiable. If by April 2027 no such proposal has been published, and no draft legislation is in inter-service consultation, the prediction is wrong. If the Commission addresses the equipment chokehold through non-legislative means — guidelines, political declarations, bilateral agreements with the Netherlands — that does not satisfy the prediction. The argument here is that the MATCH Act forces a legislative response from Brussels, because the alternative — continued structural paralysis while Washington dictates the terms of European technology companies’ commercial freedom — is not a position the Commission can sustain through another European Council cycle.

The bottom line

Remember the house from Parts 1 and 2? The foundations that nobody paid for — the aluminium, the helium, the metal floor? The foundations are still unpaid. But Part 3 has introduced a new problem. The house has a landlord.

The landlord did not build the house. ASML is Dutch. Zeiss is German. The semiconductor equipment supply chain is overwhelmingly European in engineering, European in manufacturing, and European in intellectual heritage. But the landlord holds one key — the Cymer light source, the American IP — and that key opens every door in the building. The MATCH Act is the landlord’s letter to the tenant: match my rules within 150 days, or I change the locks.

The United States built the most powerful technology industry in human history on the argument that free markets produce better outcomes than state direction. The MATCH Act is the legislative acknowledgement that Washington no longer believes this — at least not when the free market produces outcomes that benefit a competitor. The bill does not restrict an adversary’s access to technology. It restricts an ally’s freedom to sell technology the ally developed, in markets the ally chose, using capital the ally raised. The security justification is real but partial. The commercial equalisation is the structural driver. And the mechanism — extraterritorial coercion of sovereign allied governments via supply chain dependencies — is not a free market instrument. It is the opposite.

You cannot build sovereignty on someone else’s permission.

That sentence is the argument of this piece. Everything else has been evidence. The metal floor from Part 2 is the precondition nobody costed. The equipment chokehold is the precondition somebody else controls. And the question for every UK and European board is no longer theoretical: when the landlord’s letter arrives — when the 150-day clock begins — which of your supply chains run through the building he owns?

Part 4 will follow the landlord inside the house. The CLOUD Act — the legal instrument that gives U.S. law enforcement access to data held by American cloud providers regardless of where that data is physically stored — is the same permission problem applied not to equipment but to information. The metal floor, the equipment chokehold, and the data jurisdiction are three expressions of a single structural condition: European commercial activity operating inside American extraterritorial reach, with no European governance mechanism configured to counter it.

The Control Layer exists to make that condition legible on a quarterly risk paper, in a voice a board will quote. If that is the translation you have been looking for, subscribe — and forward this to the colleague who is about to discover that the allied exemption was always American permission.

Next: Part 4 — The data jurisdiction: the CLOUD Act and the landlord who reads your post.

References

[1]: U.S. House of Representatives. Multilateral Alignment of Technology Controls on Hardware Act, H.R. 8170, 119th Congress (2026). Introduced 2 April 2026. House Foreign Affairs Committee markup, 22 April 2026: advanced 36-8.

[2]: U.S. Senate. Multilateral Alignment of Technology Controls on Hardware Act, S. 4281, 119th Congress (2026). Sponsors: Sen. Pete Ricketts (R-NE), Sen. Andy Kim (D-NJ). Co-sponsors include Senate Majority Leader Chuck Schumer (D-NY) and Sen. Jim Risch (R-ID), Chairman, Senate Foreign Relations Committee.

[3]: Based on an exhaustive review of public statements, press releases, and congressional testimony from the Semiconductor Industry Association (www.semiconductors.org), SEMI , Lam Research, and Applied Materials through April 2026. No formal industry statement opposing H.R. 8170 was identified.

[4]: Lam Research Corporation. Q1 Fiscal Year 2026 Earnings Release. China revenue exceeded one-third of total quarterly revenue; projected decline below 30 per cent under tightening domestic restrictions.

[5]: U.S. Bureau of Industry and Security. Administrative Penalty: Applied Materials, Inc. $252 million civil penalty for illegal export of ion implanters to a Chinese entity via South Korean subsidiary.

[6]: Multiple corroborated industry reports on SMIC’s 7nm process capability using DUV multi-patterning, first reported in 2023 and confirmed in subsequent U.S. intelligence assessments.

[7]: ASML Holding N.V. Annual Report 2025. EUV market share: 100 per cent. Broader lithography market share: approximately 90 per cent. https://www.asml.com/en/investors/annual-report

[8]: ASML Holding N.V. Annual Report 2025. Total net sales: €32.7 billion. Gross margin: 52.8 per cent. Net income: €9.6 billion. Systems shipped: 535 (48 EUV, 279 DUV). Supplier network: 5,100 total (1,600 Netherlands, 1,450 Asia, 1,350 North America, 700 EMEA ex-NL). China revenue: 33 per cent of FY 2025.

[9]: ASML Holding N.V. Q1 2026 Quarterly Earnings Report. Net sales: €8.8 billion. Gross margin: 53.0 per cent. Installed base management revenue: €2.48 billion. China revenue: 19 per cent. South Korea: 45 per cent. Q2 2026 gross margin guidance: 51–52 per cent. China projected to stabilise at approximately 20 per cent.

[10]: Carl Zeiss SMT GmbH. ASML strategic partnership formalised 1997. ASML holds 24.9 per cent ownership stake in Zeiss SMT. Approximately 80 per cent of global microchip production utilises Zeiss optics via ASML lithography hardware.

[11]: Cymer, Inc. (San Diego, CA). Acquired by ASML. Provides laser-produced plasma light source technology for EUV lithography systems. U.S.-origin intellectual property integral to all ASML EUV machines.

[12]: U.S. Bureau of Industry and Security. Foreign Direct Product Rule — Export Administration Regulations, 15 CFR Part 734. Expanded October 2022 and December 2024.

[13]: U.S. Bureau of Industry and Security. December 2024 Semiconductor Export Control Updates. Expanded FDPR jurisdiction to cover foreign-produced SME containing “any amount of U.S.-origin integrated circuits” and classified all ICs manufactured using U.S. equipment as U.S.-origin.

[14]: The Wassenaar Arrangement on Export Controls for Conventional Arms and Dual-Use Goods and Technologies. Established 1996. 42 participating states. Consensus-based decision-making on dual-use technology restrictions.

[15]: U.S. Congress. Toshiba-COCOM Sanctions, 1987. Punitive sanctions against Toshiba Machine Company for sale of restricted submarine-milling equipment to the Soviet Union in violation of COCOM rules.

[16]: U.S. Department of Commerce. BIS Budget Allocation FY 2026. 23 per cent increase (approximately $44 million) earmarked for enforcement personnel. 200 new Export Enforcement Special Agents funded. Congressional scrutiny of Under Secretary Jeffrey Kessler regarding licence approval transparency.

[17]: Center for Strategic and International Studies (CSIS). Survey of U.S. Technology Export Licensing Friction, 2025–2026. 56 per cent of respondents reported average review times exceeding 180 days. 33 per cent reported wait times exceeding 300 days. 76 per cent reported more than $10 million in exports delayed by pending reviews. More than 50 per cent reported losing business to foreign competitors.

[18]: U.S. Bureau of Industry and Security. Annual Report, Fiscal Year 2023. Official average export licence processing time: 38 days.

[19]: NL Times. ‘Netherlands pushes back against proposed U.S. export limits on ASML,’ 14 April 2026. Reports that Dutch PM Rob Jetten discussed the MATCH Act during a White House visit and that talks “involved some disagreement, with both sides recognising each other’s positions without reaching consensus.”

[20]: Based on a review of European Commission press releases, EU Trade Commissioner statements, and European Parliament resolutions through April 2026. No formal EU institutional response to H.R. 8170 identified.

[21]: Tokyo Electron Ltd. Fiscal Year 2026 Quarterly Earnings. Track equipment market share: 87 per cent. Overall equipment market share: 13.4 per cent. China revenue: declined from 40.3 per cent (Q2 FY2026) to 31.8 per cent (Q3 FY2026). Japanese Ministry of Economy, Trade and Industry (METI): 23-item export control notice implemented; Japan passed centralised economic security intelligence legislation, April 2026.

[22]: European Union. NanoIC Semiconductor Pilot Line, imec (Leuven). €700 million investment under Chips Act / Horizon Europe framework. Research and development programme; not a commercial manufacturing alternative to ASML lithography.

[23]: Predictive judgement. Not based on any published Commission document. Based on the analytical assessment that the MATCH Act’s extraterritorial reach into European semiconductor equipment supply chains creates a legislative forcing function that the Commission’s current non-response cannot survive through another European Council cycle.

Author

Amer Altaf is Founder and CEO of Arkava, a UK and European sovereign AI agentic automation business, and Managing Editor of The Control Layer, the publication where he tracks the convergence of cyber security, technology sovereignty, and geopolitics. A techUK member, he contributes to industry engagement on UK technology sovereignty policy. He is currently writing on cloud security for Oxford University Press’s Expert Essentials series.

Share

That is the argument at the centre of this episode — and in seven words, it is the entire thesis. Everything else is evidence.

Last week, in Part 1, I traced the line from the Strait of Hormuz to the server rack and argued that the post-war bargain between Europe and America has inverted. I used the analogy of a house — joists, plumbing, planning permission, landlord — to map the four chokepoints that converged in a single fortnight.

This week, I go underneath the house. To the foundations. Because the entire European technology sovereignty project — the Chips Act, the data sovereignty regulations, the cloud procurement frameworks — is a house being built on foundations nobody has paid for.

The bill has just arrived.

What this episode covers

This is a 31-minute solo episode. I work through four arguments, each building on the last:

The physics of the problem. Why an aluminium pot line cannot be cold-started — the cells are destroyed, not paused, when the cryolite solidifies at 960 degrees Celsius. Why every helium atom in commercial use was mined, not manufactured. Why the loss of three million tonnes of Gulf aluminium capacity and 25 per cent of global helium supply is a sovereignty story, not a commodity story.

The inconvenient truth. How Ricardo’s comparative advantage theory — honest, functional, and correct for thirty years — rested on three assumptions that this fortnight removed simultaneously. Why Adam Tooze calls it “zombie globalisation.” Why Matt Stoller’s financialisation critique explains how we got here.

The policy gap. The EU Chips Act’s three structural gaps: no allocation for primary aluminium processing, no strategic helium reserve (despite helium being on the Commission’s critical raw materials list since 2020), and no crisis-response mechanism for disruptions originating upstream of the fab. The UK Critical Minerals Strategy’s order-of-magnitude funding shortfall — £50 million committed against a problem that costs £8 to £15 billion.

The honest answer. A five-point metal floor strategy for the European bloc, extending Ed Conway’s Material World thesis to argue that digital sovereignty is a subset of material sovereignty. Total cost: between 40 and 60 billion euros over a decade. The number nobody has published yet.

The episode closes with a prediction — within 18 months, a major European fab will publicly disclose a helium allocation constraint delaying capacity expansion — and three amendments to the quarterly board paper introduced in Part 1.

Read the full written analysis

The written article — with all 17 endnotes, the image brief, and the predictive judgement with explicit falsifiability conditions — is here:

Sources cited in this episode

[1]: Rio Tinto Alcan. “Sale of Lynemouth smelter to Klesch Group completed.” 2012 corporate archive, and “Rio Tinto sells Alcan Aluminium UK to Liberty House.” Financial Times, 16 December 2016.

[2]: Reuters. *“Gulf aluminium output crippled as Iranian strikes hit EGA and Alba facilities.”* 11 April 2026. See also CRU Group, *Aluminium Market Monitor*, April 2026 update.

[3]: Emirates Global Aluminium plc. *“Annual Report 2025 — European Customer Disclosures.”* https://www.ega.ae/en/investor-relations; International Aluminium Institute, Primary Aluminium Production Statistics Q1 2026

[4]: U.S. Geological Survey. “Mineral Commodity Summaries 2026 — Helium.” January 2026. ; Linde plc, Helium Supply Chain Disclosures, 2025 Annual Report; Air Liquide SA, Critical Gases Supply Position 2025.

[5]: David Ricardo. *On the Principles of Political Economy and Taxation*. John Murray, 1817. Chapter 7, “On Foreign Trade.”

[6]: Adam Tooze. *Chartbook* (Substack). See in particular the ongoing analysis of “zombie globalisation” across Chartbook issues 2023–2026.

Chartbook

A newsletter on economics, geopolitics and history from Adam Tooze. More substantial than the twitter feed. More freewheeling than what you might read from me in FT, Foreign Policy, New Statesman.

By Adam Tooze

[7]: Matt Stoller. *BIG* (Substack). See ongoing analysis at

BIG by Matt Stoller

The history and politics of monopoly power.

[8]: European Union. Regulation (EU) 2023/1781 of the European Parliament and of the Council of 13 September 2023 establishing a framework of measures for strengthening Europe’s semiconductor ecosystem (Chips Act).[9]: European Commission. “Chips Act Pillar II Implementation Report — First Annual Review.” March 2026. See Commission Staff Working Document SWD(2026) 047 final.

[10]: European Commission. “Critical Raw Materials Act — List of Critical and Strategic Raw Materials.” Regulation (EU) 2024/1252, Annex I. Helium listed as critical since 2020 Communication COM(2020) 474.

[11]: Estimate synthesised from European Round Table for Industry (ERT) position papers on industrial policy 2025, Bruegel working papers on European strategic autonomy, and off-the-record conversations with Commission officials. Not yet formally published by any Commission document.

[12]: HM Government, Department for Business, Energy and Industrial Strategy. *“UK Critical Minerals Strategy.”* July 2022; refreshed March 2023 as “Critical Minerals Refresh.”

[13]: Tata Steel UK. *“Port Talbot Transformation Announcement.”* January 2024.

[14]: HM Government, Department for Business and Trade. “Invest 2035: The UK’s Modern Industrial Strategy.”* Green paper, October 2024.

[15]: Estimate synthesised from CRU Group cost models for greenfield primary aluminium facilities, 2025 capital cost indices, and comparable recent projects (Rio Tinto Kitimat modernisation, Emirates Global Aluminium Al Taweelah expansion).

[16]: Ed Conway. *Material World: A Substantial Story of Our Past and Future*. W.H. Allen, 2023. See also ongoing analysis at Material World Substack:

Listen and subscribe

YouTube:

Apple Podcasts:

Spotify:

Substack: https://thecontrollayer.arkava.ai

Subscribe on the Substack to get every episode and written analysis by email — free.

Join the conversation

The metal floor argument is the one I expect to generate the most disagreement in this series. The numbers are large. The policy gap is structural. And the question of whether Europe should rebuild domestic processing capacity or find a different kind of resilience is genuinely open.

I want to hear from people working in industrial policy, commodity trading, semiconductor procurement, critical minerals strategy, or defence supply chains. Where am I wrong? Where is the five-point strategy naive? What am I missing?

Drop a comment below, or find me on LinkedIn

Amer Altaf is Founder and CEO of Arkava and Managing Editor of The Control Layer.