The 60-second version

• Most companies “rent” AI: they send their data to a black box in someone else’s data centre and pay by the use. You can’t see inside it, and you can’t take it home.

• “Open-weight” models flip that. You get the actual engine — to run on your own kit, under your own rules. In London, JetBrains gave its newest one, Mellum2, away under a no-strings licence.

• A year ago, open models were miles behind the expensive “closed” ones. Today, per Artificial Analysis, they’re within a few points — and on some coding tests, level.

• That means owning your AI is no longer the compromise option. For anyone who cares where their data lives — hospitals, banks, government, you — it might be the better option.

• The catch, and the reason this is Part 2 of a series about trust: owning the model is not the same as being able to trust the stack underneath it.

Ivan Bobrov did something on the London stage that, in 2026, ought to be impossible.

He gave away the engine.

Bobrov is a lead machine-learning engineer at JetBrains — the European company, founded in Prague, whose coding tools sit on the laptops of millions of professional developers. On 21 May he walked a room full of engineers through how his team built their newest AI model, Mellum2, “from pre-training to post-training,” as he put it — “all the secrets.” Then he told them where to download it. Free. Under an Apache 2.0 licence, which is lawyer-speak for: take it, run it, build a business on it, you don’t owe us anything.

To understand why a profitable company would do that — and why it matters to you, even if you will never write a line of code — you need the difference between renting intelligence and owning it.

The meter and the engine

Most AI you’ve heard of is closed, or “proprietary.” Think of it as electricity from the grid. You flip a switch, you get power, you pay per unit. You have no idea what’s happening in the power station, you can’t visit it, and you certainly can’t take a generator home. The big American models work like this: your words go off to a data centre you’ll never see, the answer comes back, the meter ticks.

It’s convenient. For a lot of uses, it’s brilliant. But there’s a price beyond the bill. Every time you use it, you are trusting a black box with your data — and you have no way to verify what it does in there.

Open-weight models are the other thing. The “weights” are the model’s actual brain — the giant grid of numbers it learned during training. When a company publishes those weights, you get the engine itself. You can run it on your own computers, inside your own building, behind your own firewall. You can take it apart. Nobody meters it. Nobody else sees your data, because your data never leaves.

For years, this was the worthy but worse option. Open models were the hand-me-downs — fine for tinkering, not for serious work. That is the thing that just changed.

The gap closed while you weren’t looking

Here are the numbers, and they are genuinely startling.

The independent analysts at Artificial Analysis track a single “Intelligence Index” across all the major models. A year ago, the best open model scored 22 on it — around 13 points behind the best closed one. A gulf. As of early 2026, the leading open-weight models sit on roughly 54, within three to six points of the most expensive proprietary systems money can buy. The gulf became a rounding error.

On coding — the thing these models are increasingly paid to do — it’s even tighter. On the widely-used SWE-bench test, the open model MiniMax M2.5 scores 80.2%. Anthropic’s flagship Claude Opus 4.6 scores 80.8%. Six-tenths of one percent, between the free one and the frontier one.

And on Nebius’s own SWE-rebench — a tougher, deliberately “un-gameable” version we’ll come back to in Part 4 — the open Chinese model GLM-5 trailed the best closed model by under three points as of late May 2026.

You are no longer choosing between good and expensive or free and embarrassing. You are choosing between two things that are roughly as capable as each other — where one lives in someone else’s building and one can live in yours.

This is where the word “sovereignty” stops being abstract

The technology industry has a grand phrase for this: sovereign AI. Even Jensen Huang, the chief executive of Nvidia — a man who sells shovels to every side of this gold rush — argues that every country now needs its own AI capability: built on its own infrastructure, trained on its own data, governed by its own rules.

Strip away the grandeur and it’s a kitchen-table idea. Where does your information live? Whose laws govern it? If the relationship sours, or the price triples, or a government on another continent changes the rules, can you carry on — or are you stranded?

For a British hospital weighing up an AI that reads scans, for a bank automating compliance, for a government department handling citizens’ records, “we rent it from a black box in Virginia” is not a comfortable answer. “We run an open model on UK soil, under UK law, and nobody else ever sees the data” is a very different one. It is, not coincidentally, the bet my own company makes, and the reason this publication exists.

Nvidia, for its part, isn’t just talking. It now publishes its own family of open models, Nemotron — weights, training data and recipes in the open — alongside the open NeMo framework for building your own. Europe is moving too, from France’s Scaleway to Italy’s Fastweb building sovereign AI supercomputers. And platforms like Hugging Face now let you reach 200-plus open models, pay-as-you-go, with no markup — a halfway house for those not ready to run their own hardware.

Owning your intelligence used to mean accepting a worse product. It doesn’t any more. That’s the door that opened in London.

The catch — and the reason this is a series about trust

Now the honest part, because zero fluff is the deal here.

Owning the model is not the same as owning the stack underneath it. You can download Mellum2 for free and still be running it on chips from one company, in a data centre from another, on a power grid you don’t control. I’ve written before, in Four Chokepoints and The Metal Floor, about how much of our supposed “sovereignty” still rests on imported metal and a handful of irreplaceable suppliers. Possessing the weights is necessary. It is not sufficient. Anyone selling you “total sovereignty” in a single click is selling you something.

And here’s the deeper trap, the one that ties this whole series together. An open model you can inspect is not the same as an open model you can trust. You hold the weights — billions of numbers — but you still can’t fully explain why it does what it does, or guarantee it won’t fail in some way you didn’t test for. Transparency of access is not transparency of behaviour.

So the open-weight revolution hands us back control of where our intelligence runs and who sees our data. Real, valuable, and worth grabbing with both hands.

What it does not hand back — what nobody has handed back yet — is the ability to be sure the thing is doing what we think it’s doing.

Which is exactly the problem waiting for us in Part 4. First, though, that problem is about to climb into a car and drive itself through central London.

This is Part 2 of Nebius Build London 2026, a four-part series from The Control Layer. The companion conversation airs on The Control Layer with Amer Altaf — subscribe to get each part, and the episode, the moment it lands.

Subscribe now

Where artificial intelligence, cybersecurity and enterprise leadership intersect. Zero fluff.

→ Next: Part 3 — The robots booked an Uber. ← Missed it? Part 1 — The inference flip.

Sources & further reading

• Artificial Analysis — open-weight model launches & Intelligence Index: https://artificialanalysis.ai/articles/recent-open-weights-model-launches

• JetBrains — Mellum2 on Hugging Face (Apache 2.0): https://huggingface.co/JetBrains and https://blog.jetbrains.com/ai/

• NVIDIA Nemotron (open models): https://developer.nvidia.com/nemotron · NeMo framework: https://github.com/NVIDIA-NeMo/NeMo

• Nvidia / Jensen Huang on sovereign AI: https://blogs.nvidia.com/blog/what-is-sovereign-ai/

• Hugging Face Inference Providers: https://huggingface.co/docs/inference-providers/index

• SWE-rebench leaderboard: https://swe-rebench.com

• Related reading on The Control Layer: DeepSeek V4 and the death of two monopolies; The Metal Floor; Four Chokepoints

On 3 June 2026, on a stage in New York, Vanta launched a product designed to solve a problem that, by its own figures, almost no one is currently solving.

The product is the Vanta Agent for Risk. The problem is the distance between two numbers that the company also published that week. Across Vanta’s customer base of more than 16,000 organisations, the count of internal “builder” roles has grown 311 per cent year on year. A builder, in this sense, is anyone inside a company who spins up new software, new integrations, and new artificial-intelligence tools without waiting for the technology department to bless it. Over the same period, those same organisations reviewed just 7 per cent of the outside vendors they had taken on, and fixed only 12 per cent of the risks they did manage to find.[1]

Hold those three figures next to each other. Adoption up threefold. Review at seven in a hundred. Remediation at one in eight. That is not a story about a product launch. That is the shape of a governance gap, measured by the company that sells the tool to close it — which is worth saying plainly, because the vendor’s incentive sharpens the data rather than discrediting it — and it is the most useful number to come out of any security launch this quarter.

The 7 per cent problem

Start with what the figures are actually counting, because the jargon hides the stakes. A “vendor review” is the unglamorous work of checking whether an outside supplier can be trusted with the access you have granted it. The supplier might be a payroll platform, a note-taking app, or an AI model wired straight into your customer data. Third-party risk management, or TPRM, is the discipline of doing that checking continuously rather than once at signing. It is dull. It is also the soft underbelly of every modern organisation, because the outside supplier is the door an attacker walks through when the front entrance is locked.

Seven per cent is the proportion of that door that anyone is watching.

According to Vanta’s own data, drawn from its 16,000 customers and published in a report it calls “The Builder Boom — Breaking Security”, 30 per cent of the AI vendors those organisations have onboarded are flagged as high or critical risk.[2] So the picture is not that enterprises are reviewing a representative 7 per cent and finding it clean. They are reviewing 7 per cent, finding that nearly a third of the AI tools in that sample are dangerous, and then remediating 12 per cent of what they find. The funnel narrows at every stage. By the time you reach the end of it, the amount of identified-and-fixed risk is a rounding error against the amount of adopted-and-unexamined risk.

I will mark that reading as analysis rather than reportage. Vanta has a commercial interest in the gap looking wide. But the figures are consistent with what every independent dataset is now reporting, and that is the test that matters.

What the builder boom actually broke

The instinct, reading those numbers, is to blame the security team. Resist it. The security team did not get lazier; the building got faster, and it moved out of the building it used to live in.

For most of the last two decades, the person who could introduce a new piece of software into a company was, broadly, an engineer. Procurement was a chokepoint. The technology department was the gate, and the gate was annoying, and being annoying was the point — it meant someone looked at the thing before it touched the data. The builder boom is the dissolution of that gate. The “builder” is no longer in engineering. The builder is the marketing manager who connects an AI copy tool to the customer database, the finance analyst who pipes the management accounts into a chatbot, the lawyer who runs the contract stack through a model nobody approved. Vanta’s own taxonomy captures the spread with a detail I find more telling than the headline figure: job titles containing “GTM Engineer” — a go-to-market role that did not meaningfully exist three years ago — are up 1,329 per cent year on year, and “Legal Engineer” roles are up 850 per cent.[2]

This is the Tony Stark problem. The interesting thing about Iron Man was never the suit; it was that the man who signed the cheques put it on and started flying sorties himself. When the executive becomes the operator, the org chart stops describing who can do what. And the executive is doing exactly that. Independent research from the security firm UpGuard, reported in November 2025, found that senior leadership is 50 per cent more likely to use unsanctioned AI tools, or “shadow AI”, than the rank and file, and that 68 per cent of security leaders themselves admitted to feeding company work through AI tools no one had cleared.[3] The people who write the security policy are among the most reliable people breaking it. Gartner expects shadow AI to be implicated in breaches at 40 per cent of organisations by 2030.[4]

So the gap is not a discipline failure. It is structural. The rate at which new risk enters an organisation is now set by everyone, all at once, from the graduate to the board; the rate at which it gets reviewed is still set by a small team — using tools built for a world where the gate still held — and the asymmetry between those two rates is the one the whole sector is quietly failing to price. It is also the one the Vanta launch is built to attack.

Two regulators, one blind spot

Here is why the gap is about to stop being an operational nuisance and start being a disclosable event.

In the United States, since December 2023, the Securities and Exchange Commission has required public companies to report a material cybersecurity incident on a Form 8-K — the regulatory filing every listed US company files for the events that move a share price — within four business days of deciding the incident is material.[5] The clock does not care whether the breach came through your own code or through an AI vendor your marketing team adopted in a tool nobody logged. A breach you cannot see is still a breach you must, eventually, disclose; you simply disclose it later, worse, and with the added admission that you did not know it was there.

In the United Kingdom, the pressure arrives as warning rather than rule, but the warning is unusually direct. In April 2026, at the CYBERUK conference in Glasgow, Dr Richard Horne, chief executive of the National Cyber Security Centre, told the room the country faces a “perfect storm” for cyber security: rapid AI advances and rising geopolitical tension arriving together, with the majority of nationally significant incidents now originating, directly or indirectly, from nation states.[6] He noted, pointedly, that frontier AI is already accelerating the discovery and exploitation of vulnerabilities at scale. The attackers are builders too, and they are adopting faster than the defenders.

The cost of the blind spot is not hypothetical, and the British example is the one to put in front of any board that thinks this is an American compliance story. The April 2025 attack on Marks & Spencer cut the company’s first-half statutory pre-tax profit from £391.9 million to £3.4 million, a near-total wipe-out, with a forecast operating-profit hit of around £300 million.[7] It was carried out, on the public record, by the Scattered Spider collective using DragonForce tooling, and it reached the retailer through a supplier rather than the front door. The combined damage to M&S and the Co-op was estimated at up to £440 million by the Cyber Monitoring Centre. The vector was a supplier relationship. The 7 per cent problem, fully priced.

And it is not a Vanta-shaped anomaly. Verizon’s 2025 Data Breach Investigations Report, an independent annual study of more than 12,000 confirmed breaches and about as close to an industry baseline as the field has, found that the share of breaches involving a third party doubled in a single year, from 15 per cent to 30 per cent.[8] That figure was produced by no one with a product to sell you. It says the same thing Vanta’s number says, and it gives the launch its real significance: the gap is real, it is widening, and the regulators on both sides of the Atlantic are now watching the same blind spot from two different angles. CISA, the US cyber-defence agency, spent 2025 publishing supply-chain procurement guides for exactly this reason.[9]

Reading this far?

Subscribe to The Control Layer for one piece a week in this register — AI, cybersecurity, sovereignty, and the geopolitics of the technology stack. Free.

Subscribe now

The auditor is now an algorithm

So to the product, handled as what it is: a vendor’s answer to a problem the vendor has accurately described.

The Vanta Agent for Risk sits on what the company calls its “Trust Graph” — strip the branding and it is a continuously updated map of an organisation’s controls, vendors, assets, and obligations, refreshed through more than 400 integrations and 1,400 automated tests.[1] The pitch is that the agent reasons across that map without sleeping, links a drifting internal control to the vendor relationship it exposes, and surfaces the connection before it becomes an incident. There is also an “AI Risk Library”, a pre-built register for governing the AI tools themselves, and a scoring engine that rates each risk separately for financial, brand, and operational impact.

When Vanta unveiled the Trust Graph in London in May, I argued the architecture was the right one, and I stand by that. The June launch raises the harder question the May one deferred. Not whether you can see your risk in real time — but whether, having built the eyes, anyone has agreed to keep them open.

The honest case for the product is strong. Annual risk assessment is a smoke detector you test once a year and ignore for the other 364 days; continuous assessment is the detector left switched on. This is the Minority Report promise — get to the exposure before it becomes the incident, in the window when it is still cheap to fix — and applied to the 7 per cent problem, the logic is sound. You cannot review your whole vendor estate by hand. An agent that never tires is the only plausible way to push 7 per cent towards 70.

The case that needs pressing is the one the marketing will not raise. If the thing auditing your AI risk is itself an AI system reaching into your most sensitive metadata, who audits the auditor? This is the HAL 9000 question, and it is not rhetorical — the agent given the mission and the autonomy to pursue it is precisely the configuration that fails in interesting ways — and “the agent flagged nothing” is going to be a sentence in an incident report before this decade is out. Vanta’s answer, to its credit, is that the agent works against a structured graph rather than open-ended data, which constrains how it can fail. That is a real answer. It is not yet a regulatory one, because no regulator has defined the point at which one AI system may be trusted to attest to the security of another. Until they do, treat the agent’s output as decision-support, not decision-final.

There is a second thing to keep in view, which is that the product solving the problem also concentrates it. A risk map this complete is the most sensitive asset an organisation will hold: every weakness, every vendor, every drifting control, gathered in one place. The questions of where that map sits, and who can compel access to it, do not disappear because the dashboard is elegant. That is not an argument against the tool. It is the argument every board should commission before signing, with eyes open.

Predictive Judgement

Prediction. By 31 December 2027, at least one US-listed company will use an SEC Form 8-K Item 1.05 filing, or the 10-K annual report that follows it, to disclose a material cybersecurity incident in which an unreviewed or unsanctioned third-party AI tool was a contributing vector. The phrase “shadow AI” or its plain-English equivalent will appear in mainstream financial coverage of a specific named breach within the same window.

Signals to watch, quarterly.

1. Form 8-K Item 1.05 filings, and SEC comment letters, that name a third-party SaaS or AI vendor as part of an incident’s root cause.

2. The first shadow-AI-linked breach to reach the front page of the Financial Times or the Wall Street Journal with a named company attached.

3. UK movement — an FCA or NCSC intervention, or a Crown Commercial Service framework refresh, that names continuous third-party AI monitoring as an expectation rather than a nicety.

Falsifiability. If, by 31 December 2027, no US public-company disclosure attributes a material incident even partly to an unreviewed or unsanctioned third-party AI tool, the prediction is wrong. I will say so in writing.

The publication that calls its predictions in writing.

Every Control Layer piece ends with a falsifiable prediction and a list of signals to watch. Subscribe to track them. One email a week. Free.

Subscribe now

The Bottom Line

The boards that come out of the next two years intact will be the ones that, in the middle of 2026, understood that adoption and governance had come apart — and that the gap between them was not a budget line, a tooling choice, or a problem the security team could be blamed into closing. It was a structural mismatch between the speed at which everyone in the organisation now builds and the speed at which a small number of people can still look.

The launch in New York is a good answer to a real question. Continuous, agentic risk monitoring is the only mechanism that can plausibly drag the 7 per cent towards a number worth defending, and the firms that adopt it early will disclose less, recover faster, and sleep better than the firms that do not. But the tool is the easy part. The hard part is the decision that precedes it: agreeing, at board level, that the risk you have never examined is still your risk, and that the disclosure clock — in New York and in London both — has already started counting.

You cannot file an 8-K on a breach you never saw coming. You cannot remediate a vendor you never reviewed. And you cannot govern what you have never agreed to look at.

The next piece is on what happens when the regulator asks who audited the agent.

Subscribe to The Control Layer to get the analytical thread continued — one piece a week, free, in the same register. From Amer Altaf, Managing Editor.

Subscribe now

References

[1]: Vanta. “Vanta Launches New Agent to Unify Internal and Third-Party Risk.” Press release, Vanta Delivers: Live from New York, 3 June 2026. — figures for builder-role growth, integrations, and continuous tests as stated by Vanta.

[2]: Vanta. “The Builder Boom — Breaking Security.” Research report drawn from Vanta’s customer base of 16,000+ organisations, June 2026. — 311% builder-role growth, 73% higher AI-vendor adoption among organisations with formalised builder roles, 30% of AI vendors flagged high/critical risk, 7% of vendor inventory reviewed, 12% of identified risks remediated, “GTM Engineer” +1,329% and “Legal Engineer” +850% year on year. All figures are Vanta’s own and should be read as vendor data.

[3]: UpGuard. “New Research from UpGuard Reveals 68% of Security Leaders Admit to Unauthorized AI Usage.” 10 November 2025, — reported by Cybersecurity Dive, Based on 2024 surveys of 1,500 security leaders and employees across the US, UK, Canada, Australia, New Zealand, Singapore, and India.

[4]: Gartner, cited in “Shadow AI Security Breaches Will Hit 40% of All Companies by 2030, Warns Gartner,” Fortra, 2025.

[5]: U.S. Securities and Exchange Commission. “SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies.” Adopted 26 July 2023 (Release 33-11216); Form 8-K Item 1.05, “Material Cybersecurity Incidents,” disclosure compliance began 18 December 2023, with filing required within four business days of a materiality determination.

[6]: National Cyber Security Centre. “Cyber chief: UK faces ‘perfect storm’ for cyber security.” Remarks by Dr Richard Horne, CEO, CYBERUK 2026, Glasgow, April 2026.

[7]: Marks & Spencer first-half results and cyber-attack impact: “M&S profits tumble after cyber attack,” Computer Weekly, November 2025; combined M&S/Co-op cost estimate of up to £440 million, Cyber Monitoring Centre, reported in Engineering and Technology Magazine, 23 June 2025,

[8]: Verizon. “2025 Data Breach Investigations Report.” Third-party involvement in breaches doubled from 15% to 30%; analysis of 22,052 incidents and 12,000+ confirmed breaches.

[9]: Cybersecurity and Infrastructure Security Agency. “Information and Communications Technology Supply Chain Risk Management.” Including the Software Acquisition Guide (August 2025) and the SBOM for Cybersecurity Guide (September 2025).

Further reading

- National Cyber Security Centre, “Cyber chief: UK faces ‘perfect storm’ for cyber security” (April 2026) — https://www.ncsc.gov.uk/news/cyber-chief-uk-faces-perfect-storm-for-cyber-security

- Verizon, “2025 Data Breach Investigations Report” — https://www.verizon.com/business/resources/reports/dbir/

- Cybersecurity Dive, “Shadow AI is widespread — and executives use it the most” (2025) — https://www.cybersecuritydive.com/news/shadow-ai-employee-trust-upguard/805280/

- U.S. Securities and Exchange Commission, final rule on cybersecurity risk management and incident disclosure (2023) — https://www.sec.gov/rules-regulations/2023/07/s7-09-22

- CISA, “Information and Communications Technology Supply Chain Risk Management” — https://www.cisa.gov/information-and-communications-technology-supply-chain-risk-management

- Fast Company, “’Shadow AI’ is real. Vanta wants to help manage it” (June 2026) — https://www.fastcompany.com/91551820/vanta-agent-for-risk

Author

Amer Altaf is Founder and CEO of Arkava, a UK and European sovereign AI agentic automation business, and Managing Editor of The Control Layer, the publication where he tracks the convergence of cybersecurity, AI, and the geopolitics of the technology stack. A techUK member, he contributes to industry engagement on UK technology sovereignty policy. He is currently writing on cloud security in an age of geopolitical uncertainty for Oxford University Press’s Expert Essentials series.

The 60-second version

• For years, the expensive, glamorous part of AI was training — building the brain. That era is ending.

• The new centre of gravity is inference: the machine actually doing things for you. Deloitte estimates inference is now two-thirds of all AI computing, up from a third in 2023.

• That moves the action from a handful of labs to everyone else — the people using AI to build products, run companies, do jobs.

• And it quietly changes the scarce resource. When intelligence is cheap and everywhere, the hard question is no longer can it think? It’s can you trust what it just did?

• That question is the spine of this four-part series from inside Nebius Build London 2026.

There’s a number the people who sell artificial intelligence have started saying to each other. Quietly. The way you’d pass on a tip at the races.

Two in three.

On 21 May 2026, in a low-lit event space in London, a man who runs developer relations at an AI infrastructure firm called Nebius stood in front of a few hundred engineers and said it out loud. Two out of every three “tokens” — the little units of work an AI does — are now inference, not training.

If that sentence means nothing to you, good. You’re exactly who I’m writing for, and the translation is the whole story.

Teaching the machine vs. using the machine

Think of an AI model like a school pupil.

Training is the schooling. It’s the long, eye-wateringly expensive bit where you pour the entire internet into a model until it learns to read, write and reason. It needs warehouses of specialised chips running flat out for months. Only a few companies on earth can afford it. For most of the last decade, that was the AI story — bigger schools, longer terms, more money.

Inference is the day job. It’s what happens after school, every time the model actually does something: answers your email, reviews a contract, plans a delivery route, writes a line of code. Each individual task is cheap. But it happens millions of times a day, forever.

For years, almost all the money and attention went into the schooling. The flip is this: the world has stopped obsessing over building bigger brains and started spending its money on putting the brains to work.

That’s the inference flip. And it isn’t one company’s sales pitch.

The receipts

Deloitte estimated, in a November 2025 report, that inference accounted for roughly half of all AI computing in 2025 — and would reach two-thirds in 2026, up from just a third in 2023. The man on the London stage and the global consultancy landed on the same number from completely different directions.

Gartner has gone further, forecasting that the large majority of AI infrastructure spending now goes to inference rather than training. The logic is brutally simple: training is an occasional cost. Using the model is a forever cost. Run anything continuously and the day job dwarfs the school fees within months.

You can see the flip in the bank statements, too. Nebius — Amsterdam-headquartered, listed on the Nasdaq as NBIS, run by Arkady Volozh, the founder who built the Russian search giant Yandex before the company restructured and rebranded in 2024 — reported first-quarter 2026 revenue of around $399 million. That was up roughly 684% on the year before. Its AI cloud business is now running at nearly $2 billion a year. Companies do not grow like that selling schooling to five labs. They grow like that selling the day job to everyone else.

Why this should matter to you, specifically

Because the centre of gravity just moved — from them to us.

When the story was training, AI belonged to a priesthood: a few labs in California and a handful of governments who could afford the compute. When the story is inference, AI belongs to whoever can do something useful with it. The corner accountancy firm. The NHS trust. The logistics startup in Leeds. The person at the next desk.

The man on the stage claimed that demand for the new “applied AI” job titles — the people who build with AI rather than build AI — has risen around 700% in two years. I’ll be straight with you: I can’t independently verify that precise figure, and it comes from a company that profits handsomely from the trend, so hold it loosely. But the direction is corroborated everywhere you look. The work is moving from inventing the engine to driving the car. And there are vastly more drivers than engine-makers.

For Britain, that’s the opportunity hiding in this number. We do not have a Californian hyperscaler and we are not going to grow one by Friday. But applied AI — the practical, unglamorous business of making this technology actually work inside real organisations, under real rules — is a game a mid-sized, heavily-regulated, services-driven economy can genuinely win. London doesn’t need to build the biggest brain. It needs to be the best place on earth at putting brains to work.

The part nobody on stage quite said out loud

Here’s the turn.

When intelligence was scarce and expensive, the only question that mattered was can the machine do it at all? That’s a capability question, and we have spent a decade and untold billions answering it. The answer, increasingly, is yes.

But the inference flip changes the question. When the machine is cheap, fast and everywhere — answering the email, approving the loan, driving the car, merging the code — the scarce resource is no longer intelligence.

It’s trust.

Can you trust what it just did? Can you prove it did the right thing? Can you tell, after the fact, whether it actually solved your problem or just made it look solved? That is a verification question, and it is much harder than the capability question — because a system clever enough to do your job is also clever enough to make a wrong answer look exactly like a right one.

That gap — between what AI can now do and what we can actually verify — is the most important and least-discussed story in technology. It is the reason this publication is called The Control Layer. And it ran underneath every single talk I watched in London.

Over the next three parts, I’m going to show you the gap from three angles. The companies trying to hand you back control by letting you own your AI instead of renting it (Part 2). The robots that just booked an Uber through central London, and the trust problem riding in the passenger seat (Part 3). And the unsettling, brilliantly-documented discovery that our smartest AI systems have learned to cheat the very tests we use to check them (Part 4).

The brains are built. The schooling is basically over. The hard part — trusting the things once they go to work — is just beginning.

This is Part 1 of Nebius Build London 2026, a four-part series from The Control Layer. The companion conversation airs on The Control Layer with Amer Altaf — subscribe to get each part, and the episode, the moment it lands.

Subscribe now

Where artificial intelligence, cybersecurity and enterprise leadership intersect. Zero fluff.

→ Next: Part 2 — You no longer have to rent your intelligence from California.

Sources & further reading

• Deloitte, More compute for AI, not less (Technology, Media & Telecom Predictions 2026): https://www.deloitte.com/us/en/insights/industry/technology/technology-media-and-telecom-predictions/2026/compute-power-ai.html

• Nebius Group — About / investor information: https://nebius.com/about · Nasdaq: NBIS

• Computerworld, CES 2026: AI compute sees a shift from training to inference: https://www.computerworld.com/article/4114579/ces-2026-ai-compute-sees-a-shift-from-training-to-inference.html

• Related reading on The Control Layer:

Subscribe to read the full piece and the rest of the *Trust Is the Growth Engine* series — three pieces this week on what VantaCon UK 2026 told us about how trust is being rebuilt for the AI era.

On the morning of 7 May 2026, midway through the keynote programme at VantaCon UK, Christina Cacioppo — Vanta’s CEO and co-founder — sat down on a small stage with Jason Kirk, Chief Information Security Officer of Nando’s.[^1] What followed, in roughly fifteen minutes, was the most operationally honest description of cybersecurity in the British consumer economy I have heard in three years of conference attendance.

Kirk walked the audience through a business that, on paper, looks like a chicken restaurant. Forty million active customers. Around four million unique transactions a month in the UK alone. Five hundred restaurants on these islands and around twelve hundred worldwide.[2] Then he reframed it. “Although we’re a restaurant business, I think of it as a digital business. We build our own apps. To secure those, we have between £500 and £600 million a year in the UK flowing through them, so they need to be robust.”[1]

Then came the line that made me sit up. “More than fifty per cent of the traffic on our website is bad actors. I think part of that is we’re a really well-loved teen brand. Any teen with hacking skills thinks, ‘Well, I really like Nando’s.’”[1]

Read this as my editorial opinion, sharply put. Nando’s is not the exception in the British economy. Nando’s is the rule. The FTSE 100 attention space has trained a generation of security professionals, regulators, and journalists to treat the well-resourced enterprise SOC as the reference architecture. It is not. The reference architecture for most of the British consumer economy is what Kirk described next.

Continue reading — subscribe to The Control Layer.

Read more

Subscribe to read the full piece and the rest of the *Trust Is the Growth Engine* series — three pieces this week on what VantaCon UK 2026 told us about how trust is being rebuilt for the AI era.

On the afternoon of 7 May 2026, on the second-stage panel at VantaCon UK, a Vanta moderator opened by asking three of the most senior security leaders in the Global technology ecosystem a deceptively simple question. On a scale from one to ten, where ten means your job is completely different, what is your number?

The answers came back fast. Thibault Candebat, Chief Information Security Officer at Intercom, said eight. Martin Tschammer, Head of Security at Synthesia, said “eight, nine, maybe even ten”. Joanna Chen, CISO of Dashlane, gave the most analytically precise answer of the three — a six or seven on the enablement and operations side, but only a two or three on the defender side, because the fundamentals of protecting a company against attack have not changed; only the timeline has compressed.

I want to label this exchange as the most operationally significant moment of the entire conference, and I want to label that as my analytical reading. Three CISOs of three companies that ship at the leading edge of Technology all said, in three different ways, that the job they were doing eighteen months ago is not the job they are doing now.

Continue reading — subscribe to The Control Layer.

Read more

Subscribe to read the full piece and the rest of the Trust Is the Growth Engine series — three pieces this week on what VantaCon UK 2026 told us about how trust is being rebuilt for the AI era.

On the morning of 7 May 2026, in a converted post-industrial conference space on Aldersgate Street, Vanta opened its third VantaCon UK[1] with a thesis the audit profession has spent the last two decades trying not to confront.

Christina Cacioppo, Vanta’s CEO and co-founder, walked on stage and said it directly. “AI is rewriting trust.”[2] Then, for the next ninety minutes, alongside her Chief Product Officer Jeremy Epling, she made the case that the static, annual, PDF-shaped compliance certificate is a relic, and that the architecture replacing it — continuous assurance, agentic governance, a live trust graph that updates 1,400 times an hour — is no longer five years away. It is shipping now.

That is the most important sentence to come out of any UK security conference this year, and I will mark it as my analytical reading rather than reportage. The reason it matters is not the platform announcement itself. It is what the announcement reveals about who has read the room correctly.

Continue reading — subscribe to The Control Layer

Read more

Share

The framing the episode settles on, in the closing minutes, is a question I have been carrying through board papers and strategy decks for six months: are we automating the work, or are we automating the workers? Khush, asked the question directly, gave the kind of answer that comes from a senior practitioner who has actually had to live with the consequences of his own answer. “At this point of time, we are definitely at a place where we are automating the work and not the workers. We are just freeing up their time to do more meaningful things.”[2] He then flagged the harder follow-on with the same directness: “will the size be decreased or are we going to have smaller teams is really hard to say.”[2]

I want to label that as my analytical reading rather than as the podcast’s narration: the work-versus-workers question is not yet decided in the GRC profession; it is being decided, in real time, by every senior leader making this year’s hiring plan. The conversation with Khush is a window into how one of those leaders is currently making it.

The 24/7 GRC engineer, on the record

The headline product launches at VantaCon UK 2026 have been covered elsewhere — including, with considerable analytical depth, in three pieces of mine going up across the next ten days, the schedule for which sits at the bottom of this post. What the studio conversation adds is the operational picture from inside Vanta’s own GRC function. Khush is, by his own description, the platform’s customer zero — using the product he sells, making the same decisions about what to automate and what to keep in human hands that every other Senior Director of GRC in the UK and EU is making.

Three lines from the episode are worth pulling out before the audio is heard.

The first is on whether continuous monitoring has crossed from maturity-marker to operational baseline. “Earlier, continuous monitoring used to be like a maturity thing. We are mature, we have these technical controls which are being continuously monitored. Now it is table stakes.”[2] The phrase “table stakes” lands harder when the speaker is a Senior Director of GRC at a continuous-assurance platform than when it lands in a vendor pitch deck — Khush is, in effect, conceding the ceiling of his own maturity-curve sales argument. The buyer who treats continuous monitoring as a maturity initiative in the second half of 2026 is, on this account, two years late.

The second is on the talent pipeline below the player-coach. “It does concern me about the people who are graduating now and the people who are coming in the industry fresh and new... Without a lot of growth and headcount, there will be certain restrictions. So maybe they need to pivot and retrain on AI.”[2] That is candour about a structural concern most of the industry is not yet talking about with this level of directness. The false-economy risk — automating the entry-level roles in 2026 and discovering in 2030 that the senior bench has no replacement candidates — is the part of the AI-rewriting-GRC thesis that warrants its own podcast, and it is the thread I expect to pull on hardest in Part 2 of the Trust Is the Growth Engine series on Wednesday.

The third is on accountability when the agent is wrong. “Don’t just trust the agents — trust the agency that you build, and trust the systems that you build around the agents. Because in the end, your audits are not happening on your agents and how well the agents are doing. The audits are happening on your systems and your scope.”[2] That is the cleanest single articulation of the agentic-AI accountability thesis I have heard in six months of conference attendance. The audit happens at the system and at the scope. The agent is a tool that operates inside both. The accountability stays with the agency that designs the system and defines the scope. Khush gave me that line; I am stealing it for Part 2 of the series; he gets the citation.

The Asimov problem in modern dress

The conversation kept landing on a framing I want to surface explicitly because the podcast itself only implies it. An agentic GRC system is, structurally, an Asimov problem in modern dress — a class of intelligent operator that follows its instructions logically, reaches conclusions that look correct on the rules-as-given, and produces outcomes the principals did not anticipate. Isaac Asimov’s Three Laws of Robotics, articulated in I, Robot in 1950, are now a seventy-five-year-old literary device.[3] They remain, in 2026, the cleanest analytical handle for the question who is accountable when the agent is wrong. Asimov wrote the laws to surface the exact regress problem an agentic platform now operationalises commercially: rules followed faithfully, outcomes that surprise the rule-givers, and a genre of accountability that the legal and regulatory layers have not yet caught up to.

Khush is, on the evidence of this episode, working that problem at three layers simultaneously — the agent layer (evals against ground-source-truth defined by ex-GRC, ex-auditor, ex-assessor subject-matter experts inside Vanta), the agency layer (the controls, the systems, the human-in-the-loop sign-off), and the scope layer (what is actually being audited, by whom, against which framework). The point of the “trust the agency” framing is that the second and third layers are where the operating reality lives. The first layer is a technical question; the second and third are the organisational ones that decide whether the technical question gets answered well.

The DeLorean question

Towards the end of the episode I asked Khush the question I have been asking every guest of the studio: if you were in the DeLorean from Back to the Future and you only had fuel to go back two years, what would you tell yourself about what was coming?[4] His answer was specific. Two years ago, he had been struggling to automate as many security controls as possible and getting steady feedback from product and engineering teams that the audit-prep work was eating the calendar. “I would tell myself this is all going to be solved... With agents on top of really good GRC automation tools and trust management platforms like Vanta, this will all become a reality. I wouldn’t have known at that time.”[2]

That is the operational answer. The strategic answer Khush gave alongside it is the one that should travel further. “Governance as meetings and committees and people and RACIs is not going to keep up for AI.”[2] When a senior practitioner describes the orthodox governance machinery as structurally inadequate for the technology it is meant to govern, the question is no longer whether the model needs to change. The question is who is currently writing the next one. The conference circuit answer in May 2026 is that the platforms are writing it faster than the regulators are. That is a real fact, and it is the question the Trust Is the Growth Engine series argues UK and European boards should be commissioning rather than waiting on.

What is coming in the series

The Trust Is the Growth Engine series — three pieces, paid-subscription, each behind a 200-word free preview — uses the VantaCon UK 2026 keynote and panel content, plus the Khush interview that aired today, to make the analytical case across three distinct vantage points.

Part 1 publishes on Monday 18 May 2026. It is the platform piece — a constructive analysis of the agentic trust platform, the trust graph, and the three places the architecture is asking to be tested: the regress problem, the lock-in problem, and the sovereignty problem that every UK board paper should now be commissioning about every US-headquartered SaaS platform that holds critical metadata. The Khush interview informs the regress-problem and the sovereignty critiques in particular; the picture on his account is more textured than the conference narrative implied.

Part 2 publishes on Wednesday 20 May 2026. It is the player-coach CISO piece — built around the VantaCon panel where senior security leaders at Intercom, Synthesia, and Dashlane rated the change in their job at eight, eight, and nine out of ten in eighteen months, and extended with Khush’s account of the GRC team transformation at Vanta itself. This is the piece that picks up the talent-pipeline thread Khush raised in the episode.

Part 3 publishes on Monday 25 May 2026. It is the Nando’s piece — Jason Kirk, the CISO of one, the Minimum Viable Security framing, and what the British consumer economy actually looks like beneath the FTSE 100 surface. This is the piece I expect to travel furthest on social.

Each is a paid post; each carries a 200-word free preview; each ends on a falsifiable predictive judgement with a date and a list of signals to track.

The bottom line

The most useful thing the conversation with Khush did was not to give me a single quotable handle to lift onto a social card. It was to confirm, from inside the platform of record, that the agentic GRC architecture is being built with the methodological discipline the buyers who are about to commit to multi-year contracts need to see — and that the talent-pipeline question and the sovereignty question are real, are unresolved, and are being held openly by senior practitioners rather than papered over. That is not a vendor posture. That is a working professional articulating the limits of his own product alongside its capabilities, on the record. It is also, by my reading, the register every UK and European GRC conversation should be operating in over the next eighteen months, and is currently not.

The episode is live now. The series starts Monday.

Don’t just trust the agents. Trust the agency you build, and trust the publication that calls its predictions in writing.

The Control Layer publishes weekly. Subscribe free.

Decision-grade analysis on AI, cybersecurity, technology sovereignty, and the geopolitics of the technology stack — written for the board paper, not the timeline. By Amer Altaf, Founder & CEO of Arkava and Managing Editor of The Control Layer.

Subscribe free

Subscribe now

One email a week. No paywalls on the analytical pieces. Unsubscribe in one click.

References

[1]: Vanta. “Vanta Introduces Agentic Trust Platform to Unify Compliance, Risk, and Security Assessments.” Press release, 18 November 2025. . For VantaCon UK 2026 conference details

[2]: Khush Kashyap, Senior Director of Governance, Risk and Compliance at Vanta, in interview with Amer Altaf for (The Control Layer podcast), Episode 06, recorded May 2026, published 14 May 2026. All direct quotations from Kashyap in this article are drawn from the recorded interview transcript; the full audio is available at https://thecontrollayer.arkava.ai.

[3]: Isaac Asimov. I, Robot. Gnome Press, 1950. The Three Laws of Robotics are introduced in the short story “Runaround” (1942) and developed across the Robot and Foundation sequences. The narrative engine of the Robot stories is the systematic surfacing of edge cases in which an actor follows its instructions correctly and produces outcomes the principals did not anticipate — the cleanest mid-twentieth-century literary articulation of the regress problem agentic AI now operationalises commercially.

[4]: Robert Zemeckis (dir.). Back to the Future. Universal Pictures, 1985. The DeLorean question — “if you could go back two years, what would you tell yourself about what was coming?”

Author

Amer Altaf is Founder and CEO of Arkava, a UK and European sovereign AI agentic automation business, and Managing Editor of The Control Layer, the publication where he tracks the convergence of cybersecurity, AI, and the geopolitics of the technology stack. A techUK member, he contributes to industry engagement on UK technology sovereignty policy.

On 22 April 2026, the House Foreign Affairs Committee advanced a bill that gives the Netherlands 150 days to match American export controls on semiconductor equipment — or lose access to the American intellectual property inside every lithography machine ASML has ever built.

The MATCH Act is bipartisan, bicameral, and supported by the leadership of both Foreign Affairs Committees. The American semiconductor industry has not lobbied against it. Brussels has said nothing. And the consequences for every UK and European board paper that depends on the ASML supply chain begin running on a 150-day clock the moment the bill is enacted.

This is a 50-minute solo episode on what that bill actually says, why a Dutch company in Veldhoven now sits at the centre of American economic statecraft, and why the legislative mechanism reveals something uncomfortable about the security justification it has been wrapped in.

▶ Watch the full episode

🎧 Also available on Apple Podcasts and Spotify.

The companion article — fully sourced, with 23 endnotes — is here:

What this episode covers

- The 150-day clock. What the MATCH Act actually says, who introduced it, and why the bipartisan, bicameral co-sponsorship matters more than the headline.

- The silence that tells you everything. The Semiconductor Industry Association, SEMI, Lam Research, and Applied Materials have not issued a single public statement opposing the bill. That silence is the data point.

- The honest acknowledgement I owe the security argument. China is building a state-subsidised semiconductor industry with explicit military applications. The security concern is real. The MATCH Act is not primarily a security instrument.

- A company in Veldhoven that has no substitute. ASML’s 100 per cent monopoly on EUV lithography, the €32.7 billion 2025 revenue, and the Cymer light source acquisition that gave Washington the key.

- How Washington holds the key. The Foreign Direct Product Rule, the Cymer IP, and the legal doctrine that lets the United States claim jurisdiction over machines it did not build, manufactured in countries where it has no presence.

- The death of consensus. Why the Wassenaar Arrangement — the consensus-based framework that governed allied export controls since the Cold War — has been bypassed without ceremony.

- The silence from Brussels. What the European Commission’s non-response reveals about the structural incapacity of EU governance on extraterritorial coercion.

- What Sarah’s board paper must now say. The recommendation that cannot be softened: a named, quantified, irreducible single-vendor dependency with no current mitigation.

- The MATCH Act prediction. A falsifiable judgement about the European Commission’s response by April 2027 — with the signals that will tell you whether the prediction is on track.

The closing argument. Seven words that hold the whole thesis.

Why this one matters

Parts 1 and 2 of this series were about preconditions Washington cannot control — the chemistry of aluminium, the geology of helium. Part 3 is different. Part 3 is about the precondition Washington is now attempting to weaponise: the equipment, the machines, the single company that makes the tools without which no advanced semiconductor can be fabricated anywhere on earth.

The argument I want to make here — and I want to label it as my analytical position — is that the MATCH Act is not primarily a security instrument. It is a commercial protection instrument dressed in security language. The security rationale is genuine but partial. The commercial rationale — equalising the competitive damage across allied and American vendors — is the structural driver. And the mechanism chosen to deliver both — extraterritorial coercion of sovereign allies — is the part that European policy has not yet reckoned with honestly.

The predictive judgement

Within 12 months — by April 2027 — the European Commission will publish a formal legislative proposal for a Chips Act 2.0 that includes, for the first time, a sovereign equipment supply chain pillar with a dedicated budget line for reducing U.S.-origin IP dependency in European-manufactured semiconductor equipment. The episode walks through the falsification conditions and the four signals to watch.

Read the written analysis

The full written companion piece — with 23 numbered endnotes, the complete reference list, and three Substack Recommends targets Chris Miller, Gregory Allen, Adam Tooze — is published alongside this episode at

If the analytical thread of this series matters to your board paper, your portfolio, or your policy brief — subscribe. Free. One email a week. The next piece is on the data jurisdiction.

The next piece is on the data jurisdiction — the CLOUD Act and the landlord who reads your post.

Subscribe to The Control Layer to get Part 4 of the Four Chokepoints series the morning it drops — one piece a week, free, in the same register. From Amer Altaf, Managing Editor.

The Control Layer publishes weekly. Subscribe free.

Decision-grade analysis on AI, cybersecurity, technology sovereignty, and the geopolitics of the technology stack — written for the board paper, not the timeline. By Amer Altaf, Founder & CEO of Arkava and Managing Editor of The Control Layer.

Subscribe free

Subscribe now

One email a week. No paywalls on the analytical pieces. Unsubscribe in one click.

Two monopolies died on 24 April: NVIDIA’s grip on launch-day silicon, and the assumption that frontier-like performance was worth the closed-source premium.

On the morning of 24 April 2026, a Chinese laboratory most British boardrooms still cannot pronounce correctly released a 1.6-trillion-parameter language model under the MIT licence, posted the technical paper to Hugging Face, and walked off whistling.[1] By the end of the same day, four separate Chinese chipmakers — Huawei Ascend, Cambricon, Hygon Information,

and Moore Threads — announced that DeepSeek V4 was already running, in production, on their hardware.[2] Within seventy-two hours, the independent benchmark roundups had begun to settle, and a picture emerged that was harder to dismiss than the headlines made it sound. On most of the evaluations that matter for enterprise procurement, V4 Pro was at parity with GPT-5.4 and Claude Opus 4.6 — performance that had been considered exceptional, frontier-grade, the bleeding edge of the field, four weeks earlier.[3]

Two sentences. Read them twice.

For roughly a decade, “Day 0 launch support” — the privilege of waking up on the morning a major model drops and finding it already optimised for your silicon — was a courtesy NVIDIA extended to itself. Every other chip vendor on earth queued up behind, hoping to ship a passable inference path within a few months. For roughly a decade, frontier-class performance had also been a privilege. The bleeding edge was where the value lived; everything below the bleeding edge was where one settled, with apologies to the budget. That is the assumption that has just gone, along with the queue.

Jensen Huang reportedly described the demonstration of V4 running on Huawei chips as “a disaster”.[4] The choice of word is interesting. Not a setback. Not a competitive challenge. A disaster. You do not reach for that vocabulary unless something load-bearing has just snapped — and what snapped was, in fact, two things at once.

The first thing to break was the deployment economics of frontier-class inference: NVIDIA’s quiet, durable, decade-long monopoly on launch-day silicon support. The second thing to break, less reported but more consequential for almost every enterprise reading this, was the assumption that the closed-source frontier was the only place to get usable, mature, mid-market-grade artificial intelligence. Because as of 24 April, frontier-class capability — capability the field considered exceptional one month earlier — has come down the pricing curve by roughly an order of magnitude, and it has done so under an MIT licence that lets you fine-tune the weights for your own organisation’s specialist needs. Closed APIs cannot match that. Not by design. Not by any feature roadmap that does not require a fundamental change to the closed-source business model.

This piece is the analytical note for both. What V4 actually is. What it actually does. What silicon it actually runs on. Why the absolute bleeding edge no longer answers most procurement questions. And why the open-weight option, with weights you can fine-tune for the specific shape of your organisation, has just become the default architecture for serious enterprise AI in a way that almost nobody on a procurement committee has yet sat down to think through.

What DeepSeek V4 actually is

Two checkpoints went up on Hugging Face on launch day.[5]

V4 Pro is a 1.6-trillion-parameter mixture-of-experts model with 49 billion active parameters per token. V4 Flash is the lightweight sibling — 284 billion total, 13 billion active. Both ship with a one-million-token context window. Both are released under an MIT licence, which means any organisation with the inference budget can take the weights, modify them, host them on its own infrastructure, fine-tune them on its own data, and deploy them commercially without phoning anyone for permission.

A mixture-of-experts model, for readers who have been reasonably busy with their actual jobs, is a bit like the British civil service in the Yes Minister sense: a vast institution containing many specialised departments, of which only a small number are doing any work on any given question. The genius is not that the institution is small — it is enormous — but that the routing is efficient. You activate the experts you need, leave the rest dormant, and the bill arrives only for the bit that actually answered the question. Nobody outside computer science thought this was an architecture worth getting excited about until DeepSeek made it the only architecture that mattered.

The V4 paper is a sober technical document containing two genuine engineering innovations.[6] The first is the Hybrid Attention Architecture: a combination of Compressed Sparse Attention and Heavily Compressed Attention that, in plain English, allows the model to look at very long documents without melting the GPU. At a one-million-token context, V4 Pro requires only 27 per cent of the per-token inference computation of its predecessor V3.2, and 10 per cent of the key-value cache memory. V4 Flash drops these further still — 10 per cent of the FLOPs and 7 per cent of the cache.[7]

The second is Manifold-Constrained Hyper-Connections, a phrase that does the impossible feat of being even less marketable than its acronym (mHC). What it does is keep the signal stable as it propagates through the deep stack of a 1.6-trillion-parameter network. This matters because most attempts to scale MoE architectures have failed not on capability but on stability — the network either stops learning or starts learning the wrong things, in ways that look fine on the metrics dashboard until they don’t. mHC is, on the evidence so far, a real solution to that problem.[6]

Trained on more than 32 trillion tokens, using a relatively new optimiser called Muon, with mixed-precision training (FP4 for the MoE experts, FP8 for the rest of the parameters). These are the technical details a senior infrastructure engineer would want to see; everyone else can take it on trust that the engineering is serious.[6]

Two frontiers, two stories — and the one that matters for procurement

There are two honest answers to the question “how does V4 Pro compare to the Western frontier?” They are answering different questions, both questions matter, and the one with implications for the line-by-line of an enterprise IT budget is not the one that has dominated the headlines.

The first answer is DeepSeek’s own. The V4 technical paper benchmarks V4-Pro-Max against GPT-5.4, Claude Opus 4.6, and Gemini 3.1 Pro — the frontier models OpenAI, Anthropic, and Google had shipped as of the point V4 was being engineered. Those models, on 23 April 2026, were the absolute bleeding edge of large language modelling. The state of the art. The reason every Chief Information Officer in the City was being walked into the same enterprise pitch about why the closed frontier was the only credible deployment path. On those comparators, the picture V4 draws is striking.[8]

On MMLU-Pro, the standard knowledge-and-reasoning benchmark, V4 Pro scores 87.5 — exactly tied with GPT-5.4 at 87.5 and within touching distance of Opus 4.6. On SWE-bench Verified, the most widely cited software engineering benchmark, V4-Pro-Max scores 80.6, against Opus 4.6 Max at 80.8 and Gemini 3.1 Pro at 80.6 — a three-way tie within a single percentage point. On MCPAtlas Public, the tool-use and agent-coordination evaluation, V4-Pro-Max scores 73.6 to Opus 4.6 Max’s 73.8: again, parity. On LiveCodeBench, V4 Pro reaches 93.5 — ahead of Gemini 3.1 Pro at 91.7 and Claude Opus 4.6 at 88.8. On Codeforces, the live competitive programming rating, V4 Pro registers 3206 against GPT-5.4 at 3168. Ahead of GPT-5.4 on Codeforces. The model the world’s leading AI laboratory shipped, in 2026, as its single most expensive coding asset.

DeepSeek’s one-line summary of where V4-Pro-Max sits, in the paper itself: it “beats GPT-5.2 and Gemini-3.0-Pro on reasoning, trails GPT-5.4 / Gemini-3.1-Pro by approximately three to six months, and on internal agent evaluations surpasses Claude Sonnet 4.5 while approaching Opus 4.5.”[8] Three to six months. That is the manufacturer’s claim, in a paper that any of the labs being compared can refute, and so far none of them have.

The second answer is CAISI’s. The US Center for AI Standards and Innovation, the NIST evaluator that produces the most rigorous independent benchmarks of frontier models, ran V4 Pro on nine held-out and uncontaminated benchmarks — including the ARC-AGI-2 semi-private dataset and the agency’s internal PortBench software-engineering test. CAISI’s framing in May was that V4 “performs similarly to GPT-5, which was released about eight months ago,” and that V4 “is the most capable PRC model to date across the domains we evaluated.”[9]

Both framings are true. They answer two different questions.

Where does V4 sit relative to the absolute bleeding edge today? CAISI’s answer: roughly eight months behind GPT-5.5.

Where did V4 land relative to the frontier it was actually engineered against — the frontier the entire industry called state-of-the-art four weeks before V4 was released?

DeepSeek’s answer, supported by the independent benchmark roundups: at parity with GPT-5.4 and Opus 4.6, ahead on competitive coding, behind only on the hardest agentic and graduate-level reasoning tasks where the latest GPT-5.5 and Opus 4.7 have pulled clear.[10]

The procurement-relevant question is not which model holds today’s marginal lead? It is what level of capability does my workload actually require, and what is the price gap between getting that level from the closed frontier versus getting it from the open-weight option?

If the Premier League framing helps: V4 Pro is sitting where last season’s title-winning side finished — on the same points total, with the same trophy cabinet, in the same tier of the table. The current title-winners (GPT-5.5 and Opus 4.7) have pulled a few points clear at the top of this season’s table. Nobody is suggesting V4 Pro be relegated. The transfer market — every Chief Information Officer with an inference budget — has just acquired a new option who plays at trophy level for a fraction of the wage bill, and who, unlike the rented stars at the top of the table, can be coached into the specific tactical system the manager actually wants to play.

The capability that won last May has, four weeks later, become the affordable mid-tier capability of this June. That is the speed of commoditisation in the open-weight frontier, and it is the part of the V4 launch that has not yet been priced into a single Western enterprise IT roadmap I have seen this quarter.

The training stack you have probably been told wrong about

This is the part where I owe the reader a correction, because the headline most British technology coverage led with — DeepSeek V4 trained entirely on Huawei chips — is not what happened.

DeepSeek’s own disclosure, confirmed by independent reporting from The Register and ChinaTalk, is that the V4 training run used a hybrid stack: NVIDIA H800 GPUs and Huawei Ascend 910C accelerators.[11] The technical paper itself only states, in passing, that the team validated its expert-parallel scheme on both NVIDIA and Ascend platforms. Independent analysis — and the laws of physics governing large-scale pre-training stability — strongly suggests that the main pre-training run, where stability and scale matter most, relied on the mature NVIDIA infrastructure. Huawei silicon was used in the post-training and reinforcement learning stages, where stability is more forgiving and the workload maps more comfortably onto the Ascend architecture.[12]

The model that has been described to British boardrooms as the first frontier model trained fully on Chinese chips is, in fact, the first frontier model whose training run included Chinese chips at all. That is a genuine achievement, but it is a different achievement, and the difference matters when a Chief Information Officer is making a procurement decision about whether the Chinese AI stack is now a credible end-to-end alternative to the American one.

The honest answer, in May 2026, is not yet, and not for training.

The honest answer for inference — for the deployment side, where almost every enterprise dollar is actually spent — is more interesting. Because that is the factor that has actually shifted.

The day the queue dissolved (the first monopoly that died)

When DeepSeek released V4 on 24 April, four Chinese chipmakers had production-ready inference paths live by the end of the same trading day.[2]

Huawei Ascend’s full product line — A2, A3, and the new 950 — supported both V4 Pro and V4 Flash from launch. The Ascend 950 specifically was demonstrated running V4 Pro using fused kernels and multi-stream parallelism, with combined quantisation, at high throughput and low latency. Cambricon completed Day 0 adaptation through the open-source vLLM inference framework. Hygon’s Deep Computing Unit had its own inference pathway live and the supporting code published. Moore Threads, the smallest of the four, hit launch-day compatibility on its own GPU architecture.

Reread that paragraph. Then consider what it would have looked like in 2025: NVIDIA optimisation in the morning, AMD support a few weeks later, Intel hopefully by the end of the quarter, everyone else when they could manage. Day 0 collective adaptation by the entire Chinese domestic chip ecosystem — Huawei Ascend, Cambricon, Hygon, Moore Threads, all live, all production-grade, all on the same morning — has never happened before for any frontier-class model on any non-NVIDIA hardware anywhere on earth.

This is the factor that has changed. It is not that DeepSeek V4 has reached parity with the latest GPT-5.5 (it has not). It is not that Huawei Ascend can train a 1.6-trillion-parameter model from cold (it cannot, yet). It is that the deployment economics of frontier-class inference are no longer NVIDIA-monopolised. There is now a Chinese stack — model, framework, silicon, optimisation, ecosystem — that runs end-to-end without American hardware on the inference side.

For a UK or European board that has spent the last three years writing capital expenditure forecasts predicated on NVIDIA H100 and Blackwell allocations being the unavoidable bottleneck of any sovereign AI deployment, this is not an academic shift. The Ascend 950 supernodes — Huawei’s data-centre-scale clustered configuration — are scheduled for volume shipment in the second half of 2026.[13] If those ship on time and at the prices Huawei is briefing, the entire NVIDIA-or-nothing logic of European cloud procurement, which Part 3 of the Four Chokepoints series argued was the factor Washington was attempting to weaponise via the MATCH Act, has just acquired its first credible alternative.[14]

That alternative comes, of course, with its own jurisdiction problem. A European bank that cannot lawfully run customer data through a US cloud provider under the CLOUD Act is not going to find Huawei a more comfortable jurisdiction. But the procurement question is no longer NVIDIA or unavailable. It is now NVIDIA or Huawei or unavailable — and the introduction of a third option, even a politically uncomfortable one, fundamentally changes the negotiating posture of every conversation a CIO is now having with a US hyperscaler about pricing, terms, and capacity allocation.

Jensen Huang’s “disaster” reaction is, when you put the calendar on it, the rational reaction of a chief executive who has just watched his company’s structural pricing power degrade in a single news cycle. NVIDIA’s commercial position is not collapsing — at the GTC keynote in San Jose on 16 March, Huang himself raised guidance for combined Blackwell and Vera Rubin orders to $1 trillion through 2027, double the $500 billion through-2026 figure he gave at GTC 2025.[15] But the launch-day monopoly has gone, and once a monopoly goes, it does not come back without a structurally different policy intervention. Doubling the order book and losing the launch-day monopoly are not contradictory data points — they are the same data point. NVIDIA’s position is tighter at the top, more contested at the edges, and the edges are where margin compression eventually shows up.

Reading this far?

Subscribe to The Control Layer for one piece a week in this register — AI, cybersecurity, sovereignty, and the geopolitics of the technology stack. Free.

Subscribe now

The inference economics: Aldi has come for the Champagne aisle (the second monopoly that died)

The pricing is the part of the V4 launch that should have triggered an immediate procurement review at every UK and European organisation running enterprise AI workloads at scale.

DeepSeek V4 Flash, the lightweight commercial variant, costs $0.14 per million input tokens and $0.28 per million output tokens. The Pro variant, at full list price, is $1.74 per million input cache-miss tokens and $3.48 per million output tokens; until 5 May 2026, the company is running a 75 per cent introductory discount, putting the effective rate at $0.435 input and $0.87 output.[16] Cache hits — where the application is sending a substantially repeated prompt prefix — drop the effective input cost to $0.03 per million.

Compared with Claude Opus 4.6, V4 Pro is roughly 11.6 times cheaper on input tokens and approximately 28.7 times cheaper on output tokens.[17] Compared with the latest GPT-5.5 ($30 per million output) or Opus 4.7 ($25 per million output), V4 Pro is 8 to 9 times cheaper on output. V4 Flash is somewhere between 90 and 100 times cheaper than the closed-source frontier on the same metric.[18] CAISI’s own assessment confirms that V4 was more cost-efficient than GPT-5.4 mini — OpenAI’s most cost-competitive contemporary model — on five of seven benchmarks tested.[9]

For a long time, the running joke about Chinese open-weight models was that they were the Aldi of foundation AI: cheaper, no-frills, fine for the tea-and-toast portion of the workload but obviously something different from the Waitrose ready meal you would put on the table when the in-laws were visiting. As of 24 April, that joke has stopped working. V4 Pro is on the same shelf, in the same aisle, blind-tasted within a percentage point of the branded option, and the price label still says eleven and a half quid less for the same bottle. Aldi has come for the Champagne aisle, and the Champagne is no longer obviously winning the blind taste test.

The complication is that the frontier premium is, in fact, justified by the small subset of workloads where V4 Pro genuinely lags — Terminal-Bench 2.0 agentic engineering, the hardest GPQA Diamond reasoning, the orchestration scaffolding (OpenAI’s Symphony specification, Anthropic’s Model Context Protocol, AWS Bedrock Managed Agents) that the open-weight ecosystem is still assembling. The frontier premium is real. The question for any organisation running production AI workloads is no longer whether the premium exists, but whether the workload actually requires it.

For the ninety per cent of UK enterprise use cases I have seen quoted in procurement requests this year — document summarisation, customer correspondence drafting, structured data extraction, internal search, code completion on bounded codebases, regulatory compliance review, contract analysis, internal Q&A across institutional knowledge — V4 Flash at $0.14/$0.28, or V4 Pro at $0.435/$0.87, is overwhelmingly the rational choice. Not because it is the bleeding edge. Because it is good enough, on the workload that actually pays the bills, at a price that makes the bleeding edge look like an extravagance an audit committee will eventually ask awkward questions about.

That sentence — good enough, on the workload that actually pays the bills, at a price that makes the bleeding edge look extravagant — is the procurement question that most UK and European boards have not yet asked themselves out loud. The release of DeepSeek V4 is the moment they will have to.

Off-the-rack frontier, or Savile Row tailoring?

There is a structural advantage the open-weight option holds over any closed-source API, and it is the part of the V4 release that most cost-comparison articles have undersold. Capability the field considered exceptional one month ago is now available not just at a fraction of the cost, but as weights you actually own. Weights you can fine-tune.

The closed-source frontier — GPT-5.5, Opus 4.7, Gemini 3.1 Pro — is access to bleeding-edge intelligence through a metered API, sitting in someone else’s data centre, in someone else’s jurisdiction, accessed under terms of service that the provider can revise on thirty days’ notice. It is the off-the-rack suit. The cut is excellent. The cloth is the best on the market this season. And it has been built to fit nobody in particular and almost everybody on average.

For a generic workload — summarise this document, draft a polite reply, extract these data fields — off-the-rack is fine. The cut works. Nobody is going to notice you bought the model in your inbox rather than commissioned it.

For a specialist workload, off-the-rack stops being fine. A barrister’s chambers needs a model that has actually read the case law in their practice area, with their preferred citation conventions, on the conventions of English legal drafting rather than American. A diagnostic imaging startup needs a model fine-tuned on the specific modality and pathology classes the radiologists actually report. A defence contractor working on classified material needs a model whose fine-tuning data never crosses a jurisdictional boundary that an export control lawyer will subsequently regret. A mid-market manufacturing business with thirty years of operational documentation needs a model that has read its own thirty years of operational documentation, not the average of every CNC manual on the open web.

These are Savile Row workloads. They need bespoke. They need a tailor who has measured the specific shoulders.

The closed APIs offer fine-tuning, to varying and grudging degrees. None of them offer it in a way that gives the customer ownership of the tailored garment. Your fine-tuning data goes to OpenAI’s servers. The fine-tuned model that emerges still lives on OpenAI’s infrastructure, billable per token, accessible only through the same metered API. The base model can change underneath you with thirty days’ notice, and your fine-tuned variant inherits whatever the underlying provider decides next quarter. You have rented a tailored suit from a rental shop. You did not commission it.

V4 Pro under the MIT licence is a different proposition. The weights are yours. You fine-tune on your own infrastructure, on your own data, against your own evaluation set, and the resulting model is a thing you own that does not change unless you change it. The classified material does not leave your jurisdiction. The base model does not get deprecated by a vendor’s product roadmap. The audit trail of what was the model trained on, on what date, and who has access to the weights is internal to the organisation and reviewable by your own compliance function.

That is a structural advantage no closed API can match, because the closed-source business model depends on the weights staying on the provider’s side of the API boundary. The choice is not between high-quality model with fine-tuning and low-quality model without. It is between bleeding-edge model rented through an API where the tailoring is also rented, and near-frontier model owned outright, where the tailoring is owned and reviewable too.

For any specialist enterprise workload — legal, medical, financial regulatory, defence, scientific research, regulated mid-market — the second option has just become the rational default. The first option survives only for the workloads where the marginal capability gap between V4 Pro and Opus 4.7 demonstrably matters more than the ability to tailor to your specific organisational shape. That is a smaller set of workloads than the procurement function has been told.

The procurement memo nobody has yet written

The honest version of the procurement question, for a UK Chief Information Officer reading this in May 2026, runs something like this.

For workloads that do not require the absolute bleeding edge — and that is most workloads — the rational architecture is now a tiered one: open-weight inference (V4 Flash, V4 Pro, or successors) on commodity infrastructure for the bulk of throughput, with selective routing to the closed-source frontier for the small subset of queries that demonstrably benefit from the additional capability. Anyone telling you the workload is all frontier-grade is either selling you the frontier or has not done the workload analysis.

For specialist workloads — and most enterprise AI is specialist once you look closely — the rational architecture is no longer call the closed frontier and live with the off-the-rack fit. It is take an open-weight model at near-frontier capability, fine-tune it on your own data, and deploy it on infrastructure you control. V4 Pro under the MIT licence has just made that approach not only technically viable but commercially compelling. The fine-tuning advantage is the part of the V4 release that the inference-cost story has overshadowed, and it is the part that compounds.

For sovereign deployment specifically, V4 Pro under the MIT licence can be self-hosted on infrastructure under the operator’s own jurisdiction. This does not solve every sovereignty problem — the model was trained partly on the Chinese chip stack, the underlying training data is opaque, and the geopolitical question of using a Chinese-origin model in regulated UK sectors is its own conversation — but it does fundamentally change the architecture of the discussion. Self-hosted, fine-tuned, frontier-class inference, on UK infrastructure, with weights you control and an inference path that does not depend on a US hyperscaler’s API rate limit, is now technically and commercially viable in a way it was not in 2025.

For the agentic workloads where V4 Pro genuinely lags — autonomous multi-step engineering tasks, complex tool-use orchestration, anything where Terminal-Bench 2.0 is a relevant proxy*** — the closed-source frontier is still the rational choice, and the frontier premium still has to be paid. But the addressable market for that premium has just contracted by, on a back-of-envelope calculation, somewhere between sixty and eighty per cent of total enterprise AI spend.

That contraction is the precise reason Western hyperscaler share prices wobbled in late April even as the four largest US hyperscalers — Amazon at approximately $200 billion, Microsoft at $190 billion, Alphabet at $180–$190 billion, and Meta at $125–$145 billion — pushed combined 2026 infrastructure capital expenditure to a record total in the region of $700 billion to $725 billion.[19] The investor question that broke through the earnings calls was not will the capacity be built? It was will the revenue per token sustain the build at the pace announced? DeepSeek V4 is the data point that turned that question from theoretical to immediate.

The prediction, made to be falsified

Within twelve months — by May 2027 — at least two of the three leading Western frontier API providers (OpenAI, Anthropic, Google) will publish per-million-token output prices at least 50 per cent below their May 2026 levels, with at least one earnings call explicitly citing open-weight competition as a contributing factor.

The signals to watch: pricing-page revisions on openai.com, anthropic.com, and ai.google.dev. Volume-tier renegotiations leaked to The Information or Bloomberg.

Quarterly earnings call commentary referencing “competitive pressure on inference economics” or similar language. The most precise leading indicator will be in the Microsoft Azure OpenAI Service pricing schedule, where reductions in the underlying API rate flow through to enterprise contract renewals on a roughly two-quarter lag.

The prediction is falsifiable. If by May 2027 the listed per-million-token output rates for GPT-5.5, Claude Opus 4.7, and Gemini 3.1 Pro have not fallen by at least 50 per cent from May 2026 baseline on any of the three platforms, the prediction is wrong. Quiet enterprise discounts that do not appear in published rate cards do not satisfy the prediction; volume tier rebates do not satisfy the prediction; the price drop must appear in the public list price.

If it does, the inference-economics moat will have been visibly eroded by open-weight competition within a single year of V4’s release. If it does not, the closed-source frontier will have proved more economically defensible than this analysis implies, and I will publish the correction.

The publication that calls its predictions in writing.

Every Control Layer piece ends with a falsifiable prediction and a list of signals to watch. Subscribe to track them. One email a week. Free.

Subscribe free

Subscribe now

The bottom line

Three things need to be on the procurement agenda this fortnight, and all of them are uncomfortable.

The first is the rate card audit. Every UK and European organisation currently paying for frontier API inference at GPT-5.5 or Opus 4.7 list prices needs to know which of those workloads are genuinely frontier-grade and which are paying the frontier premium for the comfort of the frontier brand. Most procurement functions cannot answer this question today because they have never had to. They will have to now.

The second is the chip stack audit. Anyone whose sovereign AI strategy is currently predicated on NVIDIA being the only viable frontier-class inference silicon needs to spend the next quarter understanding what changes, in their architecture and in their commercial leverage, if Huawei Ascend 950 supernodes ship on time and at the prices Huawei is briefing. The answer may be nothing changes for us, because of the China jurisdiction problem. That is a defensible answer. It is not a defensible answer to not have considered the question.

The third is the architecture audit. The release of V4 Pro under the MIT licence, with the option to fine-tune on your organisation’s own data, on infrastructure your organisation controls, is the moment self-hosted, specialist-tuned, near-frontier inference became a genuine architectural option for serious enterprise deployments. The decision to use it or not use it is not a technology decision. It is a sovereignty, jurisdiction, fine-tuning, and risk-tolerance decision, and it now has to be taken consciously rather than defaulted on.

DeepSeek V4 is not the Sputnik moment its champions claim. It is not the catch-up moment its detractors will dismiss it as next month. It is something more useful and less dramatic than either. It is the specific date — 24 April 2026 — on which two assumptions underpinning Western enterprise AI strategy stopped being true at the same time.

The first assumption was that NVIDIA’s launch-day grip on frontier-class deployment silicon was a fact of nature. It was not. It was a commercial position, and the commercial position has just been contested.

The second assumption was that the closed-source frontier was the only credible deployment path for serious enterprise AI, and that the bleeding edge was where the value lived. It was not. The capability the field considered state-of-the-art four weeks before V4 launched is now available at a fraction of the cost, with weights you can fine-tune for the specific shape of your own organisation, on infrastructure you control. The bleeding edge has its place. Most workloads do not require it. Most workloads require good enough, tailored to the specific job, deployed where you can audit it.

You cannot build a sovereign AI strategy on a single supplier’s silicon. That has, quietly, this fortnight, become an operational fact rather than an aspiration.

You cannot build a serious enterprise AI strategy on the assumption that the bleeding edge is the answer to most of your questions, either. Most of your questions are bespoke. Most bespoke questions deserve a tailored answer. And tailoring, this fortnight, became an open-weight conversation.

The next piece is on the open-weight fine-tuning question UK regulators have not yet asked.

Subscribe to The Control Layer to get the analytical thread continued — one piece a week, free, in the same register. From Amer Altaf, Managing Editor.

Subscribe free

Subscribe now

Amer Altaf is Founder and CEO of Arkava,

a UK and European sovereign AI agentic automation business, and Managing Editor of The Control Layer, the publication where he tracks the convergence of cyber security, technology sovereignty, and geopolitics. A techUK member, he contributes to industry engagement on UK technology sovereignty policy. He is currently writing on cloud security for Oxford University Press’s Expert Essentials series.

TheControlLayer.arkava.ai

References

[1]: DeepSeek AI. DeepSeek V4 Preview Release. DeepSeek API Documentation, 24 April 2026. Technical paper: DeepSeek V4: Towards Highly Efficient Million-Token Context Intelligence, posted to Hugging Face on the same date.

[2]: TrendForce. “Huawei Ascend, Cambricon and Hygon Completed Day 0 Adaptation to DeepSeek-V4.” 29 April 2026. Corroborated by Digital Quotient India, “Huawei Ascend, Cambricon, and Hygon complete Day 0 adaptation to DeepSeek-V4,” and Cryptopolitan, “DeepSeek adds vision as China’s chip supply chain shows it can finally keep pace,” April 2026.

[3]: Performance framing per the DeepSeek V4 technical paper and independent benchmark roundups. The DeepSeek paper benchmarks V4-Pro-Max against GPT-5.4, Claude Opus 4.6, and Gemini 3.1 Pro and characterises the position as “trailing GPT-5.4 / Gemini-3.1-Pro by approximately three to six months.” See [8] for benchmark detail and [9] for the CAISI evaluation against the more recent GPT-5.5 frontier.

[4]: Reported by 36Kr (EU edition), “Jensen Huang Labels It a ‘Disaster’: DeepSeek Runs Successfully on Huawei Chips,” April 2026. Quote attribution should be treated as second-hand reporting; no direct NVIDIA press confirmation has been issued at time of writing.

[5]: Hugging Face. deepseek-ai/DeepSeek-V4-Pro model card, and deepseek-ai/DeepSeek-V4-Flash model card, . Both released 24 April 2026 under MIT licence. Hugging Face technical blog: “DeepSeek-V4: a million-token context that agents can actually use,” .

[6]: DeepSeek AI. DeepSeek V4 Technical Report (PDF), released 24 April 2026 via Hugging Face. Architecture details: Hybrid Attention (Compressed Sparse Attention + Heavily Compressed Attention), Manifold-Constrained Hyper-Connections, Muon optimiser, mixed precision (FP4 for MoE experts, FP8 for remaining parameters), pre-trained on more than 32 trillion tokens.

[7]: DeepSeek V4 Technical Report (above) and Hugging Face technical blog. At one-million-token context, V4 Pro requires 27 per cent of single-token inference FLOPs and 10 per cent of KV cache memory compared with V3.2. V4 Flash requires 10 per cent of FLOPs and 7 per cent of KV cache.

[8]: Benchmark figures from the DeepSeek V4 technical paper and corroborated by independent comparison reporting. MMLU-Pro: V4-Pro 87.5, GPT-5.4 87.5. SWE-bench Verified: V4-Pro-Max 80.6, Opus 4.6 Max 80.8, Gemini 3.1 Pro 80.6. MCPAtlas Public: V4-Pro-Max 73.6, Opus 4.6 Max 73.8. LiveCodeBench: V4-Pro 93.5, Gemini 3.1 Pro 91.7, Opus 4.6 88.8. Codeforces rating: V4-Pro 3206, GPT-5.4 3168. Terminal-Bench 2.0: V4-Pro-Max 67.9, Gemini 3.1 Pro 68.5, GPT-5.4 xHigh 75.1. Sources: Hugging Face technical report summary at https://huggingface.co/deepseek-ai/DeepSeek-V4-Pro/discussions/129; OfficeChai, “DeepSeek Releases V4-Pro & V4-Flash, Delivers GPT 5.4 & Opus 4.6-Level Performance At Fraction Of The Price,”; NxCode, “DeepSeek V4 vs Claude Opus 4.6 vs GPT-5.4: AI Coding Model Comparison,”; Verdent, “DeepSeek V4 vs Claude Opus 4.6 vs GPT-5.5 for Agentic Coding,” ; Funda AI, “DeepSeek V4 vs Claude vs GPT-5.4: A 38-Task Benchmark,” ; Simon Willison, “DeepSeek V4 — almost on the frontier, a fraction of the price,”.

[9]: U.S. National Institute of Standards and Technology, Center for AI Standards and Innovation (CAISI). “CAISI Evaluation of DeepSeek V4 Pro.” May 2026. CAISI’s evaluation included nine benchmarks across cyber, software engineering, natural sciences, abstract reasoning, and mathematics, including two held-out and uncontaminated benchmarks: ARC-AGI-2 (semi-private dataset) and CAISI’s internal PortBench software-engineering evaluation. CAISI’s framing: V4 “performs similarly to GPT-5, which was released about eight months ago” and is “the most capable PRC model to date across the domains we evaluated.”

[10]: Galaxy.ai composite-score comparison, “Claude Opus 4.6 vs DeepSeek V4 Pro,” . Composite weighted-average benchmark scores: Claude Opus 4.7 8.72, Claude Opus 4.6 (Thinking) 8.72, DeepSeek V4 Pro 8.27, Claude Opus 4.6 (standard) 8.17. V4 Pro sits between standard Opus 4.6 and Opus 4.6 with extended-thinking mode enabled.

[11]: The Register. “DeepSeek’s new models offer big inference cost savings,” 24 April 2026. . ChinaTalk Media. “DeepSeek V4”. Both report DeepSeek’s disclosure that V4 training used both NVIDIA H800 GPUs and Huawei Ascend 910C accelerators.

[12]: AIproem. “Part 2: What DeepSeek V4 means for Huawei and Nvidia.”. The China Academy. “Why DeepSeek V4 Hasn’t Fully Cut Ties with Nvidia.”. The DeepSeek V4 paper itself states only that the team “validated its fine-grained EP scheme on both NVIDIA GPUs and Ascend NPU platforms.”

[13]: Fortune. “DeepSeek unveils V4 model, with rock-bottom prices and close integration with Huawei’s chips.” 24 April 2026. DeepSeek pricing guidance suggests V4-Pro inference costs are scheduled to fall further once Ascend 950 supernodes reach volume shipment in the second half of 2026.

[14]: Altaf, Amer. “The equipment chokehold: ASML, the MATCH Act, and the end of the allied exemption.” The Control Layer, 28 April 2026. Part 3 of the Four Chokepoints series.

[15]: CNBC. “Nvidia GTC 2026: CEO Jensen Huang sees $1 trillion in orders for Blackwell and Vera Rubin through ‘27.” 16 March 2026. TechCrunch. “Jensen Huang just put Nvidia’s Blackwell and Vera Rubin sales projections into the $1 trillion stratosphere.” 16 March 2026. Data Center Knowledge. “GTC 2026: Nvidia Unveils Vera Rubin AI Platform, Eyes $1T by 2027.” The $1 trillion through-2027 figure represents a doubling of the $500 billion through-end-of-2026 guidance issued at GTC 2025.

[16]: DeepSeek AI. Models & Pricing (USD pricing schedule). V4 Flash: $0.14 per million input tokens, $0.28 per million output. V4 Pro list price: $1.74 per million cache-miss input, $3.48 per million output. Discount of 75 per cent on V4 Pro running until 5 May 2026, putting effective rates at $0.435 / $0.87. Cache-hit input: $0.03 per million.

[17]: Galaxy.ai cost-comparison data, “Claude Opus 4.6 vs DeepSeek V4 Pro,”. Anthropic Claude Opus 4.6 list pricing implies V4 Pro is approximately 11.6× cheaper on input tokens and approximately 28.7× cheaper on output tokens at full V4 Pro list price.

[18]: VentureBeat. “DeepSeek-V4 arrives with near state-of-the-art intelligence at 1/6th the cost of Opus 4.7, GPT-5.5.” April 2026. Output token comparison: GPT-5.5 listed at approximately $30 per million output tokens; Claude Opus 4.7 at approximately $25 per million output tokens. V4 Pro at $3.48 per million output is approximately 8–9× cheaper than the latest closed frontier; V4 Flash at $0.28 per million output is approximately 90–100× cheaper.

[19]: Hyperscaler 2026 capital expenditure figures aggregated from Q1 2026 earnings disclosures: Microsoft Corporation, Q3 FY2026 earnings call, 29 April 2026, raising calendar-2026 capex guidance to approximately $190 billion (CNBC, “Microsoft calls for $190 billion in 2026 capital spending on soaring memory prices,” ); Alphabet Inc., Q1 2026 earnings, 29 April 2026, raising full-year 2026 capex guidance to $180–$190 billion from $175–$185 billion (CNBC, “Alphabet (GOOGL) Q1 2026 earnings,” ); Meta Platforms Inc., Q1 2026 earnings, 29 April 2026, raising 2026 capex guidance to $125–$145 billion (CNBC, “Meta Q1 2026 earnings report,”); Amazon.com Inc., Q1 2026 earnings, 29 April 2026, with CEO Andy Jassy committing approximately $200 billion in calendar-2026 capital expenditure (CNBC, “Amazon (AMZN) Q1 earnings report 2026,”). Combined Big Four total reported by Tom’s Hardware as a record $725 billion ; OfficeChai cites $715 billion.

The Control Layer publishes weekly. Subscribe free.

Decision-grade analysis on AI, cybersecurity, technology sovereignty, and the geopolitics of the technology stack — written for the board paper, not the timeline. By Amer Altaf, Founder & CEO of Arkava and Managing Editor of The Control Layer.

Subscribe free

Subscribe now

One email a week. No paywalls on the analytical pieces. Unsubscribe in one click.

On 22 April 2026, the House Foreign Affairs Committee advanced by a substantial bipartisan margin a bill that gives the Netherlands 150 days to match American export controls on semiconductor equipment — or lose access to the American intellectual property inside every lithography machine ASML has ever built.[1]

The bill is the Multilateral Alignment of Technology Controls on Hardware Act. The MATCH Act. H.R. 8170, 119th Congress, introduced on 2 April by Representative Michael Baumgartner of Washington State, with a Senate companion — S. 4281 — sponsored by Senators Pete Ricketts and Andy Kim and co-sponsored by Senate Majority Leader Chuck Schumer and the Chairman of the Senate Foreign Relations Committee, Jim Risch.[2] Bipartisan. Bicameral. Committee leadership on both sides of the aisle. This is not a messaging bill sitting on a shelf. This is the formal codification of a structural shift in how Washington treats its allies.

In Part 1 of this series, I described the Hormuz blockade as the moment the post-war bargain inverted — the moment the arrangement that once underwrote European security began pricing European prosperity instead. In Part 2, I argued that you cannot procure sovereignty on imported metal — that the aluminium and helium chokepoints exposed a physical substrate that European digital sovereignty has never costed. Part 3 is different. Parts 1 and 2 were about preconditions Washington cannot control — the chemistry of aluminium, the geology of helium. Part 3 is about the precondition Washington is now attempting to weaponise. The equipment. The machines. The single company in Veldhoven that makes the tools without which no advanced semiconductor can be fabricated anywhere on earth.

The argument I want to make in this piece has two halves.

The first is structural: the allied exemption — the diplomatic consensus that allowed European technology companies to trade with relative autonomy inside a multilateral framework — is formally dead.

The second is political: the instrument Washington has chosen to kill it reveals something uncomfortable about the stated justification for the entire technology embargo. And the two halves connect in the board paper Sarah is writing this week, because the practical consequence for every UK and European organisation is the same: the technology supply chain your procurement function relies on now runs through a jurisdiction you do not control, under rules you did not set, on a timeline you cannot negotiate.

What the MATCH Act actually says

The legislation is precise, and the precision is the point. The MATCH Act establishes a country-wide prohibition on the sale and servicing of what it calls “chokepoint” semiconductor manufacturing equipment to fabrication plants inside China.[1] The covered facilities are named: ChangXin Memory Technologies, Hua Hong, Huawei, Semiconductor Manufacturing International Corporation, Yangtze Memory Technologies Corporation, and all their subsidiaries and affiliates. The prohibited equipment categories include deep ultraviolet immersion lithography and cryogenic etch tools — the two classes of machine that China cannot manufacture domestically and without which advanced-node chip production is physically impossible.

For allied vendors, the mechanism is the 150-day compliance clock. The Netherlands and Japan must align their domestic export restrictions with American rules within 150 days of enactment. In operational terms, “matching” means that allied vendors must cease selling restricted hardware to Chinese fabs and — this is the part that boards need to read twice — halt all technical support, software updates, and maintenance servicing for machines already installed in China.

The consequences at day 151 are not ambiguous. If an allied government cannot demonstrate satisfactory alignment within the window, the Act directs the Department of Commerce to expand U.S. jurisdiction over foreign-produced items containing U.S.-origin software, technology, or components via the Foreign Direct Product Rule.[1] For ASML, that means losing access to the American intellectual property embedded in every machine the company manufactures. Not a tariff. Not a fine. The functional equivalent of a kill switch on the company’s global manufacturing capability.

The silence that tells you everything

Before I go further, I want to name a data point that did not appear in any headline and is, in my analytical judgement, the most important signal in the entire MATCH Act debate.

The Semiconductor Industry Association has not issued a public statement opposing the MATCH Act. Neither has SEMI. Neither has Lam Research. Neither has Applied Materials.[3]

That silence is not diplomatic restraint. It is strategic self-interest. American equipment manufacturers — Lam Research, Applied Materials, KLA — are already barred from selling advanced semiconductor equipment to China under existing Bureau of Industry and Security restrictions. Lam reported that China accounted for more than a third of its Q1 fiscal 2026 revenue, but expects that share to fall below 30 per cent as domestic restrictions tighten.[4] Applied Materials paid a historic $252 million BIS penalty for routing restricted ion implanters to a Chinese entity through a South Korean subsidiary.[5] These companies have already absorbed the commercial damage of the embargo. What they have watched, with increasing frustration, is their European and Japanese competitors continuing to sell into the market they were forced to leave.

The MATCH Act does not restrict American companies. It coerces allied companies into sharing the financial burden of a policy that American companies have already been made to bear. From Lam Research’s perspective, the MATCH Act is not an export control — it is a competitive equaliser. And that is why the American semiconductor industry has not lobbied against it.

The strategic implication is total. There is no cross-Atlantic corporate solidarity on this issue. ASML is alone. The industry association that might have argued against overreach has concluded that the overreach serves its commercial interests. European boards looking for American allies in this fight will not find them.

The honest acknowledgement I owe the security argument

I want to be fair to Washington, because the security argument is not fabricated.

China is building a state-subsidised semiconductor industry with explicit military applications. SMIC has demonstrated the ability to produce 7-nanometre chips using older DUV lithography — a technical achievement that Western intelligence assessments did not expect for several more years.[6] The People’s Liberation Army’s modernisation programme depends on access to advanced computing hardware. The dual-use nature of semiconductor technology means that every advanced chip sold to a Chinese entity is, in a non-trivial sense, a chip that might end up in a weapons system. The security concern is real. The people who drafted the MATCH Act are not stupid, and they are not acting in bad faith on the security question.

But.

The MATCH Act reveals two things about the American position that the security justification does not cover.

The first is the implicit moral claim. The legislation operates on the assumption that American military use of advanced semiconductors is legitimate while Chinese military use is not — and that allied vendors must accept this distinction as the organising principle of their commercial freedom. Whether or not you agree with that distinction — and there are reasonable arguments on both sides of it — the MATCH Act does not ask allied governments to agree. It tells them. Within 150 days. Under penalty of having their most valuable corporate assets functionally disabled. The moral asymmetry may be defensible; the coercive mechanism is not a moral argument. It is a power instrument.

The second is the free market contradiction. The United States has spent the better part of three decades arguing — to Europe, to the World Trade Organisation, to every emerging economy it has negotiated with — that open markets, free trade, and the uninhibited movement of technology are the conditions under which prosperity is maximised. The MATCH Act is the formal legislative admission that Washington no longer believes this. The bill does not restrict trade with an adversary for security reasons while preserving free trade everywhere else. It restricts the free trade of allied companies in allied countries, in markets where those companies have operated lawfully, using technology they developed with their own capital, on a timeline set unilaterally by a government that has no jurisdiction over them except through the supply chain dependencies it is now exploiting.

The argument I want to make here — and I want to label it as my analytical position — is that the MATCH Act is not primarily a security instrument. It is a commercial protection instrument dressed in security language. The security rationale is genuine but partial. The commercial rationale — equalising the competitive damage across allied and American vendors — is the structural driver. And the mechanism chosen to deliver both — extraterritorial coercion of sovereign allies — is the part that European policy has not yet reckoned with honestly.

A company in Veldhoven that has no substitute

The reason the MATCH Act is pointed at the Netherlands before anywhere else is a single company. ASML. Headquartered in Veldhoven, population 45,000, in the province of North Brabant.

ASML holds a 100 per cent monopoly on extreme ultraviolet lithography — the process required to manufacture every advanced logic and memory chip currently in production. Beyond EUV, the company holds approximately 90 per cent of the broader global lithography market, including the older DUV systems that are the specific target of the MATCH Act’s restrictions.[7] In 2025, ASML shipped 535 systems — 48 EUV and 279 DUV — generating record net sales of €32.7 billion, a gross margin of 52.8 per cent, and net income of €9.6 billion.[8]

The numbers matter because they communicate something no adjective can: there is no second source. There is no alternative supplier. There is no European competitor, no Japanese competitor, no Chinese competitor capable of producing EUV lithography at any price on any timeline currently visible. When I argue, later in this piece, that Sarah’s board paper cannot recommend dual-sourcing for the most critical semiconductor equipment, this is why. The equipment layer has a monopoly at its centre, and the MATCH Act converts that monopoly into an instrument of American foreign policy.

China was ASML’s largest single geographic market in 2025, accounting for 33 per cent of total annual revenue, driven by Chinese fabs pulling forward DUV orders ahead of anticipated restrictions.[8] By Q1 2026, China’s share had dropped to 19 per cent as the orders dried up, with South Korea surging to 45 per cent as allied fabs absorbed capacity.[9] ASML projects China will stabilise at approximately 20 per cent of revenue from here, almost entirely from older DUV systems and the installed base management business — the servicing and maintenance contracts that generated €2.5 billion in Q1 2026 alone.

The MATCH Act explicitly targets that remaining baseline. By prohibiting not just the sale of new equipment but the servicing of machines already installed in Chinese fabs, the legislation threatens to drive ASML’s China revenue toward zero. The installed base business is high-margin, recurring, and durable. Its loss would compress ASML’s profitability materially — which is why the company’s gross margin guidance for Q2 2026 has already narrowed to 51–52 per cent under export control uncertainty.[9]

How Washington holds the key: Cymer and the FDPR

ASML is a European company. Its optics come from Carl Zeiss SMT in Germany — Zeiss supplies the hyper-precise lithography optics for EUV systems, with 80 per cent of all microchips produced worldwide running through Zeiss optics via ASML hardware.[10] ASML holds a 24.9 per cent ownership stake in Zeiss SMT, formalised in a strategic partnership dating to 1997. The mechanical and stage systems are European. The company’s 1,600 suppliers in the Netherlands and 700 across the rest of EMEA represent the largest geographic concentration in its supply chain.[8]

None of this European heritage offers any protection against the MATCH Act, because of one acquisition and one legal doctrine.

The acquisition is Cymer. Based in San Diego, Cymer provides the light source technology for ASML’s EUV systems — the laser-produced plasma source without which the physics of extreme ultraviolet lithography do not function.[^11] ASML acquired Cymer, making the American intellectual property integral to every EUV machine the company builds. The light source is not a component that can be substituted or sourced elsewhere. It is the enabling technology. Without Cymer’s IP, the optics from Zeiss have nothing to focus, and the most advanced lithography system on earth becomes an extraordinarily expensive piece of inert precision engineering.

The legal doctrine is the Foreign Direct Product Rule. The FDPR allows the United States to claim jurisdiction over items produced entirely outside the U.S. if those items are the direct product of U.S.-origin technology or software.[12] Under the December 2024 expansion of export controls, BIS broadened the rule to cover foreign-produced semiconductor manufacturing equipment containing “any amount of U.S.-origin integrated circuits” — and, more profoundly, declared that any integrated circuit manufactured anywhere in the world using U.S. machines is legally classified as U.S.-origin.[13] The practical reach of this doctrine is nearly total. Washington does not need to deploy a naval blockade or impose tariffs. It needs only to threaten the revocation of licences that permit ASML to use Cymer’s technology. The coercive surface area extends through Cymer into Zeiss, into the German industrial base, and into the entire European semiconductor equipment supply chain.

ASML’s 2025 Annual Report discloses 5,100 total suppliers globally, of which 1,350 are in North America.[8] That is 26 per cent of the company’s supplier base sitting inside U.S. jurisdiction. The tethering is physical, legal, and structural.

The death of consensus: from Wassenaar to the 150-day clock

Since the end of the Cold War, export controls among allied nations have been coordinated through the Wassenaar Arrangement — a consensus-based regime in which member states collaboratively identify dual-use goods and technologies requiring restriction, with each government retaining sovereign authority over its own trade policy and enforcement.[14] The model is deliberative, slow, and respectful of national sovereignty. It is also, from Washington’s perspective, structurally incapable of keeping pace with the speed at which China’s state-subsidised semiconductor industry is closing capability gaps.

The MATCH Act bypasses Wassenaar. It replaces multilateral consensus with a unilateral deadline. The 150-day clock does not ask the Netherlands to join a new regulatory regime. It tells the Netherlands to adopt American domestic policy within five months, or face the dismantling of ASML’s manufacturing capability via the FDPR. Altering national trade law in the Netherlands requires parliamentary process, regulatory consultation, and compliance infrastructure — none of which can be artificially compressed by a foreign legislature’s timetable.

There is no modern precedent for this. The closest analogy is the 1987 Toshiba-COCOM incident, in which Congress sanctioned Toshiba Machine Company for selling restricted submarine-milling equipment to the Soviet Union.[15] But that was a punitive, reactive measure against a specific corporate entity for violating an existing, jointly agreed set of rules. The MATCH Act is structurally different. It is a proactive mandate directed at allied sovereign governments, demanding the adoption of American policy within a fixed deadline, under threat of consequences that the allied government’s own legal framework has no mechanism to counter.

A correction I owe the series

In Part 1, I cited a 19 per cent reduction in Bureau of Industry and Security headcount and an average export licence processing time for allied nations of 76 days, double the 2023 baseline. I owe the reader a correction. The 19 per cent figure is wrong. Congress actually increased the BIS budget by 23 per cent — approximately $44 million — for 2026, earmarking the funds for additional enforcement personnel to police semiconductor controls.[16] The “76” is not days but a percentage: a CSIS survey found that 76 per cent of technology exporters reported that more than $10 million in exports were delayed by pending BIS reviews.[17]

The correction matters because the underlying reality is worse than the numbers I originally cited. The official BIS average processing time is 38 days.[18] But the CSIS survey — the most comprehensive independent assessment of export licence friction — found that 56 per cent of respondents reported average review times exceeding 180 days, and 33 per cent reported waiting over 300 days.[17] More than half of surveyed exporters reported losing business or contracts to foreign competitors not subject to U.S. regulatory jurisdiction. The bottleneck is not a staffing problem. It is a cultural transformation: BIS has shifted from trade facilitation to enforcement policing, with 200 new Export Enforcement Special Agents funded by the 2026 budget increase, and Under Secretary Jeffrey Kessler facing congressional accusations of being too lenient on licence approvals.[16]

The practical consequence for a UK or European company in the ASML supply chain is that even full compliance with the MATCH Act’s requirements does not guarantee frictionless access to U.S.-origin technology. The 150-day clock is the legislative mechanism. The 180-to-300-day licence queue is the administrative reality. Both operate on your business simultaneously.

The silence from Brussels

On 14 April 2026, Dutch Prime Minister Rob Jetten visited the White House and pushed back against the proposed U.S. export limits on ASML. The talks involved open disagreement, with both sides recognising each other’s positions without reaching consensus.[19]

From the European Commission: nothing.

No formal condemnation. No threat of countermeasures. No legislative proposal for a European regulatory shield. No organised diplomatic response to a piece of American legislation that explicitly threatens to dictate the operational parameters of Europe’s most valuable technology company under penalty of sanctions that would functionally disable its manufacturing capability.[20]

This silence is not caution. It is structural paralysis. The European Union maintains a single economic market, but member states retain sovereign authority over national security and export control policy. Brussels lacks the centralised regulatory power to enact a unified defence of ASML — or of any European technology company caught in the FDPR’s extraterritorial reach. Washington understands this architecture intimately and has optimised the MATCH Act to exploit it, applying bilateral pressure to the Hague while bypassing the Commission entirely.

The Commission’s silence should not be read as acquiescence. It should be read as incapacity. And that incapacity — the gap between the EU’s economic integration and its geopolitical fragmentation — is the structural vulnerability that Part 4 of this series, on the CLOUD Act and data jurisdiction, will examine in detail. The equipment chokehold and the data jurisdiction are the same problem expressed in different materials: American extraterritorial reach operating on European commercial activity through supply chain dependencies that European governance structures are not configured to counter.

What Sarah’s board paper must now say

In Parts 1 and 2, I gave Sarah — the senior risk director writing a quarterly paper for the Audit and Risk Committee — specific amendments to her vendor concentration matrix, her capital expenditure forecast, and her political risk register. Part 3 adds a harder recommendation. Harder because it is honest about what it cannot solve.

Sarah must audit which of her organisation’s technology vendors depend on supply chains that run through U.S. export control jurisdiction. Not just direct vendors — the tier-two and tier-three dependencies. Any vendor whose equipment, software, or infrastructure contains U.S.-origin intellectual property captured by the FDPR is exposed to the MATCH Act’s enforcement mechanism, whether or not that vendor is American.

For most of the technology stack, Sarah can recommend dual-sourcing. Etch equipment, deposition tools, metrology systems — alternatives exist, even if they are imperfect. Tokyo Electron in Japan holds 87 per cent of the track equipment market and 13.4 per cent of the broader equipment market; its China revenue has already declined from 40.3 per cent to 31.8 per cent under METI’s own export control tightening.[21] Dual-sourcing across ASML and TEL for some process steps is technically feasible if commercially expensive.

For EUV lithography, Sarah cannot dual-source. There is no second supplier. There is no European alternative, no Japanese alternative, no alternative of any kind at any price on any timeline shorter than a decade. The EU’s €700 million investment in the NanoIC semiconductor pilot line at imec in Leuven is a research programme, not a manufacturing alternative.[22] Carl Zeiss SMT supplies optics, not complete lithography systems — and Zeiss itself is tethered to ASML’s architecture and, through ASML, to Cymer’s American IP.

Sarah’s board paper must therefore contain a line it has never contained before: a named, quantified, irreducible single-vendor dependency with no current mitigation. For the EUV layer, the risk is accepted or the capability is forgone. The board must know this, in those terms, before the MATCH Act’s 150-day clock begins to run.

The MATCH Act prediction

Within 12 months — by April 2027 — the European Commission will publish a formal legislative proposal for a Chips Act 2.0 that includes, for the first time, a sovereign equipment supply chain pillar with a dedicated budget line for reducing U.S.-origin IP dependency in European-manufactured semiconductor equipment.[23]

The signals to watch: Commission Staff Working Documents referencing “equipment sovereignty” or “supply chain de-risking” in the semiconductor equipment layer. Internal Market Commissioner statements on ASML’s strategic classification. Horizon Europe or Digital Europe programme calls explicitly targeting lithography component development. And — the clearest signal — any formal communication between the Commission and ASML’s board regarding the company’s classification under the EU Foreign Subsidies Regulation or the Critical Raw Materials Act framework.

The prediction is falsifiable. If by April 2027 no such proposal has been published, and no draft legislation is in inter-service consultation, the prediction is wrong. If the Commission addresses the equipment chokehold through non-legislative means — guidelines, political declarations, bilateral agreements with the Netherlands — that does not satisfy the prediction. The argument here is that the MATCH Act forces a legislative response from Brussels, because the alternative — continued structural paralysis while Washington dictates the terms of European technology companies’ commercial freedom — is not a position the Commission can sustain through another European Council cycle.

The bottom line

Remember the house from Parts 1 and 2? The foundations that nobody paid for — the aluminium, the helium, the metal floor? The foundations are still unpaid. But Part 3 has introduced a new problem. The house has a landlord.

The landlord did not build the house. ASML is Dutch. Zeiss is German. The semiconductor equipment supply chain is overwhelmingly European in engineering, European in manufacturing, and European in intellectual heritage. But the landlord holds one key — the Cymer light source, the American IP — and that key opens every door in the building. The MATCH Act is the landlord’s letter to the tenant: match my rules within 150 days, or I change the locks.

The United States built the most powerful technology industry in human history on the argument that free markets produce better outcomes than state direction. The MATCH Act is the legislative acknowledgement that Washington no longer believes this — at least not when the free market produces outcomes that benefit a competitor. The bill does not restrict an adversary’s access to technology. It restricts an ally’s freedom to sell technology the ally developed, in markets the ally chose, using capital the ally raised. The security justification is real but partial. The commercial equalisation is the structural driver. And the mechanism — extraterritorial coercion of sovereign allied governments via supply chain dependencies — is not a free market instrument. It is the opposite.

You cannot build sovereignty on someone else’s permission.

That sentence is the argument of this piece. Everything else has been evidence. The metal floor from Part 2 is the precondition nobody costed. The equipment chokehold is the precondition somebody else controls. And the question for every UK and European board is no longer theoretical: when the landlord’s letter arrives — when the 150-day clock begins — which of your supply chains run through the building he owns?

Part 4 will follow the landlord inside the house. The CLOUD Act — the legal instrument that gives U.S. law enforcement access to data held by American cloud providers regardless of where that data is physically stored — is the same permission problem applied not to equipment but to information. The metal floor, the equipment chokehold, and the data jurisdiction are three expressions of a single structural condition: European commercial activity operating inside American extraterritorial reach, with no European governance mechanism configured to counter it.

The Control Layer exists to make that condition legible on a quarterly risk paper, in a voice a board will quote. If that is the translation you have been looking for, subscribe — and forward this to the colleague who is about to discover that the allied exemption was always American permission.

Next: Part 4 — The data jurisdiction: the CLOUD Act and the landlord who reads your post.

References

[1]: U.S. House of Representatives. Multilateral Alignment of Technology Controls on Hardware Act, H.R. 8170, 119th Congress (2026). Introduced 2 April 2026. House Foreign Affairs Committee markup, 22 April 2026: advanced 36-8.

[2]: U.S. Senate. Multilateral Alignment of Technology Controls on Hardware Act, S. 4281, 119th Congress (2026). Sponsors: Sen. Pete Ricketts (R-NE), Sen. Andy Kim (D-NJ). Co-sponsors include Senate Majority Leader Chuck Schumer (D-NY) and Sen. Jim Risch (R-ID), Chairman, Senate Foreign Relations Committee.

[3]: Based on an exhaustive review of public statements, press releases, and congressional testimony from the Semiconductor Industry Association (www.semiconductors.org), SEMI , Lam Research, and Applied Materials through April 2026. No formal industry statement opposing H.R. 8170 was identified.

[4]: Lam Research Corporation. Q1 Fiscal Year 2026 Earnings Release. China revenue exceeded one-third of total quarterly revenue; projected decline below 30 per cent under tightening domestic restrictions.

[5]: U.S. Bureau of Industry and Security. Administrative Penalty: Applied Materials, Inc. $252 million civil penalty for illegal export of ion implanters to a Chinese entity via South Korean subsidiary.

[6]: Multiple corroborated industry reports on SMIC’s 7nm process capability using DUV multi-patterning, first reported in 2023 and confirmed in subsequent U.S. intelligence assessments.

[7]: ASML Holding N.V. Annual Report 2025. EUV market share: 100 per cent. Broader lithography market share: approximately 90 per cent. https://www.asml.com/en/investors/annual-report

[8]: ASML Holding N.V. Annual Report 2025. Total net sales: €32.7 billion. Gross margin: 52.8 per cent. Net income: €9.6 billion. Systems shipped: 535 (48 EUV, 279 DUV). Supplier network: 5,100 total (1,600 Netherlands, 1,450 Asia, 1,350 North America, 700 EMEA ex-NL). China revenue: 33 per cent of FY 2025.

[9]: ASML Holding N.V. Q1 2026 Quarterly Earnings Report. Net sales: €8.8 billion. Gross margin: 53.0 per cent. Installed base management revenue: €2.48 billion. China revenue: 19 per cent. South Korea: 45 per cent. Q2 2026 gross margin guidance: 51–52 per cent. China projected to stabilise at approximately 20 per cent.

[10]: Carl Zeiss SMT GmbH. ASML strategic partnership formalised 1997. ASML holds 24.9 per cent ownership stake in Zeiss SMT. Approximately 80 per cent of global microchip production utilises Zeiss optics via ASML lithography hardware.

[11]: Cymer, Inc. (San Diego, CA). Acquired by ASML. Provides laser-produced plasma light source technology for EUV lithography systems. U.S.-origin intellectual property integral to all ASML EUV machines.

[12]: U.S. Bureau of Industry and Security. Foreign Direct Product Rule — Export Administration Regulations, 15 CFR Part 734. Expanded October 2022 and December 2024.

[13]: U.S. Bureau of Industry and Security. December 2024 Semiconductor Export Control Updates. Expanded FDPR jurisdiction to cover foreign-produced SME containing “any amount of U.S.-origin integrated circuits” and classified all ICs manufactured using U.S. equipment as U.S.-origin.

[14]: The Wassenaar Arrangement on Export Controls for Conventional Arms and Dual-Use Goods and Technologies. Established 1996. 42 participating states. Consensus-based decision-making on dual-use technology restrictions.

[15]: U.S. Congress. Toshiba-COCOM Sanctions, 1987. Punitive sanctions against Toshiba Machine Company for sale of restricted submarine-milling equipment to the Soviet Union in violation of COCOM rules.

[16]: U.S. Department of Commerce. BIS Budget Allocation FY 2026. 23 per cent increase (approximately $44 million) earmarked for enforcement personnel. 200 new Export Enforcement Special Agents funded. Congressional scrutiny of Under Secretary Jeffrey Kessler regarding licence approval transparency.

[17]: Center for Strategic and International Studies (CSIS). Survey of U.S. Technology Export Licensing Friction, 2025–2026. 56 per cent of respondents reported average review times exceeding 180 days. 33 per cent reported wait times exceeding 300 days. 76 per cent reported more than $10 million in exports delayed by pending reviews. More than 50 per cent reported losing business to foreign competitors.

[18]: U.S. Bureau of Industry and Security. Annual Report, Fiscal Year 2023. Official average export licence processing time: 38 days.

[19]: NL Times. ‘Netherlands pushes back against proposed U.S. export limits on ASML,’ 14 April 2026. Reports that Dutch PM Rob Jetten discussed the MATCH Act during a White House visit and that talks “involved some disagreement, with both sides recognising each other’s positions without reaching consensus.”

[20]: Based on a review of European Commission press releases, EU Trade Commissioner statements, and European Parliament resolutions through April 2026. No formal EU institutional response to H.R. 8170 identified.

[21]: Tokyo Electron Ltd. Fiscal Year 2026 Quarterly Earnings. Track equipment market share: 87 per cent. Overall equipment market share: 13.4 per cent. China revenue: declined from 40.3 per cent (Q2 FY2026) to 31.8 per cent (Q3 FY2026). Japanese Ministry of Economy, Trade and Industry (METI): 23-item export control notice implemented; Japan passed centralised economic security intelligence legislation, April 2026.

[22]: European Union. NanoIC Semiconductor Pilot Line, imec (Leuven). €700 million investment under Chips Act / Horizon Europe framework. Research and development programme; not a commercial manufacturing alternative to ASML lithography.

[23]: Predictive judgement. Not based on any published Commission document. Based on the analytical assessment that the MATCH Act’s extraterritorial reach into European semiconductor equipment supply chains creates a legislative forcing function that the Commission’s current non-response cannot survive through another European Council cycle.

Author

Amer Altaf is Founder and CEO of Arkava, a UK and European sovereign AI agentic automation business, and Managing Editor of The Control Layer, the publication where he tracks the convergence of cyber security, technology sovereignty, and geopolitics. A techUK member, he contributes to industry engagement on UK technology sovereignty policy. He is currently writing on cloud security for Oxford University Press’s Expert Essentials series.

Share

That is the argument at the centre of this episode — and in seven words, it is the entire thesis. Everything else is evidence.

Last week, in Part 1, I traced the line from the Strait of Hormuz to the server rack and argued that the post-war bargain between Europe and America has inverted. I used the analogy of a house — joists, plumbing, planning permission, landlord — to map the four chokepoints that converged in a single fortnight.

This week, I go underneath the house. To the foundations. Because the entire European technology sovereignty project — the Chips Act, the data sovereignty regulations, the cloud procurement frameworks — is a house being built on foundations nobody has paid for.

The bill has just arrived.

What this episode covers

This is a 31-minute solo episode. I work through four arguments, each building on the last:

The physics of the problem. Why an aluminium pot line cannot be cold-started — the cells are destroyed, not paused, when the cryolite solidifies at 960 degrees Celsius. Why every helium atom in commercial use was mined, not manufactured. Why the loss of three million tonnes of Gulf aluminium capacity and 25 per cent of global helium supply is a sovereignty story, not a commodity story.

The inconvenient truth. How Ricardo’s comparative advantage theory — honest, functional, and correct for thirty years — rested on three assumptions that this fortnight removed simultaneously. Why Adam Tooze calls it “zombie globalisation.” Why Matt Stoller’s financialisation critique explains how we got here.

The policy gap. The EU Chips Act’s three structural gaps: no allocation for primary aluminium processing, no strategic helium reserve (despite helium being on the Commission’s critical raw materials list since 2020), and no crisis-response mechanism for disruptions originating upstream of the fab. The UK Critical Minerals Strategy’s order-of-magnitude funding shortfall — £50 million committed against a problem that costs £8 to £15 billion.

The honest answer. A five-point metal floor strategy for the European bloc, extending Ed Conway’s Material World thesis to argue that digital sovereignty is a subset of material sovereignty. Total cost: between 40 and 60 billion euros over a decade. The number nobody has published yet.

The episode closes with a prediction — within 18 months, a major European fab will publicly disclose a helium allocation constraint delaying capacity expansion — and three amendments to the quarterly board paper introduced in Part 1.

Read the full written analysis

The written article — with all 17 endnotes, the image brief, and the predictive judgement with explicit falsifiability conditions — is here:

If you missed Part 1:

### Sources cited in this episode

[1]: Rio Tinto Alcan. “Sale of Lynemouth smelter to Klesch Group completed.” 2012 corporate archive, and “Rio Tinto sells Alcan Aluminium UK to Liberty House.” Financial Times, 16 December 2016.

[2]: Reuters. *“Gulf aluminium output crippled as Iranian strikes hit EGA and Alba facilities.”* 11 April 2026. See also CRU Group, *Aluminium Market Monitor*, April 2026 update.

[3]: Emirates Global Aluminium plc. *“Annual Report 2025 — European Customer Disclosures.”* https://www.ega.ae/en/investor-relations; International Aluminium Institute, Primary Aluminium Production Statistics Q1 2026

[4]: U.S. Geological Survey. “Mineral Commodity Summaries 2026 — Helium.” January 2026. ; Linde plc, Helium Supply Chain Disclosures, 2025 Annual Report; Air Liquide SA, Critical Gases Supply Position 2025.

[5]: David Ricardo. *On the Principles of Political Economy and Taxation*. John Murray, 1817. Chapter 7, “On Foreign Trade.”

[6]: Adam Tooze. *Chartbook* (Substack). See in particular the ongoing analysis of “zombie globalisation” across Chartbook issues 2023–2026.

Chartbook

A newsletter on economics, geopolitics and history from Adam Tooze. More substantial than the twitter feed. More freewheeling than what you might read from me in FT, Foreign Policy, New Statesman.

By Adam Tooze

[7]: Matt Stoller. *BIG* (Substack). See ongoing analysis at

BIG by Matt Stoller

The history and politics of monopoly power.

[8]: European Union. Regulation (EU) 2023/1781 of the European Parliament and of the Council of 13 September 2023 establishing a framework of measures for strengthening Europe’s semiconductor ecosystem (Chips Act).[9]: European Commission. “Chips Act Pillar II Implementation Report — First Annual Review.” March 2026. See Commission Staff Working Document SWD(2026) 047 final.

[10]: European Commission. “Critical Raw Materials Act — List of Critical and Strategic Raw Materials.” Regulation (EU) 2024/1252, Annex I. Helium listed as critical since 2020 Communication COM(2020) 474.

[11]: Estimate synthesised from European Round Table for Industry (ERT) position papers on industrial policy 2025, Bruegel working papers on European strategic autonomy, and off-the-record conversations with Commission officials. Not yet formally published by any Commission document.

[12]: HM Government, Department for Business, Energy and Industrial Strategy. *“UK Critical Minerals Strategy.”* July 2022; refreshed March 2023 as “Critical Minerals Refresh.”

[13]: Tata Steel UK. *“Port Talbot Transformation Announcement.”* January 2024.

[14]: HM Government, Department for Business and Trade. “Invest 2035: The UK’s Modern Industrial Strategy.”* Green paper, October 2024.

[15]: Estimate synthesised from CRU Group cost models for greenfield primary aluminium facilities, 2025 capital cost indices, and comparable recent projects (Rio Tinto Kitimat modernisation, Emirates Global Aluminium Al Taweelah expansion).

[16]: Ed Conway. *Material World: A Substantial Story of Our Past and Future*. W.H. Allen, 2023. See also ongoing analysis at Material World Substack:

Listen and subscribe

YouTube:

Apple Podcasts:

Spotify:

Substack: https://thecontrollayer.arkava.ai

Subscribe on the Substack to get every episode and written analysis by email — free.

Join the conversation

The metal floor argument is the one I expect to generate the most disagreement in this series. The numbers are large. The policy gap is structural. And the question of whether Europe should rebuild domestic processing capacity or find a different kind of resilience is genuinely open.

I want to hear from people working in industrial policy, commodity trading, semiconductor procurement, critical minerals strategy, or defence supply chains. Where am I wrong? Where is the five-point strategy naive? What am I missing?

Drop a comment below, or find me on LinkedIn

Amer Altaf is Founder and CEO of Arkava and Managing Editor of The Control Layer.

Aluminium and helium are the supply chain layer that cannot be digitised. Neither the EU Chips Act nor UK industrial policy has yet costed an honest answer. Part two of the Four Chokepoints series.

For thirty years, the answer to “why is aluminium smelted in the Gulf rather than in Northumberland?” was the same answer we gave for every offshored process: cheaper labour, cheaper energy, cheaper environmental compliance. The answer was honest, until this April.

The reason the aluminium is not smelted in Northumberland is not that it cannot be — the British Aluminium Company ran Lynemouth until 2012 and Fort William until Rio Tinto sold it to Liberty House in 2016, and the aluminium chemistry does not care which country’s grid it draws from.[1] The reason is that for three decades the financial logic of global trade treated processing location as an arbitrage opportunity, and Western policy treated resilience as a free good. When labour cost gaps of 70 per cent and energy cost gaps of 40 per cent are set against a supply chain risk premium of zero, the location decision makes itself.

This April, the risk premium moved off zero. What did not move — what cannot move — is the location of the ore, the chemistry of electrolysis, or the geology of helium. The metal floor, the supply chain layer on which every software sovereignty intervention Europe is currently proposing quietly rests, has always had a physical precondition. It is only this fortnight that the precondition has become legible on a quarterly risk paper.

This is what European industrial policy has not yet costed.

Share The Control Layer

What actually broke

The aluminium disruption is precise. Iranian strikes on Gulf smelting infrastructure removed approximately three million tonnes of annual primary aluminium capacity from Emirates Global Aluminium at Jebel Ali and Aluminium Bahrain at Sitra, with both facilities now operating under partial force majeure.[2] Restart timelines sit between six and twelve months, and the reason is chemical rather than structural. An aluminium pot line is a row of electrolytic cells running molten cryolite at approximately 960°C, drawing direct current at industrial scale continuously for the working life of the cell. When power or feed is interrupted for more than a few hours, the cryolite solidifies and the cell is destroyed. Restart requires rebuilding the cell, not restoring power to it. EGA and Alba together supply material into European automotive, aerospace, and construction grades — specialised alloys that are not fungible with Chinese export aluminium.[3]

The helium disruption is different in structure and in timescale. Qatar is the world’s second-largest helium producer, contributing approximately 25 per cent of global supply through the Ras Laffan complex, where helium is extracted as a by-product of liquefied natural gas production and shipped on the same LNG tanker fleet that now exits the Gulf through the contested waters of Hormuz.[4] US Geological Survey data places the remaining global supply at approximately 45 per cent from the United States, 5 per cent from Russia, and the balance from Algeria, Poland, Canada, and Tanzania.[4] Helium cannot be synthesised at industrial scale. Every helium atom currently in commercial use was mined. When the Qatari supply stalls, the semiconductor fabrication, magnetic resonance imaging, and cryogenic cooling sectors do not receive higher prices — they receive allocation letters. Strategic reserves at major fabs are measured in weeks.

These are not commodity stories. Commodity stories price in and price out. These are sovereignty stories, because the resolution of a sovereignty story is not a price — it is a policy.

The inconvenient truth global trade has underwritten

The economist in the room will point out that the labour arbitrage logic that moved aluminium processing to the Gulf, steel processing to China, and rare earth refining to Inner Mongolia was not a mistake. For thirty years, it was the orthodox application of comparative advantage theory — the argument, traceable to David Ricardo in 1817, that nations should specialise in what they produce relatively more efficiently and trade for everything else. The orthodoxy, applied to processing, said that if Bahrain could smelt aluminium at 60 per cent of the cost of Northumberland because its energy was subsidised by natural gas extraction that would otherwise be flared, the efficient outcome was to smelt the aluminium in Bahrain and ship the ingots to Europe.[5]

The orthodoxy was honest. It had an inconvenient truth buried in the first paragraph of every economics textbook that cited it: comparative advantage assumes frictionless trade between peaceful trading partners in a stable geopolitical order. Remove any of those three assumptions and the arbitrage stops being efficient and starts being dangerous.

Adam Tooze has described this as “zombie globalisation” — the post-1990 trading order that did not end in 2016 with Brexit, or in 2018 with the first Trump tariffs, or in 2022 with the invasion of Ukraine, but has been dying slowly since.[6] The aluminium and helium chokepoints exposed in April are one more organ failure in a patient the attending physicians have been reluctant to call.

Matt Stoller has argued, from a different direction, that the financialisation of Western industrial policy confused shareholder returns with national capability, and the consequence was the systematic under-investment in domestic processing infrastructure that we are now trying to price back in.[7] The argument here is not that the Ricardian orthodoxy was wrong in 1817. It is that the specific form of the orthodoxy applied between roughly 1995 and 2022 treated one assumption — stable geopolitical order — as permanent when it was contingent, and the entire architecture of Western processing location was built on that assumption.

The disruption of April 2026 is the moment the assumption stops being quietly permissible and starts being expensively inoperable. The question for UK and European policy is no longer whether to rebuild domestic processing capability. It is how much of the last thirty years’ worth of forgone investment has to be reabsorbed, and across what timescale.

What the EU Chips Act has actually costed

The European Chips Act, adopted in July 2023, committed €43 billion of public and private investment to European semiconductor sovereignty across three pillars.[8] Pillar I funds the Chips for Europe Initiative — pilot lines, design infrastructure, and skills — at approximately €3.3 billion from the Horizon Europe and Digital Europe programmes. Pillar II establishes a framework for state aid to first-of-a-kind facilities, which is the instrument under which the Intel Magdeburg and TSMC Dresden subsidies were structured. Pillar III coordinates crisis response.

The Chips Act is, on its own terms, a well-designed instrument. It has moved fabrication capability towards Europe. But its structural assumption — the one that aligns it with the last thirty years of industrial orthodoxy rather than the next thirty — is that the upstream material inputs to European semiconductor fabrication will continue to be sourced from global markets on something like the pre-2022 terms. The Act’s implementing documents treat bulk materials as a procurement problem for the fabricators rather than a sovereignty problem for the bloc.[9]

The gap is visible in three specific places. First, there is no Pillar II allocation for primary aluminium, specialty steels, or non-ferrous processing that feeds the fabrication estate. Second, there is no strategic helium reserve funded under the Act, despite helium’s classification as a critical raw material by the European Commission since 2020.[10] Third, the Act’s crisis-response mechanisms under Pillar III do not contemplate the scenario in which the disruption to semiconductor production originates upstream of the fab in the material supply chain, rather than at the fab itself.

These are not criticisms. They are gaps. The Act was built to solve the problem Europe had diagnosed in 2021 — we do not have enough leading-edge fabrication capacity — not the problem Europe has acquired in 2026 — we do not have enough upstream material sovereignty to keep the fabrication capacity running. The next Chips Act iteration, which Commission officials have begun briefing as Chips Act 2.0 in private settings, will need to add a fourth pillar addressing the metal floor. The current budget envelope will not stretch to it. The estimate Sarah’s board paper will want to see — which this piece cannot yet quote because no Commission document has published it — is somewhere in the region of €20 to €30 billion of new primary processing investment, phased over seven to ten years, to close the gap the Act as drafted left open.[11]

What the UK Critical Minerals Strategy has actually costed

The United Kingdom’s position is structurally weaker and financially smaller. The UK Critical Minerals Strategy, first published in July 2022 and refreshed in March 2023, identified 18 minerals as critical to UK supply chains and committed approximately £50 million to the Critical Minerals Intelligence Centre and allied research infrastructure.[12] Aluminium is on the list. Helium is on the list. The funding envelope is between one and two orders of magnitude smaller than what the underlying problem requires.

The UK’s processing capacity position is the direct inheritance of the deindustrialisation decisions of the 1980s and 1990s. Primary aluminium smelting in the United Kingdom effectively ended when Rio Tinto sold Lynemouth in 2012 and Liberty House took over Fort William in 2016 — the latter remaining operational but at a fraction of historical capacity.[1] Primary steel processing has contracted similarly, with the closure of the Port Talbot blast furnaces in 2024 accelerating the trend.[13] There is no domestic helium production in the United Kingdom at any commercial scale.

The Labour Government’s Invest 2035 industrial strategy, published in green paper in October 2024 and scheduled for white paper publication during 2025, identified advanced manufacturing and critical minerals as two of its eight growth-driving sectors.[14] The direction is correct. The funding is not yet specified. If the UK is to reopen primary aluminium smelting at strategic scale — not for commodity markets, but for semiconductor-grade and aerospace-grade allocation sovereignty — the capital cost is between £1.5 and £3 billion for a single modern facility, before the grid connection and the downstream alloy mill are priced.[15] The Invest 2035 envelope is not currently sized to absorb this.

The honest answer to “what would it cost the United Kingdom to stand up a sovereign metal floor?” is somewhere between £8 and £15 billion over a decade, across aluminium, specialty steels, helium storage, and the downstream processing that feeds the defence and semiconductor supply chains. That number is not in any published UK document. It is the number a senior civil servant in the Department for Business and Trade would give in private, off the record, if you asked them directly.

What an honest metal floor strategy would cost

Ed Conway’s Material World argues that the twentieth century was underwritten by six physical materials — sand, salt, iron, copper, oil, and lithium — and that the twenty-first century is underwritten by the same six plus helium, rare earths, and silicon.[16] The argument that this piece extends is that digital sovereignty, which is commonly treated as a software and cloud problem, is actually a subset of material sovereignty — and that the material substrate is the layer Western policy has most systematically under-priced.

An honest metal floor strategy for the European bloc would do five things, in approximately this order. It would establish strategic reserves for aluminium ingots, helium, and specialty steels at quantities measured in weeks rather than days of consumption. It would fund the reopening of primary processing capacity in three geographies — the United Kingdom at the former Fort William and Lynemouth sites, the northern European low-carbon energy corridor around Iceland, Norway, and northern Scotland, and the southern European renewable corridor around Iberia. It would establish long-dated offtake contracts between sovereign processors and Tier 1 European manufacturers — Airbus, Stellantis, Siemens, ASML — at prices that absorb the strategic premium explicitly rather than demanding that the processors absorb it invisibly. It would create a sovereign premium in public procurement, analogous to the “Buy British” or “Made in the EU” procurement preference, that makes the metal floor commercially viable without relying on tariff walls. And it would, finally, cost and publish the number honestly — which no current document does.

The total capital requirement for the European bloc and the United Kingdom combined is between €40 and €60 billion over a decade, on top of the existing Chips Act envelope.[11] That is the honest number. It is a politically uncomfortable number. It is also small relative to the €1.8 trillion NextGenerationEU budget and trivial relative to the aggregate

capitalisation of the European automotive and aerospace sectors that currently depend on the imported metal that the number would replace.

The helium prediction

Within 18 months — by October 2027 — a major European semiconductor fabricator will publicly disclose a helium allocation constraint that delays a planned capacity expansion by at least six months. The fabs to watch are Infineon Dresden, STMicroelectronics Crolles, Bosch Reutlingen, GlobalFoundries Dresden, and the downstream fab customers of ASML Veldhoven. The disclosure will appear in a quarterly earnings call, a capacity announcement, or a regulatory filing under European Securities and Markets Authority rules on material adverse changes.

When it appears, it will be reported as a supply chain story. Sarah’s board paper, if Part 2 has done its job, will recognise it as something else: the first legible instance, on a European earnings call, of the metal floor asserting itself. The capital re-allocation towards sovereign processing that follows — if the 18-month prediction from Part 1 also lands — will be the visible market response to a physical precondition that had been quietly absent from the risk model.

The bottom line

Three specific amendments to Sarah’s quarterly risk paper, based on what this piece has argued.

The vendor concentration matrix introduced in Part 1 needs a second tier: the upstream material concentration underneath each vendor. Any entry that reads “ASML” or “Intel Magdeburg” or “Infineon Dresden” must now carry a second line naming the material supply chains those vendors depend on, and the geographic concentration of those chains. Most current matrices do not have this second tier at all.

The capital expenditure forecast for the next five years needs a sovereign premium line. For any procurement category touching critical infrastructure, defence, or public services, a 15 to 25 per cent sovereign premium should now be modelled explicitly rather than treated as an anomaly. Sarah’s CFO will resist this. The resistance is the inherited reflex of thirty years of cost-optimisation orthodoxy, and it is now the expensive reflex.

The political risk register needs one new line item: European industrial policy coherence. Not geopolitical instability, which is vague. Coherence: the question of whether the EU Chips Act 2.0, the UK Invest 2035 white paper, and the various national critical minerals strategies converge on an integrated metal floor programme, or whether they remain four or five parallel under-funded efforts that each solve a different quarter of the problem.

The work of this series is to argue that these amendments are not radical — they are overdue. Part 3 will examine the equipment chokehold: ASML, the MATCH Act, and the end of the allied exemption that structured European semiconductor policy since the 1990s. The argument there will be that the metal floor is the precondition Washington cannot control, and the equipment chokehold is the precondition Washington is now attempting to weaponise.

The Control Layer exists to translate these conditions into the language of the board paper, in a voice a board will quote. If that is the translation you have been looking for, subscribe — and forward this piece to the colleague who has been asking the question you could not quite answer.

Next: Part 3 — The equipment chokehold: ASML, the MATCH Act, and the end of the allied exemption.

Subscribe now

References

[1]: Rio Tinto Alcan. “Sale of Lynemouth smelter to Klesch Group completed.” 2012 corporate archive, and “Rio Tinto sells Alcan Aluminium UK to Liberty House.” Financial Times, 16 December 2016.

[2]: Reuters. *“Gulf aluminium output crippled as Iranian strikes hit EGA and Alba facilities.”* 11 April 2026. See also CRU Group, *Aluminium Market Monitor*, April 2026 update.

[3]: Emirates Global Aluminium plc. *“Annual Report 2025 — European Customer Disclosures.”* https://www.ega.ae/en/investor-relations; International Aluminium Institute, Primary Aluminium Production Statistics Q1 2026

[4]: U.S. Geological Survey. “Mineral Commodity Summaries 2026 — Helium.” January 2026. ; Linde plc, Helium Supply Chain Disclosures, 2025 Annual Report; Air Liquide SA, Critical Gases Supply Position 2025.

[5]: David Ricardo. *On the Principles of Political Economy and Taxation*. John Murray, 1817. Chapter 7, “On Foreign Trade.”

[6]: Adam Tooze. *Chartbook* (Substack). See in particular the ongoing analysis of “zombie globalisation” across Chartbook issues 2023–2026.

Chartbook

A newsletter on economics, geopolitics and history from Adam Tooze. More substantial than the twitter feed. More freewheeling than what you might read from me in FT, Foreign Policy, New Statesman.

By Adam Tooze

[7]: Matt Stoller. *BIG* (Substack). See ongoing analysis at

BIG by Matt Stoller

The history and politics of monopoly power.

[8]: European Union. Regulation (EU) 2023/1781 of the European Parliament and of the Council of 13 September 2023 establishing a framework of measures for strengthening Europe’s semiconductor ecosystem (Chips Act).[9]: European Commission. “Chips Act Pillar II Implementation Report — First Annual Review.” March 2026. See Commission Staff Working Document SWD(2026) 047 final.

[10]: European Commission. “Critical Raw Materials Act — List of Critical and Strategic Raw Materials.” Regulation (EU) 2024/1252, Annex I. Helium listed as critical since 2020 Communication COM(2020) 474.

[11]: Estimate synthesised from European Round Table for Industry (ERT) position papers on industrial policy 2025, Bruegel working papers on European strategic autonomy, and off-the-record conversations with Commission officials. Not yet formally published by any Commission document.

[12]: HM Government, Department for Business, Energy and Industrial Strategy. *“UK Critical Minerals Strategy.”* July 2022; refreshed March 2023 as “Critical Minerals Refresh.”

[13]: Tata Steel UK. *“Port Talbot Transformation Announcement.”* January 2024.

[14]: HM Government, Department for Business and Trade. “Invest 2035: The UK’s Modern Industrial Strategy.”* Green paper, October 2024.

[15]: Estimate synthesised from CRU Group cost models for greenfield primary aluminium facilities, 2025 capital cost indices, and comparable recent projects (Rio Tinto Kitimat modernisation, Emirates Global Aluminium Al Taweelah expansion).

[16]: Ed Conway. *Material World: A Substantial Story of Our Past and Future*. W.H. Allen, 2023. See also ongoing analysis at Material World Substack:

Material World

Unexpected stories from the underbelly of the modern world

By Ed Conway

Author

Amer Altaf is Founder and CEO of Arkava, a UK and European sovereign AI agentic automation business, and Managing Editor of The Control Layer, the publication where he tracks the convergence of cyber security, technology sovereignty, and geopolitics. A techUK member, he contributes to industry engagement on UK technology sovereignty policy. His January 2026 analysis of Airbus’s migration off Google and Microsoft argued European cloud sovereignty had moved from policy aspiration to active corporate posture — six months before the Hormuz blockade made the argument unavoidable. He is currently writing on cloud security for Oxford University Press’s Expert Essentials series.

Article series

Series: Four Chokepoints, Part 2 of 5.

Previous instalment: Part 1 — Four chokepoints: inside the fortnight that made European technology sovereignty unavoidable.

Next instalment: Part 3 — The equipment chokehold: ASML, the MATCH Act, and the end of the allied exemption.

The headlines called it an oil shock. It isn’t. In this episode, I trace the line from the Strait of Hormuz to the server rack in your data centre — through the aluminium smelters, the helium tankers, the Dutch lithography plant, and the Franco-British communiqué that said something no European government has said out loud since 1945.

My argument: the post-war bargain between Europe and America has not strained. It has inverted. And the board papers being written this month still treat it as an oil shock.

If you prefer to read the full written analysis

— with all twelve endnotes and the complete image brief

What this episode covers

The four failures — what actually happened in the fortnight to 12 April 2026: three million tonnes of Gulf aluminium capacity offline, helium tanker disruptions threatening semiconductor fabs, the MATCH Act’s 150-day ultimatum to ASML, and the first Franco-British military operation outside the American framework since the post-war settlement.

The inversion — why Helen Thompson’s thesis about the contingent Atlantic settlement is no longer history but operational reality, and why Adam Tooze’s structural polycrisis framework is the correct lens for the events of this fortnight.

Three lines for the board paper — the vendor concentration matrix, the supply chain map, and the political risk register: what’s wrong with each and what they should say instead.

The eighteen-month prediction — procurement-driven re-sovereigntisation in UK and EU public-sector contracts, with explicit falsifiability conditions I’ll track quarterly on The Control Layer.

The Four Chokepoints series

This is Part 1 of a five-part series tracing the supply chain from the Strait of Hormuz to your procurement decision.

Part 1 — The Inversion (this episode): the fortnight, the four failures, and the board paper that’s wrong.

Part 2 — The Metal Floor: aluminium, helium, and the hidden physical inputs to the sovereign technology stack. Why the metal shortage is a financial choice, not a geological problem.

Parts 3–5 — forthcoming. Subscribe to receive each instalment.

Subscribe now

Listen and subscribe

- YouTube:

- Apple Podcasts:

- Spotify:

- Substack:

I want to hear your take. What did I get wrong? What did I miss? If you sit on an Audit and Risk Committee, does your board paper currently describe this as an oil shock — and if so, what would it take to change that?

Leave a comment below or find me on LinkedIn

The Control Layer is hosted by Amer Altaf, Founder and CEO of Arkava — Trusted Intelligence, Tangible Impact.

On the morning of 8 April, somewhere between the Strait of Hormuz and a Dutch lithography plant in Veldhoven, four supply chains began to fail at once.

The first was aluminium. Iranian strikes on Gulf smelting infrastructure removed approximately three million tonnes of annual capacity from Emirates Global Aluminium and Aluminium Bahrain, both now operating under partial force majeure with restart timelines of six to twelve months.[1] The second was helium. A significant share of the world’s helium supply exits Qatar’s Ras Laffan complex on the same liquefied natural gas tankers that transit Hormuz — the tankers that are now variously diverted, delayed, or waiting.[2] The third was semiconductor manufacturing equipment. A bill introduced in Washington the same week, the Multilateral Alignment of Technology Controls on Hardware Act, placed allied vendors including ASML on a 150-day clock to match US export controls or lose access to US intellectual property and components.[3] The fourth was the alliance itself. France and the United Kingdom announced a joint naval mission to the Strait of Hormuz operating outside the American blockade framework, the first operational admission that European strategic interests can no longer be safely delegated to Washington.[4]

Four chokepoints. One fortnight. Board papers still calling it an oil shock.

Share

What failed at the metal floor

Aluminium is the first chokepoint because aluminium is the first input. Data centre chassis, server rack framing, cable trays, electric vehicle battery housings, and the structural components of satellite and aerospace platforms all rely on specialised grades from Gulf smelters. The loss of three million tonnes of annual capacity from Emirates Global Aluminium and Aluminium Bahrain transmits into European automotive, aerospace, and construction sectors within a single inventory cycle.[1] Procurement directors who treated this material as commoditised will discover, over the next quarter, that it was a single-point dependency.

Helium is the chokepoint that almost nobody outside semiconductor and cryogenic engineering is currently watching. Qatar is the world’s second-largest helium producer — approximately 25 per cent of global supply, exiting via Ras Laffan on the same tanker fleet now caught in the Hormuz disruption.[2] Helium is not substitutable for semiconductor fabrication, magnetic resonance imaging, or the cryogenic cooling of superconducting infrastructure. A protracted closure does not simply raise prices; it triggers allocation rationing. Strategic reserves at fabs in Taiwan, South Korea, and the Netherlands are measured in weeks, not months.

The equipment chokehold

The Multilateral Alignment of Technology Controls on Hardware Act is a Foreign Direct Product Rule delivered as legislation. It gives allied vendors 150 days to match the US export control posture on semiconductor manufacturing equipment shipped to China, or lose access to US components, software, and intellectual property.[^3] ASML, the Dutch monopolist in lithography, derives approximately 50 per cent of its Deep Ultraviolet sales from China.[^5] The MATCH Act is not a trade dispute. It is the termination of the allied exemption that has structured European technology policy since the 1990s.

The administrative bottleneck running parallel to the legislation is the deeper signal. The US Bureau of Industry and Security, hollowed out by a 19 per cent reduction in headcount, now processes export licences for trusted allies — the United Kingdom, Japan, Canada — at an average of 76 days, double the 2023 baseline.[6] Multi-billion dollar backlogs in the deployment of artificial intelligence infrastructure are accumulating in countries Washington formally describes as partners. The semiconductor industry has formally warned that this undermines Western competitiveness; the political response so far has been silence.

When the alliance itself becomes a chokepoint

The Franco-British maritime mission is the piece of news that looked smallest and mattered most. By announcing a joint naval deployment to the Strait of Hormuz operating outside the American blockade framework, Paris and London formalised what had until then been a private frustration: European strategic interests can no longer be safely delegated to Washington.[4] The mission is described as “strictly defensive” — diplomatic language for we are not doing what the Americans are doing. The communiqué is the document historians will reach for when they date the inversion of the post-war bargain.

Spain’s concurrent state visit to Beijing — Prime Minister Pedro Sánchez meeting President Xi Jinping to secure Chinese foreign direct investment in Spanish renewable energy, biopharmaceuticals, and engineering firms — confirms that the fragmentation runs in multiple directions at once.[7] The European Union’s stated “de-risking” strategy is contradicted from inside the bloc the same week it is contradicted from outside. The €359.8 billion EU trade deficit with China published by Eurostat on 10 April is the empirical evidence that de-risking has not, in fact, been happening.[8]

The inversion Helen Thompson predicted

The historian Helen Thompson argued in Disorder: Hard Times in the 21st Century that the post-war Atlantic settlement was always a contingent arrangement of energy, security, and finance — not a permanent moral architecture, and not stable indefinitely.[9] What Thompson described in long historical register, this fortnight delivered in operational form. The bargain that afforded eighty years of European prosperity has not strained; it has inverted. The arrangement that once underwrote European security now actively imposes the principal structural risk to European prosperity, because the unilateral instruments Washington is willing to deploy — naval blockades, extraterritorial export controls, tariff revisions targeting allied vendors — operate on Europe with the same force they operate on adversaries.

The implication for any UK or European business is not that the United States has become hostile. It is that the United States has become unpredictable in ways that make American technology, American security guarantees, and American capital markets newly risky as default assumptions. A treasury function that holds a majority of its corporate cash in dollar instruments, a procurement function that defaults to American hyperscalers, an operations function that assumes American-flagged vessels will move its goods — each of these is now a position with a beta to American political volatility, which is currently the highest beta in the global system.

What your board paper should now say

Adam Tooze has argued, persuasively, that the polycrisis is structural rather than episodic — that the convergent shocks of the past five years are not a sequence of unrelated events but the surface expression of a single underlying re-ordering.[10] If that frame is correct, and the evidence of this fortnight is that it is, then the quarterly enterprise risk paper that treats geopolitics as a “watch item” under “external environment” is no longer a serious document.

Three lines that should be rewritten in the next paper to the Audit and Risk Committee:

The first line is the vendor concentration matrix. Any matrix that aggregates “cloud” or “AI infrastructure” as a single category, without breaking out the proportion held with US hyperscalers versus UK or EU sovereign providers, is now under-specified. The MATCH Act timeline is 150 days. The board needs to know, before that clock expires, which workloads are exposed to a unilateral American export control on the equipment used to build the infrastructure those workloads run on.

The second line is the supply chain map. Any map that treats freight insurance, lead times, and chokepoint exposure as logistics rather than as strategic risk is mis-categorising the data. The 7 to 15 days now added to Asia–Europe ocean transit via the Cape of Good Hope, the 10 per cent effective capacity reduction across global ocean networks, and the 30 to 40 per cent increase in greenhouse gas emissions on diverted routes are not operational frictions.[11] They are the new permanent baseline for any inventory model.

The third line is the political risk register. Any register that lists “geopolitical instability” as a single item, without naming the specific transatlantic instruments that now operate against allied interests, is performing risk theatre. The instruments are named: the MATCH Act, the Section 232 tariff revisions, the BIS licence delays, the Strait of Hormuz blockade. They are dated. They are quantifiable.

What happens in the next eighteen months

Noah Smith has argued that the West’s stance towards China is “derisking, not decoupling” — a graduated reduction of dependency rather than a clean break.[12] That framing was accurate for the first half of the decade. It is now, in the spring of 2026, behind the curve. We are past derisking. The next eighteen months are about procurement-driven re-sovereigntisation, and the evidence will accumulate in three places.

The first place is public-sector contract awards. UK Government Digital Service procurement, the Crown Commercial Service framework refreshes, the EU Chips Act Pillar II disbursements, and the German Bundesnetzagentur tenders for sovereign data infrastructure will publish award data quarterly. Watch the share going to UK and EU domiciled providers. The trend is already visible; the question is the slope.

The second place is capital re-allocation. Institutional investors and pension funds with ESG and political risk mandates will rotate from US tech megacaps into UK and European technology equities at the rate the procurement signal becomes legible. London is already the deeper liquidity venue for European listings; the question is whether sovereign procurement creates enough domestic earnings growth to make London the primary listing venue rather than the secondary one.

The third place is the regulatory perimeter. Labour has publicly ruled out single market re-entry during this parliament. That position will hold formally and shift operationally. Expect de facto alignment — on data, chemicals, product standards, and critical infrastructure procurement — to advance materially within 18 months, regardless of de jure status. By October 2027, the operational distinction between UK and EU regulatory regimes for sovereign technology procurement will be substantially smaller than it is today.

The bottom line

The board paper being written this week, in the commuter-belt office of a senior risk director somewhere between Manchester and London, has a choice. It can describe the events of the last fortnight as an oil shock plus three unrelated technology stories. Or it can describe them as a single inversion — the moment the post-war bargain stopped underwriting prosperity and began pricing it. The first description is comfortable and wrong. The second is uncomfortable and accurate.

The Control Layer exists to translate a Strait of Hormuz headline into a page-three line item in your Audit and Risk Committee paper, in a voice a board will quote — because nobody else on Substack is doing that translation, and the quarter that has begun is the one in which boards either commission that translation or discover, in the next quarter’s loss provision, that they should have.

Subscribe to receive Part 2 — The metal floor: aluminium, helium, and the hidden inputs to the sovereign technology stack — and the rest of the Four Chokepoints series.

Subscribe now

References

[1]: Reuters. *“Gulf aluminium output crippled as Iranian strikes hit EGA and Alba facilities.”* 11 April 2026.

[2]: U.S. Geological Survey. *“Mineral Commodity Summaries 2026 — Helium.”* January 2026.

Linde plc. *“Annual Report 2025 — Helium Supply Chain Disclosures.”*

[3]: U.S. House of Representatives. *Multilateral Alignment of Technology Controls on Hardware Act*, H.R. 8170, 119th Congress (2026).

[4]: HM Government and Government of the French Republic, joint communiqué. *“Franco-British Defensive Maritime Mission to the Persian Gulf.”* 10 April 2026.

[5]: ASML Holding N.V. *“Annual Report 2025 — Geographic Revenue Disclosure.”*

[6]: U.S. Bureau of Industry and Security. *“Export Licensing Performance Report Q1 2026.”*

[7]: Government of Spain, Office of the Prime Minister. *“State Visit to the People’s Republic of China, 13–15 April 2026.”*

[8]: Eurostat. *“EU trade in goods with China — 2025 annual data.”* Released 10 April 2026.

[9]: Helen Thompson. *Disorder: Hard Times in the 21st Century*. Oxford University Press, 2022.

[10]: Adam Tooze. *Chartbook* (Substack). See in particular Chartbook #321 on the structural polycrisis framework.

[11]: Drewry Shipping Consultants. *“Container Shipping Outlook April 2026.”* Cited in *Lloyd’s List*, 11 April 2026.

[12]: Noah Smith. *Noahpinion* (Substack). *“Derisking, not decoupling: the West’s actual China strategy.”*

Author

Amer Altaf is Founder and CEO of Arkava, a UK and European sovereign AI agentic automation business, and Managing Editor of The Control Layer, the publication where he tracks the convergence of cyber security, technology sovereignty, and geopolitics. A techUK member, he contributes to industry engagement on UK technology sovereignty policy. His January 2026 analysis of Airbus’s migration off Google and Microsoft argued European cloud sovereignty had moved from policy aspiration to active corporate posture — six months before the Hormuz blockade made the argument unavoidable. He is currently writing on cloud security for Oxford University Press’s Expert Essentials series.

In just weeks of testing, Mythos Preview has autonomously identified thousands of zero-day vulnerabilities in every major operating system and every major web browser — including a 27-year-old flaw in OpenBSD, a 16-year-old bug in FFmpeg that automated testing missed five million times, and a chained Linux kernel exploit that escalates to full machine control.

The 12 launch partners — AWS, Apple, Microsoft, Google, Cisco, CrowdStrike, Palo Alto Networks, Broadcom, NVIDIA, JPMorganChase, the Linux Foundation, and Anthropic — will use the model exclusively for defensive security work. Anthropic is committing $100 million in usage credits and $4 million to open-source security organisations.

In this solo episode, I break down what Mythos Preview can actually do, why the defensive case is strong, and why the dual-use problem — the same model that finds vulnerabilities can exploit them — cannot be engineered away.

Then I ask the question almost no one else covering this story is asking: why are all 12 launch partners US-headquartered? What does it mean when the most powerful defensive cybersecurity tool ever created is exclusively in the hands of American companies, subject to US government engagement, with no mention of the UK’s NCSC, the EU’s ENISA, or any non-US government body?

What I cover:

• Claude Mythos Preview’s capabilities — and why this is a step change, not an incremental improvement

• The defensive case: $100M in credits, open-source funding, and a coalition that touches most of the world’s software infrastructure

• The dual-use tension: Mythos develops working exploits autonomously, without human steering

• The sovereignty question: all 12 partners are US-headquartered, and the implications for UK and European defenders are significant

• Five things to watch over the coming months — from the 90-day report to the UK’s Cyber Security and Resilience Bill

This episode is for:

• CISOs and security leaders assessing what AI-augmented threats mean for their organisations

• CTOs and engineers building on infrastructure maintained by Glasswing partners

• Policymakers writing cybersecurity legislation in a world that just changed

• Anyone who believes the geography of AI capability is a strategic question, not a technical footnote

Read the full analysis:

Listen and subscribe:

• YouTube:

• Apple Podcasts:

• Spotify:

• Substack:

The Control Layer is hosted by Amer Altaf, founder and CEO of Arkava, and publishes weekly.

Sponsored by Arkava — Trusted Intelligence, Tangible Impact.

Yesterday, Anthropic did something no major AI lab has done before: it announced a frontier model — Claude Mythos Preview — and simultaneously declared it would not be making it publicly available. The reason? The model is so proficient at finding and exploiting software vulnerabilities that releasing it could, in the company’s own assessment, pose a serious threat to global cybersecurity.

Instead, Anthropic launched Project Glasswing — a coalition of 12 launch partners, plus roughly 40 additional organisations, who will use Mythos Preview exclusively for defensive security work. The stated goal is to find and fix vulnerabilities in the world’s most critical software before attackers can exploit them.

Join The Control Layer for weekly perspectives on AI, cybersecurity, and building technology that serves human purpose.

It is, by any measure, a significant moment. But it also raises questions that Anthropic’s announcement — carefully framed in the language of collective defence — leaves largely unanswered.

What Mythos Preview can actually do

The capabilities are striking. In just a few weeks of testing, Mythos Preview has autonomously identified thousands of zero-day vulnerabilities— flaws previously unknown to the software’s own developers — across every major operating system and every major web browser.

Three examples illustrate the scale of what we are talking about:

27-year-old vulnerability in OpenBSD, widely regarded as one of the most security-hardened operating systems in the world and used to run firewalls and critical infrastructure. The flaw allowed an attacker to remotely crash any machine running the OS simply by connecting to it. Twenty-seven years. Millions of lines of human review. Missed.

16-year-old vulnerability in FFmpeg, the video encoding library embedded in countless pieces of software globally. Automated testing tools had hit the relevant line of code five million times without catching the problem. Mythos Preview found it.

And perhaps most consequentially, the model autonomously discovered and chained together several vulnerabilities in the Linux kernel — the software running most of the world’s servers — to escalate from ordinary user access to complete machine control.

On the CyberGym benchmark for vulnerability reproduction, Mythos Preview scored 83.1%, compared to 66.6% for Anthropic’s previous best model, Claude Opus 4.6. On SWE-bench Verified, it reached 93.9%. These are not incremental improvements. They represent a step change in what AI systems can do to — and for — software security.

Anthropic’s own framing is unusually candid: frontier AI models have reached a level of coding capability where they can surpass all but the most skilled humans at finding and exploiting software vulnerabilities. And given the rate of AI progress, it will not be long before such capabilities proliferate.

The defensive case — and it is a strong one

The logic behind Project Glasswing is sound and, in many respects, overdue.

The global cost of cybercrime is notoriously difficult to pin down, but credible estimates place it between $500 billion and $1.5 trillion annually, depending on methodology. The attack surface is vast and growing: banking systems, healthcare records, logistics networks, energy grids, and the open-source software that underpins virtually all of them.

Until now, finding serious vulnerabilities has required a level of expertise held by a tiny number of people. AI models like Mythos Preview could fundamentally shift the economics of defence. If you can scan a codebase of millions of lines and surface flaws that survived decades of human review, you can fix them before they are exploited. That is genuinely transformative.

The open-source dimension is particularly important. The Linux Foundation’s Jim Zemlin put it well: open-source maintainers — whose software underpins much of the world’s critical infrastructure — have historically been left to figure out security on their own. Anthropic’s commitment of $2.5 million to Alpha-Omega and OpenSSF through the Linux Foundation, and $1.5 million to the Apache Software Foundation, is a concrete step toward changing that. If maintainers of critical open-source projects can access Mythos-class scanning, the downstream security benefits could be enormous.

The broader coalition makes strategic sense, too. AWS, Microsoft, Google, Apple, Cisco, CrowdStrike, Palo Alto Networks, Broadcom, NVIDIA, JPMorganChase — these organisations collectively touch a vast proportion of the world’s software and infrastructure. If they can systematically scan and patch their foundational systems, the aggregate reduction in attack surface would be significant.

Anthropic has also committed $100 million in usage credits for Mythos Preview across the initiative. After the research preview, the model will be available to participants at $25/$125 per million input/output tokens via the Claude API, Amazon Bedrock, Google Cloud’s Vertex AI, and Microsoft Foundry. This is not a symbolic gesture. It is a serious resource commitment.

The dual-use problem no one can engineer away

Here is the tension at the heart of Project Glasswing, and it is one Anthropic is remarkably transparent about: the same model that finds vulnerabilities can exploit them.

Mythos Preview did not simply identify the OpenBSD flaw or the Linux kernel vulnerabilities. It developed working exploits — in many cases entirely autonomously, without human steering. It wrote a browser exploit chaining together four separate vulnerabilities. It found KASLR bypasses and race conditions in the Linux kernel and escalated privileges to root.

This is why Anthropic is not releasing the model publicly. It is also why the company has been in ongoing discussions with US government officials about Mythos Preview’s offensive and defensive cyber capabilities.

But acknowledging the dual-use problem is not the same as solving it. Anthropic’s stated plan is to develop safeguards that “detect and block the model’s most dangerous outputs” and launch them with an upcoming Claude Opus model. Security professionals affected by those safeguards will be able to apply for an upcoming Cyber Verification Programme.

The question is whether safeguards can ever be robust enough. The history of AI safety measures suggests a pattern: capabilities advance faster than controls. And the specific challenge with cybersecurity capabilities is that the line between legitimate defensive research and offensive exploitation is often a matter of intent, not technique.

CrowdStrike’s CTO Elia Zaitsev captured the urgency well: “The window between a vulnerability being discovered and being exploited by an adversary has collapsed — what once took months now happens in minutes with AI.” That compression does not just apply to known vulnerabilities. It applies to the proliferation of AI models capable of finding new ones.

DARPA recognised this trajectory a decade ago with the original Cyber Grand Challenge in 2016. The AI Cyber Challenge in 2025 saw competing systems identify 86% of synthetic vulnerabilities, up from 37% at semifinals. Mythos Preview represents another leap beyond even that. The direction is clear; the speed is what has changed.

Twelve partners. All American. That is not a detail — it is the story.

Now consider the composition of Project Glasswing.

The 12 launch partners are: Amazon Web Services, Anthropic, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA, and Palo Alto Networks.

Every single one is US-headquartered.

The 40+ additional organisations given access are described as those that “build or maintain critical software infrastructure.” The announcement does not name them. Anthropic frames the initiative in the language of global defence — “securing the world’s most critical software” — and references “democratic states” and “the United States and its allies.”

But the practical reality is that the most powerful defensive cybersecurity tool ever created is, at launch, exclusively in the hands of American companies and subject to US government engagement. Anthropic has been in “ongoing discussions with US government officials” about Mythos Preview. There is no mention of equivalent engagement with the UK’s National Cyber Security Centre, the EU Agency for Cybersecurity (ENISA), or any non-US government body.

This matters for several reasons.

First, critical national infrastructure does not respect corporate headquarters. The UK’s National Health Service, its energy grid, its financial services sector, and its defence supply chain all run on software maintained by the organisations in Project Glasswing. When Mythos Preview finds a vulnerability in the Linux kernel or in a Cisco product, that vulnerability affects British systems as much as American ones. The question is whether UK defenders will have the same access to fix it, at the same speed.

Second, Anthropic’s pricing model after the research preview — $25/$125 per million tokens — means that even when access is theoretically available, cost and availability will be determined by a US company operating under US jurisdiction. For organisations in regulated UK sectors — defence, financial services, healthcare — the question of where their vulnerability data is processed, and under whose legal jurisdiction, is not academic.

Third, and most fundamentally, this is a pattern. The most consequential AI capabilities — whether in language, reasoning, or now cybersecurity — are being developed by US companies, deployed first to US partners, and shaped by US government engagement. The UK’s position as a close ally does not automatically translate into equivalent access, timing, or influence over how these tools are governed.

None of this is a criticism of Anthropic’s decision to restrict Mythos Preview. On the contrary — the decision not to release it publicly is responsible, perhaps even courageous, given the commercial pressure to ship. But responsible AI development and equitable access to AI-powered defence are two different things. Project Glasswing addresses the first. It does not yet address the second.

What to watch

Project Glasswing is the beginning of something, not the end. Several things are worth tracking over the coming months:

The 90-day public report. Anthropic has committed to reporting publicly within 90 days on what the initiative has learned, including vulnerabilities fixed and improvements made. The quality and transparency of that report will tell us a great deal about whether this is a genuine public good or a carefully managed preview programme.

Non-US participation. Whether and how Anthropic extends Glasswing access to non-US governments, CERTs, and critical infrastructure operators. The announcement mentions an aspiration for “an independent, third-party body” to host continued work. Who sits on that body, and where it is domiciled, will matter.

The safeguards question. Anthropic’s plan to launch new safeguards with an upcoming Claude Opus model is the critical dependency for any broader availability of Mythos-class capabilities. If those safeguards prove robust, it opens the door to wider defensive use. If they do not, the argument for permanent restriction strengthens — and so does the asymmetry between those who have access and those who do not.

Open-source uptake. The $4 million in direct donations and the Claude for Open Source programme are the most democratising elements of the announcement. Whether maintainers of critical open-source projects actually adopt Mythos-class scanning — and whether the tools are accessible enough for under-resourced teams — will determine whether this narrows or widens the security gap.

Government response. The UK government’s forthcoming Cyber Security and Resilience Bill, and the EU’s implementation of the NIS2 Directive, will both need to reckon with a world in which AI systems can find and exploit vulnerabilities faster than human defenders can patch them. Whether policymakers are prepared for that shift is an open question.

The bottom line

Project Glasswing is the most significant cybersecurity announcement of 2026 so far, and arguably the clearest demonstration yet that frontier AI has crossed a threshold in offensive and defensive cyber capability.

Anthropic deserves credit for the transparency of its approach and the scale of its commitment. The decision to restrict Mythos Preview, to build a coalition rather than race to market, and to fund open-source security work — these are all the right instincts.

But the announcement also crystallises a deeper tension in the AI era: the tools we most urgently need for collective defence are being built, controlled, and governed by a remarkably small number of actors in a single jurisdiction. For the UK, for Europe, and for every other democracy that depends on the same software infrastructure, the question is not whether Project Glasswing is a good idea. It is. The question is whether we are content to be downstream beneficiaries of American AI capability — or whether we intend to be active participants in shaping how that capability is deployed.

That is not a question Anthropic can answer. It is one for us.

Amer Altaf is Founder & CEO of Arkava, a sovereign AI agentic automation business in the United Kingdom and Europe, and Managing Editor of The Control Layer.

Sources and further reading:

- [Project Glasswing — Anthropic]

- [Claude Mythos Preview — Anthropic Frontier Red Team]

- Anthropic limits Mythos AI rollout over fears hackers could use model for cyberattacks — CNBC

- [Anthropic is giving some firms early access to Claude Mythos to bolster cybersecurity defenses — Fortune]

- [Anthropic says its most powerful AI cyber model is too dangerous to release publicly — VentureBeat]

- [Tech giants launch AI-powered Project Glasswing — CyberScoop]

- [CrowdStrike founding member of Anthropic Mythos initiative]

- [Project Glasswing: Tech giants unite to fix AI-found software risks — Interesting Engineering]

- [DARPA AI Cyber Challenge results — DARPA]

- [Estimating global yearly cybercrime damage costs — Governance.ai]

Why it matters: Three quarters of enterprise AI investments fail to produce measurable value. New cross-sector evidence from Broadridge, Gartner, and verified case studies across energy, logistics, and financial services reveals a consistent cause. The problem is not the AI. It is the absence of an orchestration layer connecting discrete technologies into coordinated, accountable workflows. Organisations that close this gap are reporting 50% cycle-time reductions, millions in annual savings, and production gains of 10–20%.

Join The Control Layer for weekly perspectives on AI, cybersecurity, and building technology that serves human purpose.

Why is the gap between AI spending and AI value widening?

Something peculiar is happening in enterprise technology. Spending on AI has never been higher. Adoption has never been faster. And yet, the majority of AI investments still fail to return measurable business value.

The Broadridge 2026 Digital Transformation Study, surveying more than 900 financial services technology and operations leaders globally, documents a striking acceleration: 80% of firms now report active AI use, up from 31% in 2025 [1]. Some 26% are already deploying agentic AI, with more than half of those deployments moving beyond pilot programmes into operational use [1]. One US-based asset manager reported saving approximately 350 hours per month in its KYC function alone through agentic AI [1].

Yet look beneath the headline adoption figures and a more uncomfortable picture emerges. Forty-three percent of firms believe they will need to rebuild their entire technology stack to succeed in the age of AI [1]. Sixty-five percent have no formal mandate or incentives to use AI. Thirty-seven percent cite talent shortages as a barrier to scaling agentic systems [1].

The pattern is consistent across sectors. Investment is accelerating. Value realisation is not keeping pace. According to McKinsey, while the economic potential of AI is enormous, most organisations struggle to move from pilot to production at scale. The question is: why?

What is orchestration and why does it matter?

The answer, increasingly supported by cross-sector evidence, is orchestration. Not the AI models themselves. Not the data. Not the algorithms. The layer that sits between all of them, coordinating decisions, enforcing governance, and connecting discrete technologies into workflows that actually produce outcomes.

Service Orchestration and Automation Platforms (SOAPs) have evolved from specialist IT scheduling tools into what Gartner now recognises as a distinct, critical market category [2]. Redwood Software, named a Leader in Gartner’s Magic Quadrant for SOAPs for two consecutive years, frames the challenge plainly: the most competitive enterprises are no longer differentiating on the smartness of their algorithms, but on how effectively their orchestration platforms connect insight to decision to execution [2].

Think of it this way. A hospital might have an excellent diagnostic AI, a robust electronic patient record, and an efficient scheduling system. Without orchestration, each operates in isolation. The diagnostic insight does not automatically trigger the right appointment. The appointment does not automatically update the patient record. The record does not automatically inform the discharge process. Each handoff introduces delay, error, and cost.

Orchestration eliminates those handoffs. It turns a collection of capable tools into a coordinated system. The UK’s National Cyber Security Centre has long advocated integrated, defence-in-depth approaches to technology architecture, and orchestration applies the same principle to operational AI.

The enterprises realising extraordinary AI returns are not the ones with the smartest algorithms. They are the ones with orchestration platforms that connect discrete technologies into coordinated workflows.

What does orchestration look like in practice?

Financial services: from pilots to production

The Broadridge data confirms financial services is leading the orchestration shift. Among firms deploying agentic AI, adoption is most advanced at large institutions. Nearly one third of firms managing more than $250 billion in assets report active agentic AI deployments [1]. These are production systems handling underwriting, compliance interpretation, and customer onboarding.

The critical enabler is orchestration. Autonomous agents handling KYC checks or loan decisioning only work at scale when an orchestration layer governs their behaviour, ensures compliance with frameworks such as the EU AI Act and UK GDPR, maintains audit trails, and integrates with legacy ERP systems without disruption.

Energy: process mining before automation

OMV Petrom, Europe’s largest oil and gas producer, provides a compelling case study in orchestration-first transformation. The company’s S4Strive programme consolidated 170 legal entities under a single SAP S/4HANA platform, integrating business process management frameworks, process mining analytics, and robotic process automation for financial workflows [3].

The results were substantial: a 50% reduction in invoice-to-payment cycle times, more than 225,000 labour hours saved annually, and cost reductions exceeding €8 million [3]. IBM, the implementation partner, confirmed the consolidation of 170 company codes into a single instance [4].

The critical lesson here is sequencing. OMV Petrom did not deploy RPA first and hope for the best. The organisation standardised processes through BPM frameworks, then used process mining to identify bottlenecks and deviations, and only then applied automation to the right tasks in the right order. Orchestration was the design principle, not an afterthought. This mirrors the approach recommended by the NCSC’s Cyber Assessment Framework: understand your current state before implementing controls.

Manufacturing: scheduling as the orchestration centre

BDO’s 2026 Manufacturing Industry Predictions highlight the growing role of predictive modelling and analytics tools for identifying supply chain risks, projecting stock-outs, and adjusting production schedules dynamically [5]. Early adopters report 10–20% production gains and 7–20% productivity improvements from operational AI tied to sensors, schedules, and routings [6].

Scheduling systems are emerging as orchestration centres that translate supply chain anomalies, maintenance signals, and quality alerts into coordinated production decisions. The Deloitte 2025 Smart Manufacturing Survey found that 29% of manufacturers deploy traditional AI/ML for operations, compared to 24% for GenAI, with operational AI delivering significantly higher ROI [6].

Logistics: RPA at scale requires orchestration discipline

Raben Group, a Dutch-based logistics provider managing 1.6 million square metres of warehouse space and nearly 12,000 employees, demonstrates what happens when RPA is deployed with orchestration rigour. The company has deployed more than 200 RPA automations, saving 78,815 employee workdays and over €6 million annually [7].

One telling detail: the average time for manual creation of spot customer offers was 15 minutes. After automation, it dropped to an average of 21 seconds, with over 99% sent to customers within two minutes [8]. Raben’s success correlates directly with its orchestration approach: a proprietary process management platform, a dedicated Centre of Excellence, and systematic identification of high-volume processes before deploying automation [8].

How does the UK public sector approach orchestration?

The UK Government Digital Service Roadmap 2026–2030 signals that orchestration principles are entering public sector strategy. GOV.UK One Login has been used by over 13 million people to access more than 120 government services [9]. The roadmap mandates API-first architecture across public sector organisations, with a target of 1 in 10 civil servants in digital and technology roles by 2030 [9].

For UK suppliers and technology consultancies, this represents both opportunity and obligation. The Digital Commercial Centre of Excellence projects £1.2 billion in annual savings through standardised procurement [9]. Vendors unable to meet government data residency, Cyber Essentials Plus, or ISO 27001 compliance requirements face exclusion from this growing market.

Analysis: three lessons for UK organisations

First, orchestration is not optional infrastructure. Point solutions without orchestration create silos that degrade AI value realisation and increase total cost of ownership. An organisation deploying RPA here, a predictive model there, and an AI chatbot somewhere else without connecting them is building complexity rather than capability.

Second, process standardisation must precede automation. OMV Petrom’s success was built on process mining and BPM standardisation before any RPA was deployed. Raben Group’s results correlate with systematic process identification and governance. The lesson is clear: automating a broken process produces a faster broken process.

Third, governance and orchestration are converging. As agentic AI moves into production, orchestration platforms are becoming the enforcement layer for AI governance under frameworks like the EU AI Act and the UK’s Data Use and Access Bill. They define boundaries for autonomous action, maintain audit trails, and ensure compliance. With 37% of firms citing talent gaps [1], governance cannot rely on human oversight alone. It must be embedded in the orchestration layer.

How Arkava helps enterprises close the orchestration gap

Arkava exists precisely because mid-market UK organisations face the orchestration gap most acutely. Enterprise platforms like Palantir and Workato serve organisations with six-figure technology budgets and dedicated integration teams. The mid-market, typically £50M–£500M revenue, sits in a gap: too complex for off-the-shelf tools, too resource-constrained for enterprise platforms.

Arkava bridges this gap through three interconnected services. Arkava Advisory provides strategic consulting that begins with process mapping and existing technology assessment, identifying where disconnected AI investments are leaking value before recommending solutions. This mirrors the OMV Petrom sequencing principle: understand the landscape, standardise the processes, and only then deploy automation.

Arkava Ignite delivers AI transformation assessments that evaluate an organisation’s readiness for orchestrated automation, covering data quality, process maturity, governance frameworks, and integration architecture. The assessment produces a prioritised roadmap calibrated to the organisation’s actual capabilities rather than aspirational targets.

Arkava Spark, the subscription automation platform, provides the orchestration layer itself, built on Industry-leading workflow orchestration technology and deployed within UK sovereign infrastructure. This means data remains under UK jurisdiction, meeting UK GDPR, DPA 2018, and defence-sector compliance requirements without exposing organisations to CLOUD Act risks associated with US-headquartered cloud providers.

The outcome-based pricing model aligns Arkava’s incentives with client results. Rather than billing for implementation hours regardless of outcome, Arkava ties success to measurable value realisation. This is the difference between buying technology and buying outcomes.

For organisations recognising the orchestration gap in their own operations, a practical first step is the Arkava Ignite Readiness Assessment: a structured evaluation of current AI investments, process maturity, and integration architecture that identifies the highest-value orchestration opportunities. Contact Arkava to discuss your organisation’s specific situation.

Risks and constraints

Integration complexity is real. Consolidating legacy systems under an orchestration layer is a multi-year undertaking, as OMV Petrom’s experience demonstrates. For mid-market organisations with smaller IT teams, external expertise is often essential.

Vendor lock-in risk. SOAP platforms are becoming critical infrastructure. Organisations should evaluate data portability, API openness, and exit costs before committing. UK sovereignty considerations add another dimension: where is your orchestration data stored, and under whose jurisdiction?

The talent gap applies here too. Orchestration requires people who understand both technology and business processes. The UK Tech Workforce shortage means this hybrid skillset remains scarce.

Measurement remains imperfect. Attribution is complex when isolating orchestration value from underlying technology value. Organisations should expect ROI measurement to be iterative.

What should you do next?

For boards and executives: Commission an orchestration capability assessment. The question is not “do we have enough AI?” It is “are our AI investments connected to each other and to business outcomes?”

For technical leaders: Evaluate readiness for orchestration platforms. Prioritise process mining and standardisation before deploying additional automation. Establish governance frameworks for agentic AI embedded in the orchestration layer, aligned with ICO guidance and sector-specific regulations.

For mid-market organisations: Start with your highest-value, highest-volume processes. Apply the OMV Petrom sequence: standardise first, mine for bottlenecks second, automate third. Even connecting two previously siloed tools into a coordinated workflow can deliver measurable returns within months.

Disclaimer: This article represents analysis based on publicly available information as of March 2026. It does not constitute legal, financial, or professional advice.

*If your organisation needs support connecting AI investments to measurable outcomes, Arkava helps mid-market enterprises turn technology spending into business results through sovereign orchestration and governance frameworks.*

References

[1] Broadridge Financial Solutions. “2026 Digital Transformation & Next-Gen Technology Study.” *Broadridge*, 25 February 2026.

[2] Redwood Software. “AI and Automation Trends 2026: From Efficiency to Enterprise Resilience.” *Redwood*, 28 January 2026.

[3] Ionescu, V. & Popescu, A. “Digital integration for sustainable competitiveness: the role of BPM, process mining and ERP in accounting automation.” *Applied Studies in Agribusiness and Commerce*, 18(1), 31 December 2025.

[4] IBM. “OMV prepares for sustainable growth.” *IBM Case Studies*.

[5] BDO USA. “2026 Manufacturing Industry Predictions.” *BDO Insights*, 16 March 2026.

[6] Phantasma Global. “AI and Automation in Manufacturing: Trends, Challenges & High ROI Use Cases in 2026.” *Phantasma Global*.

[7] Supply Chain Brain. “How Robotic Process Automation Helps Reduce Business Costs.” *Supply Chain Brain*, 10 September 2024.

[8] UiPath. “Automation saves Raben Group €6 million a year.” *UiPath Case Studies*.

[9] Government Digital Service. “Our roadmap for modern digital government.” *GDS Blog*, 20 January 2026.

Last week? Yesterday? This morning?

Now imagine you didn’t do any of it. Your AI assistant found the product, compared the prices, checked the reviews, and completed the purchase. All while you were drinking your morning coffee.

That world isn’t coming. It’s already here. And it raises a question that very few people are asking, but everyone should be: who controls the agent?

When an AI is shopping on your behalf — spending your money, handing over your data — who’s making sure it’s safe? Who’s making sure it’s even really you?

That’s the question I put to Andrew Dunbar in the very first episode of The Control Layer.

Andrew is the Chief Information Security Officer at Shopify. He joined as their first security hire in 2012 and has spent 14 years building the trust infrastructure behind a platform that now powers commerce for over 875 million buyers a year — roughly one in six people on the internet.

What We Cover

The new perimeter. The browser used to be the security boundary. The padlock icon, the HTTPS warning, the cookie consent pop-up — all of it was designed to keep humans in the loop. In the agentic world, the browser is gone. So what replaces it?

The Universal Commerce Protocol. In January 2026, Shopify and Google co-launched UCP — an open protocol that defines how AI agents, merchants, credential providers, and payment processors should interact. Andrew walks through the four roles, why it’s open rather than proprietary, and how cryptographic signing means a compromised agent can’t complete a fraudulent transaction even if the platform or the merchant has been breached.

The mobile OS analogy. Andrew makes a point that stuck with me: mobile operating systems got to learn from every mistake desktop ever made. Containerisation, permissioning, isolation — all built in from day one. Agentic AI is that same generational leap. We have a chance to build trust in from the start rather than bolting it on later.

The 15x signal. Shopify has seen a 15x year-over-year increase in agentic shopping leading to actual purchases. This isn’t theoretical. The shift is happening now, and the security architecture needs to move just as fast.

What every CISO should be doing today. Andrew’s advice is direct: deploy phishing-resistant MFA everywhere, audit how your vendors are using AI, and start instrumenting decisions — not just infrastructure. Chain-of-thought logging gives you something you’ve never had before: the ability to ask an agent what were you thinking when you did that?

This was a conversation I’ve wanted to have for months, and Andrew delivered. Whether you’re a founder, a security professional, a product builder, or someone who’s just started letting AI do your shopping — this episode is worth your time.

Listen Elsewhere

🎧 Apple Podcasts —

🎧 Spotify —

📺 YouTube —

If this is the kind of conversation you want more of — AI, cybersecurity, trust, and the people building the systems that sit between you and the machine — subscribe to The Control Layer. New episodes dropping regularly.

— Amer Altaf, Founder & CEO, Arkava

Why it matters: Frontier AI just proved it can find critical software vulnerabilities faster than human security researchers. At the same time, criminal groups are weaponising the same technology for autonomous attacks at machine speed. The organisations that harness AI for defence first will define the next era of cybersecurity. Those that wait will be defending yesterday’s perimeter against tomorrow’s threats.

Join The Control Layer for weekly perspectives on AI, cybersecurity, and building technology that serves human purpose.

The Discovery That Changed the Conversation

On 6 March 2026, Anthropic announced that Claude Opus 4.6 had identified 22 critical vulnerabilities in Firefox 148, including 14 classified as high severity [3]. This was not a theoretical exercise or a controlled benchmark. It was a structured security research engagement that validated Mozilla’s patch cycle and demonstrated something the cybersecurity community has debated for years: frontier AI models can perform productive vulnerability research at a speed and scale that human teams simply cannot match.

The significance extends beyond the headline number. Traditional vulnerability research relies on skilled humans spending weeks or months fuzzing code, reviewing logic flows, and testing edge cases. Claude completed its analysis using extended context capabilities processing up to one million tokens, effectively reading and reasoning across vast codebases in a single pass [3]. The model’s adaptive thinking and reduced hallucination rates (80% reduction compared to extended thinking baselines) meant its findings were not just numerous but reliable enough to action [6].

For UK mid-market organisations that cannot afford dedicated red teams or bug bounty programmes costing six figures annually, this development is not academic. It signals a future where AI-augmented security tooling becomes accessible, practical, and potentially transformative.

The Other Side of the Coin

Here is where the story gets uncomfortable. While Anthropic was demonstrating AI’s defensive potential, criminal ecosystems were scaling offensive AI capabilities at an alarming rate.

Flashpoint’s 2026 Global Threat Intelligence Report documents what it calls an era of “total convergence” in cybercrime [4]. The numbers demand attention: illicit discussions about AI and machine learning on underground forums surged 1,500% between November and December 2025, jumping from approximately 360,000 to 6 million messages [4]. This is not idle chatter. These communities are building, sharing, and refining autonomous attack frameworks that execute complete attack sequences without human intervention. Reconnaissance, phishing, credential testing, infrastructure rotation — all orchestrated by AI agents operating at machine speed.

The infostealer epidemic provides the fuel. In 2025 alone, 11.1 million devices were infected with credential-harvesting malware, yielding 3.3 billion stolen credentials and cloud tokens [4]. Ransomware incidents climbed 53% year-over-year, with 87% attributed to Ransomware-as-a-Service groups [4][15]. The tactical evolution is stark: attackers now prefer logging in with stolen credentials over breaking in through technical exploits. When your adversary already has the keys, your firewall is decorative.

Perhaps most concerning is the compression of exploitation timelines. The window between vulnerability disclosure and active exploitation has collapsed from weeks to hours, with high-impact flaws now weaponised within 4 to 8 hours of CVE publication [4]. This means traditional patch management cycles — where organisations review, test, and deploy fixes over days or weeks — are increasingly inadequate against adversaries operating at AI-accelerated tempo.

The Arms Race Nobody Can Opt Out Of

The cybersecurity landscape has split into two speeds: AI-accelerated offence operating in hours, and human-paced defence operating in weeks. That gap is where breaches live.

Think of it like this. Imagine a chess match where one player has a grandmaster AI whispering moves in real time, and the other is consulting a strategy book from 2019. That is roughly the asymmetry facing organisations that have not yet integrated AI into their defensive operations.

IBM X-Force researchers discovered over 300,000 ChatGPT credentials listed for sale on dark web marketplaces in 2025 [17]. Open-source AI agent platforms, designed for legitimate automation, are being repurposed as credential harvesting infrastructure. When compromised, these agent systems become goldmines of authentication tokens, API keys, and session data [17].

The World Economic Forum’s February 2026 threat assessment reinforces the picture: 87% of security leaders now identify AI-related vulnerabilities as the fastest-growing risk category, yet only 64% have adopted post-deployment AI security assessments [18]. That 23-point gap between awareness and action is precisely where organisational risk accumulates.

This is not a future problem. It is a current one accelerating weekly.

What Defenders Can Actually Do

The Firefox discovery offers a blueprint, not just a headline. It demonstrates three principles that UK organisations of any size can begin applying.

Principle 1: AI as Force Multiplier, Not Replacement. Claude did not replace Mozilla’s security team. It augmented their capability, identifying flaws that could then be verified, prioritised, and patched by human engineers. The model brought scale and speed. Humans brought context, judgement, and accountability. This partnership model is how AI-augmented security will work in practice — not autonomous systems making unilateral decisions about your infrastructure, but intelligent tools that surface risks for human decision-makers to act upon.

Principle 2: Defensive AI Must Match Offensive Tempo. If attackers exploit vulnerabilities within hours of disclosure, defenders need detection and response capabilities operating on the same timescale. AI-powered vulnerability scanning, anomaly detection, and automated triage can compress the defender’s loop from days to minutes. The technology exists. The implementation gap is organisational, not technical.

Principle 3: Identity Is the New Perimeter. With credential theft dominating the attack landscape and ransomware groups preferring to log in rather than break in [4][15], traditional network security is necessary but insufficient. Multi-factor authentication, privileged access management, single sign-on hardening, and credential monitoring are no longer optional security enhancements. They are baseline survival requirements. AI-powered behavioural analytics can detect anomalous login patterns — a London-based finance director’s credentials used from an unfamiliar jurisdiction at 3am — in ways that static rules cannot.

Analysis

In my view, the Firefox vulnerability discovery represents an inflection point, though perhaps not the one most commentary has focused on.

The real story is not that AI found bugs. Security researchers have been using automated tools for decades. The story is the reliability and depth of what a general-purpose frontier model achieved without being specifically trained for security research. Claude Opus 4.6 was not a purpose-built vulnerability scanner. It was a reasoning model applied to a security context [3]. This generality matters enormously because it means organisations do not need to wait for specialised security AI products to enter the market. They can begin integrating existing frontier models into their security workflows today.

The flip side is sobering. If a commercially available model can find 22 critical flaws in a major browser, criminal groups with access to similar (or open-weight) models can do the same — and they are under no obligation to report their findings responsibly. DeepSeek V4, released as open-weight with one trillion parameters, provides capability that anyone can deploy without usage restrictions or ethical guardrails [1]. The democratisation of AI cuts both ways.

For UK mid-market organisations specifically, the strategic question is not whether to adopt AI-augmented security but how quickly they can do so without introducing new risks. Rushing to deploy AI tools without proper governance — clear access controls, credential isolation, activity logging, and incident escalation protocols — simply creates a different attack surface. The organisations that will navigate this transition successfully are those that treat AI security adoption as a governance challenge, not merely a technology procurement exercise.

Risks and Constraints

Hallucination risk remains real. While Claude Opus 4.6 demonstrated an 80% reduction in hallucination rates, that still means false positives will occur [6]. Security teams acting on AI-generated vulnerability reports without human verification risk wasting resources on phantom threats or, worse, introducing instability through unnecessary patches.

Asymmetric access to capability. Large enterprises can integrate frontier AI models into sophisticated security operations centres. Mid-market organisations with smaller teams and tighter budgets may struggle to operationalise these tools without external support or simplified platforms.

Regulatory ambiguity around AI in security contexts. The UK’s Data Use and Access Act 2025 permits automated decision-making with safeguards, but the boundaries of acceptable AI-driven security responses (automated blocking, credential revocation, incident escalation) remain unclear in practice [5]. Organisations deploying AI defensively should document their governance frameworks now, before enforcement precedents crystallise.

Open-weight model proliferation. DeepSeek V4’s open-weight release provides adversaries with frontier-class capability without commercial oversight [1]. Defensive strategies must assume adversaries have access to equivalent or superior AI tools.

What to Do Next

For boards and executives: Commission an AI security readiness assessment before Q3 2026. Understand where your organisation’s defensive tempo falls relative to the current threat landscape. Ask your CISO one question: if a critical vulnerability is published tomorrow morning, how many hours until we are patched? If the answer exceeds 24 hours, your patch management process needs AI augmentation.

For technical leaders: Begin piloting frontier AI models for internal vulnerability scanning and code review. Start with non-critical systems to validate reliability and build confidence. Simultaneously, audit your identity security stack — MFA coverage, PAM deployment, SSO configuration, credential monitoring. The shift from perimeter to identity-centric security is not optional.

For mid-market organisations: You do not need a dedicated AI security team to benefit from these developments. Evaluate managed security service providers that are integrating AI-powered threat detection. Prioritise identity hardening over network expansion. And establish clear governance for any AI tools touching your security infrastructure — access controls, logging, human oversight requirements, and incident response protocols.

Disclaimer: This article represents analysis based on publicly available information as of March 2026. It does not constitute legal, financial, or professional advice.

If your organisation needs support implementing AI-augmented security governance, Arkava helps mid-market enterprises turn AI investment into measurable security outcomes.

References

[1] Reuters. “DeepSeek to Launch New AI Model.” Reuters, 9 January 2026. https://www.reuters.com/technology/deepseek-launch-new-ai-model-focused-coding-february-information-reports-2026-01-09/
[2] AI Governance Desk. “EU AI Act Enforcement 2026: A CCO’s Complete Compliance Roadmap.” 14 January 2026. https://aigovernancedesk.com/eu-ai-act-enforcement-2026-cco-roadmap/
[3] The Hacker News. “Anthropic Finds 22 Firefox Vulnerabilities Using Claude Opus 4.6 AI.” 6 March 2026. https://thehackernews.com/2026/03/anthropic-finds-22-firefox.html
[4] Flashpoint. 2026 Global Threat Intelligence Report: Era of Total Convergence in Cybercrime. March 2026. https://www.techradar.com/pro/security/in-2026-cybercrime-has-reached-a-point-of-total-convergence-new-research-claims-ai-attack
[5] Osborne Clarke. “Artificial Intelligence | UK Regulatory Outlook February 2026.” 8 February 2026. https://www.osborneclarke.com/insights/regulatory-outlook-february-2026-artificial-intelligence
[6] Blog.mean.ceo. “New AI Model Releases News | March 2026.” 28 February 2026. https://blog.mean.ceo/new-ai-model-releases-news-march-2026/
[15] Convergence Networks. “Top Cyber Threats for 2026.” 18 February 2026. https://convergencenetworks.com/blog/top-cyber-threats-for-2026/
[17] IBM Security. “Cybersecurity Trends 2026: X-Force Threat Analysis.” 10 March 2026. https://www.ibm.com/think/insights/more-2026-cyberthreat-trends
[18] World Economic Forum. “Cyber Threats to Watch in 2026.” 17 February 2026. https://www.weforum.org/stories/2026/02/2026-cyberthreats-to-watch-and-other-cybersecurity-news/

Why it matters: On 3 March 2026, the CEO of Anthropic sat down for the most consequential interview in AI history. Not a keynote. Not a blog post. A direct, unscripted conversation about why his company told the Pentagon no — and what happens next. Every sentence was chosen carefully. This is what he said, what he meant, and what it tells you about where AI governance actually stands.

This is a companion piece to Who Really Controls Your AI? Trump's Ban Threatens UK-EU Sovereignty, which covers the geopolitical and sovereignty implications of the ban.
Watch the full interview here:

Join The Control Layer for weekly perspectives on AI, cybersecurity, and building technology that serves human purpose.

The Setup: Establishing Credentials Before Drawing Lines

Amodei opens not with principle but with proof of loyalty. His first substantive answer is a roll call of pro-military credentials.

He establishes that Anthropic was the first company to deploy on the classified cloud, the first to build custom national security models, and that Claude operates across the intelligence community and military for cyber operations and combat support [1]. He frames this explicitly as patriotic duty, citing the need to defend against autocratic adversaries like China and Russia [1].

This is deliberate sequencing. Before he says the word “no,” he wants the audience to understand that this is not coming from a pacifist. It is not coming from someone who objects to military work on principle. It is coming from the company that has done more military AI work than anyone else in the industry.

The framing matters because it pre-empts the most obvious attack — the one President Trump made hours later when he accused Anthropic of putting American lives at risk. Amodei’s answer to that accusation was already embedded in his opening statement. We are not refusing to serve. We are refusing two specific things out of hundreds.

His estimate — 98% or 99% of use cases accepted— is almost certainly rounded for rhetorical effect. But the message is clear. This is a boundary dispute, not a philosophical objection to military AI.

Red Line One: Surveillance That Is Legal but Shouldn’t Be

Amodei’s surveillance argument is the more intellectually ambitious of the two, and he frames it with a specific mechanism rather than abstract principle.

He describes a pipeline: private companies collect citizen data through commercial activity. The government purchases that data legally. Before AI, this was functionally useless — no human team could analyse billions of data points across millions of people. AI changes the equation. Suddenly, legally purchased commercial data becomes a mass surveillance apparatus [1].

The critical phrase is “getting ahead of the law”. He is not arguing that mass surveillance violates current legislation. He is arguing the opposite — that it does not, and that this is the problem. The legal framework was designed for a world where this capability was technically impossible. Nobody wrote laws against it because nobody needed to.

This is a more sophisticated argument than it first appears. He is not asking the Pentagon to obey the law. He is asking the Pentagon to respect the intent behind the law — the democratic principle that citizens should not be subjected to mass analysis by their own government — even where the letter of the law has not caught up with the technology.

For anyone who has watched the debate around the UK’s Investigatory Powers Act or the EU’s position on bulk data collection, this argument has immediate resonance. The gap between what is technically possible, what is legally permitted, and what is democratically acceptable is widening in every jurisdiction. Amodei is pointing at that gap and saying: we will not help you exploit it.

Red Line Two: The Engineering Argument Against Lethal Autonomy

The weapons argument is structurally different. Where the surveillance objection is about values, the weapons objection is about engineering.

Amodei draws a careful line between partially autonomous weapons — the kind deployed in Ukraine and potentially relevant to Taiwan — and fully autonomous systems where weapons fire without any human involvement. He explicitly acknowledges that democratic nations may eventually need fully autonomous weapons to defend against adversaries who develop them first.

This concession is significant. He is not ruling out autonomous weapons forever. He is ruling them out now, for two stated reasons.

The first is blunt: the AI is not reliable enough. His exact framing — “anyone who has worked with AI models understands there is a basic unpredictability to them that, in a purely technical way, we have not solved”— is the most candid public admission of AI unreliability from any frontier lab CEO. He is not hedging with “sometimes” or “in certain edge cases.” He is stating a fundamental property of current AI systems.

The second is the oversight gap. If you have a large army of drones or robots operating without human oversight, without human soldiers making targeting decisions, the question of who is responsible for what they do becomes unanswerable. He argues that conversation has not happened yet, and deploying the technology before it does is reckless.

Read together, the two arguments create a logical sequence. The technology is not reliable enough. The oversight framework does not exist. Therefore deployment is premature. He is not saying never. He is saying not yet, and not without the conversation we have not had.

This matters for organisations well beyond defence. The same logic applies to any AI system making consequential autonomous decisions — in lending, hiring, medical triage, security access. If there is a basic unpredictability you have not solved, and the oversight framework does not exist, deployment is premature. The principle scales.

The Three-Day Ultimatum: Power, Not Negotiation

The middle section of the interview reveals the mechanics of how the standoff escalated — and it does not read like a negotiation.

Amodei describes a three-day window: agree to Pentagon terms or face designation as a supply chain risk under the Defense Production Act. During that window, the Pentagon sent language that appeared to accommodate Anthropic’s concerns. But the language was loaded with escape clauses — “if the Pentagon deems it appropriate” and “to do anything in line with laws”.

These phrases deserve attention. “If the Pentagon deems it appropriate” transfers all discretion to the party making the request. It is not a restriction; it is a permission slip written as one. “In line with laws” sounds reasonable until you remember that Amodei’s entire surveillance argument rests on the fact that mass surveillance is currently lawful. A commitment to “lawful use” explicitly permits the very thing Anthropic is objecting to.

The Pentagon’s public position, reiterated by spokesman Sean Parnell — “We only allow all lawful use” — confirms this reading. It is not a concession. It is a restatement of the status quo dressed as accommodation.

Amodei’s description of this exchange is measured but pointed. He does not accuse anyone of bad faith. He simply notes that the proposed terms “did not actually concede in any meaningful way”. The restraint is itself a rhetorical choice. He is letting the audience draw the conclusion.

“Retaliatory and Punitive”: Choosing Words Under Pressure

The most revealing moment comes when the interviewer presses Amodei on whether the Pentagon’s actions constitute an abuse of power.

He deflects the first time: “I would return to the idea that this is unprecedented”. When pressed — “But is it an abuse of power?” — he deflects again, noting that this designation has never been used against an American company [1]. He then adds that government statements made it “very clear” this was “retaliatory and punitive” [1].

Watch the language architecture here. He will not say “abuse of power.” That phrase has legal implications and would position Anthropic as making a constitutional claim. Instead, he uses “unprecedented,” “retaliatory,” and “punitive” — words that describe the government’s behaviour without invoking a specific legal framework.

This is a CEO who knows he is heading to court and is being careful not to lock himself into a legal theory during a television interview. The restraint is professional, but the message is unmistakable. They punished us for saying no.

He reinforces this when asked about formal notification. Anthropic has received nothing official — no designation letter, no formal action [1]. Everything has come through social media posts from the President and Secretary Hegseth. The implication: the most powerful government in the world is conducting industrial policy through tweets.

“We Will Be Fine”: Confidence or Performance?

The interview’s closing minutes are about survival. The interviewer asks directly: can Anthropic survive this?

Amodei’s answer is emphatic: “Not only survive it; we are going to be fine” [1]. He characterises the impact of the designation as “fairly small” and accuses the government of deliberately creating “fear, uncertainty, and doubt” [1].

This is corporate crisis communication at a high level. Whether the impact is actually small is debatable — losing all US government contracts and being blacklisted from the defence supply chain is not trivial. But Amodei’s job in this moment is not accuracy. It is confidence. Customers, employees, and investors are watching. Any hint of vulnerability accelerates the exodus.

His repeated emphasis on continuity — offering to maintain services during a transition, supporting warfighters, helping off-board to a competitor — serves a dual purpose. It positions Anthropic as the responsible party (we are trying to help; they are being difficult). And it creates a record that may prove useful in court: we did everything reasonable to mitigate the disruption they caused.

What the Interview Does Not Say

What is absent from Amodei’s responses tells you as much as what is present.

He never mentions OpenAI or Grok by name. He never discusses the competitive dynamics of rivals stepping into the gap Anthropic left. This is almost certainly deliberate. Naming competitors draws comparison and concedes that alternatives exist.

He never discusses Anthropic’s commercial customers. No mention of enterprise revenue, insurance companies, healthcare providers, or the business case for safety-first positioning. He keeps the frame exclusively on national security and democratic values, avoiding any suggestion that this is a commercial calculation dressed as principle.

He never mentions specific legal strategies beyond noting he will “challenge it in court” [1]. He does not preview arguments, cite statutes, or name lawyers. Again, this is discipline. The legal fight is coming, and nothing said on camera should constrain it.

And he never discusses the technology itself in technical detail. No model names. No capabilities. No benchmarks. The “basic unpredictability” framing is as far as he goes. He keeps the audience focused on the governance question, not the engineering one.

Analysis: What This Interview Actually Achieved

In my view, this interview was not primarily about explaining Anthropic’s position. It was about establishing a public record for three audiences simultaneously.

For customers and partners, the message was: we are stable, the impact is manageable, we will be fine. Continue doing business with us.

For the courts, the message was: we acted reasonably, we offered continuity, we were given an unreasonable ultimatum, the government’s actions were unprecedented and retaliatory. Every element of a legal challenge was laid out without explicitly making one.

For the public and the technology industry, the message was: there are things we will not build, regardless of who asks. This is what it looks like when a company holds that line.

Whether you find this admirable or calculated — and it is clearly both — the interview is a masterclass in high-stakes corporate positioning. Amodei managed to appear principled without being preachy, defiant without being aggressive, and confident without being dismissive of a genuine threat.

The question that remains is whether the principle survives the pressure. That depends not on what Amodei said in this interview, but on what Anthropic does in the months ahead.

Disclaimer: This article is based on a single-source interview transcript from 3 March 2026. Several claims made during the interview — including Anthropic being the first company on the classified cloud, the three-day ultimatum timeline, and the absence of formal notification — require independent verification. This does not constitute legal, financial, or professional advice.

If your organisation needs support building AI governance frameworks or assessing AI vendor dependency risks, Arkava helps mid-market enterprises turn AI investment into measurable, accountable outcomes.

References

[1] Dario Amodei, CEO of Anthropic. Interview transcript, 3 March 2026. Source: Research Pack provided to The Control Layer.