Supply, Sovereignty and Jurisdiction: Where the Landscape Runs

On a Monday morning a claims handler in Hansa Mutual's Swiss subsidiary opens a motor claim and asks the claims assistant what the policy wording says about a hire car. The answer appears within a second. She would say it came from the group tool. The longer answer is this. The assistant runs on the group's shared AI platform in Germany. The model that drafted the answer is served from the group data centre in Frankfurt, with a fallback to a general-purpose model provider outside the EU under a recorded exception. Her question and the claim details crossed a border to get there, out of a country that belongs neither to the EU nor to the EEA (the European Economic Area, which adds Norway, Iceland and Liechtenstein to the EU) and into Germany, and the answer crossed back. Nothing on the screen says so. Hansa Mutual is one of the two fictional organisations this book uses and the scene is illustrative, but its shape is ordinary: the person in one place, the application in a second, the model in a third, and the supplier who operates it all perhaps in a fourth.

This chapter teaches the third of the six standard views of Contour, the notation this book uses: V3 The supply and sovereignty view. Chapter 14 taught V1 The one-page landscape, in which every AI use in an organisation, every unit, is drawn as one mark on a grid of autonomy against reversibility; Chapter 15 taught V2 The landscape over time. V3 keeps the same marks and moves them off the grid into the container of whoever runs them: the organisation's own boundary, a supplier named by its role, or a jurisdiction outside the EU and the EEA. It answers the question her screen could not: where does this run, and under whose law.

Figure 16.1: Hansa Mutual's landscape at the end of 2027 in V3: the group's own boundary inside the EU and EEA area, three non-EU jurisdiction containers, and a model chip linking two units to a model provider outside the EU. Illustrative: rendered from landscape/models/hansa_mutual.yaml.

Where it runs

Chapter 5 named the box instinct, which draws the supply of AI as one cloud. The supply behind one AI use is a stack, and for any unit there are four answers to "where does it run", which can be four organisations in four countries. The model: who trained the weights the unit calls, and where they are served. The hosting: on whose computers, in which country, the unit's software runs. The application: who built and supplies the software around the model. The operations: who runs the service day to day, holds the credentials and answers the telephone when it fails. For an AI feature a vendor switched on inside a licensed product, all four are the vendor, and the organisation may know none of them.

AI Governance, Chapter 6, concluded that model origin is a risk question separate from hosting: a dependency has a service layer, a model layer and a platform layer, each with its own jurisdiction (2, Nordqvist, 2026). AI Platform and Security, Chapter 13, concluded that digital sovereignty is a set of verifiable properties and not a location: knowing where workloads run, which law governs them, being able to move them and being able to continue if a provider fails (3, Nordqvist, 2026). V3 is the picture of both: the containers answer the first two properties, and the other two are the questions to ask of every dashed container.

One question must be settled before anything is drawn: does a supplier's AI belong on the organisation's landscape? The notation's answer is that the mark always belongs to the organisation, whether or not the organisation controls the supplier. The organisation is the deployer in the AI Act's terms and, where personal data are involved, the controller in the GDPR's, the body that decides why and how the data are processed. The supplier is never a mark. It is a container, and the mark sits inside the container of whoever operates the unit.

Roles, not brands

A supplier container carries a role and a jurisdiction and nothing else. The four roles are the four answers above: model provider, hosting, application and operations. The renderer prints "Supplier: hosting (EU)" or "Supplier: model provider (non-EU)" with a short generic description, and a brand name never appears.

I drew it this way for four reasons. Brands change, and a view that named them would date within a year, while a supplier's role changes only when the architecture does. The same brand plays different roles in different units, and a view by brand would draw three dependencies as one. The law attaches to roles, as the next sections show. And a brand invites the model instinct of Chapter 7, the habit of judging a use by the name of the model behind it; a role forces the question the brand would answer too quickly, which is what this supplier does for this unit and what happens if it stops.

A supplier's jurisdiction is recorded as EU, EEA or non-EU. The notation does not distinguish Member States from one another, because the instruments this chapter cites apply across the Union.

Author's note needed: a passage of two paragraphs at most from the author's own practice in which a procurement or an architecture review was argued over the name of a model or a vendor when the questions that mattered were the role the supplier would play and the jurisdiction it would place the data in; it would sit here, as the scene that the rule "roles, not brands" answers.

Jurisdictions: solid, dashed, dotted

The boundary frame of the notation has three kinds of border. A solid border is the organisation's own boundary: its premises, its tenant, its data centre. A dashed border is a supplier, labelled by role. A dotted border is a jurisdiction outside the EU and the EEA, labelled as far as it is known: "outside the EU", "EU region of a non-EU vendor", "various". The borders nest. The organisation's own box sits inside a shaded area labelled "EU and EEA", and so does every supplier whose jurisdiction is EU or EEA; a supplier outside the Union sits inside a dotted container, and its dashed box inside that. A model chip, a small box labelled "model" joined by a thin line to a mark, says that a unit takes its model from a supplier other than the one whose container it sits in.

One case deserves a word, because it is the most common and the most argued over. A global vendor that offers an "EU data region" is drawn as a non-EU jurisdiction, dotted, with the location recorded as "EU region of a non-EU vendor". The contract is with a company governed by the law of its home country, and the data region is a property of the service, which the vendor can change, not of the law, which it cannot. Both of the book's organisations use one. The view does not say they are wrong; it makes the placement visible, as a choice with a legal character, so that the people who made it can defend it.

Jurisdiction changes four things. It changes which law applies to the unit and the data it touches. It changes which supervisor can ask questions about it. It changes whether moving data to the unit is, in the GDPR's terms, a transfer. And it changes whether the stop path is within reach: whether the organisation can switch the unit off, take its data back and carry on, or must ask. The fourth is the one I would ask about first.

What the law adds

Three European instruments speak directly to what V3 draws. What follows attributes each statement to the instrument and the article, frames it as an organisational and architectural implication, and is not legal advice.

The AI Act's roles. Regulation (EU) 2024/1689, the AI Act, as amended by the Digital Omnibus, Regulation (EU) 2026/1744 (40, European Union, 2026), defines two roles that every mark in V3 carries. Under Article 3(3) a provider is a body that develops an AI system or a general-purpose AI model, or has one developed, and places it on the market or puts it into service "under its own name or trademark"; under Article 3(4) a deployer is a body "using an AI system under its authority" other than in a personal, non-professional activity (39, European Union, 2024). The role is a property of the organisation's relation to the unit, not of the container the unit sits in. The organisation is the deployer of every mark on its landscape, including those in non-EU containers, and the provider of the units it built and put into service under its own name; under Article 25(1) a deployer becomes the provider of a high-risk AI system if it puts its name on one already on the market, substantially modifies one, or modifies the intended purpose of a system so that it becomes high-risk (39, European Union, 2024). Article 2(1) says the same about geography: the Regulation applies to providers placing AI systems or general-purpose AI models on the market in the Union whether or not they are established in the Union, and to providers and deployers in a third country "where the output produced by the AI system is used in the Union" (39, European Union, 2024). A dotted container is outside the Union's territory, not outside the Act's reach.

DORA's register of information. For a financial entity, V3 has a legal twin. Regulation (EU) 2022/2554, the Digital Operational Resilience Act or DORA, which sets ICT resilience rules for the financial sector, requires in Article 28(3) that financial entities "maintain and update at entity level, and at sub-consolidated and consolidated levels, a register of information in relation to all contractual arrangements on the use of ICT services provided by ICT third-party service providers" (42, European Union, 2022). An EU insurer or bank therefore already holds the raw material of the view, and V3 draws the part of that register that concerns AI units. The register does not draw itself: in the scenario of Chapter 18, the AI features vendors have switched on inside licensed software have no entry in Hansa Mutual's until the group adds notice clauses on 30 September 2027.

The GDPR's transfers. Where a unit touches personal data, every dotted container is a question under Chapter V of Regulation (EU) 2016/679, the GDPR. Article 44 lays down the principle that a transfer of personal data to a third country may take place only under the conditions of that chapter; Article 45 provides for transfers on the basis of a Commission adequacy decision, a finding that the country protects personal data adequately, and Article 46 for transfers subject to appropriate safeguards in the absence of such a decision (41, European Union, 2016). The line from a mark inside the solid boundary to a model chip in a non-EU container is a transfer if personal data travel along it. The opening scene is a transfer in both directions: Hansa Mutual's profile records that transfers from the EU to its UK and Swiss entities rely on the Commission's adequacy decisions, while transfers from them are governed by UK and Swiss law (illustrative).

None of the three instruments draws a border on a map. Each attaches duties to a role, and the roles are what V3 labels.

The evidence

Question 5 of the test asked what share of EU enterprises bought at least one paid cloud computing service in 2025; Chapter 5 gives the answer in full. Eurostat's survey of enterprises with ten or more persons employed, outside the financial sector, found 52.74 per cent (10, Eurostat, 2026). The headline hides what kind of service and in which country, and V3 makes both visible. Eurostat divides the services into basic (such as e-mail and file storage), intermediate (such as accounting and customer-relationship software) and sophisticated (security software, database hosting and development platforms); 40.89 per cent of EU enterprises bought at least one sophisticated service in 2025. Size matters: 84.67 per cent of large enterprises, with 250 or more persons employed, bought a paid cloud service, against 49.3 per cent of small enterprises with 10 to 49 (10, Eurostat, 2026).

Figure 16.2: Enterprises with 10 or more persons employed buying any paid cloud computing service (light bar) and, within it, sophisticated services, which are security software, database hosting and development platforms (dark bar), by EU Member State, 2025, with the EU27 average marked. Source: Eurostat, Cloud computing services by size class of enterprise, isoc_cicce_use (retrieved 2026).

Figure 16.2 shows that the range between Member States is wide. Finland had the highest share in 2025, 79.21 per cent of enterprises buying a paid cloud service and 65.90 per cent buying a sophisticated one; Bulgaria the lowest, 17.83 and 13.91 per cent (10, Eurostat, 2026). Thirteen Member States lie above the EU average and fourteen below it, with Germany at 53.91 per cent and France at 40.41 (10, Eurostat, 2026). A reader who knows only the EU average knows little about the country she works in.

Two cautions. The first concerns the population: the survey covers enterprises with ten or more persons employed in the non-financial business economy (10, Eurostat, 2026), so neither of the book's organisations would appear in it, Hansa Mutual because the financial sector is excluded and Nordvik Region because public administration lies outside the activities covered. The second concerns direction. The survey counts buyers: it asks what an enterprise buys and of what kind, not from whom. The book looked for an official statistic of the other side of the market, the shares held by providers of cloud and model services in Europe and the jurisdictions they belong to, and found none. For a chapter about sovereignty the gap matters, because a dependence that is not measured is not governed. V3 is the measurement an organisation can make for itself.

The nearest figures come from one market research vendor, and they are press-release data, not official statistics. Synergy Research Group, in a press release of 24 July 2025, estimated that European cloud providers held 29 per cent of the European market for cloud infrastructure services (computing, storage and platforms sold as a service) in 2017 and 15 per cent in 2022, with the share around 15 per cent since, and that Amazon, Microsoft and Google together held 70 per cent in 2024 (53, Synergy Research Group, 2025). The Commission's impact assessment for its June 2026 proposal for a Cloud and AI Development Act relays the same figures from Synergy in its footnotes, adopts the 15 per cent as its baseline and sets 30 per cent by 2035 as a policy objective, which is a target and not a forecast (47, European Commission, 2026). The estimates come from Synergy's proprietary model, which publishes no methodology, and they are restated between releases: its release of 27 September 2022 gave 27 and 13 per cent for 2017 and the second quarter of 2022 (52, Synergy Research Group, 2022). They show the order of magnitude that analysts and the Commission work with, one vendor's estimate and not a measurement, and the book does not extend them beyond the periods they cover.

Figure 16.3: Shares of European cloud infrastructure service revenues as estimated by Synergy Research Group: European providers 29 per cent in 2017, 15 per cent in 2022 and around 15 per cent in 2024; Amazon, Microsoft and Google combined 72 per cent in the second quarter of 2022 and 70 per cent in 2024. Press-release data from a market research vendor's proprietary model, restated between releases; not official statistics. Source: Synergy Research Group, press releases of 24 July 2025 and 27 September 2022 (vendor market estimates), relayed in part by the European Commission, SWD(2026) 502 (retrieved 2026).

Three statements about the future belong here. The Digital Decade Policy Programme 2030, the EU's set of digital targets for the end of the decade, sets in Decision (EU) 2022/2481, Article 4(1), point (3)(a), the target that at least 75 per cent of Union enterprises have taken up one or more of cloud computing services, big data and artificial intelligence by 2030 (43, European Union, 2022); that the target exists is observable. That the share of enterprises buying cloud services will keep rising is expected: it has risen at every survey since 2014 (10, Eurostat, 2026), and the Commission's dashboard tracks cloud on a trajectory of its own with a 2030 value of 75 per cent, measured on intermediate and sophisticated services (15, European Commission, 2026), where the EU stood at 46.69 per cent in 2025 (10, Eurostat, 2026). That the target will be met, or that European providers will reach the 30 per cent the Commission sets as an objective for 2035, is speculation: the book found no evidence that supports either. The market projections that analysts publish are their publishers' expectations, and this book reports none of them.

Reading a supply view

Return to Figure 16.1 and read it as Chapter 4 taught, in thirty seconds, now with containers. It draws the group at the end of the scenario's year; where that differs from the start, the text says so. The subtitle names the seven countries the group operates in: Germany, the Netherlands, Sweden, Poland, Norway, the United Kingdom and Switzerland. The solid box inside the EU and EEA area holds thirteen marks, and every mark inside the solid border has a filled diamond, a seat and a solid baseline except the exposure prioritiser, whose baseline is dashed. The model chip is joined to the claims assistant and to the engineering tools; the line to the engineering tools runs behind the claims-triage agent's mark, which does not use that supplier.

Then the dotted containers. "Outside the EU" holds two supplier boxes with marks and one with the chip. The conversational assistants, a Mode 1 unit, sit in a model provider's box as an XL circle with a dashed baseline: the proof that its controls hold is the vendor's word. The recruitment screening and video-interview unit sits in an application supplier's box, a square at R3 with a T3 seat and, by the end of the year, a solid baseline, because the supplier's logs are now retained. The third box holds only the chip, the model provider that the claims assistant and the engineering tools call under the recorded exception. "EU region of a non-EU vendor" holds the embedded workplace assistants, an XL circle with a filled diamond enforced through the tenant and a dashed baseline. "Various" holds the ambient AI in licensed software, the Mode 0 mark, which at the end of 2027 has a seat at T2 and an attested baseline where at the start of the year it had neither.

The UK and Swiss subsidiaries have no container. The renderer draws a supplier's container only where a unit sits in it, and no unit does: the subsidiaries keep their claims handling at home and use the group platform in Germany, so their people and their data travel to the marks in Frankfurt and Poland, and the marks do not travel to them. A jurisdiction can enter a landscape through the people who use a unit and the data they bring, without hosting a single mark, and a reader who counts containers will not find it. The subtitle names the seven countries for that reason.

What to do

For an executive

Ask for V3 and for the answers to four questions about every unit that touches personal data or acts without a person approving each step: who supplies the model, who hosts it, who supplies the application, who operates it, and in which jurisdiction each sits. Ask which answers rest on a contract and which on the vendor's practice, and test any placement described as sovereign against the four properties: where the workload runs, which law governs it, whether it can be moved and whether the organisation could continue if the provider failed.

For an architect

A first supply view takes an afternoon, and the material is already in the building.

1. Start from the contracts register, not from the IT estate: the live contracts from procurement, the DORA register of information if the organisation is a financial entity, and the records of processing under the GDPR, beside the list of units from the V1 landscape of Chapter 14.
2. Ask four questions of every unit, and write the answers as roles: who supplies the model, who hosts it, who supplies the application, who operates it. Where the answer is "we do", the unit sits inside the solid boundary.
3. Give every supplier an identifier, a role, a jurisdiction (EU, EEA or non-EU) and a generic label that says what it does and not who it is, with the location of processing as a note; Appendix A lists the fields.
4. Add the suppliers nobody chose. Every licensed product with an AI feature the vendor switched on is a unit, and its supplier is one entry with the role application, the jurisdiction non-EU where that is the honest answer, and the location "various".
5. Render, and read the dotted containers first. Every mark in one is a jurisdiction question; every chip is a model-origin question; every dashed baseline in a supplier's box is a control whose proof is a promise.
6. Write down what you could not place. A unit whose model, hosting, application or operations you could not name by the end of the afternoon is the first finding, and it goes to the person who holds the seat for that unit.

The afternoon produces no legal assessment, only the picture those documents need and usually lack: one page on which the organisation can see where its AI runs.

For a public official

A public authority can write the four roles into a tender: the supplier must say what it supplies, where it hosts and operates, which model the unit calls, and where that model is served, and must notify any change. The answers are the fields of the view, and the authority can draw V3 from the contract.

Nordvik Region and Hansa Mutual

The two organisations' supply views differ as their profiles would predict, and the difference is the point of drawing them the same way. Both are illustrative.

Figure 16.4: Nordvik Region's landscape at the end of 2027 in V3: four marks in its own boundary, three EU and EEA supplier containers, and three non-EU jurisdiction containers holding the conversational assistant, the retired recruitment pilot, the workplace-assistant pilot and the ambient AI. Illustrative: rendered from landscape/models/nordvik_region.yaml.

Nordvik Region's view is a picture of choices made inside the Union. Its own boundary holds the benefits-triage system, the case-note summariser, the correspondence classifier and the exposure prioritisation: the high-risk system and the unit that touches special-category data run on the Region's own premises. The staff assistant sits in the dashed box of a European cloud provider under a contract that confines processing to the EEA with customer-held keys. The citizen-service assistant, the platform team's agentic work tools and the SOC triage assistant sit in the box of a Nordic hosting provider in the EEA that reserves accelerators for the Region's open-weight models. The rostering unit sits in an EU application supplier's box.

What lies outside is what the Region did not choose, or chose only by approving it. The conversational assistant sits with a model provider outside the EU, an L circle with a dashed baseline. The recruitment screening pilot is drawn hollow with a cross in an application supplier's box outside the EU: paused in September 2026, retired in June 2027, and still on the view because the dependency existed. The workplace-assistant pilot sits in the EU region of a non-EU vendor, widened to M during the year once tenant policies were enforced. And the ambient AI in licensed software sits in "various", a square at Level 4 Autonomous with, by the end of the year, a seat at T2 and a hollow diamond: the features have an owner and a planned policy point, not yet an enforced one. The mark the Region controls least is the one it never procured.

Hansa Mutual's view, Figure 16.1, is a picture of a builder: thirteen marks inside its own boundary, served from its own data centre, with agents at Level 3 Bounded acting with identities of their own behind filled diamonds. Where Nordvik's leverage over its suppliers is the contract, Hansa's is the platform: the three non-EU marks it chose have filled diamonds enforced through the platform's tenant and proxy. The two views share one feature neither organisation chose, the Mode 0 mark in the "various" container, and Chapter 18 follows what each does about it.

Summary

The supply and sovereignty view, V3, answers the question no screen answers: where an AI use runs and under whose law. It takes the marks of the one-page landscape and places each inside the container of whoever operates it: the organisation's own boundary with a solid border, a supplier with a dashed border labelled by its role, or a jurisdiction outside the EU and the EEA with a dotted border. Suppliers are drawn by role, model provider, hosting, application or operations, and not by brand, because brands change, one brand plays several roles, and the law attaches to roles.

Jurisdiction changes four things: which law applies, which supervisor may ask, whether moving data to the unit is a transfer, and whether the stop path is within reach. The AI Act's provider and deployer roles follow the organisation's relation to the unit, not the container it sits in, and the Act reaches providers outside the Union whose systems are used inside it (Articles 2, 3 and 25). DORA's register of information gives a financial entity the raw material of the view (Article 28(3)). The GDPR's Chapter V makes every dotted container a transfer question (Articles 44 to 46). The evidence says that cloud supply is the rule for large European organisations and that it varies widely between Member States: 52.74 per cent of EU enterprises bought a paid cloud service in 2025, 84.67 per cent of large ones, 79.21 per cent in Finland and 17.83 in Bulgaria (10, Eurostat, 2026). It is measured only from the buyer's side; the book found no official statistic of who supplies that cloud, only one vendor's press-release estimates that European providers held around 15 per cent of the European market, and says so, because a dependence that is not measured is not governed.

A first supply view starts from the contracts register, asks four questions of every unit, lists every supplier by role and jurisdiction, adds the one entry for the vendors nobody chose, and reads the dotted containers first. Chapter 17 turns from where the landscape runs to who decides about it and how anyone could prove it.

Sources

1. Nordqvist, G. (2026). AI Governance: Governing Artificial Intelligence in European Enterprises and Public Authorities. aig.geon.se. (2, Nordqvist, 2026)
2. Nordqvist, G. (2026). AI Platform and Security: Building and Securing AI Platforms in European Enterprises and Public Authorities. aips.geon.se. (3, Nordqvist, 2026)
3. Eurostat (2026). Cloud computing services by size class of enterprise. Online data code isoc_cicce_use. (10, Eurostat, 2026)
4. European Commission, Directorate-General for Communications Networks, Content and Technology (2026). Digital Decade DESI dashboard: Digital Decade EU-level trajectories and Digital Economy and Society Indicators. (15, European Commission, 2026)
5. European Parliament and Council of the European Union (2024). Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). Official Journal of the European Union. (39, European Union, 2024)
6. European Parliament and Council of the European Union (2026). Regulation (EU) 2026/1744 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI). Official Journal of the European Union. (40, European Union, 2026)
7. European Parliament and Council of the European Union (2016). Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). Official Journal of the European Union. (41, European Union, 2016)
8. European Parliament and Council of the European Union (2022). Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA). Official Journal of the European Union. (42, European Union, 2022)
9. European Parliament and Council of the European Union (2022). Decision (EU) 2022/2481 establishing the Digital Decade Policy Programme 2030. Official Journal of the European Union. (43, European Union, 2022)
10. European Commission (2026). Commission Staff Working Document: Impact Assessment Report accompanying the proposal for a Cloud and AI Development Act. SWD(2026) 502 final. (47, European Commission, 2026)
11. Synergy Research Group (2022). European Cloud Providers Continue to Grow but Still Lose Market Share. Press release, 27 September 2022. (52, Synergy Research Group, 2022)
12. Synergy Research Group (2025). European Cloud Providers' Local Market Share Now Holds Steady at 15%. Press release, 24 July 2025. (53, Synergy Research Group, 2025)