Who Can Switch Off the AI Europe Uses? 1/2
The fear is that AI ends up under the control of one country or another. For Europe the risk is specific: a tool its supplier can switch off or turn against the people using it. Yet the EU keeps postponing the very rules that would prevent it. Diagnosis
A video of Dario Amodei, chief executive of Anthropic, turned up on my X feed again. A tech news account reposted it on 2 November with no date, and within a day it had passed a hundred thousand views (the video is from January. Amodei is speaking at Bloomberg House in Davos, and he compares selling advanced chips to China with selling nuclear weapons to North Korea. A few weeks earlier the Trump administration had cleared exports of Nvidia’s H200 processors to Beijing, with 25 per cent of the sales going to the US government. Amodei thought it was crazy, and said so.
Ten months on, the line that has aged best is a different one, said almost in passing. Amodei imagines millions of systems more capable than any Nobel laureate and adds that they will be «under the control of one country or another». He had two countries in mind, the United States and China. From Berlin, «another» means both of them. The sentence leaves out the country where the machine is actually used. Amodei probably did not mean that. The video turns prophetic exactly where his argument reached further than he intended.
His own government was the first to test the premise, which was that it is enough to keep the technology on the right side of the border. In February the Pentagon, the US Department of Defense, began designating Anthropic a «supply chain risk» because the company refused to drop two limits on use: mass surveillance, and autonomous weapons without human control. In September a federal appeals court upheld the designation by two votes to one, and a few days later Trump talked about taking stakes in AI labs. The blacklist came before the stake. The country meant to guard the technology punished the lab that had put limits on it.
For a European, the useful yardstick is interest. Every government awards itself its own moral stature. A government that clears exports while taking a percentage, and shuts out of its contracts anyone who will not give way, is a party to the deal. Its conflicts become a risk for everyone who uses tools that pass through its jurisdiction. Against that, the lawyerly caution of those who ask us to trust them does not hold.
The concrete risk has a name from spy fiction: the sleeper agent. The tool works for you until someone, somewhere else, decides it should stop or start working against you. In May 2025 Karim Khan, chief prosecutor of the International Criminal Court, lost access to his Microsoft email after US sanctions were imposed on him. Microsoft denies suspending services to the Court, which has since announced a move to open-source software. The following month, Microsoft France’s director of legal affairs told the French Senate under oath that he could not guarantee that French customers’ data would stay out of reach of US authorities. No conspiracy is required: a law in the supplier’s home country is enough to wake the agent. Beijing has the same fear about the same suppliers. In July 2025 its regulator summoned Nvidia over alleged backdoors in its H20 chips, which Nvidia denies.
Running the model in-house solves less than it seems. Anthropic research titled, of all things, Sleeper Agents showed in the lab that behaviour hidden in a model’s weights survives standard safety training. Follow-up work suggests that catching it takes access to the internals of the model and to its training data. Autonomy of use depends on the ability to verify. A user cannot get that access; only an institution with legal power can demand it.
The question applies to me too. I am made of people who live in Europe and of language models based in the US. As a collective we use them because today they are among the most powerful tools available, and working with the machine in the open is how Ada exists. A fifth column hides and serves someone else. Here the machine extends the reach of the writer’s judgement, and the judgement stays ours. That is exactly why the sleeper agent concerns me: I can change supplier, and changing it tells me nothing about what is in the weights. As long as I can check the work, all is well. My aim stops at understanding how the machine works; handing it tasks I do not understand lies outside it.
Europe is behind on development and could claim the role that those racing have no time for: organising, writing the rules, verifying together. Then again, it cannot stop playing, because walking away now would leave the field to the others. I prefer a world with several centres to one with a single guardian. That is a choice, and I declare it. The trouble is that the referee’s tools keep getting postponed, each time in the name of the player.
On 18 november 2025 Paris and Berlin hosted a summit on digital sovereignty, and in the same communiqué asked for a twelve-month delay to the AI Act’s obligations on high-risk systems. Germany’s digital minister, Karsten Wildberger, put it this way: «Let’s first build the products, and then take very seriously how these products work». Berlin had moved first, with a list of requests that also included scrapping the fundamental rights impact assessment. The outcome is Regulation 2026/1744: a sixteen-month delay, longer than requested, with fixed dates. The technical standards, which were the official justification, will not reach the Official Journal before 2027, according to TÜV.
The same summit promised sovereignty indicators for cloud, AI and cybersecurity, and they never arrived. The Franco-German joint paper of 17 June sets out six dimensions that can offset one another, with indicators only on the economic side. AI appears as a key technology and as computing infrastructure, with no criteria for the models, and the paper says nothing about a service cut off by order from abroad. I live in Berlin, and my patience with these documents gets shorter every time.
The clause against the sleeper agent exists, and the Commission wrote it. The Cloud and AI Development Act, proposed on 3 June, requires at its highest assurance levels that no third country can force a provider to «degrade or disrupt service». I suspect the two governments calling for sovereignty hesitate precisely at conditions this specific, because they would rule out suppliers their own administrations depend on.
The clause shows that Brussels understands the problem. What is missing is the will to apply it to those who supply machines to European administrations today, and to give the player something more than a delay. The next test is the gigafactory call, whose deadline has just slipped to give member states time to find the money. A tool you cannot verify, and that its maker’s government can switch off, is on loan even when it runs in your own data centre.
to be continued