The EU AI Stack Checklist

#ai #eu #opensource #security

In June 2026 a frontier AI model went dark for everyone outside America.
Anthropic launched Fable 5 and Mythos 5 on 9 June. At 5:21pm ET on 12 June,
a US export-control directive
ordered access suspended for all foreign nationals, and since a shared cloud
cannot be fenced by nationality, both models went dark for everyone outside
the US.
Access came back on 1 July
with a new safety classifier that routes blocked requests to a different
model,
and the stronger tier, Mythos 5, returned only to roughly 100 vetted US
organisations
that defend critical infrastructure. Nobody's engineering failed. The terms
did.

Europe noticed. Austria's State Secretary for Digitalisation wrote to the
European Commission
proposing the EU explore bringing Anthropic inside European jurisdiction.
And the money had already moved: Gartner forecasts worldwide sovereign
cloud infrastructure spending of $80 billion in 2026, with European spending
growing 83%.

That is the thing about an AI stack: the model is the easy part. The part
that decides whether your product survives a bad Friday is jurisdiction,
portability and exit terms. Here is the checklist we use. Run your current
stack through it honestly.

1. EU hosting

Ask where inference runs, not where the vendor is incorporated. A European
sales entity in front of US-controlled compute fails this check. What to
demand: the region of the machines that execute your requests, in the
contract.

How we answer it: Socaity runs open models on EU soil. The deployment is the
product, not a compliance footnote.

2. Data residency

Your prompts and outputs are business data. If they transit or rest outside
EU jurisdiction, your DPO inherits a problem you created. What to demand:
residency for data in transit and at rest, named in writing.

3. Model portability

The June story had a quiet lesson: teams glued to one proprietary model had
no plan B. Portability means switching models without a rewrite. This is the
whole test:

import socaity
socaity.install("qwen/qwen-image-edit-plus")
from socaity.sdk.replicate.qwen import qwen_image_edit_plus

out = qwen_image_edit_plus(api_key=key).run(
    image=["you.png"], prompt="keep the face"
)
out.get_result().save("real.png")

Swap the model name, keep the call. If your stack cannot do that, every
model decision you make is a marriage.

4. Exit terms

Read the clause that describes your last day as a customer. Can you export
what is yours? How much notice do you get before a model is retired or
restricted? The June directive gave the world three days.
What to demand: notice periods and export rights, not goodwill.

5. The off-switch test

One question: who can switch you off, and under which law? If any answer
involves a jurisdiction you do not operate in, you are renting your roadmap
from someone else's government. Open weights on EU infrastructure is the
boring answer. Boring is the point. Trust something that never surprises
you.

The full Socaity model list is one SDK call away:
https://socaity.ai?utm_source=substack&utm_content=eu-ai-stack-checklist

If this checklist found a gap in your stack, that is the post doing its job.
Forward it to whoever owns the vendor contract.

Sources