Supply, Sovereignty and Jurisdiction: Where the Landscape Runs

All courses / Landscape / Module 3 / Chapter 16

Learning objectives

After the lesson the participant can:

• Name the four roles a supplier can play for a unit and place a unit in the right container.
• Explain why a global vendor's EU data region is drawn as a non-EU jurisdiction.
• Relate the AI Act's roles, DORA's register of information and the GDPR's transfer rules to what V3 draws, as organisational implications.
• Draw a first supply view from the contracts register and list what could not be placed.

Key concepts

Four answers to where it runs

The model: who trained the weights and where they are served. The hosting: on whose computers, in which country. The application: who built and supplies the software around the model. The operations: who runs the service day to day and holds the credentials.

Roles, not brands

A supplier container carries a role and a jurisdiction and nothing else. Brands change, one brand plays different roles in different units, the law attaches to roles, and a brand invites the model instinct.

Solid, dashed, dotted

A solid border is the organisation's own boundary, a dashed border a supplier labelled by role, a dotted border a jurisdiction outside the EU and the EEA. The borders nest, and a model chip marks a model taken from another supplier.

The mark belongs to the organisation

The supplier is never a mark; it is a container. The organisation is the deployer in the AI Act's terms of every mark on its landscape, including those in non-EU containers, and the mark sits in the container of whoever operates the unit.

Sovereignty as verifiable properties

From AI Platform and Security, Chapter 13: knowing where workloads run, which law governs them, being able to move them and being able to continue if a provider fails. The containers answer the first two; the other two are asked of every dashed container.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. Of the four things jurisdiction changes, the author would ask first whether the stop path is within reach. Why that one, and how would you find the answer for a unit in a dotted container?
2. The book found no official statistic of who supplies Europe's cloud and model services and says a dependence that is not measured is not governed. What can an organisation measure for itself?
3. A jurisdiction can enter a landscape through the people who use a unit and the data they bring, without hosting a single mark. Where does that happen in your organisation?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. How does V3 draw a unit hosted in the EU data region of a global vendor, and why?

   1. Inside the EU and EEA area with a dashed border, because the data stay in the Union under the contract
   2. Inside the organisation's solid boundary, because the organisation is the deployer
   3. It is left off the view until the vendor confirms the location in writing
   4. In a dotted container, because the contract is with a company governed by its home country's law
   Show the answer

   D. In a dotted container, because the contract is with a company governed by its home country's law
   The data region is a property of the service, which the vendor can change, not of the law, which it cannot. The view does not say the choice is wrong; it makes the placement visible as a choice with a legal character.

2. Why do Hansa Mutual's UK and Swiss subsidiaries have no container in its supply view?

   1. Because the AI Act does not apply directly in those two countries, so the notation leaves them out
   2. Because the renderer draws a supplier's container only where a unit sits in it, and no unit does
   3. Because the subsidiaries use no AI at all
   4. Because their units are counted inside the container labelled various
   Show the answer

   B. Because the renderer draws a supplier's container only where a unit sits in it, and no unit does
   The subsidiaries use the group platform in Germany, so their people and data travel to the marks and the marks do not travel to them. A reader who counts containers will not find the jurisdiction, which is why the subtitle names the seven countries.

3. How does the chapter characterise the estimate that European providers held around 15 per cent of the European cloud infrastructure market?

   1. As one market research vendor's press-release estimate from a proprietary model, not an official statistic
   2. As a Eurostat figure from the survey of enterprises with ten or more persons employed
   3. As a measurement the Commission made for its Digital Decade dashboard
   4. As a forecast by the book's author for the year 2035
   Show the answer

   A. As one market research vendor's press-release estimate from a proprietary model, not an official statistic
   The figures come from Synergy Research Group's press releases, rest on a proprietary model with no published methodology and are restated between releases. The Commission relays them; the book calls them one vendor's estimate and not a measurement.