The EU AI Stack Checklist

Five checks that keep the off switch on your side.

Jul 05, 2026

In June 2026 a frontier AI model went dark for everyone outside America. Anthropic launched Fable 5 and Mythos 5 on 9 June. At 5:21pm ET on 12 June, a US export-control directive ordered access suspended for all foreign nationals, and since a shared cloud cannot be fenced by nationality, both models went dark for everyone outside the US. Access came back on 1 July with a new safety classifier that routes blocked requests to a different model, and the stronger tier, Mythos 5, returned only to roughly 100 vetted US organisations that defend critical infrastructure. Nobody's engineering failed. The terms did.

Europe noticed. Austria's State Secretary for Digitalisation wrote to the European Commission proposing the EU explore bringing Anthropic inside European jurisdiction. And the money had already moved: Gartner forecasts worldwide sovereign cloud infrastructure spending of $80 billion in 2026, with European spending growing 83%.

That is the thing about an AI stack: the model is the easy part. The part that decides whether your product survives a bad Friday is jurisdiction, portability and exit terms. Here is the checklist we use. Run your current stack through it honestly.

The five checks: EU hosting, data residency, model portability, exit terms, off-switch test

1. EU hosting

Ask where inference runs, not where the vendor is incorporated. A European sales entity in front of US-controlled compute fails this check. What to demand: the region of the machines that execute your requests, in the contract.

How we answer it: Socaity runs open models on EU soil. The deployment is the product, not a compliance footnote.

2. Data residency

Your prompts and outputs are business data. If they transit or rest outside EU jurisdiction, your DPO inherits a problem you created. What to demand: residency for data in transit and at rest, named in writing.

3. Model portability

The June story had a quiet lesson: teams glued to one proprietary model had no plan B. Portability means switching models without a rewrite. This is the whole test:

import socaity
socaity.install("qwen/qwen-image-edit-plus")
from socaity.sdk.replicate.qwen import qwen_image_edit_plus

out = qwen_image_edit_plus(api_key=key).run(
    image=["you.png"], prompt="keep the face"
)
out.get_result().save("real.png")

Swap the model name, keep the call. If your stack cannot do that, every model decision you make is a marriage.

4. Exit terms

Read the clause that describes your last day as a customer. Can you export what is yours? How much notice do you get before a model is retired or restricted? The June directive gave the world three days. What to demand: notice periods and export rights, not goodwill.

5. The off-switch test

One question: who can switch you off, and under which law? If any answer involves a jurisdiction you do not operate in, you are renting your roadmap from someone else's government. Open weights on EU infrastructure is the boring answer. Boring is the point. Trust something that never surprises you.

The full Socaity model list is one SDK call away: socaity.ai.

If this checklist found a gap in your stack, that is the post doing its job. Forward it to whoever owns the vendor contract.

Sources

socaity.ai's Substack

Discussion about this post

Ready for more?