Model access is a supply chain

Version 1.0 · Published 2026-09-10

For two years, arguments about which large language model to build on have been arguments about quality. Which one reasons better, which one is cheaper per token, which one handles your language properly. Those are real questions and they are not the interesting ones any more.

The interesting question is what happens to you when something happens to your provider. That used to be a hypothetical with no mechanism attached. It now has one, with article numbers.

What changed in August

The EU AI Office’s enforcement powers over providers of general-purpose AI models became exercisable on 2 August 2026. In late August it used them for the first time.

It sent information requests to model providers, asking how they prevent their models being stolen, what access outside evaluators are given, and how usage is monitored once a model is public. Commissioner Henna Virkkunen described the requests publicly. Recipients were not named, and some providers were left out on the grounds that there was already close dialogue with them. Separately, more than thirty companies that had published no training-data summary were asked about copyright. The EU AI Act Newsletter covered it as Powers in Practice in issue 110.

None of that is dramatic on its own. A regulator wrote some letters. What makes it worth your attention is the ladder those letters sit on.

The four articles that make this a supplier question

Article 91 is the information request, which is what was used. Article 92 lets the AI Office run its own evaluation of a model, including access through APIs or source code. Article 93 is measures, and it runs as far as restricting a model or withdrawing it from the market. Article 101 is fines.

Article 101(1) is worth quoting, because the number is usually reported loosely. The text reads “not exceeding 3 % of their annual total worldwide turnover in the preceding financial year or EUR 15 000 000, whichever is higher”. It also lists failure to comply with a request for a document or for information as a ground in its own right. One honest note on sourcing: that is the consolidated Act as published rather than the Official Journal PDF, which would not render for us, so read it as the article text and not as a certified copy.

The sentence that should change an architecture decision is not the one about money. It is Article 93: a model can be restricted, or withdrawn from the market.

Think about what that means downstream. Not that a provider might have an outage, or raise prices, or deprecate a version with six months notice. That a model your product depends on could become unavailable to you for a legal reason, on a timeline set by somebody else, with no technical fault on anybody’s part.

That is just supplier risk, and we already know how to think about it

Every other critical input your business takes has this property, and you have processes for it. You do not sole-source a component that would stop your production line. You qualify a second supplier before you need one. You keep the switching cost low enough that switching is a decision rather than a crisis.

Nobody applies this to model choice, because for two years a model felt like a technology rather than a supplier. It was an API you called. The idea that it had regulators, obligations, and a legal existence that could change independently of its quality did not come up, because until August there was no instrument that could act on it.

The counter-argument deserves a fair hearing. Switching models is not switching screws. Prompts behave differently, output shape differs, evaluation has to be redone, and a team that swaps models casually will ship regressions to customers. That objection is correct, and it is an argument about switching cost rather than about whether substitutability matters. If switching is expensive, the answer is to make it cheaper before you need it, not to conclude that you will never need it.

What we built, stated with its limits

Unless runs a constellation of large language models from independent providers, hosted in Europe, with a registry, routing between them, and automatic failover. Moving from one to another does not change how a customer’s data flows.

That architecture exists because of a single engineering fact, and the claim is exactly as strong as that fact and no stronger. Recoverable personal data does not reach the generative model. Identifiers are filtered and tokenized at the gateway, so the model that phrases an answer receives placeholders. Because of that, a model is a replaceable component rather than a dependency, and changing one does not add anybody to a customer’s sub-processor list or require re-papering a contract downstream.

Two things I want to say plainly, because the temptation to overclaim here is strong.

The capability is that we can move deliberately and fast, not that we change models constantly. Every provider is vetted before it is in the rotation, and instability is not a feature. Control is the thing a regulated buyer is actually buying.

And European hosting is a supporting fact, not the load-bearing one. It would be convenient to imply that a European model is somehow beyond reach, and it is not true. The AI Office’s requests reach European providers too, which is the correct outcome and rather the point. What protects a customer is that no single provider is structurally necessary, not where that provider is incorporated.

This argument lives at the model layer and nowhere else. We run on AWS EU regions ourselves, so we are in no position to make a substitutability argument about infrastructure, and we do not.

The question to sit with

You do not need to change model providers. Most companies should not, and for most workloads the one you are on is fine.

What is worth doing is answering one question honestly, this quarter, while it is cheap. If the model under your product became unavailable for a reason that had nothing to do with its quality, what would you do, and how long would it take?

If the answer is a plan, you have a supply chain. If the answer is a pause, you have a dependency. There is now a regulator with the power to test which one you have.