Last time the punchline was that the moat was never the model, and that power lives in the tap on access. What I left out (because one post can only hold so much) is that the tap was already being dismantled while I was writing. An American lab had open-weighted a frontier-ish model nine days earlier. AMD had put 192GB of unified memory under a desk the day before I hit publish. Europe isn’t reclaiming the tap. Washington and Beijing are handing it over, open, cheap, and small enough to fit in a rucksack. Timeo Danaos et dona ferentes?

In No Moat, No Master I closed with a line I still stand by: if we want to reduce risks of continuity and sovreignity we should stop renting cognition by the API call. Download, self-host, diversify, reclaim the tap before someone else remembers they can close it.

I framed it as something Europe should do. I was wrong about the verb. It’s not something we’re doing. It’s something being done to us: by the two blocs whose rivalry is, entirely by accident, dismantling the very chokepoint we were told to fear.

A confession on timing, since we’re doing Trojan metaphors. That piece went out on Friday 24 July. Both of the exhibits below were already public when it did: one nine days old, the other less than twenty-four hours. I knew. I filed anyway, because you cannot fit the whole Odyssey into a single post and the horse was already inside the walls before anyone got round to the risk assessment. Consider this the second scroll.

(And yes, I know: Laocoön’s warning is Virgil, the horse itself is Homer. Both were writing sequels to somebody else’s war. So is this.)

Two exhibits, few days apart: it turns out, just a single argument.

Exhibit A: The Americans Broke Ranks

On July 15, Thinking Machines Lab released Inkling: a 975B-parameter Mixture-of-Experts model, 41B active per token, natively multimodal across text, image and audio, with a 1M-token context window in the open-weights build. Pretrained on 45 trillion tokens. License: Apache 2.0. Full weights on Hugging Face, BF16 and NVFP4, plus recipes for vLLM, SGLang, Unsloth and llama.cpp on day one.

Artificial Analysis has it debuting at 41 on their Intelligence Index: the leading open-weights release from a U.S. lab, three points above Nemotron 3 Ultra, and comfortably above gpt-oss-120b. It’s not the strongest model on the market and Thinking Machines says so in the first three paragraphs, which is refreshing. What it is: token-efficient (25K output tokens per Index task against 43K for GLM-5.2 and 38K for Kimi K2.6), genuinely multimodal, and explicitly built to be fine-tuned on somebody else’s data.

Note who this is. Not an outsider: Mira Murati’s lab, seeded at a $12bn valuation, with a multi-year Nvidia partnership for a gigawatt of Vera Rubin systems. The most establishment startup in AI just published its weights under the most permissive licence in the business.

And the detail that made me laugh out loud: post-training was bootstrapped with synthetic data generated by open-weights models including Kimi K2.5 (Moonshot). The American answer to the Chinese open-weight invasion was, in part, distilled from the Chinese open-weight invasion. Somewhere in Washington a Treasury press release about IP theft is aging like milk.

Strategically this is not altruism. It’s a wedge against the OpenAI/Anthropic duopoly, and a bid to make sure the high-end open-weight tier isn’t a Chinese-only club. The motive doesn’t matter. The artifact does. The weights are on your disk, or they aren’t. Inkling’s are.

Exhibit B: AMD Put the Data Center Under the Desk

On 22-23 July, Advancing AI 2026, AMD stopped selling chips (well they didn’t really stop selling chips: they actually announced a partnership with Anthropic) and started selling a thesis: local inference is now good enough, so stop paying for tokens.

Their argument rests on two curves crossing. On the model side, AMD’s slides compare gpt-oss 120B (August 2025) with Qwen 3.5 at 9b parameters (March 2026) on GPQA: 80.1 versus 81.7. Then Qwen 3.6 at 27B scoring 87.8: above Claude Opus 4.5 at 87.0. Take vendor benchmarks with the usual fistful of salt; GPQA is one narrow slice and AMD is not a neutral referee. But the direction is not in dispute, and everyone in this industry has watched this for months.

On the hardware side: the Ryzen AI Halo developer platform at $3,999, 128GB of unified memory, models up to 200B parameters natively. And the successor AMD previewed, codename Gorgon Halo: 192GB of unified memory, models up to 300B parameters, Ryzen AI Max+ PRO 495 with a Radeon 8065S iGPU, partner systems from Q3 2026: Framework has already previewed one.

Round it up: four to five thousand euro for a box that runs a 200–300B-parameter model with nobody else in the loop. Not a toy. Not a lab curiosity. A line item that fits inside a departmental budget without a steering committee.

Then AMD did the thing that tells you they’ve actually talked to a CISO: they announced a partnership with Cisco wrapping the Halo hardware in local inference (Lemonade), agent sandboxing, policy enforcement, Splunk-based observability and a central console. Plus an extended Hugging Face partnership with native Halo support and a year of HF PRO in the box. Somebody understood that “AI PC” without governance is just shadow IT with better marketing.

The Uncomfortable Part

Here is the sentence I did not expect to write a few days apart.

Europe’s sovereign AI window was not opened by European policy. It was opened by an American lab trying to break an American duopoly, and an American chipmaker trying to sell against Nvidia, both of them accelerated by Chinese labs who open-weighted first for their own strategic reasons. The AI Act didn’t do this. Europe didn’t do this. Neither did any of the fourteen strategy documents with “sovereign” in the title.

We spent three years arguing about how to regulate the tap. The tap is being decommissioned by a price war we’re not participating in.

That’s good news, and I’ll take it. But let’s be precise about what we’ve been handed, because timeo Danaos et dona ferentes is not just a good line: it’s a threat model.

What Local Actually Buys You (and What It Doesn’t)

The strongest argument for the box under the desk isn’t cost. It’s jurisdiction.

When your prompts hit a US-operated API, they land inside a legal perimeter you don’t control. The CLOUD Act obliges US providers to produce data in their possession or control regardless of where it’s stored: a European data centre with a European flag on the rack does not, by itself, solve this. Layer on FISA 702 for non-US persons, layer on intelligence-sharing arrangements among the Five Eyes, and the honest summary is: your prompts are a corpus, in a foreign jurisdiction, describing your business in exhaustive detail. Your M&A memos. Your incident timelines. Your unpatched CVEs, pasted in by an engineer asking for a remediation plan at 2am.

Self-hosted inference removes that corpus from the wire entirely. No prompt log, no retention policy to argue about, no vendor “we may use your data to improve our services” clause to lawyer, no discovery order pointed at somebody else’s storage. For anything under NIS2, DORA, or plain old professional privilege, that’s not a nice-to-have.

Now the caveats, because I promised risk discipline and not champagne.

Local kills the prompt-in-transit problem. It doesn’t kill the supply chain. The silicon is American, fabbed in Taiwan. The firmware, the drivers and the ROCm stack ship from Santa Clara with their own update channel and their own telemetry defaults. The weights were trained by a US lab on a corpus you can’t audit, and Thinking Machines is candid in the model card that the residual risks (role-play compliance, indirectly framed harmful prompts) are “consistent with what you would see from any open-weight model” and want defence-in-depth layered around them, not trust in the model’s own refusals. Downloading weights converts a continuity risk into an integrity risk. That’s a trade, not a cure.

And check the arithmetic before you write the PO. 192GB does not run Inkling. The full 975B model is roughly two terabytes in BF16, and still around half a terabyte in the NVFP4 4-bit checkpoint. Nowhere near a desktop APU. What fits is the tier below and, conveniently, Inkling-Small (276B total, 12B active) lands squarely inside AMD’s stated 300B envelope, as do Qwen’s mid-size models and most of what’s shipping open today. So the honest pitch is not “frontier model on your desk.” It’s “a very good model on your desk, and the frontier on tap when you actually need it.” Which, for the majority of enterprise workloads (summarisation, retrieval, drafting, triage, internal agents) is a good enough architecture anyway.

To put it in simple terms: local models for the agents touching sensitive data, big remote models for the genuinely hard tasks. Edge computing, rediscovered.

Finally: sovereignty and shadow IT are the same box.

A €4,000 appliance that runs a capable model with no logging, no identity integration and no egress monitoring is a sovereignty win in the CFO’s slide and an ungoverned inference endpoint in your asset inventory. The Cisco partnership exists precisely because AMD knows this. If your organisation’s first Halo arrives as an engineer’s expense claim, you have not gained sovereignty. You’ve lost visibility.

Who Pays for the Gift

One more thing before the playbook, because it decides whether any of the above is affordable.

“Verify the weights like any other binary” is cheap to write and expensive to do. Sovereignty you can’t afford to assure is not sovereignty: it’s an anecdote.

Two things worth watching: prEN 18282, the harmonised cybersecurity standard for the AI Act, now in consultation (I’ve commented on it here) and, separately, the recast Product Liability Directive (EU) 2024/2853, under which whoever substantially modifies a product and puts it into service is treated as its manufacturer. Fine-tuning and quantisation look a lot like substantial modification. Ask your lawyer before you sign the PO, not after.

The Playbook, Updated

Last time the advice was to treat model selection as a supply-chain decision. Same principle, new hardware layer:

  • Put local inference on the roadmap now, or at least in the 2027 budget. But be prepared as Q3 2026 partner systems means procurement questions may land on your desk this autumn whether you’re ready or not.
  • Tier your workloads by data sensitivity, not by benchmark envy. Anything touching regulated, privileged or competitively sensitive material is a candidate for local. Everything else can stay on tap.
  • Inventory the inference endpoints. A model running under a desk is an asset. Register it, patch it, log it, and put an identity in front of it: including for the agents calling it.
  • Verify the weights like any other binary. Provenance, checksums, isolated evaluation, red-teaming for backdoors and prompt injection. Apache 2.0 is a licence, not an attestation.
  • Write the jurisdictional analysis down. Which prompts may leave the perimeter, under which legal regime, and who signed off. If you can’t answer that today, you have a finding, not a strategy.
  • Keep the exit strategy per model. Still the cheapest insurance in the building.

Reclaim, or Just Receive?

The moat was never the model. The tap turned out to be the thing worth holding. Now, through no virtue of our own, the tap is being handed over in an open box with a Hugging Face subscription in the packaging.

Europe is about to discover something useful: our sovereignty problem was never mainly a legislative problem. It was a procurement and architecture problem, and the market is solving it faster than the regulation was ever going to.

So take the gift. Take it with both hands. Then do what nobody does with gifts and read the manual, check the provenance, and put it in the asset register: because a dependency you didn’t choose is still a dependency, and a Trojan horse is, technically speaking, a supply-chain compromise with excellent packaging.

Download, self-host, diversify. And this time, inventory.