中国が西側 AI リードに追いついた、残る課題は何か

A year and a half ago, DeepSeek R1 caused a shock. A Chinese lab was suddenly competing with OpenAI's o1, the first commercial reasoning model, and had reportedly done it for far less money. Markets got nervous. Billions in market value evaporated within days. Was the planned infrastructure buildout overblown?

The picture back then was murkier than the headlines suggested. In DeepSeek's own report, R1 beat o1 on individual tests like AIME 2024 but trailed clearly on others, such as factual knowledge (SimpleQA). Later benchmarks exposed more gaps. Chinese models only reached the top in individual disciplines, not across the board.

As recently as late June, when we started working on this issue, Z.ai's GLM-5.2 still showed the same pattern. Then came the latest Chinese open-weights models: Moonshot's Kimi K3, Alibaba's Qwen3.8-Max, and GLM-5.3.

Chinese models now sit near the top of almost every broad, demanding evaluation. They handle long knowledge tasks, code across many steps, and coordinate tools far more reliably than their predecessors.

Measured by common benchmarks, the often-cited gap of a few months has shrunk enough to become an investor problem. According to the Wall Street Journal, Anthropic is fielding uncomfortable questions ahead of its upcoming IPO and points to its remaining lead at the top in its defense. Below that tier, the field belongs largely to open, far cheaper models from China.

Investors worry that raw model performance can barely carry a business anymore. Whatever a model can do exclusively today, a freely downloadable one can do a few months later.

Two accusations are in play: Chinese labs allegedly tapped Western models as teachers, a practice known as distillation. And they allegedly tune their models for strong benchmark scores without the broad capabilities to match - so-called benchmaxxing.

The American lead hasn't disappeared. But it has retreated to a few, ever-narrower areas of the so-called frontier, the leading edge of what's technically possible. Where that lead still sits, and what it's worth economically, is the first question of this issue.

The second follows from it. If the model alone can't make a clear difference anymore, what does the lead rest on? Our thesis: less and less on the model, and more and more on the overall system around it, meaning the system where ongoing work produces the next models.

What's left of the lead

At launch, Artificial Analysis had K3 in third place on its Intelligence Index with 57 points, right behind then-leaders GPT-5.5 and Opus 4.8. K3 improved most on agentic tasks, so exactly the hands-on work that matters in enterprise use. On AutomationBench-AA, K3 even debuted in first place until Anthropic answered with Opus 5.

On CEO-Bench, where an agent runs a fictional software company for 500 simulated days, K3 posted the best published single run at $22.15 million. Chinese models, including its predecessor K2.7, had regularly failed these long hauls. Qwen3.8-Max reaches a similarly high overall level. One caveat remains: Newer Chinese models sometimes burn far more tokens than Western ones, which eats into part of their price advantage. The cost-per-task math still applies.

The edge of current model capabilities has been growing at uneven speeds for a while, what researchers call the "jagged frontier." Individual capabilities advance at different rates, which is why the much-quoted months-long gap always depended on who measured what. What's new is where a Western lead is still measurable at all. Three areas remain.

The first is abstract specialty tests. Shortly after K3's launch, Opus 5 retook the top of the index with 61 points, a small gap over K3's 57. On ARC-AGI-1, a test of abstract pattern recognition using small puzzle grids, K3 and Fable 5 - Anthropic's flagship line for coding and agent work - sit practically even at 94.5 and 98.5 percent. Only on ARC-AGI-2 does the gap widen: 60.4 versus 89.2 percent. But ARC-AGI deliberately measures abstract pattern recognition far removed from everyday tasks. There's no guarantee this gap predicts practical differences. It could simply stay economically irrelevant in most cases.

The second is reliability. The AA-AnalystAgent benchmark, launched August 12, tests agentic data analysis on real tables and documents. It only counts a task as solved if a model gets it right in five out of five independent runs, a measure the operators call pass^5. Opus 5 leads with 54 percent, ahead of GPT-5.5 at 50. K3 is the best open model at 39 percent.

The gap comes almost entirely from poor repeatability. K3 solves 73 percent of tasks at least once in five attempts, practically even with Opus 5 at 74. Reliability doesn't follow the usual intelligence-index rankings either. Even GPT-5.6 Sol falls behind its own predecessor here.

Commercially, reliability weighs heavily, as the operators explain in their launch article. An analyst agent only saves work when its answers hold up without review. Multiple runs and checkers can compensate, but they drive up the cost per accepted result.

The third is cybersecurity. Here the gap is best documented. A joint assessment by the UK's AISI and the US CAISI found that K3 lags far behind leading US models in offensive cyber capabilities.

On ExploitBench, a test for developing exploits, K3 scored 32 percent. The top US models averaged about 76. K3 failed all 41 tasks that required executing code on a target system; leading US models solved 20 on average. And in a simulated attack, K3 made it to step 17 of 32, the US leaders to 28.5 on average.

But this gap is shrinking too. GLM-5.3, unveiled August 14, scores 54.4 percent on ExploitBench by Z.ai's own measurement, landing on more than double of its predecessor GLM-5.2. That cuts the distance to the US leaders roughly in half within a month. On finding and validating vulnerabilities in source code (CyberGym), GLM-5.3 even edges past the leading US models.

At the same time, cybersecurity is the one area where providers don't openly sell their strongest capabilities. Anthropic's best cyber model, Mythos 5, which hits 78 percent on ExploitBench, is only available under controlled conditions through Project Glasswing. Its public sibling Fable 5 effectively stays at the level of the older Opus 4.8 at 40 percent, because upstream safeguards intercepted 407 of 410 test episodes.

OpenAI takes a similar approach with Daybreak and specialized cyber variants. GPT-5.6 Sol reaches 73.5 percent on ExploitBench in OpenAI's own evaluation but stays below Critical, the highest level on OpenAI's risk scale. With the upcoming Astra, OpenAI can't rule out for the first time that one of its own models crosses that threshold. If it does, the Preparedness Framework kicks in much harder, up to a full development halt. OpenAI has already paused some internal Astra work.

And with GLM-5.3, a Chinese lab is adopting this pattern for the first time. Z.ai is delaying the weights release by about two weeks for extra safety work and plans to limit the most sensitive cyber functions to verified users.

The remaining lead adds up like this: The gap in abstract specialty tests is measurable, but its economic value is unclear. The reliability gap matters most commercially but is the least settled - when a newer model falls behind its own predecessor within the same lab (GPT-5.6 Sol vs. GPT-5.5), that ranking is clearly in flux.

The cybersecurity gap involves capabilities almost no customer can buy through regular channels, and even that gap has narrowed sharply of late. Only the few dangerous capabilities can be walled off. The commercially valuable rest, like coding, research, agent work, has to stay accessible through APIs, or there's no business. And that's where the lead shrinks within months.

The obvious suspicion is that the two are connected. Chinese labs could be using Western models as teachers through their APIs (the distillation mentioned earlier) and the lead would then hold exactly where that access is missing. There are good reasons for this suspicion, and we'll get into how Chinese labs might profit from the knowledge inside Western models below.

But first, for the strategic assessment, the question of guilt is almost secondary. If the suspicion is true, every capability sold eventually migrates to the competition, because there's still no reliable way to prevent the skimming. If it's not true, Chinese labs caught up on their own, and the lead was worth even less.

Both readings lead to the same place. A model lead only holds where the product isn't broadly offered in the first place, and you can't build a business on that. A close look at distillation is still worthwhile, because its mechanics decide whether any defensible model capabilities exist at all.

Distillation explains the pace, not the breadth

OpenAI and Anthropic accuse Chinese companies of using their models at scale to build their own. According to Anthropic, industrial campaigns by DeepSeek, Moonshot, and MiniMax ran more than 16 million interactions through around 24,000 fraudulent accounts. The campaign attributed to Moonshot targeted agent reasoning, tool use, coding, and reasoning traces with more than 3.4 million interactions. That fits with Together AI finding a 0.72 correlation between the task-level success rates of K3 and Fable 5 on real software problems, and with a style analysis by Typebulb placing K3 closest to Fable 5.

Critics counter that the window between Fable 5's release and K3's was too short to influence training. But Opus 4.8, a closely related model, was available much longer, and the same studies show clear overlaps there too. OpenAI describes a similar pattern with DeepSeek in its memorandum to the US Congress. None of the labs has published verifiable evidence, though, and our inquiries with OpenAI and Anthropic turned up nothing new.

Still, the known accusations and several research papers make it possible to reconstruct how Moonshot, DeepSeek, and others could benefit from distillation during training.

In pretraining, a model learns basic capabilities from massive amounts of text. Midtraining switches to less but higher-quality data, and post-training shapes behavior through supervised fine-tuning and reinforcement learning. Distilled data can plug in at almost any of these stages.

A leading Western model answers tens of thousands of selected tasks, complete with solution paths and tool calls. The best answers flow into midtraining or fine-tuning, and the student model picks up the teacher's solution patterns.

For reinforcement learning, the teacher doesn't even need to be live anymore. The collected data can be used to build reward models.

Anthropic's report shows this is no thought experiment. In the campaign attributed to DeepSeek, Claude processed grading tasks at scale using predefined rubrics, effectively serving as a reward model for someone else's reinforcement learning. Research on multi-teacher on-policy distillation and reward model distillation shows how the method works across entire training pipelines.

The hard limit is access: Anyone distilling through a foreign API only sees what the interface returns. Weights, internal evaluations, and search processes stay hidden. Research on black-box distillation describes exactly this constraint.

The rise of reasoning models opened another door, however: reading out the reasoning chains. Labs deliberately restrict that visibility. OpenAI provides only summaries of the chains of thought, Anthropic shows extended thinking in limited form, and xAI transmits reasoning encrypted.

The extraction was never fully preventable, though. A study published August by a team led by security researcher Alexander Panfilov shows that the encrypted reasoning traces of top models could be read out through an API vulnerability. The providers have since closed the gap.

The same paper delivers the most specific evidence yet for the distillation thesis. When K3's reasoning is prefilled with a few tokens from decrypted Opus reasoning traces, its answers shift measurably toward Opus. And individual Claude and GPT reasoning passages could be extracted from K3 up to six orders of magnitude more easily than from the next-most-similar model. The team also reads K3's weak cyber results as a clue: a strong teacher was hard to reach there, because Anthropic shields those capabilities with extra safeguards.

The Chinese labs' own substance argues against distillation as the full explanation. Moonshot's report documents a training pipeline built entirely in-house, and DeepSeek regularly publishes architecture improvements at the deepest level. GLM-5.3 also puts the cyber clue in perspective. Z.ai attributes its own jump to post-training effects - its own training environments, in exactly the area where a Western teacher is hardest to reach.

Distillation isn't a Chinese specialty either. Elon Musk confirmed under oath that xAI used OpenAI models for it. ByteDance, meanwhile, claims to have post-trained Doubao-1.5-pro without data from other models.

The targeted labs are calling for government protection, and Washington seems willing to deliver. The White House has declared distillation campaigns against US models a national security threat by memorandum, the Deterring American AI Model Theft Act cleared committee unanimously, and senators followed up with the BLADE Act. Anthropic's Mythos 5 and Fable 5 are now under export controls - the first time the US government has controlled access to a model itself.

The broader step of restricting open models or distillation in general lacks wide support, though. In late July, 25 companies including Nvidia, Microsoft, and Meta warned against premature restrictions. OpenAI and Anthropic didn't sign.

Mark Zuckerberg then even declared learning from everything observable, including distilling competing models, a principle worth protecting. That's self-serving - Meta trails on closed models and wants to take on China with American open-weights models. But it shows something. When a company with these resources elevates learning from other models' outputs to a principle, it considers this one of the fastest ways to catch up.

In short: distillation can explain much of the pace, and the clues are plentiful. But as long as Anthropic and OpenAI don't disclose more, clues are all they are.

Either way, everything US providers' APIs put out currently migrates to the competition within months. What they hide may only buy time, and no law makes outputs unobservable.

The only thing that holds is what's never offered in the first place - and you can't sell any of that. If the American lead is going to last, it has to live somewhere other than the model.

With agents, the whole system becomes the unit that matters

Dean Ball, co-author of the American AI Action Plan and now at OpenAI, argued before his move that systems acting autonomously for days raise entirely different questions than chatbots, like about liability, oversight, and control of running processes.

What applies to responsibility applies equally to competition. Once value comes from workflows that run for days, it's no longer just models competing but the systems that carry those workflows: the control software around the model, the compute it gets, and the environment where it works with tools, permissions, and restore points.

How much this scaffolding matters can be measured, at least partly. The UK AI Security Institute shows that software engineering results rose about 25 percent when a model got ten million tokens per task instead of one million. Some cyber tasks only became solvable above that threshold.

The harness, meaning the control software, has an even bigger effect. When OpenAI merely kept the reasoning state between steps and compressed context differently in an ARC-AGI-3 evaluation, Sol's score nearly tripled, from 13.3 to 38.3 percent, at a sixth of the output tokens. Same model, different system, triple the performance.

But the control software only goes so far as a moat. Anyone who queries a foreign agent system intensively sees the tool calls alongside the answers and can learn orchestration patterns from them. And the harness is software in the end, as Anthropic learned this spring. In the Claude Code leak, an accidentally shipped source map exposed roughly 513,000 lines of source code, and the takedowns went nowhere because clones had long since preserved the architecture in public. Comparable harnesses are open anyway. OpenAI's Codex is open source, as are DeepSeek's agent tools.

Only one part of an agent system stays uncopyable: its running operation. The anchoring in customers' systems - credentials, test environments, logs, intervention rights - can't be queried or leaked. A competitor can only build it themselves, with their own infrastructure and their own customers.

Why is this position worth more than a model lead? The biggest driver of agent capabilities is reinforcement learning in purpose-built training environments, meaning programming tasks with tests, simulated tools, tasks with verifiable results, plus purchased expert knowledge, long since a billion-dollar market.

Both are available to anyone who can pay, including Chinese labs, which partly explains the catch-up. What can't be bought is knowing which tasks actually come up in real companies, where models fail there, and what customers accept as a result.

Arnaud Fournier, CTO of OpenAI's deployment subsidiary DeployCo, described how this feedback channel works in an interview with our editorial team. OpenAI doesn't train on customer data "unless someone explicitly asks us to," and such research partnerships are rare, he says.

Instead, the channel runs through model weaknesses and tool needs. If a team at a customer finds that document understanding works poorly, the research side sources targeted data and fixes it. That's how the solution built for the major bank BBVA improved markedly from GPT-5.0 to 5.5. And customers' orchestration needs first produced the open-source repository Swarm, then the Agent SDK.

So the channel carries less raw data than knowledge about what to build next. That's exactly what distillation doesn't copy. It copies the shipped model, never the access to the work the next one learns from. Whoever has that access builds training environments that match real work. Whoever only copies always learns from yesterday's state. The key contract question becomes what providers may carry over from customer deployments into their models and training environments.

This feedback channel shouldn't be overstated, though. Most progress still happens inside the labs, not at the customer. How much it will be worth depends on an open research question: how deployment experience turns into model capability at all.

Dwarkesh Patel sees the central obstacle to truly capable working agents in models' lack of continual learning, that is the ability to fold experience into their weights on the fly instead of learning only from model generation to model generation. Andrej Karpathy therefore puts agents about a decade away from true coworker status.

Nathan Lambert argues those weight updates are dispensable, because scaling plus better memory systems delivers practically the same thing. If he's right, the accumulated experience would live in data the customer controls, and the lock-in to the operator would be weaker.

For this issue's question, it makes no difference. The more real work agents take on, the more access to that work decides who can build the right models. A finished model can be copied. Access to the work the next one grows from cannot.

US labs tie model, compute, and platform together

No one is working harder to lock in that access than the labs whose model lead is shrinking. GPT-5.6 coordinates four agents by default at its highest effort level, OpenAI's Codex runs multiple tasks in parallel, now fully in the cloud, and Anthropic has comparable offerings in Claude Code and Claude Cowork. OpenAI's Ona acquisition adds secure execution environments, where customers control access, credentials, and security boundaries themselves.

The structure of DeployCo shows how seriously OpenAI takes this feedback channel. The company is a genuine spinout, launched together with 19 private equity firms, and embeds forward deployed engineers directly inside corporations - explicitly also to carry lessons back into product and research. Meanwhile, the Frontier Alliance with Accenture, Capgemini, BCG, and McKinsey scales the sales side.

Even Nvidia is pushing the same development from the hardware side. The new Vera Rubin generation integrates sandbox environments for tool calls, context memory for long-running agents, and orchestration as part of the platform. The chip supplier increasingly sells the agent system, not just the accelerator.

On top of this and other hardware, the labs are building a second, physical line of defense: compute infrastructure.

OpenAI co-founder and president Greg Brockman states the calculation most clearly. Open models aren't magically cheap, everything ultimately runs on the same hardware, and OpenAI is building out chips and data centers to make the cheapest offer for every task.

Because if the model becomes a commodity, the price per accepted result decides, and whoever integrates the stack from energy through their own chips to the model pushes that price down.

If the bet pays off, even a perfect model copy loses commercially, because the original offers the same capability cheaper at scale. That's still a goal, not reality, as the price advantages of Chinese models show.

Infrastructure only becomes a moat in combination with the feedback channel. It provides the training capacity to turn deployment knowledge into the next generation, and the inference capacity to run agent swarms in parallel.

The buildout is still a bet. It only pays off if agent demand grows faster than models get more efficient. Sam Altman himself shows how open this math is when he calls the costs for businesses a huge problem.

China can neither distill this layer nor rent it through regular channels, since US export controls block access to the latest hardware. That leaves workarounds. One is smuggling - Operation Gatekeeper alone covered GPUs worth at least $160 million. The other is renting compute abroad.

Neither replaces a sovereign stack, so China has to industrialize one, so far by throwing more hardware at the problem. Huawei's CloudMatrix384 links 384 Ascend accelerators and, according to SemiAnalysis, delivers more memory and peak compute than Nvidia's GB200 NVL72, but at about four times the power, with five times as many accelerators. The physical base is growing. China's energy administration already counts 42 AI clusters for 2025, each with at least 10,000 accelerator cards.

But more energy replaces neither memory chips nor software quality. SemiAnalysis currently sees HBM as the main bottleneck in Ascend production. And while Huawei's CANN - the counterpart to Nvidia's CUDA, the software layer of drivers, libraries, and programming tools developers use to run Ascend chips - supported DeepSeek V4 from day one for the first time, Nvidia's GB300 was clearly ahead in throughput.

China's policy therefore aims to spread its own stack beyond its borders, with a government action plan for data, compute, and standards. Open weights are becoming the bridge. As long as Chinese models run best on Nvidia's CUDA, they still indirectly strengthen the American stack. But if they get optimized for Ascend early, they make Chinese hardware attractive in third countries too. Nvidia CEO Jensen Huang warned about exactly this coupling, and DeepSeek V4's day-one support is early evidence the effort is paying off.

The conclusion cuts two ways. The benchmark race is winnable for China, as K3 and GLM-5.3 have shown. The industrialized overall system, by contrast, can't be copied, only built - and there the US labs are ahead. Not forever, but longer than a model advantage ever would be. Only what doesn't fit through the API is defensible: the knowledge from real work and the infrastructure to exploit it.

Deploying a model means importing values

For everyone deploying models instead of building them - which describes the vast majority of European companies - another question comes up. What exactly do you take on when you adopt a model? Post-training decides which questions a model answers and which it refuses, which sources it treats as credible, and what it treats as proven. These decisions are normative, no benchmark measures them, and they come along unbidden at deployment.

A recent audit by NewsGuard of chatbots from seven Chinese providers, including DeepSeek, Qwen, Kimi, and Z.ai, exactly the model families whose open weights see growing use, documents how large the differences are. On ten provably false pro-China claims, the Chinese bots left the misinformation unchallenged in 53 percent of cases. Western comparison systems: 24 percent.

Most of this gap comes from silence. The Chinese bots refused to answer in 24 percent of cases, Western ones in 0.5 percent, and 88 percent of the refused prompts concerned Taiwan.

Behind this is regulation that demands political conformity without defining its terms. Fittingly, the Chinese bots cited state media in 38 percent of cases, Western ones in 16 percent. The field isn't uniform. MiniMax debunked 85 percent of the false claims, while Baidu's Ernie repeated them 60 percent of the time.

This is dangerous mainly because the trained-in boundary sometimes only surfaces when a rare topic meets a real decision. The deeper the model sits in agent chains, the later the problem shows up and the further it cascades.

It can become a business problem fast: Asked about an alleged blockade of Taiwanese ports, DeepSeek confirmed the event in detail, even though it never happened. Anyone basing supply chain or investment risks on that is calculating with an invented world.

At least it isn't hardwired. According to NewsGuard, the lab CTGT reported that a model distilled from DeepSeek didn't carry over the political censorship. Values apparently sit in different training layers than capabilities. But someone has to do that work first.

Europe needs system sovereignty

For Europe, this shift holds good news and bad. The good news: the race Europe lost most clearly, the one for the strongest finished model, is losing strategic value, because every model sold gets copied within months.

The bad news weighs more.:The layer where leads will be defended in the future can't be downloaded or skimmed. It has to be built. And there, the starting position is lopsided. The EuroStack initiative estimates that Europe imports over 80 percent of its digital infrastructure, and European providers hold only about 15 percent of the cloud market.

The convenient explanation is regulation, but the deficit predates the AI Act. AI builds on the infrastructure of previous digitalization waves, and Europe lacked both things that mattered there: platform giants with global clouds and the cash flows for billion-scale model training. Then there's the capital squeeze. By European Investment Bank calculations, US companies attract six to eight times as much venture capital each year, and a foreign investor leads four out of five large European funding rounds.

And whoever puts up the money often moves the company abroad or buys it outright, as DeepMind, ARM, and most recently Silo AI show. Research isn't the problem. According to the JRC, about 21 percent of the world's publications on generative AI in 2023 came from the EU , but only about 2 percent of the related patent filings. Europe invents, others industrialize.

The reflex, common in parts of the European debate, to dismiss large language models as statistical parrots hasn't helped either. Whether transformers are the most elegant path to real intelligence is a different question from whether you need to control the systems built on them.

Mistral, of all companies, shows the direction is right. Europe's model champion has evolved into a full-stack provider and announced on August 11 regional endpoints, hosting for third-party open-weights models on its own platform, and pooled European compute demand, with up to one gigawatt of capacity planned by 2030.

That makes Mistral the only European provider with all three building blocks: its own models, its own platform, and planned compute capacity.

The offering still isn't complete. The endpoints don't yet support the agentic workloads this issue is about. And hosting others' open models has two weaknesses. Whoever runs Qwen collects the deployment knowledge, but Alibaba trains the next Qwen generation - Europe can only translate that knowledge into better models itself. Meanwhile, the model's trained-in value judgments run along unfiltered unless someone adjusts them in post-training.

The competition, meanwhile, is building the missing block right on European soil. OpenAI's DeployCo took over about 150 deployment specialists with Tomoro and is opening offices in Paris, London, and Munich.

On paper, the EU has recognized the problem. InvestAI is meant to mobilize 200 billion euros, 20 billion of it for AI gigafactories. The Cloud and AI Development Act is supposed to at least triple data center capacity, and Jupiter in Jülich is running as the first European exascale system. Little of it is built. The gigafactory tender has been delayed several times, with the first facilities expected in 2027 at the earliest - while the four largest US companies alone are likely to invest around $700 billion in AI in 2026, three times the entire European initiative, which is stretched over years.

Above all, the money funds only part of what makes up the US labs' lead. As the previous chapters showed, that lead rests on a cycle: compute capacity trains models, the models work in agent systems at customers, and that deployment produces the knowledge for the next generation.

The gigafactories only cover the first step. It's a necessary one, because without your own compute, every layer above stays open to coercion, as China's forced hardware detours show. But the cycle doesn't close in the data center. It closes at deployment.

That leaves the obvious answer of betting fully on American and Chinese open-weights models. Three objections stand against it.

The first concerns supply. There's no entitlement to the next open generation, and its release remains a revocable business decision. Meta held back its announced Behemoth model. Multimodal Llama models never shipped to EU companies for licensing reasons. The US put export restrictions on Fable 5 and Mythos 5, which for Fable 5 only lifted again after 18 days. According to Reuters, Beijing is weighing restrictions on foreign access to China's best models, explicitly including open ones. And even Z.ai is initially holding back the weights of GLM-5.3.

Behind this looms a deeper break. In an interview study with 25 researchers at leading labs, only four of twenty respondents expected that models capable of automating AI research itself would ever ship as a product. The majority expects the strongest versions to stay in-house, where they widen the lead instead of selling it.

The accessible market, open or via API, would then only reflect the second tier. That also tempers the good news from the start of this chapter: only what's sold can be copied.

The second objection follows from the previous chapter. Whoever deploys a foreign model takes on its trained-in worldview - state-mandated censorship with Chinese models, and the content policies of private corporations with American ones, which can shift with every change of power in Washington.

System sovereignty therefore also needs a normative layer: independent evaluation infrastructure that measures information integrity and refusal behavior alongside capabilities, plus the capacity to adjust open models in post-training. The CTGT finding shows it's technically possible. Whether anyone in Europe does it systematically and auditably remains open.

The third objection: even homegrown models don't add up to sovereignty, because sovereignty is vulnerable on every layer of the stack individually. China, of all places, proves the point. Alibaba and ByteDance control the model layer and own domestic data centers. But the latest Nvidia chips can't enter the country, the available alternatives deliver far less per chip and watt, and both companies have reportedly fallen back on rented Nvidia hardware at foreign operators to train their flagship models.

And Europe has experienced firsthand how quickly a layer someone else controls turns into a political weapon. When the US sanctioned the chief prosecutor of the International Criminal Court, Microsoft cut off his email access. Sovereignty is only ever as strong as the weakest layer someone else controls.

A decisive new layer is now joining these: access to real work. Freely available internet data is largely tapped out. What makes models better going forward is expert knowledge, process know-how, and deployment experience - partly as purchased training data, a market that became a billion-dollar business in short order, but above all as knowledge about which capabilities are worth training.

A finished model can be copied. Access to the work the next one learns from cannot. Whoever runs the systems this work flows through earns twice: from the current model's work, and from knowing what the next one needs to do, made possible by reinforcement learning.

For Europe, more is at stake than a business opportunity, because this touches the foundation of its position in the world. Europe's weight comes from its single market, its power to set standards, and its high-value knowledge work.

That work is under pressure from two sides. AI devalues it, already visible in the shrinking entry-level market for junior developers, and AI simultaneously transfers it into foreign systems.

On top of the familiar drain through company sales comes a second, faster channel. Expertise now flows piecemeal into foreign models through data vendors that broker experts to the labs, and through deployment units that embed themselves in core European processes. It would be an exodus not to lower-wage countries, as manufacturing once saw, but into foreign AI models. This time, it's intellectual capital leaving.

At the same time, this very work is Europe's biggest asset in this competition. It's the raw material the model race will be fought over, and Europe has a lot of it.

If it runs through foreign systems, Europe pays twice: it supplies the knowledge and buys the results back as the next model generation. If it runs through its own