In partnership with
Two things happened in AI that look unrelated.
Andrej Karpathy open-sourced a self-improving research loop that ran eighty-three experiments overnight and found an eleven percent gain in a model its creator thought was finished.
The Dutch central bank signed a cloud contract with the company that owns Lidl, explicitly choosing a technically inferior European provider over AWS because the alternative meant handing control of financial infrastructure to a foreign jurisdiction.
One story is about what AI can do when it runs without human intervention.
The other is about who decides where it runs.
The infrastructure question is the one that does not get enough coverage, because it is slower and less dramatic than the capability question. A self-improving AI loop is a visible event. Infrastructure dependency is invisible until the moment it is weaponized.
The ICC prosecutor's email was hosted on American servers. An American president severed his access in 2025. The prosecutor was on European soil. It did not matter.
That is what infrastructure dependency looks like when it becomes a political instrument. Not a cyberattack, not a dramatic shutdown. A quiet administrative decision that one party can make and the other party cannot reverse.
The US CLOUD Act is the mechanism.
It requires American cloud providers to hand over data to US authorities on request, regardless of where the servers physically sit. A data center in Frankfurt, operated by Europeans, storing European institutional data, is still within reach of Washington.
This is not a hypothetical risk. It is a demonstrated one. The DNB and the Dutch financial regulator named it explicitly in their warnings last year. They did not use the word vulnerability. They used the phrase "geopolitical tensions." That is regulatory language for "we watched what happened to the ICC and drew the obvious conclusion."
Ray Dalio has written that the current period resembles the late stage of a dominant power cycle, where the leading power begins using financial and technological systems as leverage instruments rather than purely as commercial infrastructure.
The CLOUD Act is one such instrument.
What changed in 2025 is that European institutions stopped treating it as a theoretical concern and started treating it as an operational constraint.
That shift creates a structural split in the global AI landscape that is not about capability. StackIT is not as good as AWS right now. The Dutch central bank said so openly. They chose it anyway, because the alternative was legal exposure they were no longer willing to accept.
The same logic applies to AI systems built on top of American cloud infrastructure. A European hospital running an AI diagnostic system on AWS is not just making a technical decision. It is making a jurisdictional one. That jurisdictional dimension is increasingly being priced into procurement decisions across the continent.
Watch every match the way it was meant to sound.
This summer, 48 nations play. For a lot of fans in the US, the match doesn't feel right in the wrong language. The commentary, the energy, the way goals sound when your language is calling them.
Norton Neo is a free browser with a free built-in VPN. Stream privately in the language you want. No subscription, no sign-up, no credit card. Built-in VPN, anti-fingerprinting, and ad blocking, all backed by Norton security.
Free to download. Free to use.
Fast. Safe. Intelligent. That's Neo..
This is where Karpathy's story connects to DNB's.
Autoresearch runs on one GPU. It improves models overnight without human intervention. The capability is now cheap, available, and open-source. The question of who benefits from that capability is entirely a function of where it runs and under whose legal framework.
A European institution running autoresearch-style self-improvement loops on European sovereign infrastructure produces output that stays within European jurisdiction. The same loops running on AWS do not.
The AI capability race is increasingly settled. The infrastructure race is not. The organizations that understand the difference between those two races, and build accordingly, are the ones that will still control their own systems in ten years.
The ones that don't will find out the hard way, the same way the ICC prosecutor did, not through a breach, but through a meeting in Washington they were not invited to.
What to do with this today as a builder is in this week's High Stakes Human Skills.
404 Found covers AI developments from a European Insider, three times a week.
8 levels of context maturity in AI-native engineering
More MCPs give agents access to information, not understanding. You agents are still missing the context to generate output you can fully trust. This 8-level model explains where teams get stuck and what fixes it. Join this live webinar on June 24 (FREE) and grab the free assessment to see where your team stands.