Inequality and the Concentration of Power

The dystopias of the previous chapters needed a machine that watched, judged or flattered. The one in this chapter needs only ownership. If the most capable AI systems are built by a handful of companies, on chips from a handful of suppliers, in data centres run by a handful of cloud providers and under the law of two or three states, then whoever controls that chain gains leverage over everyone who depends on it. Science fiction gave the fear the face of a state, the watching power of Nineteen Eighty-Four (37, Orwell, 1949); Shoshana Zuboff widened it to companies that accumulate behavioural data to predict and shape behaviour (170, Zuboff, 2019). AI adds dependence on systems that a few actors can price, change or withdraw.

The chapter tests two tropes from Chapter 2. T7 The watching state asks whether control of AI concentrates economic and political power beyond the reach of the institutions meant to hold it to account. T8 The machine that stops, and the humans who forgot is tested in its systemic form, in which many organisations rely on the same few systems and cannot continue when those systems fail, change or are withdrawn; Chapter 6 tested its individual form. The chapter also answers Q12 from the series foundations: what a single enterprise or public authority can do about risks that are systemic, international and decided by a handful of developers. No organisation can change the market's structure, but each can see its position in it and make its dependence visible and reversible.

The AI supply chain in six layers from chip design to the applications of deployers

Figure 15.1: The AI supply chain from chip design to the applications of deployers; an organisation's own exit plans and second sources act on the last link.

Table 15.1: Concentration and levers by layer.

Layer Concentration Lever
Chip design and accelerators A few designers, one dominant in AI training
Chip manufacture and lithography One dominant foundry and one lithography supplier Export controls and state strategies
Cloud and data centre capacity Three non-EU hyperscalers hold most of the European market
Frontier and open-weight models A handful of frontier developers in two countries Export controls; open weights and second sources
Platforms, suites and distribution Suite vendors choose the model for the user
Applications of deployers Many deployers, little leverage each Dependency map and exit plans

Compute, data and capital

Frontier AI concentrates because each of its inputs rewards scale (Figure 15.1). Accelerator design is dominated by a few firms, one of which accounts for over 60 per cent of global AI computing capacity; a single foundry in Taiwan fabricates almost every leading AI chip (71, Stanford HAI, 2026); and the extreme-ultraviolet lithography machines they need come from a single Dutch company. Frontier capability still tracks compute: as Chapter 5 explained, the AI Act presumes systemic risk for a general-purpose AI model whose cumulative training compute exceeds 10²⁵ floating-point operations (Article 51(2)), with the additional obligations of Article 55 (1, European Union, 2024). Only a few organisations can cross that threshold. The Stanford AI Index records that industry produced over 90 per cent of notable models in 2025, that the training compute of notable models has risen by several orders of magnitude, and that the United States produced the most notable models, China the next most and European countries far fewer (71, Stanford HAI, 2026).

The cloud layer is equally concentrated. The Commission's proposal for a Cloud and AI Development Act records that the share of EU cloud providers in the European market fell from 29 per cent in 2017 to 15 per cent in 2022, and that three non-EU hyperscalers hold more than 70 per cent of it (14, European Commission, 2026). The same companies invest in frontier developers and distribute their models, so the layers are not independent. Firms that run search engines, social networks and office suites also hold the data training needs and the channels through which AI reaches people (170, Zuboff, 2019); where AI arrives embedded in licensed software, AI Governance, Chapter 6, showed, the vendor chooses the model and the customer's lever shrinks to contract clauses (178, Nordqvist, 2026). Underneath lies capital that only the largest firms and states can raise, and foundation models spread their defects to everything built on them, so homogenisation brings both leverage and correlated failure (93, Bommasani et al., 2021).

Two forces push the other way, however. The AI Index records a fall of more than 99 per cent in the cost of GPU computation since 2006 and open-weight models that are far more competitive than a few years ago, though still behind the leading closed-weight model in March 2026 (71, Stanford HAI, 2026). Concentration at the frontier is therefore compatible with wide diffusion a year or two behind it, and most organisations need only the latter.

Who gains

Who captures the value is a separate question from who supplies it. An International Monetary Fund staff discussion note estimated that almost 40 per cent of global employment is exposed to AI, about 60 per cent in advanced economies, and concluded that in most scenarios AI is likely to worsen overall inequality unless policy responds (161, Cazzaniga et al., 2024). The International Labour Organization found clerical work the most exposed, and exposure more often a transformation of tasks than a disappearance of jobs (159, Gmyrek et al., 2025). Within firms, the customer-support study discussed in Chapter 6 found productivity up by about 14 per cent on average and by much more for the least experienced agents (162, Brynjolfsson et al., 2025). Whether such gains reach workers as wages or employers as lower costs is not decided by technology.

That is the core of Daron Acemoglu and Simon Johnson's Power and Progress: over a thousand years, productivity gains were widely shared only when workers and citizens had enough countervailing power to claim a share, and they are critical of technology aimed at automation for its own sake and at surveillance of workers (67, Acemoglu & Johnson, 2023). Acemoglu estimated a gain in total factor productivity of well under one per cent over a decade, with no tendency to reduce inequality and a possible widening of the gap between income from capital and from labour (158, Acemoglu, 2024).

Between countries the picture is sharper. The IMF found advanced economies better placed to benefit than emerging and low-income ones (161, Cazzaniga et al., 2024). The UN High-level Advisory Body on Artificial Intelligence found that of seven prominent international AI governance initiatives, 118 countries were party to none and only seven to all, and proposed a capacity-development network and a global fund (21, UN Advisory Body, 2024). Europe is rich and well placed to adopt AI but builds few frontier models and owns little of the cloud capacity they run on, so its gains come mostly from use, and that becomes a threat when supply can be withheld for reasons unrelated to the customer.

States and strategies

Because the supply chain runs through few jurisdictions, states treat it as strategy. The United States' AI Action Plan of July 2025, Winning the Race, treats AI leadership as national security, proposes exporting the full American AI technology stack to allies and calls for stronger enforcement of export controls (175, White House, 2025). Those rules change fast: AI Governance, Chapter 6, recorded that the AI Diffusion Rule, issued in January 2025, ceased to be enforced in May 2025, and that in January 2026 licence review for certain chips exported to China moved to case-by-case review (178, Nordqvist, 2026). In March 2026 the US Department of Defense designated one frontier developer, Anthropic, as a supply-chain risk after talks broke down over the company's request for assurances that its models would not be used for fully autonomous weapons or domestic mass surveillance; in September 2026 a federal appeals court upheld the designation by two votes to one (176, CNBC, 2026). The case is reported for what it shows about structure, not to take a side: a provider's usage policies are subject to its home state's decisions.

China combines investment in domestic chips with a strong presence in open-weight models, which European organisations can run on their own infrastructure; AI Governance concluded that self-hosting removes the legal-access risk of a hosted service but leaves behaviour and supply-chain integrity to be tested (178, Nordqvist, 2026). Evaluations are part of the contest: the US Center for AI Standards and Innovation reported that DeepSeek models were more susceptible to agent hijacking and more often echoed narratives of the Chinese state (130, NIST, 2025), work that is credible and produced by an interested party.

The European Union's response has two strands. The AI Act applies to providers placing AI systems or general-purpose AI models on the Union market wherever they are established (Article 2), requires third-country providers of general-purpose AI models to appoint an authorised representative (Article 54) and imposes documentation duties towards downstream providers (Article 53) (1, European Union, 2024), which gives a dependent customer leverage. The AI Continent Action Plan of April 2025 sets out to build AI factories, gigafactories and data-centre capacity so that Europe is not left dependent on capacity elsewhere (13, European Commission, 2025), and the proposed Cloud and AI Development Act would add four Union assurance levels for cloud services in public procurement; its recitals state that the tailored versions of their offerings that cloud providers have launched do not address the extraterritorial reach of third-country laws or the possible disruption of the service (14, European Commission, 2026). It is still a proposal, and Europe remains a large customer rather than a large supplier (178, Nordqvist, 2026).

Behind all three lies the framing of AI as a race, which Leopold Aschenbrenner set out as a national-security project the democracies must win (64, Aschenbrenner, 2024); Chapter 21 examines its military side. A race justifies concentration, because if the stakes are national survival, national champions look like prudence and allies' dependence like a feature.

Dependence as a threat

For a European organisation the question is what happens if a supplier changes the terms, fails or is cut off. AI Governance identified legal access to data by the provider's home state and continuity under sanctions and export controls as geopolitical risks of a model (178, Nordqvist, 2026); this chapter adds the market dimension. First, lock-in: prompts tuned to one model, embeddings computed with it and fine-tuned derivatives make switching costlier every month, and a provider with locked-in customers can raise prices or change terms, a risk that applies to European providers too. Second, forced migration: models are retired on the provider's schedule, often at shorter notice than a procurement cycle, and deprecating the model on which a high-risk system was evaluated forces re-evaluation and retraining of its overseers at a time the deployer did not choose. Third, leverage: states use the supply chain as a lever, so far mainly towards rivals and their own suppliers, and no case has been documented in 2026 of a US AI or cloud service withdrawn from European customers for political reasons (178, Nordqvist, 2026).

Concentration also produces a systemic form of T8 that needs no one's decision. When many organisations rely on the same model or cloud region, one failure or faulty update reaches all of them at once, and the International AI Safety Report warns that widespread reliance on a small number of models creates single points of failure (50, Bengio et al., 2026). For an insurer the mechanism appears twice, in its own operations and in correlated claims. European law already names part of this. DORA requires financial entities to keep a register of information on ICT third-party arrangements (Article 28(3)), assess concentration risk (Article 29) and maintain exit strategies (Article 28(8)), and allows designation of critical ICT third-party providers for direct oversight (Article 31) (11, European Union, 2022); NIS 2 requires attention to supply-chain security (Article 21(2)(d)) (10, European Union, 2022).

The deeper concern links dependence to T7. Jan Kulveit and colleagues argue that the need for human labour and participation helped keep states and economies responsive to people, and that if AI replaces much of it, accountability may weaken gradually without any single decision (167, Kulveit et al., 2025); Chapter 26 examines the argument. A public authority whose services depend on systems it cannot inspect, move or replace is less able to answer to citizens for them.

What sovereignty can achieve

AI Platform and Security, Chapter 13, defined digital sovereignty as verifiable properties rather than a location: knowing where workloads run, which law governs them, being able to move them and to continue if a provider becomes unavailable, achieved through region pinning, customer-held keys, portable infrastructure definitions and open-weight models for sensitive workloads (179, Nordqvist, 2026). AI Governance, Chapter 6, added an exit plan with a warm second source from a different jurisdiction, drilled twice a year (178, Nordqvist, 2026). These designs turn lock-in into a known cost, limit leverage because weights held by the organisation cannot be withdrawn, and preserve accountability because an authority that can name every provider under a service can answer for it. They do not, however, reduce market concentration or reach the chips, and they usually cost capability, money and skills. The honest claim is reversibility, not independence.

Practical guide: Mapping AI dependencies and their exit options

Purpose. Make dependence on AI suppliers visible layer by layer and give every critical AI service an exit with a known cost and time.

Roles. The owner of the threat-register entry for supplier dependence owns the map; system owners supply entries; the architecture team maps the layers; procurement supplies notice periods; the legal function confirms jurisdictions; in a financial entity, the risk function reconciles the map with the DORA register.

Steps.

  1. Select the services that support a critical function, decisions about people or special-category data. Default: at most twenty at first.
  2. Map each service down the chain: application, model and developer, hosting and region, accelerator vendor where known, including models embedded in licensed suites.
  3. Record jurisdiction and ultimate owner at each layer.
  4. Classify each dependency as reducible, accept and monitor or unavoidable. Default: reducible unless shown otherwise.
  5. Link an exit plan to every reducible dependency of a critical service, with a second source, a maximum switch time and a recent evaluation. Default: ten working days, two for critical services.
  6. Name monitoring signals for accepted dependencies, such as change of ownership, deprecation notice or export-control change.
  7. Count concentration. Default: flag any provider behind more than a third of critical services.
  8. Record the residual risk in the threat register and review every six months and on trigger.

Definition of done. Every critical service is mapped and classified, every reducible dependency has a tested exit, and concentration is counted and decided. Financial entities and authorities with statutory deadlines may need shorter switch times.

Worked example: A dependency map with exit plan references

The following map is illustrative. It belongs to Nordvik Region, supports register entry THR-NR-05 (dependence on a small number of model and hosting providers) in ATA-NR-2026-01, and lives in version control beside the register.

dependency_map:
  id: DEP-NR-2026-01
  status: illustrative
  owner: CISO, as owner of the AI threat register
  threat_register_entry: THR-NR-05
  review: {cadence_months: 6, next: 2027-04-30}
  services:
    - name: benefits-triage system
      decision_records: [AIDR-0007, AIDR-0018]
      model: {owner: TriageSoft, hosted_in: Nordvik regional data centre, class: accept_and_monitor}
      exit_plan: EXIT-NR-01
    - name: citizen-service assistant
      decision_records: [AIDR-0014]
      model: {type: open-weight, weights_held_by: Nordvik, class: reducible}
      hosting: {provider: European hosting provider, capacity: reserved, class: reducible}
      exit_plan: EXIT-NR-02
      max_switch_working_days: 2
    - name: internal staff assistant
      decision_records: [AIDR-0211]
      hosting: {provider: European cloud provider, contract: NR-2026-031, keys: customer-held, class: reducible}
      exit_plan: EXIT-NR-03
      max_switch_working_days: 10
    - name: embedded workplace assistant pilot
      model: {chosen_by: suite vendor, provider_jurisdiction: non-EU, class: accept_and_monitor}
      signals: [change of model provider, change of data boundary terms]
  unavoidable:
    - layer: accelerators
      note: all hosting options use non-European accelerators
  concentration: {european_hosting_provider: 1 of 4 critical services, decision: accepted}

The map shows the audit committee which dependencies have exits, which are accepted with signals that would bring them back for decision, and which nobody can avoid.

The debate

Concentration is documented. Whether it amounts to a threat depends on what one expects to follow from it: unaccountable power and lasting inequality, or a temporary lead that competition, open models and policy will erode.

The case for concern

At every layer a few firms in a few states hold most of the capacity, and the European share of cloud is shrinking (14, European Commission, 2026). Those who hold this view argue that scale economics will not unwind by themselves, and that concentration of foundation models becomes concentration of defects and of influence over what millions of applications say and refuse (93, Bommasani et al., 2021). Acemoglu and Johnson argue that AI is being directed largely towards automation and surveillance (67, Acemoglu & Johnson, 2023), aggregate gains look modest (158, Acemoglu, 2024), the IMF expects inequality to worsen (161, Cazzaniga et al., 2024), and most countries take no part in governance (21, UN Advisory Body, 2024). States already use the supply chain as an instrument of policy (175, White House, 2025) (176, CNBC, 2026), the race framing justifies more concentration (64, Aschenbrenner, 2024), and accountability may erode as human participation matters less (167, Kulveit et al., 2025). On this view T7 needs no tyrant, only systems that democracies cannot inspect or replace.

The case for calm

The case for calm begins with diffusion: the cost of computation has fallen steeply, open-weight models are far more competitive than they were and the gap between US and Chinese models has effectively closed (71, Stanford HAI, 2026), so capability a year behind the frontier is cheap and impossible to withdraw once downloaded. Technological leads have repeatedly eroded. Arvind Narayanan and Sayash Kapoor argue that AI is a normal technology whose effects unfold slowly enough for policy to act, and that restricting the spread of capability would itself concentrate power (60, Narayanan & Kapoor, 2025). Dario Amodei, chief executive of one frontier developer, argues that AI could accelerate growth in poorer countries if benefits are deliberately spread (66, Amodei, 2024), an interested party's argument reported as such. The best-studied deployment narrowed the gap between novices and experts (162, Brynjolfsson et al., 2025), and in Europe the AI Act binds foreign providers, DORA gives supervisors oversight of critical ICT providers and the Commission is investing in public compute (1, European Union, 2024) (11, European Union, 2022) (13, European Commission, 2025). On this view the worst outcomes require a failure of policy.

Where the positions meet

Both positions accept that the frontier is concentrated and that capability behind it diffuses quickly, and both treat distribution as a political choice; Acemoglu and the advocates of normal technology differ on speed and magnitude, not on that principle (67, Acemoglu & Johnson, 2023) (60, Narayanan & Kapoor, 2025). Neither recommends that a European organisation build its own frontier model or ignore concentration. Both conclude that dependence must be visible and exit possible at a known cost. They disagree on how likely a supplier or its home state is to use dependence as leverage, which is precisely the question an exit plan makes less important.

What can be done

Individuals can prefer services that allow data export and portability, keep documents in formats no single assistant controls, and engage with how authorities choose suppliers and how AI's gains are shared; workers' representatives can use consultation rights, one of the countervailing powers Acemoglu and Johnson identify (67, Acemoglu & Johnson, 2023). Organisations can map and classify dependencies, keep tested exit plans, count concentration, record the residual risk in the AI threat register (Chapter 32) and write sovereignty into procurement as verifiable criteria; financial entities can align the map with the DORA register (11, European Union, 2022). Society can scrutinise links between cloud providers, chip suppliers and frontier developers, build public compute as the AI Continent Action Plan and the proposed Cloud and AI Development Act intend (13, European Commission, 2025) (14, European Commission, 2026), and widen access to compute and skills as the UN Advisory Body proposed (21, UN Advisory Body, 2024). Chapter 28 describes what has been decided so far.

Verdict

T7 The watching state. The concentration of AI capability in a few firms and states is a pattern at scale and observable. The use of the supply chain as an instrument of state power has reached incident in the wild, through export controls and a state's designation of one of its own developers; it is observable. That concentration will deepen inequality rests on argument and forecasts, not yet on a measured pattern specific to AI; it is expected where policy does not respond. Power that escapes democratic accountability altogether remains argument, and any forecast that it will come about is speculation.

T8 The machine that stops, and the humans who forgot. Dependence of many organisations on the same few providers is observable as a pattern at scale. Correlated failures of shared cloud and software services have reached incident in the wild in IT generally; for AI services they have not yet caused documented large-scale harm, so correlated failure through a shared model provider is expected. That European organisations could not continue if a foreign supplier withdrew is a plausible argument for those without exit plans, and largely answered for those with tested second sources.

What can be influenced. No organisation can change market concentration or a foreign state's export controls, but every organisation can see its dependence, reduce what is reducible, test its exits and contribute to the policies that decide distribution.

Nordvik Region and Hansa Mutual

Nordvik Region hedges deliberately. Its citizen-service assistant runs on open-weight models on accelerators a European hosting provider reserves for it in a Nordic data centre, its staff assistant runs with a European cloud provider under contract NR-2026-031, and the benefits-triage system runs in its own data centre. It pays with capability behind the frontier and gains reversibility, recorded under THR-NR-05.

Hansa Mutual's claims-correspondence classification uses a US provider's model in a hyperscaler's EU region, with a European open-weight second source in its Frankfurt data centre under exit plan EXIT-004, and assessment GEO-2026-017 records the jurisdictional side. The group registers THR-HM-06, correlated failure of a shared model provider, and as an insurer THR-HM-07, the accumulation of AI-related losses across its cyber and liability portfolios. Its map is reconciled with the DORA register for the EU entities, while the UK and Swiss entities confirm it against their own regimes. Nordvik thus holds its weights; Hansa relies on warm second sources and measures concentration across a large estate.

Summary

Frontier AI concentrates because compute, data and capital reward scale, while falling prices and open-weight models spread capability quickly behind the frontier. The IMF expects AI to worsen inequality in most scenarios, Acemoglu and Johnson argue that shared prosperity needs countervailing power, and states treat the supply chain as strategy: the United States through export controls, China through self-reliance and open weights, the European Union through rules and public capacity.

For a European organisation, dependence becomes a threat through lock-in, forced migration, leverage and correlated failure. Sovereignty as verifiable properties cannot remove concentration but can make dependence visible and reversible, and the practical answer to Q12 is a dependency map linked to tested exit plans. The verdict: concentration is observable as a pattern at scale and state leverage as an incident in the wild; deepening inequality is expected where policy does not respond; power beyond democratic accountability remains argument. Chapter 16 turns to culture and asks whether models trained on the same data make human thought and creativity more alike.

Sources

  1. Orwell, G. (1949). Nineteen Eighty-Four. (37, Orwell, 1949)
  2. Zuboff, S. (2019). The Age of Surveillance Capitalism: The Fight for a Human Future at the New Frontier of Power. (170, Zuboff, 2019)
  3. European Parliament and Council of the European Union (2024). Regulation (EU) 2024/1689 (Artificial Intelligence Act). (1, European Union, 2024)
  4. Stanford Institute for Human-Centered Artificial Intelligence (2026). The 2026 AI Index Report. (71, Stanford HAI, 2026)
  5. European Commission (2026). Proposal for a Cloud and AI Development Act (CADA). (14, European Commission, 2026)
  6. Nordqvist, G. (2026). AI Governance: Governing Artificial Intelligence in European Enterprises and Public Authorities. (178, Nordqvist, 2026)
  7. Bommasani, R. et al. (2021). On the Opportunities and Risks of Foundation Models. (93, Bommasani et al., 2021)
  8. Cazzaniga, M., Jaumotte, F., Li, L., Melina, G., Panton, A. J., Pizzinelli, C., Rockall, E. J. & Tavares, M. M. (2024). Gen-AI: Artificial Intelligence and the Future of Work. (161, Cazzaniga et al., 2024)
  9. Gmyrek, P. et al. (2025). Generative AI and Jobs: A Refined Global Index of Occupational Exposure. (159, Gmyrek et al., 2025)
  10. Brynjolfsson, E., Li, D. & Raymond, L. (2025). Generative AI at Work. (162, Brynjolfsson et al., 2025)
  11. Acemoglu, D. & Johnson, S. (2023). Power and Progress: Our Thousand-Year Struggle Over Technology and Prosperity. (67, Acemoglu & Johnson, 2023)
  12. Acemoglu, D. (2024). The Simple Macroeconomics of AI. (158, Acemoglu, 2024)
  13. United Nations High-level Advisory Body on Artificial Intelligence (2024). Governing AI for Humanity: Final Report. (21, UN Advisory Body, 2024)
  14. The White House (2025). Winning the Race: America's AI Action Plan. (175, White House, 2025)
  15. CNBC (2026). U.S. appeals court upholds Pentagon designation of Anthropic as supply chain risk. (176, CNBC, 2026)
  16. National Institute of Standards and Technology, Center for AI Standards and Innovation (2025). CAISI Evaluation of DeepSeek AI Models Finds Shortcomings and Risks. (130, NIST, 2025)
  17. European Commission (2025). AI Continent Action Plan. (13, European Commission, 2025)
  18. Aschenbrenner, L. (2024). Situational Awareness: The Decade Ahead. (64, Aschenbrenner, 2024)
  19. Bengio, Y. et al. (2026). International AI Safety Report 2026. (50, Bengio et al., 2026)
  20. European Parliament and Council of the European Union (2022). Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA). (11, European Union, 2022)
  21. European Parliament and Council of the European Union (2022). Directive (EU) 2022/2555 (NIS 2 Directive). (10, European Union, 2022)
  22. Kulveit, J., Douglas, R., Ammann, N., Turan, D., Krueger, D. & Duvenaud, D. (2025). Gradual Disempowerment: Systemic Existential Risks from Incremental AI Development. (167, Kulveit et al., 2025)
  23. Nordqvist, G. (2026). AI Platform and Security: Building and Securing AI Platforms in European Enterprises and Public Authorities. (179, Nordqvist, 2026)
  24. Narayanan, A. & Kapoor, S. (2025). AI as Normal Technology. (60, Narayanan & Kapoor, 2025)
  25. Amodei, D. (2024). Machines of Loving Grace: How AI Could Transform the World for the Better. (66, Amodei, 2024)