Concentration-risk and supply-chain disclosure
Making the whole AI supply chain's jurisdictional exposure inspectable, not just the top layer's: a sovereignty bill of materials an agent can query before committing data. A sovereign front end with foreign dependencies underneath is disclosed as exactly that.
The impact of agents
A government may pick a sovereign cloud provider or a domestically hosted model. The supply chain behind that service can still hide foreign dependencies. A nominally sovereign model may have been trained on a foreign hyperscaler's infrastructure, fine-tuned on a foreign platform, or served through networks that route data across borders. The user's agent, committing data to what looks like a domestic service, has no way to see those buried exposures.
The jurisdictional exposure of the whole stack has to be inspectable before data is committed.
What must be verified
Government must make the jurisdictional exposure of the whole AI processing chain inspectable, not just the sovereignty of the service at the top. A user's agent can then find hidden foreign dependencies before committing data to a nominally sovereign service. A sovereignty claim that covers only the visible layer, while sub-processors and upstream training infrastructure go undisclosed, does not meet that requirement.
Protecting access
A raw component manifest is legible only to someone who can read a supply chain. That excludes exactly the users the disclosure is meant to protect. They see a list they can't interpret, and can't tell whether the service is exposed to a foreign dependency.
Keeping the path open
- Render the manifest as a summary sovereignty label, legible at a glance and in plain words.
- Make the detailed manifest agent-queryable for high-sensitivity interactions, so an agent can evaluate on the user's behalf what the user should never have to parse.
Response surface
A per-layer card shows where each part of the stack sits and whose jurisdiction it answers to.
Model, hosting, and orchestration all trace back to Coretide or its parent. One legal or commercial event abroad would affect all three layers at once. Recorded mitigations: a portable model contract, and an onshore fallback for orchestration now under test.
Built from the same supply-chain mapping a software bill of materials starts from, and extended from components to jurisdictions. A querying agent receives the summary counts; the per-vendor map is released only to authenticated oversight bodies.
An unmapped dependency cannot be debated, priced, or replaced. The manifest lists every layer, so each one can be.
Maturity
- Emerging
For the SBOM as structural precedent, and concentration-risk oversight in financial regulation.
- Frontier Headline
For an AI sovereignty BOM, and agent-queryable supply-chain jurisdiction metadata.
Precedents
Executive Order 14028 and the SBOM (US). The order required software bills of materials for software sold to the federal government, disclosing all components and dependencies. The concept has since been extended to AI systems as AI bills of materials listing training data, architecture, and dependencies. A machine-readable manifest of every component is a shape that transfers.
The UK Critical Third Parties regime. HM Treasury can designate a cloud provider as critical to the UK financial sector, and the CTP Fundamental Rules bind it from designation. Requirement 6 makes the designated provider map the resources and interdependencies behind each systemic service, which puts nth-party concentration on the record. One sector's regulator has already obliged a provider to draw the supply chain beneath its own contracting layer.
EU Data Act Article 32. The Act requires cloud providers to take reasonable measures to prevent unlawful non-EU government access and to challenge access requests that conflict with EU law. The obligation extends through the supply chain, so a sovereign provider using US-based sub-processors must ensure those sub-processors resist unlawful access too.
What carries over to agent use
When a user's agent makes a tool call (invoking an API, querying a database, or processing data through a model), the agent may trigger cross-border data flows invisible to both the user and the government service. The agent selects and invokes those tools autonomously, with no visibility into the jurisdiction hosting them.
The design pattern is an "AI sovereignty BOM": a machine-readable manifest disclosing the jurisdictional exposure of every component in the AI processing chain. For high-sensitivity government interactions, this BOM is queryable by the user's agent before committing data.
Where things go wrong
Hidden foreign dependencies are an accountability gap of the same family as a hidden calculation assumption. A queryable manifest of the stack makes those buried exposures inspectable before harm occurs. A sovereignty BOM is only as complete as what the filer chooses to disclose: a provider can list its direct sub-processors and leave out an nth-party dependency further down the chain, filing a manifest that is accurate as far as it goes and silent about the layer where the foreign exposure sits. A manifest built from self-reported components, with no independent check on completeness, can pass as filed while missing exactly the dependency it exists to surface.
Sources
7 references
The instrument, the operating deployment, or the official record itself.
- Financial Services and Markets Act 2000, s 312L — designation of critical third parties
- FCA Handbook — CTPS 3.2, the CTP Fundamental Rules
- FCA Handbook — CTPS 4.7, Requirement 6: Mapping
- FCA Handbook — CTPS 4.8, Requirement 7: Incident management
- EUR-Lex — EU Data Act, Regulation (EU) 2023/2854 (Article 32)
- Executive Order 14028 — Improving the Nation's Cybersecurity (SBOM)
Writing about the subject rather than the framework itself, including vendor commentary.