← Papers

Europe has written the rules for AI but not the machines: without a publicly governed, open-source family of models under European jurisdiction, regulation will be limited to shaping behaviour rather than supply. Floridi urges a federated 'European Open Source AI' built via model distillation to secure legal standing, reduce foreign leverage, and support sovereign procurement.

Rules Without Models: Why Europe Must Build the AI It Regulates

Luciano Floridi · August 25, 2026 · Philosophy & Technology

openalex commentary n/a evidence 7/10 relevance Full text usable extracted full text DOI Source PDF

Structured author observations

Linked only from stored provider relations; the raw author line above is never matched by name.

OpenAlex

Latest observation: August 28, 2026

Luciano Floridi provider ID

Semantic Scholar

Latest observation: August 28, 2026

Luciano Floridi provider ID

Floridi argues that the EU has built strong AI regulation but lacks the public infrastructure and model-level sovereignty to enforce it, and therefore should create a certified, open-source European AI capability (EOSAI) using distillation from existing models.

Citation observations

Cumulative provider counts captured on specific dates; providers are never combined.

0 cumulative citations

OpenAlex · Observed August 28, 2026

View corpus context

0 cumulative citations

Semantic Scholar · Observed August 28, 2026

View corpus context

For a decade, the European Union has been building a digital constitution, encompassing the General Data Protection Regulation, the Digital Services Act, the Digital Markets Act, the Data Governance Act, the Data Act, the AI Act, and the proposed Cloud and AI Development Act. The result is a Europe that others must legally consider but can ignore technologically. Since the Italian Garante’s March 2023 order against OpenAI, evidence has accumulated: Llama 4’s withholding of multimodal rights from EU-domiciled developers, the worldwide disabling of Anthropic’s frontier models under an American export directive, Beijing’s meetings to restrict foreign access to its open-weight models, and, beneath them, the CLOUD Act’s standing exposure of data held by providers subject to American jurisdiction. This pattern is not exclusion but demotion, a digital civitas sine suffragio: conditional access to lesser models on someone else’s terms. The correction is not more regulation but EOSAI, European Open Source AI: a public institution for the models themselves, open source and deployable under Union jurisdiction. Three pathways can achieve it: an industrial consortium, a Member-State vehicle opening national defence resources, and a European Joint Undertaking for multi-decade stability. Distilling models that meet the Open Source AI Definition (OSAID) makes the first two realistic in the near term, and the third buildable on what they establish. EOSAI also reframes European regulation: what is read as a compliance burden becomes, for a capability compliant by design, a competitive advantage in regulated markets, where services on the open models can make it partly self-financing.

Summary

Main Finding

Europe has built strong AI regulation but not the public infrastructure the rules presuppose. Without a sovereign, publicly governed family of certified open-source models (proposed as “European Open Source AI”, EOSAI), the EU will remain legally powerful but technologically dependent — vulnerable to foreign licensing choices, export controls, and extraterritorial laws. The remedy is to build a federated public capability (via industrial consortia, Member-State vehicles, and a European Joint Undertaking) using distillation from genuinely open-weight models to deliver legally compliant, cost‑effective, and controllable models under Union jurisdiction.

Key Points

Empirical episodes illustrating dependence and vulnerability:
- Italian data-protection authority ordered limits on OpenAI (Mar 2023); availability and jurisdictional questions persisted; fine later annulled on jurisdictional grounds.
- Meta’s Llama 4 licence (2024–25) excluded EU‑domiciled developers, showing that “open” releases can be contractually restricted.
- US export-control directive on Anthropic (June 2026) briefly removed frontier models from global availability, showing foreign-government control over deployment.
- Reports of Chinese deliberations to restrict access to their best models showed that “open weights” can be revoked or conditioned.
- The US CLOUD Act (2018) remains a structural constraint: providers subject to US jurisdiction can be compelled to disclose data regardless of server location.
Two-layer sovereignty framework:
- Model layer: ownership of weights, data, IP, and governance decisions.
- Deployment layer: where and under whose jurisdiction models run, data residency, and legal recourse.
- Effective sovereignty requires both layers and non-domination (freedom from another’s discretionary control).
Regulation alone is insufficient:
- EU laws (GDPR, AI Act, Data Act, CADA proposal) provide legal standards but not the institutional capacity to ensure continuous, sovereign supply of models.
- Public procurement rules and assurance levels (CADA) create a demand-side advantage for compliant providers, but an institutional supplier is needed to convert that into durable sovereignty.
Proposal — EOSAI:
- Not a single entity but a federated public capability with three complementary pathways: an industrial consortium (fast start), Member-State-led vehicle (uses national defence/industrial resources), and a European Joint Undertaking (multi‑decade stability).
- Emphasizes genuinely open-source models certified by design (demonstrable compliance with EU law), ownership/asset-lock provisions, federation, and openness to avoid autarky.
Technical route — distillation:
- Distillation (training student models on outputs of teacher models or teacher‑generated corpora) offers a practical, far-less-costly path than training frontier models from scratch.
- Existing European open‑weight projects (e.g., EuroLLM-22B, SOOFI, others) provide a teacher pool; distillation can produce deployable, controllable, and cost‑efficient students suitable for European needs.
- Distillation raises licensing/legal questions (teacher outputs’ licensing matters), but it is technically mature and can close the performance gap for many deployment uses.

Data & Methods

Type of paper: normative editorial / policy argument grounded in legal and political‑economic analysis rather than new empirical estimation.
Evidence used:
- Case examples and timelines: Italian Garante decisions (OpenAI), Meta Llama licence revisions, Anthropic export-control episode (June 2026), reporting on Chinese model-access deliberations, CLOUD Act legal background.
- References to EU legislative instruments: GDPR, AI Act (Regulation (EU) 2024/1689 and amendments), proposed Cloud and AI Development Act (CADA), and other Tech Sovereignty Package elements (Chips Act 2.0, Open Source Strategy).
- Descriptions of European technical initiatives and consortia: EuroLLM-22B (Dec 2025), OpenEuroLLM consortium, German SOOFI consortium, plus other European projects.
Methods:
- Legal‑institutional analysis (sovereignty frames, jurisdictional competence).
- Policy design and institutional proposal (three pathways, procurement leverage).
- Technical argumentation summarizing distillation and its cost/feasibility advantages.
Limitations explicitly acknowledged by author:
- Frontier training from scratch is expensive; the plan relies on distillation and existing open-weight teacher models.
- The proposal is a strategic policy prescription rather than an empirical causal identification; timing and implementation depend on political choices and resource commitments.

Implications for AI Economics

Market structure and strategic supply:
- Regulatory strength without domestic supply can leave Europe a buyer‑market dependent on foreign suppliers; that creates recurring exposure to foreign policy shifts, licence restrictions, and export controls.
- A publicly governed EOSAI can act as a credible supplier of compliant inputs (models/services) and reduce strategic dependence, changing bargaining power in the market.
Demand-side leverage and procurement:
- Public procurement (CADA’s assurance levels) can convert regulatory standards into economic gates favoring compliant suppliers. A European public model would internalize that advantage and become a natural procurement partner, lowering friction and regulatory risk for EU buyers.
- This creates potential multiplier effects: procurement demand reduces market uncertainty, encourages complementary private services, and can bootstrap domestic AI ecosystems.
Public goods, crowding‑in vs crowding‑out:
- A federated public model is a public good (non-rival in use by many organizations) that can lower entry costs for EU firms, fostering innovation in downstream applications.
- Risks: poorly designed public offerings could crowd out private investment or distort incentives if not openly governed and interoperable. The proposal’s emphasis on open-source, federation, and asset locks aims to mitigate capture and crowding-out.
Cost and innovation trade-offs:
- Distillation dramatically reduces the compute and financial barrier relative to training frontier models from scratch, improving feasibility of sovereign supply with smaller budgets.
- The student‑teacher approach can produce models that are “good enough” for many commercial and public applications (cost, latency, controllability), enabling faster adoption and economic benefits without matching frontier scale.
Competition, entry, and vendor lock-in:
- Open‑weight, publicly certified models reduce vendor lock-in and switching costs for firms and public agencies, increasing competition in services and applications.
- If asset-locks and ownership rules are well designed, foreign acquisitions or licensing strategies that would exclude EU developers can be prevented or limited.
International trade and regulatory arbitrage:
- EOSAI could blunt “weaponized interdependence” by reducing reliance on foreign-controlled frontier models. That reduces the economic exposure of EU firms to extraterritorial legal processes (e.g., CLOUD Act) and foreign export controls.
- However, protectionist missteps or opaque governance could provoke trade tensions; openness and federation are key to avoiding autarky while securing sovereignty.
Financing and institutional economics:
- Multi-decade institutional forms (Joint Undertakings) and Member-State involvement can address the long-tail financing and investment uncertainty that private firms may avoid.
- Public investment can crowd-in complementary private finance if governance, IP, and access rules are predictable and align incentives for downstream commercialization.
Timing and practical feasibility:
- Distillation suggests an achievable near-term path (18–30 months for initial certified family under aggressive schedules mentioned), implying that public policy choices now can materially affect Europe’s market position and reduced dependence in the medium term.
- Delays in building supply risk locking in foreign dependence as regulatory frameworks mature and procurement preferences harden.

Overall, the editorial argues that from an AI‑economics perspective, strategic public investment in certified open-source models is a targeted industrial policy: it reduces dependence, leverages procurement to create demand for compliant suppliers, and can catalyse a competitive, innovation‑friendly European AI ecosystem if implemented with openness, federation, and proper governance.

Assessment

Paper Typecommentary Evidence Strengthn/a — This is an editorial/policy argument that cites episodes and policy documents but provides no original empirical analysis or causal identification; it does not produce evidence intended to establish causal claims. Methods Rigorn/a — No empirical methods, identification strategy, or formal theoretical derivation are presented; the piece is argumentative and normative rather than methodological. SampleAn editorial drawing on public episodes, regulatory texts, and policy developments (e.g., Italian Garante order on OpenAI, Meta Llama licence exclusions, US export controls on Anthropic, CLOUD Act, EU AI/Cloud proposals) and descriptions of European open-model consortia; not based on novel empirical data or statistical samples. Themesgovernance innovation GeneralizabilityPrimarily Europe-focused; recommendations tailored to EU legal and institutional context, Normative/policy prescriptions not empirically validated or tested in other political economies, Technical claims (feasibility of distillation route) are stated at a high level without empirical benchmarks, so practical transferability is uncertain, Assumes political will, funding, and cross-member-state coordination that may not generalize

Claims (11)

Claim	Direction	Outcome	Confidence & Evidence	Details
European regulation can secure compliance from foreign AI providers without securing the continued availability of their products in the EU. Governance And Regulation	negative	EU access and regulatory control over foreign AI services	Reading fidelity high Study strength medium	not reported 0.06
EU-domiciled developers were excluded from rights to the multimodal materials of Meta's Llama models under the relevant licence, limiting the practical availability of the purportedly open-source alternative in Europe. Automation Exposure	negative	Availability of model materials and developer rights in the EU	Reading fidelity high Study strength medium	not reported 0.06
A single US government directive temporarily removed frontier AI models from European users and exposed Europe's dependence on foreign government and corporate decisions for access. Automation Exposure	negative	Continuity and sovereignty of access to frontier AI models	Reading fidelity high Study strength medium	not reported 0.06
European developers relying on Chinese open-weight models are exposed to potential future restrictions on model supply and access. Automation Exposure	negative	Reliability and continuity of foreign AI model supply for European developers	Reading fidelity high Study strength low	not reported 0.03
Locating data in an EU data centre does not by itself establish data sovereignty when the cloud provider remains subject to US jurisdiction under the CLOUD Act. Governance And Regulation	negative	Data sovereignty and exposure to foreign legal compulsion	Reading fidelity high Study strength medium	not reported 0.06
In regulated public-procurement markets, a European public AI capability designed to comply with the GDPR and AI Act would have an advantage in cost, administrative friction, and regulatory risk relative to foreign alternatives. Organizational Efficiency	positive	Cost, procurement friction, and regulatory risk in public-sector AI procurement	Reading fidelity high Study strength low	not reported 0.03
CADA's strictest Union assurance level would require that an AI provider not be controlled from a third country and retain effective control over all software components. Governance And Regulation	positive	Institutional and jurisdictional control over cloud and AI services	Reading fidelity high Study strength medium	not reported 0.06
Knowledge distillation could provide Europe with a route to build certified and sovereign AI models at a small fraction of the compute required for frontier training from scratch. Organizational Efficiency	positive	Compute requirements and feasibility of developing European AI models	Reading fidelity high Study strength low	a small fraction of the compute 0.03
For many deployment purposes, a well-distilled student model may be preferable to its teacher because of lower cost, lower latency, and greater controllability. Organizational Efficiency	positive	Model deployment cost, latency, and controllability	Reading fidelity high Study strength low	not reported 0.03
A durable European AI capability requires a public-mission vehicle rather than relying solely on European commercial firms. Governance And Regulation	positive	Long-term European control and continuity of AI infrastructure	Reading fidelity high Study strength speculative	not reported 0.01
The proposed European Open Source AI capability is intended to secure both model-layer sovereignty through public control of weights and deployment-layer sovereignty through provision under EU jurisdiction. Governance And Regulation	positive	European sovereignty over AI model development, improvement, and deployment	Reading fidelity high Study strength speculative	not reported 0.01