AI FAQ

Yes. I routed Claude Code through OpenRouter and selected Moonshot AI's Kimi K3 as the underlying model. The Claude Code interface and most of the workflow stayed the same.

Not in my experience. Opus still feels more dependable on difficult coding work. Kimi K3 was closer than I expected, though, and much cheaper for the token mix in this test.

The exported activity log contained 115 requests, 13.64 million prompt tokens and 82,307 output tokens. It cost $7.18, helped by 12.95 million prompt-cache hits.

Applying Anthropic's published standard input, output and cache-hit prices to the same recorded token mix gives an estimated $11.96 for Claude Opus 4.8 and $23.92 for Claude Fable 5.

In principle, once the weights are released. In practice it is a 2.8-trillion-parameter mixture-of-experts model and Moonshot recommends 64 or more accelerators, so this is data-centre infrastructure, not a server under somebody's desk.

Effectively yes. On June 12, 2026, a US export-control directive forced Anthropic to suspend its Fable 5 and Mythos 5 models for all foreign nationals, which in practice meant a global shutoff. As of June 21 access hadn't been restored, the first clear use of an AI 'kill switch.'

A US government export-control order required it, citing national security after a claimed jailbreak. Anthropic disputed the basis, calling the flagged flaw a 'narrow, non-universal jailbreak' available from other models, but complied because it couldn't screen users by nationality in real time.

A January 2025 US rule that sorted the world into three tiers for AI-compute access and split the EU into two of them. It was rescinded in May 2025 because, in the government's words, it 'downgraded' allies to second-tier status, confirming that allied access was a discretionary privilege.

On living standards, mostly no. Paul Krugman shows the productivity 'decline' is largely a price-index artifact and the median gap is roughly stable. The real decline is strategic: Europe consumes frontier technology it neither builds nor controls, and can now be cut off from it.

A June 2026 set of EU proposals, including Chips Act 2.0 and the Cloud and AI Development Act, meant to cut Europe's dependence on US and Asian chips, cloud, and AI. Its launch line, 'we want to be sure nobody has a kill switch,' concedes the dependence it is trying to fix.

ASML is the only maker of EUV lithography, the machines required to build leading-edge chips, making it Europe's strongest chokepoint. But Europe still depends on the US for GPUs, design software, cloud, and frontier models, so one node doesn't add up to autonomy.

A concept from Henry Farrell and Abraham Newman: when an economy runs through a few hubs, whoever controls a hub can cut off everyone downstream, the 'chokepoint effect.' The US-controlled AI stack of chips, cloud, and models is a textbook case.

Partly. Open weights leak and trail the closed frontier by only months, so the models themselves are hard to embargo. But the binding dependence is the cloud, APIs, and chips underneath, which can't be downloaded, so the chokepoint still holds.

On 18 November 2025 the European Supervisory Authorities (EBA, EIOPA, ESMA) published the first official list of Critical ICT Third-Party Providers under the Digital Operational Resilience Act (Regulation (EU) 2022/2554, applicable from 17 January 2025). The list contains 19 designations, including AWS, Microsoft, Google Cloud, IBM, Bloomberg, LSEG, TCS, and Orange. Each designated provider sits under direct EU-level oversight by Lead Overseers under Articles 31–44 of DORA, with fines up to 1% of average daily global turnover applied per day for up to six months. Article 28 mandates contractual exit strategies, Article 30 specifies critical-function contract terms.

The CLOUD Act (18 U.S.C. § 2713, enacted March 2018) compels US-headquartered providers to disclose data "regardless of whether such communication, record, or other information is located within or outside of the United States." Microsoft's H2 2024 transparency report shows 5,587 US law-enforcement demands for consumer data, 115 of them warrants for content stored outside the US. In late 2024 Microsoft France told the French Senate it cannot guarantee EU-hosted data won't be transferred to US authorities under a CLOUD Act order. For an EU bank, this creates a structural conflict with the EU Data Act Article 32 requirement to resist third-country governmental access to non-personal data, and with DORA-mandated audit rights enforceable in the host jurisdiction.

Legally unresolved as of mid-2026. AWS European Sovereign Cloud is operated by EU-incorporated entities with EU-resident staff and dedicated infrastructure (first region eusc-de-east-1, Brandenburg, launching January 2026, €7.8B investment through 2040). A legal opinion commissioned by AWS argues the structure escapes CLOUD Act reach. A Dutch Ministry of Justice memo (February 2025) noted that the parent ownership is ultimately Amazon.com, Inc., and the CLOUD Act applies to providers with "possession, custody, or control" — corporate parent control plausibly satisfies that test. The question will only be settled by the first contested CLOUD Act warrant against an EU-resident hyperscaler subsidiary, which has not yet occurred.

Announced by Brad Smith at the Atlantic Council Brussels on 30 April 2025 and embedded as a contractual "European Digital Resilience Commitment" with EU national governments and the Commission, Microsoft pledges to challenge in court any government order to suspend operations in Europe and to escrow source code in Switzerland if it loses. Counter-evidence: Microsoft France's French Senate admission that it cannot guarantee non-transfer under a lawful CLOUD Act order, and the Microsoft / Karim Khan episode in which the ICC lost access to its chief prosecutor's Outlook account after EO 14203 sanctioned him. Microsoft denies actively cutting Khan off; the ICC migrated to openDesk anyway. The court-fight clause is a contractual commitment, not a statutory exemption.

Article 32(1) of Regulation (EU) 2023/2854 (applicable 12 September 2025) requires data-processing providers to take "all adequate technical, organisational and legal measures... to prevent international and third-country governmental access and transfer of non-personal data held in the Union where such transfer or access would create a conflict with Union law." Article 32(2) recognises a third-country court order only where it is based on an international agreement in force with the EU or relevant Member State. No EU–US CLOUD Act executive agreement exists, so a US warrant served on Frankfurt-hosted non-personal data is a statutory conflict the provider must resist. Most bank transactional metadata is non-personal under EU law and therefore falls inside Article 32's scope.

DACH bank supervision triangulates four layers. DORA (Regulation 2022/2554) applies EU-wide and creates direct supervision of the 19 Critical ICT Third-Party Providers. The ECB Guide on Outsourcing Cloud Services (16 July 2025) operationalises SSM expectations: concentration risk metrics, exit testing as a continuous obligation, audit rights as enforceable rather than contractual boilerplate. BaFin BAIT and MaRisk AT 9 (9th amendment, June 2024) align German national supervision with DORA; BaFin's March 2024 cloud guidance update adds specific German enforcement detail. FINMA Circular 2018/3 has been in force in Switzerland since 2018, is technology-neutral, and conditions outsourcing abroad on enforceable inspection rights in the host jurisdiction. The four converge on three operational requirements: a tested exit plan with a last-test date, jurisdictionally enforceable audit access, and a measurable concentration metric for ICT third-party providers.

DORA Article 28(8) requires exit plans to be comprehensive, documented, and sufficiently tested and reviewed periodically. In practice the supervisory standard is at least one tabletop exercise or partial migration every two years for any ICT third-party arrangement supporting a critical or important function. Tests must validate data portability, that alternative providers exist, and that the time-to-cutover is realistic. The ECB Cloud Outsourcing Guide of 16 July 2025 reinforces the point by treating exit testing as a continuous obligation; ticking the contractual box once is no longer enough.