How to avoid being held up by the labs

Open banking, harnesses, and the strongest economic force of all

Luis Garicano and Jesús Saa-Requejo^*

On June 12, the US used export controls to cut foreign access to Anthropic’s newest models, ostensibly in response to reports of jailbreaks and cybersecurity risks. The episode represents the strongest objection posed to our ‘smart second-mover’ strategy: that the more Europe builds its economy around models it does not own, the more it makes itself hostage to whoever does own them.

To recall, the pillars of our policy, presented over three posts here, are the following:

• Race to adopt and implement frontier models rather than build those models, both because the value capture lies in the messy work of implementation, not the model layer, and because the race to lead is lost.

• Regulate to keep the model layer competitive, ensuring interoperability between closed-weight and open-weight models.

• Facilitate the formation of ecosystems of companies that lead the AI adoption.

• Build, as insurance, a shared open-weight model a tier or two behind the frontier.

The risk of a hold-up is omnipresent in business investment decisions. Once any firm has made investments specific to one supplier, the supplier can seize the returns on everything the firm invested by exploiting the bottleneck, for instance by threatening to withhold the promised supply.

Oliver Williamson won a Nobel Memorial Prize in economics in 2009 for analysing the consequences of hold-up and notably how it affects the buy-versus-make decision.¹ In previous generations of software and IT, many firms, notably in Europe, have suffered the consequences: Apple has taken a 30% cut on all app downloads from its platform; industrial and service companies built around Oracle or SAP’s custom code routinely spend years and millions of dollars trying to extract themselves, or are instead forced to buy expensive upgrades at the rhythm set by these players.

There are four forms of hold-up that need to be addressed in the large language model space. The first is access: the model can be withdrawn, as we have just experienced. The second is price: terms can change after users have sunk costs. The third is workflow: the prompts, agents, memories, traces, evaluations and permissions that make the system useful become non-portable. The fourth, and the one that concerns us more here, is knowledge expropriation: the supplier can learn from the customer’s activity and use this knowledge to commoditise it or to compete with the customer.

The fear of hold-up is not a European neurosis. AI models, warned Microsoft’s Satya Nadella in a recent post, continuously absorb the expertise of the organisations that use them and commoditise it, and for a firm to defend itself from such expropriation it needs a learning loop that it owns, making it interoperable so that it can swap the generalist model underneath without losing the expertise built on top.

Alex Karp on CNBC argued that enterprise customers are convinced the labs are ‘stealing the weights and alpha [i.e. the competitive advantage] of my business”; his remedy, with Nvidia, was to run on open-weight models the customer keeps locally. It goes without saying that both Karp and Nadella are doing a sales pitch in favour of their own business, since Microsoft sells the platform and Palantir has solutions that do just what Karp is arguing for, as we discuss below.

But this does not mean they do not have a point. In fact, both statements make the same correct point: no serious company should build its core workflows around a seller unless it can be sure that proprietary data and business logic cannot be reused to train future models or trap the customer. And yet the closed-model frontier labs’ business model implicitly assumes otherwise. When Anthropic launched its first design product, their own product chief had been sitting on the board of the incumbent customer it was about to undercut, Figma, resigning three days before launch. Figma’s shares halved on the year. Anthropic built Claude Code, its coding product, after watching Cursor, a top customer, succeed. It then expanded into other verticals such as legal, finance and security.

The European debate offers no real answer to this question. Some seek a subsidized European champion, which would indeed protect, but at a forbidding cost. The second view is that renting American software served Europe well for twenty years and we can continue doing it. But renting does not work as well when the platform can suddenly be disconnected, like we learned from the embargo and even less when the platform can duplicate the business models built on top. A third view is that Europe should look for leverage in other non-model domains, especially by building lots of compute.

Our suggestion is to chart something of a middle ground between those paths. To us, it is clear that relying on American promises is not possible after the “Turnberry surrender” in the face of Trump’s hold-up. But taking a huge bet on a different layer — models or compute — would be an enormous misallocation of time, money, and attention, in exchange for a resource that might end up not even providing true leverage.

Instead, Europe should rely on ensuring competition between model providers to keep itself free and on owning the model harness and the data. We believe that Europe can implement these ideas at a much lower cost than what it would cost to try to set up one frontier lab

Keep the investment portable

Switching LLM providers today is (roughly) a one-line configuration change: making the API call to a different model, since the fine-tuning data stays on the customer’s servers. Of course the frontier labs (Anthropic and OpenAI) understand that this keeps the market competitive, and would love to end this option by creating “memories” that know you, as well as agents that are engineered to your own workflow but are kept with the LLM. The essential question is whether it is possible to change models without losing the learning. The company must be able to take with it what it has taught the system: all the firm’s documents and records, the instructions and past corrections, the evaluations and performance checks, and all the links into everyday workflows of the company. Policy can help make this the default through mandated data-export standards, a ban on locking out rivals (a rule the EU already applies to Google for search and ads), and a requirement that public procurement requires portability across models.

For us the inspiration is in the regulation that Europe imposed on finance (PSD2) and which dismantled this kind of hold-up. Until 2018, a customer’s transaction history was effectively controlled by the bank, even if the customer had legal rights in the data. Since the bank held the data, the bank kept the customers, and the fintechs could not do anything other than rely on scraping bank screens. The revised payments directive separated the custody of the data from ownership. After it, any licensed third party, with the customer’s consent, could read the account and initiate payments through an interface the bank had to provide free of charge and without a contract. Notice that the law did not build a competitor or create a Euro-champion in fintech. It simply allowed for the data to become portable.

The rest was accomplished by the strongest economic force of all, free entry. By late 2025 there were 537 authorised third-party providers across the EEA and Britain. Seven million UK citizens and SMEs were using open banking by January 2023, and one small firm in six by 2023; Stockholm’s Tink, a solution to allow for a single API for all new bank connections, sold to Visa for €1.8 billion.

One problem with the directive was that it did not create a standard, so every bank built its own API and third parties still wrestle with country-by-country quirks. The banks obviously were less than happy, and dragged their feet until supervisors pushed them. The analogy with models is obvious: grant the right to portability and access, mandate a single API standard, enforce mobility, and fight incumbent efforts to block entry from the start.

Own the harness

A harness allows you to put a strong animal to work and control where it goes. The animal here is the large language model. There are three separable objects a firm handles when it deploys AI. The intelligence, which it rents and which is interchangeable. The data, its documents and records, which the firm owns. And a third thing between them, the knowledge of how the firm runs: which actions exist, who may take them, under what limits, and what happened the last hundred times they were taken. Economists call this organizational capital, and it is why one hospital or one ready-mixed concrete factory outperforms another with the same doctors or the same machines. When an employee leaves, the organizational capital stays. The same must be true with AI: the firm must treat the model like that employee, working inside rules the firm sets and leaving nothing behind when replaced.

Palantir has built a business selling one version of this. Its name for the firm’s map is the “ontology”: in its telling, the nouns are every object the customer cares about, a patient, a bed, a prescription, and the verbs are the actions allowed to change them, discharge, reorder, each carrying rules about who may use it and a log of every use. Nobody edits the records directly; the state of the firm changes only through these actions. The model layer on top, the Artificial Intelligence Platform Karp was promoting on CNBC, reads the nouns and proposes a verb; the harness decides whether that model may pull that lever, and writes the decision down.

Palantir sells this arrangement to the American, Ukrainian and Israeli militaries, the most hold-up-conscious buyers in existence, whose downside is not a lost quarter but a lost war. What runs underneath is Nvidia’s Nemotron family: open weights, built on Meta’s Llama and, per Nvidia’s own model card, “improved using Qwen”, with post-training data processed with Qwen and DeepSeek-R1. Buyers with everything to lose accept rented, interchangeable, partly Chinese-lineage models, because the layer above them is theirs. The best open-weight models now are months behind the frontier at a fraction of the price per token, one twenty-fifth by our count last month. If that is good enough for the American military, it is good enough for a European hospital or factory.

Every embargo strengthens the case for keeping the firm’s learning outside the labs. The objective is that the European firm of the near future controls its data, its harness and its own model, a private branch forked from an open frontier trunk and impossible to embargo.

While Europe cannot compete in the frontier models, it already competes in this implementation (harness) layer, which depends strongly on integration, trust, and local knowledge. Mistral has been moving from models to deployment: an enterprise platform with BNP Paribas, AXA and Stellantis as customers. Since September 2025, ASML has been its largest shareholder, with an 11 per cent stake intended to point Mistral’s models at ASML’s engineering problems. Note that for ASML, the fear of leakage is particularly strategic.

Aleph Alpha, a German AI company, gave up on trying to make frontier models in 2024 and now sells PhariaAI, an operating layer that runs open-weight models on premises, with no links to the open internet, for governments and regulated industry. Helsing does the same in defence.

Note that, whereas forcing European firms onto a worse European large language model is a terrible idea, because it gets EU firms to use worse intelligence, and hence be less competitive internationally, in the name of control, steering public procurement and EU firms toward a European harness does not have the same consequences, because the harness leaves the choice of model free: American, European or Chinese.

We do add a caveat here: keeping the second source at the pleasure of China or Meta or Nvidia is less than ideal. That is why we do believe that a coalition-funded open-weight model, held a tier or two behind the frontier and run not to win the race but to keep it competitive, is still necessary. IBM would not bet the PC on Intel’s processor until Intel licensed AMD to manufacture it too. No one at IBM thought AMD would beat Intel, and no one should think a European reserve model will beat the labs. The purpose of a second source is not to win, but to ensure the primary supplier knows you can leave. We should see the cost of the model as an insurance premium. For Europe, the premium can be modest, given that the model can be built on existing open-weight models, as Nvidia’s model was, while giving European firms a trunk of their own to fork from. It has an additional advantage: it works as a European AI university that keeps and trains the continent’s best people working on the problem at home. None of this means forcing European firms to “buy European”. The point is to exist, not to be bought. The trickiest objection to this is recursive self-improvement: the risk that the leader’s advantage compounds until anything behind it is hopeless. Our view is that precisely if capability compounds, being rationed out of the frontier is a catastrophic risk, and hence that is the state of the world where insurance is particularly valuable, even if the coverage of that insurance is only partial.

The Anthropic episode does not show that Europe must build the world’s leading model. It shows that adopting without an exit option is dangerous. Europe’s goal should be to adopt frontier AI quickly while keeping the assets that make adoption valuable, including all the company data, documents permissions, and the institutional learning outside the control of any single lab or government. The anti-hold-up strategy is therefore not autarky. It is portability, scale, a harness owned by the customer, with credible second sources.

[*] Jesús Saa-Requejo is chairman of Fondation L'Ontano and Board member at Vega Asset Management Holdings Ltd. This is the fourth post in our Smart Second Mover series, begun in July 2025. The earlier three are The Smart Second Mover (July 2025), The Smart Second Mover, Part II (March 2026) and Three Theses on AI Value Capture (May 2026).

Giovanni Domenico Tiepolo - The Procession of the Trojan Horse in Troy

1. Empirical researchers have studied the role of hold-up in a broad range of instances, like power plants built next to coal mines (Joskow), car parts (Monteverde and Teece) or aerospace components (Masten).