Artificial intelligence is not only a set of technologies; it is an international system of power, production, rules, and alliances. Compute hardware and energy are traded across borders, models are trained on global data, and deployments must comply with many jurisdictions at once. This chapter offers a practical map for business leaders. It outlines how governments are approaching AI through industrial policy and national strategies; explains the geopolitics and chokepoints of the supply chain; summarizes data sovereignty and localization trends; describes the emerging pattern of collaboration and competition across borders; and closes with concrete implications for multinationals designing products, infrastructure, and operating models that must work globally.
The goal is not to provide a catalogue of every new law or subsidy—those change quickly—but to extract durable structures and decision frames.
20.1 Industrial Policy and National Strategies (Analytical Overview)
Why AI is being treated as strategic industry
AI sits at the intersection of productivity growth, national security, and critical infrastructure. It relies on upstream industries (semiconductors, data centers, energy, optics, networking) with high fixed costs and long lead times. That combination almost guarantees industrial policy: public investment, standards, export controls, procurement preferences, and immigration rules that aim to pull private capital toward nationally defined objectives.
Across major economies, the toolkit looks similar even when rhetoric differs:
- Direct subsidies and tax credits for semiconductor manufacturing, advanced packaging, and AI data centers; multi‑billion‑dollar grant programs and investment tax credits for fab equipment; public R&D centers for chip design and packaging.
- Public procurement to create stable demand (e.g., sovereign or public‑sector AI platforms, shared “national compute” for research).
- Standards and certification programs for safety, privacy, model documentation, and assurance; national testing and evaluation facilities.
- Data governance to control access, transfers, and retention; adequacy or certification mechanisms for cross‑border data flows.
- Workforce and immigration policies to attract or train scarce skills (chip process engineers, distributed systems experts, safety evaluators).
- Security and trade instruments: export controls on advanced chips and tools; investment screening; sanctions and entity lists.
- Competition and market structure interventions: scrutiny of large platforms’ control of models, cloud, and app distribution; remedies to promote interoperability.
Stylized national approaches
While every country is unique, four archetypes recur:
- Frontier innovation hubs. Emphasis on research leadership, venture ecosystems, and flexible deployment, paired with export controls and competition policy. These hubs prioritize scale in compute, access to frontier models, and rapid commercialization.
- Regulatory and standards leaders. Emphasis on comprehensive horizontal legislation, conformity assessment, and documentation requirements, combined with support for trusted data spaces and sovereign cloud. This approach aims to set global norms that vendors must meet to access a large market.
- Sovereignty‑first ecosystems. Emphasis on domestic stack independence: local chips and tooling, local model training and hosting, tight control over data exports, and sensitivity to foreign dependencies. This reduces reliance on foreign technologies but raises cost and slows access to frontier capabilities.
- Specialist and enabler economies. Focus on high‑value niches in the supply chain (e.g., lithography, optical components, memory, substrates), energy‑intensive hosting, or specialized services (labeling, safety evaluation). Rather than full‑stack autonomy, the strategy is to dominate a chokepoint or critical service.
Most countries mix elements. Leaders should expect policy pluralism and design for interoperability across these regimes rather than assuming convergence.
Examples of policy instruments in practice
- Comprehensive AI law. The European Union’s AI Act entered into force on August 1, 2024, with a staged application schedule by risk category. It codifies obligations for risk management, data governance, transparency, human oversight, documentation, and post‑market monitoring, with specific rules for high‑risk systems and prohibitions on certain practices.
- Executive action. The United States used executive orders to direct agency action on safety, security, and civil‑rights guardrails for AI in late 2023, while subsequent executive actions in 2025 reset aspects of the federal posture—an illustration that U.S. governance can shift with administrations.
- Targeted AI rules. China’s Interim Measures for the Management of Generative AI Services took effect in August 2023, setting obligations for providers on data governance, safety, and content moderation for generative services.
- Semiconductor industrial policy. The United States’ CHIPS and Science Act (2022) funds domestic manufacturing, R&D, and workforce development; the European Union’s Chips Act (2023) aims to strengthen Europe’s semiconductor ecosystem.
These measures exist alongside sectoral rules (health, finance), long‑standing privacy and consumer protection law, and standards initiatives. They interact; for example, a model deployed in a bank must satisfy both horizontal AI requirements and sectoral risk‑management rules.
A practical takeaway for firms
Treat government policy as a design input. Classify each use case by risk and geography; map applicable obligations; and instrument your systems (retrieval, safety filters, logging, evaluation) to produce the evidence those regimes require. Build for portability so you can satisfy sovereignty constraints without duplicating your entire stack.
20.2 Supply Chains and Geopolitics
The hardware stack and its bottlenecks
Modern AI is compute‑intensive. That compute depends on a chain with notorious chokepoints:
- Lithography. Extreme ultraviolet (EUV) lithography machines remain a single‑supplier market; ASML’s EUV systems are used to pattern the most advanced logic layers. This concentration makes export policy and Dutch licensing geopolitically salient.
- Foundries and packaging. A small number of foundries fabricate leading‑edge logic; the largest dedicated foundry is TSMC, with substantial capacity and advanced packaging capabilities that are themselves a constraint at times.
- Memory and interconnect. High‑bandwidth memory (HBM) and advanced substrates (e.g., ABF) are capacity‑constrained periodically, affecting accelerator availability.
- Accelerators and systems. GPU vendors integrate silicon, HBM stacks, and NICs into server platforms; system assemblers and cloud providers compete for early allocation, reinforcing first‑mover advantages.
- Power and cooling. Data centers need megawatts of power and significant cooling water or heat‑rejection capacity. In many regions, grid interconnection queues and substation upgrades, not servers, are the gating factor.
Trade controls and strategic competition
Export controls have become a central instrument. The United States issued rules in 2022 and updated them in 2023 and 2024 to restrict the export to China of advanced AI chips and semiconductor manufacturing equipment, and allied countries have taken related steps on advanced lithography equipment. The policy surface continues to evolve.
These controls shape global product roadmaps (e.g., “compliant” chips for restricted markets), alter data center build‑outs, and influence where model training occurs. They also provoke countermoves: domestic chip investments, alternative supply relationships, and policy responses.
Energy as a constraint with international dimensions
Global data‑center electricity consumption is rising quickly. The International Energy Agency (IEA) estimates ~415 TWh in 2024 (~1.5% of global consumption), with a base‑case projection of around 945 TWh by 2030, driven significantly by AI. Regional concentration is high; the U.S., China, and Europe account for the majority of demand. For siting and operations, this means long‑term power procurement, grid coordination, and regional policy engagement are strategic, not ancillary.
Geopolitical risk management
Because the hardware stack is geographically concentrated—in equipment, lithography, foundry capacity, and packaging—natural disasters, geopolitical tensions, or policy shifts can propagate quickly. Practical mitigations include multi‑vendor designs, inventory policies for spare parts and substrates, diversified colocation and cloud regions, portable model artifacts (weights, prompts, indices), and contractual portability.
20.3 Data Sovereignty and Localization Trends
Concepts: residency, localization, and transfers
- Data residency requires that certain data be stored in a specified geography.
- Localization adds processing and transfer restrictions: some data must be processed in‑country and may not be exported except through recognized mechanisms.
- Cross‑border transfer regimes specify when and how personal data may leave a jurisdiction (e.g., standard contractual clauses, certifications, adequacy decisions).
These policies matter for AI because training, retrieval, logging, and telemetry create many copies and derivatives (embeddings, caches, traces) that must be in scope.
The baseline regimes that shape global design
- European Union. The EU’s General Data Protection Regulation (GDPR) restricts transfers of personal data to countries without “adequate” protection, with mechanisms such as Standard Contractual Clauses. In July 2023, the Commission adopted an adequacy decision for the EU–U.S. Data Privacy Framework, restoring a transfer pathway for participating U.S. entities.
- China. The Personal Information Protection Law (PIPL) requires consent and additional steps for cross‑border transfer; related rules and Q&A documents set out security assessments and certification mechanisms, with refinements through 2024–2025 to streamline some transfers while maintaining national‑security carve‑outs.
- India. The Digital Personal Data Protection Act, 2023 establishes a national framework for processing digital personal data, with rulemaking to specify transfer conditions and compliance obligations.
Other jurisdictions (Brazil’s LGPD, sectoral laws in many countries) add their own transfer rules, breach notification duties, and consent requirements. The trend is toward more prescriptive cross‑border controls for personal and “important” data, and explicit localization for public‑sector, defense, critical‑infrastructure, or financial data in some countries.
Architectural consequences for enterprises
- Regionalized stacks. Separate ingestion, storage, vector indices, and inference endpoints by region; keep embeddings and logs regional; transmit only allowed aggregates.
- Customer‑managed keys and enclaves. Enable customers to hold encryption keys and keep compute within specified regions; consider confidential computing for sensitive inference.
- Permission‑aware retrieval. Enforce access controls at indexing and query time; propagate ACLs into vector stores; key caches and prompts by tenant and region.
- Deletion and DSAR propagation. Ensure subject‑rights workflows propagate to indices, caches, training sets, and backups; provide evidence of completion.
- Vendor diligence. Contract for data‑location guarantees; map sub‑processors and their regions; require notice and approval for changes.
- Testing and support. Prevent cross‑border movement through support channels; scrub PII; provide regional support environments.
The design pattern is “globally centralized control, regionally executed processing”: one policy and governance layer controls multiple regional deployments.
20.4 Cross‑Border Collaboration and Competition
Despite geopolitical friction, AI governance features both competition and coordination. Collaboration occurs in standards bodies, ministerial processes, and multi‑stakeholder partnerships; competition plays out in export controls, industrial subsidies, and national branding of safety regimes.
International principles and fora
- OECD AI Principles (2019). The first intergovernmental standard on trustworthy AI, emphasizing human rights, transparency, robustness, and accountability, now referenced by many national strategies.
- G7 Hiroshima AI Process (2023). Leaders endorsed guiding principles and a voluntary code of conduct for developers of advanced AI systems—soft law intended to steer practice while formal legislation matures.
- AI Safety Summits (2023–2024). The Bletchley Declaration affirmed shared concern about frontier AI risks and the need for scientific cooperation and evaluation capacity; subsequent summits extended the dialogue.
- GPAI (Global Partnership on AI). A multi‑stakeholder, multi‑government initiative now integrated more closely with the OECD to advance implementation and coordination.
- Standards. ISO/IEC JTC 1/SC 42 coordinates international AI standardization across foundational, trustworthiness, and application areas, shaping documentation and assurance practices that enterprises can adopt.
These mechanisms do not erase national differences, but they reduce friction by harmonizing concepts (e.g., model cards/system cards, evaluation terminology) and by establishing assurance expectations that vendors can meet once and reuse in many markets.
Competitive dynamics
- Compute and energy races. Countries compete to attract fabs, packaging plants, HBM lines, and large data‑center campuses with access to low‑carbon power and water. Power procurement and grid interconnection become site‑selection differentiators.
- Safety regime branding. Jurisdictions compete to be perceived as the safest or most innovation‑friendly places to build and test frontier systems, courting labs while asserting assurance standards.
- Open‑source positioning. Some governments emphasize support for open‑weight models and permissive ecosystems; others emphasize controls on dissemination and safety gating, especially for high‑capability weights.
- Data‑space initiatives. Cross‑border consortia attempt to create trusted “data spaces” in sectors (health, mobility, manufacturing) where shared semantics and access controls enable collaboration without violating privacy or commercial confidentiality.
The practical implication is dual motion: firms should both participate in cooperative fora to shape interoperable expectations and plan for diverse, sometimes conflicting, national requirements.
20.5 Implications for Multinationals
1) Architect for portability and sovereignty
Assume that what is allowed and where it must run will vary by country—and may change. Design your AI platform with:
- Model‑agnostic routing. The ability to choose among multiple base models (open‑weight, commercial API, on‑prem) and sizes per region/use case. This supports cost and compliance optimization and resilience to policy shocks.
- Regionalized retrieval and logging. Keep knowledge bases, embeddings, caches, and traces in region with strong tenant and user separation; enforce permissioning at index and query time.
- Exportable artifacts. Prompts, tool schemas, evaluation suites, indices, and fine‑tuned adapters must export in open formats to move between clouds, regions, or vendors.
- Sovereign and air‑gapped options. For regulated or public‑sector customers, provide deployment patterns that meet localization, operator controls, and audit requirements.
- Energy strategy. Treat power as a first‑class dependency. For large deployments, align site selection with grid capacity and renewable procurement; plan for backup and curtailment; instrument load shaping.
2) Make compliance a product feature
Compliance should be baked into your offering, not added ad hoc:
- System cards and datasheets that describe intended use, limitations, training/adaptation sources in summary form, evaluation results (including slice analyses), and update histories.
- Policy‑aware run‑time controls: refusal behaviors, schema validators, citation/entailment checks, tool allow‑lists, and least privilege by default.
- Change management and auditability: versioned prompts, models, indices; reproducible experiments; golden tests; and logs sufficient to reconstruct decisions.
- Multi‑jurisdiction privacy controls: configurable retention and deletion, options to exclude data from training, and documented cross‑border transfer mechanisms where used.
- Sector overlays: documentation and controls aligned to the expectations of regulated buyers (e.g., model risk management in finance; medical device rules and quality systems in health).
3) Negotiate contracts that preserve optionality
Vendor agreements should reflect the international operating reality:
- Data‑use clauses that restrict vendors from training on your data (inputs, outputs, embeddings) without explicit permission; evidence‑backed deletion on termination, including of caches and backups.
- Residency and sub‑processors: named regions; list of sub‑processors and their locations; change‑notification and consent requirements.
- Portability and termination assistance: guaranteed export of prompts, indices, embeddings, logs, and fine‑tune artifacts in open formats; a cooperation period to transition.
- SLOs with remedies for latency and availability, priced by region; clarity on behavior under throttling and power curtailment events.
- Compliance evidence: reports or attestations that include AI‑specific controls (evaluation, safety, data rights), not just general IT security.
4) Plan for export controls and component risk
If your products depend on specific accelerators, HBM parts, or packaging lines, treat supply risk as a program:
- Maintain multi‑SKU inference strategies (quantized small models, larger models, and CPU fallbacks) to keep service levels under supply constraints.
- Keep a capacity ledger across clouds and colocation providers; pre‑negotiate “surge” options.
- Track regulatory exposure for your markets (e.g., whether certain SKUs or services are restricted in specific geographies); be able to degrade gracefully.
- For on‑prem customers, document minimum viable hardware by task and quality level, and highlight how retrieval and right‑sizing reduce dependence on frontier accelerators.
5) Operate a cross‑border governance program
Standing up a global AI governance function is now table stakes:
- Policy harmonization: one global policy mapped to local overlays; a register of use cases with risk tiering and regional status.
- Evaluation and safety ops: centralized test suites (including jailbreak and prompt‑injection batteries), with local complements for language and sector specifics.
- Incident response: 24/7 on‑call with kill switches, rollback playbooks, and regulator/customer notification templates by region.
- Regulatory horizon scanning: a cadence to review new obligations (AI laws, privacy rules, employment AI audits), with rapid translation into platform controls and documentation.
- Public engagement: participation in standards efforts (e.g., ISO/IEC SC 42) and policy fora (OECD/GPAI, sector alliances) to both shape expectations and anticipate future requirements.
6) Choose where to lead and where to follow
Global firms cannot lead everywhere. A practical portfolio:
- Lead in regions where you have distribution or compliance advantages; build reference customers and evidence packages there.
- Follow fast in regions that are strategically important but governance is in flux; keep technical optionality high; pilot with low‑risk use cases.
- License/partner where sovereignty expectations demand domestic control or where local integrators own the channel.
7) Communicate with clarity
Internally and externally, explain how you meet international expectations:
- Which tasks are automated vs. assisted; how refusals and escalations work; what evidence (citations, validators) accompanies outputs.
- Where data live by customer and region; how deletion and subject‑rights requests propagate; whether your systems train on customer data.
- How you handle safety and incidents; what models you use and how you route among them; what changes you made and why.
Clear, disciplined communication builds trust with auditors, regulators, customers, and employees.
