arXiv: Sovereign by necessity? Frontier AI export controls, cyber security, and the limits of national AI capability

This paper, published on arXiv, analyzes the intersection of frontier AI export controls, cyber security, and national AI capability. It argues that current export control regimes, which restrict access to advanced AI chips and models, are creating a "sovereign by necessity" dynamic. This means nations are increasingly forced to develop their own domestic AI infrastructure and capabilities, rather than relying on global supply chains, due to security and resilience concerns. The paper does not introduce new law or regulation, but it provides a strategic analysis of how existing and proposed export controls are reshaping the global AI landscape.

The primary audience affected are multinational technology firms, AI developers, cloud service providers, and semiconductor manufacturers. Additionally, compliance teams in defense, critical infrastructure, and financial services that use frontier AI models will be impacted, as they must navigate a fragmented regulatory environment where access to cutting-edge AI tools may be restricted or require domestic alternatives. The paper highlights that cyber security risks are amplified when nations are forced to build or source AI capabilities locally, potentially creating new attack surfaces.

Compliance teams should treat this paper as a strategic early warning. They should conduct a supply chain and dependency audit to identify where their AI models and hardware originate, and assess exposure to current and proposed export controls. Next, they should monitor national AI strategies and cyber security frameworks in their operating jurisdictions, as these will likely diverge. Finally, they should begin scenario planning for a future where access to frontier AI is restricted, including developing contingency plans for using domestic or open-source alternatives, and ensuring that their cyber security posture accounts for the increased risk of operating in a more fragmented and potentially less secure AI ecosystem.