Sovereignty in a world of layered dependencies

A tariff puts a visible price on crossing a border. A change in the conditions under which technology can be supplied can reach much further into how a business works and how an economy operates.

AI gives companies new ways to develop products and perform work using technology supplied elsewhere. Many of the commercial and political arrangements around it are still taking shape. The contests over who earns and who sets the terms have a longer history. Global technology companies helped economies become more productive and connected. Governments have spent years contesting where their profits should be taxed, how much intermediaries should charge and what companies may do with people’s data.¹²³

The current US administration has raised the stakes in these disputes. Its February 2025 memorandum threatened tariffs and other responses to foreign taxes and regulations it considered discriminatory towards American technology companies. It explicitly challenged restrictions on cross-border data flows, even as Washington maintains its own controls over where certain sensitive data may be processed and who may access it.⁴⁵ Its wider trade policy sought to bring production and jobs to the United States, with possible tariff reductions linked to trading partners addressing US trade concerns and aligning with its economic and security interests.⁶

Concern about what happens if political relationships deteriorate has intensified scrutiny of these dependencies.⁷ Countries are asking what they need to retain or develop across payments, cloud services and AI. The questions extend beyond where data is held: where does the income go, who can change the terms, and will the service remain available during a dispute?

Looking back to look forward

Countries have spent decades trying to influence the cost and organisation of payments. Their experience shows both what a domestic alternative can achieve and what it takes to keep that choice useful.

Denmark built a widely used national card that made everyday payments more economical. Decades later, customers’ move to phone wallets challenged its position. The case Dankort: what Denmark is choosing to keep examines why banks, merchants and customers supported the system, and why sustaining it now requires a new bargain, including higher merchant charges to fund development.

A domestic alternative can also create opportunities for international suppliers. In 2020, Brazil’s central bank launched Pix for payments between accounts. Larger financial institutions had to participate so that customers could reach one another. Merchants gained another way to accept payment; early research found lower charges than for debit cards.⁸ Visa then saw a business opportunity: in June 2025 it announced Conecta, a subsidiary intended to let customers pay through Pix without leaving the merchant’s checkout.⁹

Washington disputed the terms on which Pix competed with American providers, including required participation and the central bank’s role as both regulator and operator. Electronic payments were among several grounds it cited for a tariff on certain Brazilian goods in July 2026.¹⁰ Brazil had changed its payment arrangements, but those choices remained exposed to political pressure from outside.

The broader case, Payments: the bargain keeps changing, examines why cheaper domestic routes can struggle to attract banks, how international suppliers find new roles around them, and why the next layer of technology can move value elsewhere.

That last question is already taking shape in payments. AI agents can influence what customers buy, while wallets can shape how they pay. A country could retain its own payment route while businesses elsewhere control those relationships.¹¹ Domestic infrastructure remains valuable, but it does not settle who controls the services built around it.

The data stays. What else has to stay with it?

In January 2026, France announced that its state-developed Visio service would be extended across state services by 2027, replacing non-European videoconferencing tools such as Teams and Zoom. Its stated reasons included confidentiality, cost and strategic dependence. The proposal concerned the service through which officials communicate, not simply where a recording would be stored.¹²

France’s digital and postal commission had also asked whether digital infrastructure would keep functioning under unilateral US measures as political tensions intensified.⁷ In April, the government’s wider programme called for reducing reliance on American tools and recovering control over rules, prices and technological development. Ministries were to identify their needs so suppliers could see the demand ahead. Public purchasing would help develop the alternatives the state wanted to use.¹²

A domestic data centre alone cannot provide all that control. Administrators, software updates, specialist support and authority over the supplier may still sit elsewhere. A requirement to store a recording locally does not settle who can administer the service, maintain it or authorise its continued supply.

Personal-data protection and sovereignty overlap, but they are not interchangeable. GDPR protects individuals and sets conditions for processing their data, including transfers abroad. A service can meet those requirements while its operation and continued supply remain dependent on decisions taken elsewhere.¹³

Europe’s Data Act addresses both protection and the ability to put data to use. It provides safeguards against unlawful third-country government access to non-personal data, and rights to access specified data generated by connected products. Those rights can allow customers to use another provider for services such as maintenance. Separately, its cloud-switching provisions require providers to remove obstacles to customers moving between services.¹⁴ Those rights give customers more room to choose another provider. Moving still takes work: adapting systems, transferring data and preparing people to operate the replacement.

That is where the pursuit of technological sovereignty meets the operating model built during the cloud era. Cloud services gave organisations infrastructure and expertise they could struggle to reproduce. Teams learnt the platforms and applications grew around them. The UK’s cloud investigation found that switching could require retraining or recruitment and divert engineers from other work.¹⁵ A different supplier on a procurement list does not recreate the people and capability needed to use it.

Even a very large customer can want more control over that arrangement. In April 2025, JPMorganChase challenged suppliers over software delivered as a service, often the only format available. Its concern was security: integrations could give a compromised provider access to the bank’s own systems. The letter called for options including customer self-hosting and deployment in the customer’s own cloud, seeking stronger controls while preserving the benefits of the services.¹⁶

France is organising public demand to help alternatives develop. JPMorgan is pressing existing suppliers to change how they deliver their products. Their reasons differ, but both are using their position as customers to influence what the market offers.

AI changes what the bargain buys

Data has an economic life beyond the service for which it was supplied. Social platforms turned knowledge of their users into advertising revenue.³ Where data is used to train or improve an AI model, it can contribute to a capability sold to many customers. An economy’s digital activity can help create assets whose subsequent use and income are controlled elsewhere.¹⁷

The customers using those models are building something too. They can develop products, undertake specialised work or offer services that were previously out of reach. Buying capability from abroad can help create valuable capability at home.

What happens next depends on how that capability is used. A company may use AI to develop a product without needing the same model to keep selling it. If the model performs part of the service, continued access becomes part of delivering what the customer buys. Keeping information private and excluding it from training does not resolve that dependence. Existing integrations matter too: customers told the UK’s cloud investigation that these made particular models easier to use and, in some cases, constrained their choice of cloud provider.¹⁸

Access can continue while the economics change. In June 2026, GitHub began replacing Copilot’s request allowances with credits charged according to the model used and the tokens consumed. Monthly subscription prices stayed the same. GitHub said longer agent sessions had outgrown the old charging model.¹⁹ Customers were still buying access to Copilot, but the basis for calculating how much work their subscription would cover had changed.

A familiar subscription price need not buy a familiar amount of useful work.

For businesses building AI into their operations, those terms affect the economics of what they can produce and sell. For countries considering investment in alternatives, they raise a question about what the investment would change. Hosting the same service domestically need not change its pricing. Developing a domestic model may build expertise and influence over its development, but brings costs of its own. Keeping a service available during a political dispute requires another set of arrangements. Location, commercial influence, productive capability and continuity are different gains; a sovereignty investment needs to be clear about which it is pursuing.

The supplier's country has a stake too

The United States has a substantial interest in other countries continuing to buy American technology. Its July 2025 AI export programme envisaged packages spanning hardware, cloud, data systems, models and applications, supported by finance and diplomacy. It sought wider adoption of American standards and governance as well as technology. Industry consortia would propose the packages; export controls would still determine where they could go.²⁰ The ambition was to help American companies build markets while retaining authority over supply.

How to pursue that ambition is contested within the industry. NVIDIA reported Jensen Huang meeting the US president and policymakers, then officials in Beijing, alongside its efforts to resume H20 chip sales to China. Its argument favoured keeping international AI development on American technology. Anthropic has advocated tighter restrictions on China’s access to advanced compute and models, alongside wider deployment of American AI elsewhere.²¹ Both argue for American leadership. They differ over how access to American technology helps secure it.

China is pursuing productive capability as well as control. In commentary on its AI+ programme published by the National Development and Reform Commission, China’s economic planning agency, Xu Bo credited DeepSeek’s open release with strengthening the domestic technology ecosystem. He coupled that progress with challenges facing AI worldwide, including incorporating specialist knowledge and producing reliable results. His prescription was to develop a technology base China could control and improve it through demanding applications.²² Domestic capability was a foundation for further development, not simply a substitute for foreign supply.

Chinese companies also seek international markets. Alibaba’s Joe Tsai has championed open models and the opportunity for businesses to build applications. In June 2026 he described investment across chips, cloud, models and applications against uncertainty over where value would accrue. Alibaba also announced a cloud region in France.²³ A supplier building capability at home can become another country’s option abroad. That gives the customer another choice; it brings another set of interests and authorities into the relationship.

For established suppliers, keeping their place can require changes to the service itself. Announcing Microsoft’s European commitments in April 2025, Brad Smith explicitly discussed the US–EU tariff dispute and acknowledged that European governments would consider alternatives. Microsoft promised to contest orders suspending its European cloud operations. It also proposed continuity arrangements giving European partners access to backup code and legal rights to use it if a court required a suspension. A year later, Microsoft reported making the litigation commitment legally binding in specified government contracts and launching a resiliency partnership with Delos, its German partner.²⁴

The two commitments address different problems: challenging an order, and preparing for service to continue if Microsoft is constrained. Neither establishes that every interruption could be overcome. They do show how concern about dependence can change what a foreign supplier offers. Microsoft has a commercial interest in remaining useful to Europe, even when relations between governments deteriorate. Greater customer influence can come through changing that bargain as well as building an alternative.

Building a position others have to consider

Mark Carney put a choice to Australia’s Parliament in March 2026: countries such as Canada and Australia could help shape the emerging order, or leave larger powers to determine their place in it. “Middle powers must convene to matter,” he said.²⁵

For AI, the prospect was being “caught between hyper-scalers and hegemons”. His answer was to build capability with other countries: secure clouds, data, models and applications.²⁵ Australia and Canada agreed to develop a workplan with India covering AI infrastructure, business partnerships, skills and exchanges on regulation. Canada’s announced agenda included trade missions and partnerships involving smaller businesses.²⁶ The ambition requires firms able to turn cooperation into capabilities others would use.

At the UN in September, Singapore’s Foreign Minister Vivian Balakrishnan argued that shared rules protect countries’ autonomy when power is unequal. Willing countries should begin cooperating without waiting for everyone, while leaving others a route to join.²⁷ Cooperation could give countries more room to act, rather than requiring them to surrender it.

Nor does that require every component to be supplied at home. The European Payments Initiative (EPI), which operates Wero, acknowledges that the payment service uses international cloud providers because they offered capabilities needed to compete at launch.²⁸ The outside supplier helped establish a European payment alternative. European governance and foreign technology are part of the same choice.

With AI, the contest also reaches into the expertise and work on which companies build their services.

Who controls the technology also affects which markets a company can serve. An exporter may need local partners, a different operating arrangement or stronger commitments on data and continuity to remain acceptable in a market. Its home government may support its expansion while restricting where its technology can go. The conditions of participation become part of the investment.

Sovereignty depends on choices that someone has built, paid for and kept open. A domestic address does not establish that position. Nor does changing suppliers necessarily improve it. The investment has to change something that matters: the ability to develop capability, earn from it, influence its terms or keep it available.

For boards, this reaches beyond procurement. Investment, partnerships and engagement with regulators can help shape the conditions under which the company will operate. Those decisions deserve a view of what the business needs to retain, what it can gain through others and what it is prepared to contribute.

The strategic question is what influence the company needs over the technology and markets it depends on, and which commitments would give it that influence.

Connected works

Some assembly required explains why the location of computing, responsibility for operating an AI model and control over the resulting service are different choices.

Payments: the bargain keeps changing develops the broader contest over payment costs, domestic capability and the next sources of value. Dankort: what Denmark is choosing to keep takes that account into one country, examining the investment and changing bargain behind Denmark's domestic payment system.

The terms of access can change follows how political decisions reach into technology and operating capability already in use. The risk is shared. The race is not. examines the difficulty of governing AI's dangers when countries and companies are competing for its benefits.

What the company knows develops the organisational questions of knowledge, judgement and continuing development. Open models. Competing ambitions. follows what companies develop from available AI models and how suppliers, customers and partners compete over the resulting value. The alphabet soup of agentic commerce examines the changing relationships through which purchases are made. The position is taken considers how investment changes the opportunities an organisation can reach.

Board Considerations: Deciding before the terms are settled

Themes and questions for board and senior executive discussion, drawing on this Signal and related QURKI work.

Notes

Footnotes

1. Council of the European Union, Digital taxation, including the 2018 proposals; OECD, 2018 Interim Report, Chapter 5. Digital participation in a market challenged taxing rights historically tied to physical presence and the allocation of profits among jurisdictions. A local office does not make all profits associated with local customers taxable there. Revenue, taxable profit and tax legally due are different measures; the dispute over a fair contribution does not itself establish tax evasion. ↩

2. Regulation (EU) 2015/751 capped covered consumer interchange fees and addressed restrictions on payment choice and competition. The European Commission’s 2020 evaluation, printed pp. 3–7, examines its effects on merchants and domestic schemes. Interchange generally goes to issuing banks; the cap did not cover all merchant charges or the networks’ own fees. ↩

3. Federal Trade Commission, A look behind the screens, September 2024, and its summary of the findings. The staff study concerns nine major social-media and video-streaming companies, principally examining practices in 2019–2020. It documents advertising incentives for extensive data collection and use, including in automated systems. It does not establish that every digital service uses this business model or sells raw personal records. ↩ ↩²

4. White House, Defending American Companies and Innovators From Overseas Extortion and Unfair Fines and Penalties, 21 February 2025, Section 1 explicitly identifies foreign legal regimes that limit cross-border data flows; section 2 sets out tariffs and other responses to tax or regulatory burdens it considers discriminatory, disproportionate or designed to transfer funds or intellectual property from American companies. Its characterisation of those measures as discriminatory is attributed. The memorandum establishes a policy and mechanisms for action; it does not establish that every threatened action occurred. Canada’s June 2025 withdrawal of its digital-services tax provides an instance of digital policy becoming part of wider economic and security negotiations. ↩

5. US controls extend beyond defence. The IRS’s cloud-computing guidance requires federal tax information to remain within US legal jurisdiction and prohibits offshore administrator access to agency systems containing it; Publication 1075, section 2.C.7, addresses offshore operations. GovRAMP’s FAQ records state and local governments’ own US data-residency and system-maintenance requirements, while distinguishing these from GovRAMP itself, which imposes no geographic hosting requirement at Low or Moderate. The Justice Department’s Data Security Program prohibits or restricts specified transactions giving countries of concern or covered persons access to bulk US sensitive personal data or government-related data, subject to thresholds and exemptions. It reaches commercial arrangements as well as government-related information; it is not a general data-localisation mandate. These restrictions illustrate competing claims to control; their scope and justification differ from the foreign measures Washington challenges. ↩

6. White House, 2 April 2025 tariff-policy fact sheet. It presents reshoring, jobs and economic security as policy objectives. Its modification provision allows tariff reductions where trading partners take significant steps to remedy what Washington considers non-reciprocal trade arrangements and align with the United States on economic and national-security matters. These are the administration’s stated aims, not an assessment of realised benefits or current tariff rates. ↩

7. Commission supérieure du numérique et des postes, Opinion 2026-01, 19 January 2026, printed p. 18. The commission expressly links heightened concern about existing dependence to tensions since the change of US administration in 2025. This establishes a stated French institutional assessment, not a claim that this opinion originated Visio or that France's sovereignty policy began in 2025. DINUM's April programme independently identifies reduction of reliance on American tools as an objective. ↩ ↩²

8. Duarte et al., Central banks, the monetary system and public payment infrastructures: lessons from Brazil’s Pix, BIS Bulletin 52, March 2022. Reports the November 2020 launch, required participation for institutions with more than 500,000 transaction accounts and early lower merchant costs. See also Fast payments: design and adoption, BIS Quarterly Review, March 2024, footnote 7, citing the 2022 research: 0.22% for Pix, 1.1% for debit and 2.2% for credit. These are merchant charges, not network revenues. The observation concerns early adoption, not a current 2026 fee quote. Account transfers and credit-card services have different features; no like-for-like cost estimate or claim of total foreign-technology independence is made. ↩

9. Visa, Visa Inc. lança Instituição de Pagamento focada em movimentação financeira, 5 June 2025. Visa announced a Brazilian subsidiary focused initially on Open Finance and Pix payment initiation, with operations expected to begin at year-end. This establishes its announced commercial strategy, not verified launch, adoption or revenue. Foreign participation does not itself establish who captures most of the value. ↩

10. USTR, Section 301 determination on Brazil, 1 June 2026, and its Federal Register notice, which names Pix. The 15 July final-action announcement imposes a 25% tariff on certain Brazilian goods. The investigation covered digital trade and electronic payments, preferential tariffs, anti-corruption interference, intellectual property, ethanol access and deforestation. The action cannot be attributed to Pix alone. USTR’s characterisation of Brazilian practices is its position in the dispute. ↩

11. QURKI, The alphabet soup of agentic commerce, and its Reference Map, Who is assembling the agentic-commerce market?, evidence checked 3 September 2026. The existing work examines how agents, platforms, wallets, networks and national payment infrastructure affect authority, access, obligation and value; the map records Visa and Mastercard's initiatives with maturity distinctions. The scenario in the body is QURKI's analysis of possible layered dependence, not an observed national loss estimate. The linked pieces provide the detailed explanation. ↩

12. DINUM, L’État généralise Visio, 26 January 2026, and Réduction des dépendances extra-européennes, 8 April 2026. The January announcement sets a 2027 rollout target for state videoconferencing. The April programme requires ministries and their operators to formalise plans identifying their needs, giving the digital industry visibility of potential demand. It explicitly links that visibility and public procurement to industrial development. David Amiel explicitly names dependence on rules, prices, development and risks the state does not control. These are state plans and objectives; Visio does not replace every function of commercial collaboration suites. ↩ ↩²

13. European Data Protection Board, International data transfers, especially the explanations of adequacy decisions, appropriate safeguards and supplementary measures. GDPR does not generally require personal data to remain in the EEA. Transfers must satisfy its conditions as well as the rules governing the processing itself. Assessing protection can include foreign laws and practices concerning government access; jurisdiction is therefore already part of the data-protection question. These protections do not themselves establish domestic ownership or the operating capability to maintain a service if supply is interrupted. ↩

14. European Commission, Data Act explained, especially Chapters II, VI and VII. Applicable since 12 September 2025, with provision-specific transition arrangements. Chapter II covers specified connected-product and related-service data; it is not a general right to all supplier data or intellectual property. Inferred or derived data falls outside that particular access scope. Chapter VI addresses switching between data-processing services, including contractual terms, data export, interfaces and interoperability; it is distinct from Chapter II’s connected-product access rights. The complete removal of switching charges is scheduled for 12 January 2027, with cost-based charges permitted during the transition. Chapter VII concerns unlawful third-country government access to non-personal data held in the EU by data-processing providers, rather than a prohibition on international flows or lawful cooperation. ↩

15. Competition and Markets Authority, Cloud services market investigation: final decision, July 2025, final decision report paragraphs 6.231–6.245. Customer experiences differ; the skills findings do not establish that every migration is prohibitive. ↩

16. Patrick Opet, JPMorganChase, An open letter to third-party suppliers, 26 April 2025. A challenge concerning SaaS concentration, integration and customer security boundaries; not proof that suppliers adopted the requested changes. ↩

17. Anthropic, Updates to consumer terms and privacy policy, 28 August 2025. A concrete example of consumer chat and coding data being used for future model improvement with the stated user choice; the announcement expressly excludes services under its commercial terms. This is evidence of the mechanism, not a claim about every provider or a guide to current account settings. Separately, the European Data Protection Board’s December 2024 opinion makes anonymity of an AI model a case-specific assessment. Transforming data into a model does not automatically dispose of personal-data obligations. The distinction between permission to train and dependence on a service, and the possible distribution of value from model development, are this Signal’s analysis. No national income share or claim that all customer data is used in training is established here. ↩

18. Competition and Markets Authority, Cloud services market investigation: final decision report, July 2025, paragraphs 4.83–4.89, printed pp. 198–200. Includes customer accounts of integration benefits and constraints, providers’ differing views on multi-cloud use, and development of arrangements allowing models to be changed. The evidence concerns conditions during the investigation; historical exclusivity arrangements and model rankings are not presented as current. Integration can affect choice without making dependence inevitable. ↩

19. GitHub, GitHub Copilot is moving to usage-based billing, 27 April 2026; Copilot CLI auto model selection routes based on task, 1 July 2026; and Usage-based billing for organizations and enterprises. The transition began on 1 June; existing annual individual subscriptions retained request-based billing until expiry. Automatic selection respects administrator policies, and users can select a specific model. Paid subscribers using Auto receive a 10% discount on the selected model’s cost; GitHub also reports efficiency benefits from routing and caching. Token consumption and model rates affect cost per task; spending controls can cap expenditure without guaranteeing how much work the cap will buy. The example establishes supplier pricing discretion, not geopolitical direction of prices or a cost advantage for domestic alternatives. ↩

20. White House, Promoting the export of the American AI technology stack, 23 July 2025. Sections 1–4 seek wider adoption of American technology, standards and governance; provide for industry-led export proposals; and direct mobilisation of financing, technical and diplomatic support. Proposals must address export-control compliance. It establishes policy, not achieved market share. Foreign-affiliate sales and cross-border US exports are different measures; global revenue of US companies is not a direct measure of US exports. The White House's 21 February 2025 memorandum also connects foreign digital taxation and regulation with possible US trade responses. Its accusations about discriminatory treatment are the administration's position. ↩

21. NVIDIA, NVIDIA CEO promotes AI in Washington, DC and China, 14 July 2025; Anthropic, 2028: Two scenarios for global AI leadership, May 2026. Both advocate American technological leadership. NVIDIA argues for international adoption of American technology; Anthropic combines tighter controls on China with wider deployment of American AI and greater domestic adoption. These establish distinct corporate positions, rather than a simple division between commercial and security interests. NVIDIA's account of meetings and government assurances does not prove that its intervention caused a policy change; Anthropic's scenarios and capability assessments are advocacy, not independently established outcomes. ↩

22. Xu Bo, director of the Chinese Academy of Sciences Institute of Automation, 以技术持续创新支撑“人工智能+”行动加速落地, 26 August 2025. Expert commentary published in the NDRC's policy-interpretation section. Xu credits progress in China's domestic technology ecosystem while describing challenges in demanding AI applications worldwide; he advocates innovation driven by application needs and feedback. The article does not discuss US export permission. The State Council's AI+ opinion sets the broader programme, including domestic capability, open communities and international cooperation. ↩

23. Alibaba's accounts of Joe Tsai at CNBC Converge Live, 12 March 2025, and VivaTech, 19 June 2026. Corporate arguments about openness, investment and where value will accrue. In March, Tsai explicitly challenged framing AI primarily as a contest between countries, emphasising open versus closed models; the June account announces a French cloud region. The interpretation of simultaneous domestic capability and international ambition is this Signal's synthesis. ↩

24. Microsoft, European digital commitments, 30 April 2025, and One year on: progress on our European digital commitments, 29 April 2026. The first connects European continuity commitments with the tariff dispute and acknowledges customers’ alternatives. It promises backup code in a Swiss repository and rights for European partners to access and use it for continuity if a court requires Microsoft to suspend services. The second reports a legally binding litigation commitment to European national governments and the European Commission, and a launched Delos resiliency partnership. It does not establish that the earlier code-repository arrangements are complete. These are Microsoft’s accounts of commitments and progress; neither successful litigation nor uninterrupted service is guaranteed. ↩

25. Prime Minister of Canada, Address to both Houses of Australia's Parliament, 5 March 2026. The address connects payment systems, capital and other capabilities with sovereignty, and proposes collective AI capability including secure clouds, data, models and applications. It is a strategy for gaining influence, not evidence that the proposed capacity is already delivered. ↩ ↩²

26. Governments of Australia and Canada, Australia–Canada Joint Statement, 5 March 2026, especially paragraph 12; Prime Minister of Canada, Prime Minister Carney elevates partnership with Australia, 5 March 2026. The statement records agreement to develop a joint workplan under the Australia–Canada–India Technology and Innovation Partnership, covering AI and digital infrastructure, business-to-business partnerships, policy and regulatory exchanges, and skills cooperation. The Canadian announcement identifies trade missions and private-sector partnerships, including SMEs and startups. These describe intended mechanisms of cooperation, not a delivered shared cloud or pooled customer base. ↩

27. Singapore Ministry of Foreign Affairs, Vivian Balakrishnan’s national statement to the UN General Assembly, delivered 26 September 2026, paragraphs 3–5 and 17–19. He argues that shared rules preserve autonomy despite unequal power and that willing coalitions should proceed while remaining open to later participation. Bilateral and regional arrangements complement, rather than replace, universal rules. The speech’s maritime and AI-safeguards arguments are developed in The risk is shared. The race is not. ↩

28. European Payments Initiative, Wero reduces its dependence on international providers, 27 April 2026. EPI's own account of European governance, underlying SEPA infrastructure and continuing non-European dependencies. Its statements about data protection and suitability of available providers are not independent technical assessments. ↩