The foundation model dependency

Agentic AI systems moved from research prototypes to commercial deployment at speed between 2023 and 2025. In the commerce sector, the transition is visible in automated customer resolution, dynamic inventory management, and AI-mediated procurement workflows that replace rule-based automation with LLM-driven planning. The regulatory frame that governs this transition (the EU AI Act, GDPR, and the emerging GPAI Code of Practice) was designed against a landscape in which AI was a tool operated by a human, not an autonomous planning agent executing multi-step tasks with access to financial and personal data [22].

At the same moment, European technology sovereignty emerged as an explicit policy priority. The Russian invasion of Ukraine in 2022 accelerated EU thinking about strategic dependence on external infrastructure [19], and the 2023 AI Act debate embedded sovereignty language into the legislative record. What the policy debate has not resolved is the distance between the aspiration and the technical baseline: the European foundation model ecosystem, while growing, has not produced a model that carries production agentic commerce workloads at the capability level of the frontier US providers [23]. The visibility of the gap is therefore a function of deployment pace: as agentic systems move from pilot to production, the reasoning layer dependency that was previously a research architecture choice becomes an operational and regulatory obligation.

An agentic commerce system is not a single model call. It is a compound architecture: a reasoning layer that plans and decomposes tasks, an orchestration layer that routes sub-tasks to specialised tools or APIs, and an execution layer that interacts with commerce infrastructure (inventory, payment, fulfilment). The reasoning layer is the load-bearing component. It maintains context across multi-step plans, resolves ambiguity in tool outputs, and generates the decision logic that downstream layers execute. Current production deployments concentrate this reasoning function in large foundation models because no other component class provides the combination of general-purpose language understanding, tool-use capability, and in-context planning required [20].

The dependency deepens through the mechanics of scale. Production compound AI systems exhibit fan-out patterns in which a single user request spawns multiple parallel sub-agent calls, each carrying its own inference overhead [21]. Cold-start latency penalties accumulate across the chain. Fine-tuning histories and retrieval-augmented context accumulated on a specific provider's infrastructure are not portable: they are tied to the weight checkpoints, embedding spaces, and API contracts of the host provider. European commerce operators who have accumulated domain-specific adaptation on a US-hosted model face a migration cost that is not limited to retraining compute. It includes re-embedding proprietary data, reconstructing evaluation pipelines, and absorbing a latency and throughput regression during transition.

The architecture is not, in principle, monolithic. Ecosystem theory establishes that modular infrastructure allows capable components to emerge and substitute at discrete layers without requiring end-to-end replacement [6]. An agentic system that cleanly separates its reasoning layer from its orchestration and execution layers is, structurally, more amenable to component substitution than one in which the foundation model's API shapes all downstream interfaces. In practice, however, the degree of modularity in current production deployments varies: providers who supply both the reasoning layer and the surrounding toolchain (plugin registries, embedding APIs, evaluation frameworks) create interface dependencies that resist component-level substitution even where the model weights themselves could in principle be replaced.

European foundation model development has produced capable smaller models at the language-specific level [23], but no European model has been demonstrated at the parameter scale, multi-modal breadth, and production throughput required by the agentic commerce workloads described in deployment studies [21]. The domestic proof of localised outperformance on single-language tasks has not extended to the multilingual, multi-step commercial reasoning workloads that constitute the core agentic commerce use case. The gap is structural, not merely one of elapsed time.

Four concrete consequences follow from the architecture described above, each distinct in character and timeline.

Governance accountability. The EU AI Act classifies certain agentic decision-making functions (credit decisions, product eligibility, personalised pricing) under Annex III high-risk categories, with full obligations applying from August 2026 [22]. GPAI obligations, which govern general-purpose model providers, applied from August 2024. A European commerce operator whose reasoning layer runs on a US-hosted foundation model must obtain from that provider the technical documentation, logging access, and conformity evidence required to satisfy NCA audits. Whether US providers are obligated to maintain EU-compatible audit trails at the granularity the Act requires is an open regulatory risk position: no authoritative supervisory guidance or Commission decision has established the applicable threshold for non-EU-hosted GPAI models, and compliance currently depends on the terms individual operators negotiate rather than on any framework-level obligation the provider is bound to observe [22].

Inference cost and margin structure. Agentic commerce workloads generate inference costs that scale with task complexity and fan-out depth, not with transaction volume alone [21]. European operators pricing in euros and subject to EU consumer-protection constraints on automated pricing cannot easily pass through inference cost volatility driven by US provider pricing decisions. The provider, by contrast, sets inference pricing in a market where the majority of its customers are US-denominated.

Model control and output accountability. When the foundation model is updated, deprecated, or fine-tuned differently by the provider, the behaviour of downstream commerce agents changes without operator action. European operators cannot compel US providers to maintain version stability for regulatory compliance purposes, and no EU instrument currently imposes such an obligation on non-EU model hosts.

GDPR and data residency. Training data, inference inputs, and intermediate reasoning traces passing through a US-hosted model may constitute personal data transfers subject to GDPR Chapter V. Contractual data-residency arrangements (Standard Contractual Clauses, EU-soil compute commitments) are the current practical instrument, but their adequacy when inference itself occurs outside EU jurisdiction awaits authoritative supervisory guidance [22].