Your AI Supply Chain Starts In Veldhoven

Europe spends a great deal of energy worrying about its dependence on foreign technology. Yet one of the narrowest points in the global AI supply chain sits in Veldhoven, in the Netherlands. On 14 October, ASML said it cannot build enough machines to meet its customers’ demand in 2027 or 2028.

That is not a story about European weakness. Rather, it shows how dependence actually works. It also carries a lesson for any organisation that runs AI on someone else’s capacity.

What ASML said about the AI supply chain

ASML provides chipmakers with the hardware, software and services to mass produce the patterns of microchips. Its third-quarter release reported record net sales of €11.7 billion and net income of €5.0 billion.

The figures are not the interesting part. According to chief executive Christophe Fouquet, customers keep raising their equipment forecasts, “driven primarily by their views on the size and duration of AI-related investments.” The company now expects that its supply, as currently planned for 2027 and 2028, “will not fully meet the demand of our customers.” It had already announced a 30% capacity increase and is investigating ways to go beyond it for 2028.

In other words, the queue for the machines that make the chips that run AI is now measured in years.

Nobody in your organisation can fix this

A mid-market firm has no say over lithography capacity. Who gets the scarce machines is decided several layers above the organisations that end up running AI workloads, between ASML and its customers.

That is precisely why the AI supply chain deserves a place in governance. You cannot control the top of the AI supply chain. You can, however, know where you sit in it and what you would do if your part of it tightened.

A shortage upstream travels down

ASML did not say who will wait longest, and we will not guess. What its statement does establish is that demand for the bottom layer of the AI supply chain now exceeds the planned supply for two years. Every layer above it, from chipmakers to clouds to the AI services an organisation buys, is built on that bottom layer. A plan that assumes unlimited, steadily cheaper AI capacity is therefore an assumption, not a fact. It belongs in the risk register, not in the background.

Sovereignty is about the terms of dependence

A white paper the World Economic Forum published on 9 October offers a better frame than the usual sovereignty debate. The Next-Generation Computing Framework treats sovereignty and interdependence as one pillar, not as opposites. In its own words, sovereignty in compute is “less about eliminating dependence and more about shaping the terms, risks and evolution of dependence over time.”

The paper makes three points that translate well from national compute strategy to an organisation’s own AI supply chain.

First, dependence is not binary. Exposure differs per layer of the stack. Second-order dependencies are also easy to miss: firmware updates, toolchains and maintenance ecosystems are harder to replace than the headline supplier.

Second, layers move at different speeds. AI software dependencies can shift relatively quickly, whereas chip fabrication embeds dependencies that can last for decades. An organisation can replace its model provider far faster than anyone can replace the hardware underneath it.

Third, agency has to be tested rather than assumed. The paper recommends stress-testing whether control still exists when a supplier is unavailable. It warns against what it calls “peacetime assumptions of access.”

The paper’s own figures for the scale of the computing boom vary from page to page. Their direction does not.

Mapping your own AI supply chain

The WEF distinguishes upstream dependencies (chips, tools, intellectual property), midstream dependencies (platforms, clouds, orchestration) and downstream ones (applications, users, services). For an organisation that buys AI rather than builds it, that split gives a workable map of its own AI supply chain.

• Upstream: accept that you have no influence here and stop pretending otherwise. Note which of your providers depend on scarce hardware, and how much notice they would give you of a shortage.
• Midstream: this is where your contracts live. Capacity commitments, notice of model changes, data portability and exit terms belong in the agreement, not in a sales conversation.
• Downstream: this is the layer you own. Know which business processes would stop if an AI service slowed down or disappeared, and what the manual fallback is.

Three questions for your providers

The midstream layer is where an organisation can still negotiate, so it is worth asking each AI provider three things in writing. First, what happens to our service levels if your own capacity is rationed? Second, how much notice do we get before a model we depend on is changed or withdrawn? Third, how do we take our data, prompts and configurations elsewhere, and how long would that take? A provider that cannot answer is telling you something about its own place in the AI supply chain.

None of this requires an opinion on geopolitics. It requires a procurement file that treats the AI supply chain as a dependency like any other: named, documented and reviewed.

We made a related argument about location in Compute Sovereignty Is Not About Where The Building Is. A data centre in the EU settles less than its address suggests. The same lesson applies here from the other direction: owning the chokepoint did not give Europe more machines.

Test the exit before you need it

So what does a board ask? Not whether the organisation is sovereign, since no mid-market firm is. The useful question is narrower. If our AI supply chain tightened for two years, which of our services would we lose first? And have we ever tried running without them?

If nobody has checked, the answer is a guess. Mapping the AI supply chain costs a workshop. Not checking costs whatever the queue decides.