The AI Act’s Blind Side? Dependency Risk, Hybrid Warfare and the Fragmented Governance of Critical AI Infrastructure

Abstract Regulation (EU) 2024/1689 (the AI Act) is the most comprehensive attempt so far to subject artificial intelligence to a horizontal legal regime. Its conceptual centre of gravity is the individual AI system and the risks it poses to health, safety and fundamental rights. This article argues that in an environment of hybrid conflict the decisive security risk increasingly lies outside the model: in cloud and identity infrastructure, software supply chains, privileged vendor access, telecommunications and data-integration platforms, and in the small number of providers capable of operating them at scale. On the basis of the European Union’s July 2026 attribution of sabotage operations against Polish combined heat and power plants to the 16th Centre of the Russian FSB, CERT Polska’s analyses of the December 2025 attacks on the energy sector and of the UNC1151 phishing campaign, and the 2026 compromises of healthcare and invoicing software providers in Poland, the article reconstructs the category of dependency risk and contrasts it with the model-centred concept of risk adopted in the AI Act, including its Article 9(3), which confines risk management to risks that can be addressed through the design of the system. It proposes a structural definition of technofascism as a failure mode in which concentrated informational power, automated decision capacity and infrastructural dependence become fused with coercive political power. Its principal claim is that the limitation lies not in the absence of cybersecurity regulation within the AI Act, but in the fragmentation of dependency governance across the AI Act, the Digital Operational Resilience Act, the NIS2 Directive, the Cyber Resilience Act, the Critical Entities Resilience Directive and adjacent Union legislation. While these instruments regulate different layers of the same technological architecture, they do not establish a common method for identifying sector-wide concentration, transitive supplier dependencies and the consequences of losing trust in a strategically positioned provider. The article concludes with control domains for the operational resilience of critical AI deployments, proposes a cross-regulatory dependency map and argues that the central question of European AI governance is shifting from the safety of systems to the control of control planes.