ADR-003 — Ownership counts in the jurisdiction score

Status: Accepted Date: 2026-10-13 (decided), 2026-10-15 (applied; chain hops aligned with ADR-001) Context: EU Sovereignty Score methodology (amends the scoring consequence of ADR-001)

Context

ADR-001 introduced ultimate_parent_country so that foreign control of a European company is recorded honestly instead of by moving its headquarters into another region. The scoring engine kept looking at headquarters_region only. A European subsidiary of a US group therefore scored the maximum on jurisdiction, even though its parent can be compelled to produce data the subsidiary controls: the US CLOUD Act reaches data in a provider's "possession, custody, or control", and a parent controls its subsidiaries. The vendor page showed the foreign owner as a badge and in the text, but the number said the opposite.

Decision

The jurisdiction dimension (JES) takes the strictest jurisdiction along the control chain:

1. the headquarters region (headquarters_region: EU 100, OTHER 50, US 10),
2. every recorded intermediate owner (ownership_chain, each hop's country), and
3. the ultimate parent (ultimate_parent_country),

with countries bucketed the same way: EU-27 and EFTA (CH, NO, IS, LI) are EU, the United States is US, every other country is OTHER. An intermediate owner counts because it exercises control itself: a German subsidiary of a US group that is in turn majority-owned by a Swiss fund is within reach of the CLOUD Act through the US group, whatever the fund's seat.

Only a company that exercises control is a hop: an operating group, or an investor with a sourced majority or controlling stake. A holding's registered seat (Delaware, Luxembourg, Jersey) is not a controller of its own (ADR-001, "Who counts as the controlling owner"); the chain records the country where the controlling company actually sits, so a pure holding registration never lowers a score. Holding vehicles may still be recorded as hops with relationship: "holding", so the registered trail is visible on the vendor page; the score skips them.

The rule only lowers a score. A European parent does not improve a non-European headquarters: the subsidiary itself remains subject to the law of its own seat.

Headquarters	Strictest owner (chain or ultimate parent)	JES
EU	none, EU or EFTA	100
EU	outside Europe, not US (e.g. GB, JP, CN)	50
EU	US	10
OTHER	US	10
OTHER	EU	50
US	any	10

The same effective jurisdiction drives the badge "EU-hosted, non-EU parent", the risk driver for US jurisdiction, the driver for core control points outside the EU, the "European company" reason of a recommendation, and the migration priority, so that the score, the explanation and the advice agree.

Rationale

The sovereignty question behind JES is who can legally compel access to the data. For a subsidiary, that includes every authority that can compel its parent. Treating ownership as information only meant that the badge "EU-hosted, non-EU parent" and the score contradicted each other. A minority stake or a consortium without a single controller does not count: ultimate_parent_country is set only for a single majority owner in another country (CLAUDE.md data-model conventions).

Consequences

• Vendors with a European headquarters and a foreign owner, and non-European vendors owned from the US, score lower on jurisdiction and therefore on average. At introduction this affected a few hundred records; each received a score_change event on its timeline.
• The quality of ultimate_parent_country and ownership_chain now moves scores directly. Changes to them go through review with sources, never automatically. Where a US (or other non-European) operating group sits between the vendor and a European fund, record that group as a hop in ownership_chain.
• The other four dimensions are unchanged. Data residency, key control and lock-in describe hosting and software, not ownership.
• The badge "EU-hosted, non-EU parent" stays: it says where control sits, the score now reflects it.