AI governance has just stopped being a "compliance" topic and become a business continuity topic
AIRisk
On Friday (June 12), the US government issued an export control directive ordering the immediate suspension of access to Anthropic's most advanced models, Fable 5 and Mythos 5, for any foreign national, inside or outside US territory, including the company's own non-American employees.
Since there is no technical way to segment access by nationality in a global SaaS product, Anthropic had to disable both models for all customers, in every country, days after launching a technology the company itself described as the most capable ever made commercially available.
The relevant fact is not the jailbreak. It is the speed and scope of the regulatory response.
Anthropic says it worked for months with government agencies, independent red teams and external audits before launch, and still received a total suspension order based on preliminary evidence that was not formally documented, with immediate compliance. The company disagrees with the proportionality of the measure, but complied in full, with no alternative.
Three direct implications for those who decide on architecture, vendors and roadmap
- Regulatory risk for AI now has the same profile as a critical infrastructure outage. It is no longer a "long-term" risk or a "hypothetical scenario". It is an operational risk with a materialization window measured in hours, with no prior notice and no defined appeal process.
- Concentration on a single model or vendor is a risk decision, not just a technical one. Products and operations that depend on a single cutting-edge AI, with no functional fallback, are exposed to a variable outside any CTO's control: the jurisdictional decision of a third country.
- Business continuity needs to incorporate scenarios of regulatory unavailability of AI. Just as there are contingency plans for a cloud provider failure, it is time to map: which critical processes depend on which model, what the impact of a suspension within 24h would be, and what plan B is, even with reduced capacity.
The question worth taking to the executive committee
If the AI model that underpins a critical process in your business became unavailable overnight by regulatory decision, not by technical failure, not by contractual default, what is the impact, and what is the plan?
This is no longer a question for the compliance team to answer in isolation. It is a question of architecture, risk and strategy, and it is, definitively, on the C-level table.