On June 12, a single letter from the US Commerce Department took two AI models offline. Not throttled. Off.

Anthropic received a legally binding export-control order and, within hours, suspended all access to Claude Fable 5 and Mythos 5 for every foreign national, anywhere in the world, including foreign nationals working inside the United States. In practice that meant a global shutdown. The models stayed dark for 18 days. They came back on July 1, after the order was lifted. Zero notice going in, zero notice coming out.

Sit with that for a second, because I don’t think most of us have.

An organization that had built a workflow on Fable 5 woke up on June 13 to find that a core dependency had been switched off by a government, not by a vendor outage, not by a price change, not by anything in a contract. There was no SLA to invoke. There was no support ticket that would bring it back. The only thing that would restore service was a policy decision in Washington, and that took two and a half weeks.

This is a third-party risk story wearing a tech headline

We are trained to see this pattern. Strip away the word “AI” and what happened is a critical single-source supplier going offline with no notice, no contractual remedy, and no substitute ready to go. If that supplier were a payroll processor or a data center, your function would already have a workpaper open and a question for the business continuity owner.

The reason it doesn’t feel like that yet is that AI models got filed under “innovation” rather than “supplier.” So the discipline we apply to every other critical vendor, concentration analysis, exit plans, tested failover, simply never got pointed at them.

Here is the uncomfortable number. In a survey of US enterprise leaders this year, most said losing their primary AI vendor would disrupt day-to-day operations, and only a small single-digit percentage believed they could switch to an alternative without real interruption. The confidence gap is the finding. People think they can move. Almost nobody has tested whether they can.

The other half of the pincer

While Fable 5 was dark, something else was happening that makes the concentration question sharper, not softer.

US companies have been moving real volume onto cheaper Chinese models. The share of tokens that US developers run on Chinese models through OpenRouter has sat above 30% for months and has touched 46%, up from around 11% a year ago. Open-source models from DeepSeek, Alibaba’s Qwen, Z.ai and others are landing at 60% to 90% below the price of the leading US models. One startup, Lindy, moved 100% of its traffic off Claude to DeepSeek and expects to save millions.

This is the direct sequel to the cost story I wrote about last week in The Token Bill Came Due. When the bill for frontier models shocked people, the response was not only to cap spend. It was to go shopping. And the cheapest capable models on the market right now are Chinese.

So now you have the opposite risk on the other side of the same trade. On July 8, US lawmakers opened a probe into American companies using Chinese models, with congressional investigations reported into Airbnb and Anysphere, the company behind Cursor. The concerns are the familiar ones: data security, where the inference actually runs, and what a foreign model provider can see or shape.

Put the two events next to each other. Stay on a US frontier model and a government can switch it off. Move to a cheaper Chinese model and a different government starts asking your board questions. Concentration on either side is now a live risk, and the honest answer for most organizations is that they chose their model on capability and price and never modeled either failure mode.

What our function actually adds here

I want to be careful not to turn this into “audit should tell everyone which model to use.” That is not our job and we are not qualified to do it.

What we are qualified to do is ask whether the decision was made with eyes open. That is the whole game with third-party risk. Not “is this vendor good,” but “does the organization understand what it depends on, what happens if that dependency fails, and can it prove it has a way to keep operating.” Those are our questions. They predate AI by decades.

The thing that has changed is that a foundation model is a stranger kind of supplier than we are used to. You can swap payroll providers over a weekend with a migration plan. Swapping a model is not a like-for-like replacement, because two models with the same task will not behave identically, and a workflow tuned to one can quietly degrade on another. During the Fable 5 blackout, there were reports of requests silently rerouting to a different model with no error surfaced to the user. Whether or not that held in every case, the point stands: model substitution can happen without anyone being told, and a control that assumes a stable, known model underneath it is resting on an assumption nobody is testing.

That last part is where this connects to the governance gap I keep coming back to. The controls exist. The vocabulary exists. What is missing is anyone pointing them at the fastest-moving dependency in the enterprise before an incident forces the issue.

What I’d look at this quarter

I’m wary of a checklist, because the real work is judgment. But if I were scoping this now, I’d start with a few concrete questions.

  • Can the business name every critical workflow that depends on a specific AI model, and say which model? If nobody can produce that map, that gap is the first finding.
  • For each of those workflows, is there a written answer to a simple question: if this model vanished tomorrow with no notice, what runs in the next 72 hours? An aspirational backup is not a tested one.
  • Do the models sit behind a gateway, or is a specific model ID hard-coded into production? Hard-coding turns a provider decision into your outage.
  • Where a cheaper or foreign model has already been adopted, was that a documented decision with data-security sign-off, or did it happen quietly inside an engineering budget because it saved money?
  • Does AI appear anywhere in the business continuity plan and the third-party risk register at all? In most places I’d bet it doesn’t, and that absence is itself the story.

None of this requires you to understand transformer architecture. It requires you to treat a model as what it now is: a critical supplier that can be switched off by forces outside any contract you hold.

June proved that can happen. The only real question is whether your organization finds out the answer to “what’s our 72-hour plan” during an audit, or during the outage.

If you’re building AI vendor continuity or model-concentration controls into your audit plan, I’d like to hear how you’re approaching it. Get in touch.

Sources and further reading:

Connects to:

  • The Token Bill Came Due: the cost surge in that post is exactly what is now driving US companies toward cheaper (and Chinese) models. This post is the third-party-risk sequel to the cost-control story.
  • The Governance Gap: same core thesis. The controls and vocabulary already exist, they just haven’t been pointed at the fastest-moving AI dependency yet.
  • Can You Produce a List of Every AI Agent in Your Systems?: same “ask for the inventory / can anyone produce the list” move, applied to model dependencies instead of agents.