In June, thousands of organizations lost access to two of Anthropic’s most capable AI models after the US government issued an export control directive that forced Anthropic to disable Fable 5 and Mythos 5 for all customers.  

Owing to national security concerns, this was carried out with no advance warning or timeline for restoration. Although the controls were lifted and access restored less than three weeks later, the questions raised by the incident have not gone away.

Geopolitics, jailbreaks and the relationship between the US government and frontier AI developers have all become hot topics of debate in the proceeding weeks. These are legitimate and important conversations, but for many organizations, the more pressing question is this – what does it mean when a tool your business depends on can be switched off overnight?

Indeed, on August 18, the UK government commissioned an urgent review examining the economic and national security risks of losing access to advanced US AI models.

The simple and blunt truth is that most are not well prepared to answer it. According to the ISMS The State of Information Security Report 2025, 54% of respondents say they adopted AI technology too quickly and are now facing challenges in scaling it back or implementing it more responsibly.

A Concentration of Risk Hiding in Plain Sight

When organizations talk about AI risk, they tend to focus on what the technology does; things like bias, hallucination and data exposure. What receives far less attention is the risk of the technology not being there at all.

The risk is a substantial one, partly because the AI market is very concentrated. A small number of providers account for the models that many businesses now rely on, models which are often deeply embedded in how they work on a daily basis. Such dependency has rarely been stress-tested because, until recently, there has been little reason to test it.

The Anthropic case has provided one of the clearest signals yet that stress-testing needs to happen. It has demonstrated that AI tools which are considered stable and compliant on any given day can be subject to export controls, licensing restrictions or government intervention – quickly and without notice.

In this case, the trigger for the US government to intervene was a potential jailbreak in a cybersecurity model, but the mechanism itself is not unique to Anthropic, and the geopolitical environment suggests the risk of similar interventions is growing rather than shrinking.

Around the world, different countries are taking increasingly different approaches to AI regulation and oversight. This is generating a fragmented AI landscape that will create new dependencies and new points of failure for organisations that have not mapped them.

What Good Governance Provides

The natural response to an Anthropic-style incident is to default to some kind of technical solution, which could take the form of switching to a different model, backup provider or redundancy arrangement.

Again, these are important considerations, but they are downstream of a more important question – whether the organisation has the visibility to know what it would need to switch, and the processes to act on that knowledge quickly.

Mature AI governance frameworks are the key to unlocking this level of visibility, as organizations will know what models they are using, where their dependencies exist, what data is being processed and which operations will be affected if access were interrupted. In addition, policy structures will help guide employees through the kind of disruption the Anthropic situation has created.

Without this foundation, the response to an access outage is likely to be more reactive and less consistent. This is because employees find workarounds and often that leads to the increased use of shadow AI (already cited as a concern by 37% of respondents in our report). As a result, the risk profile of the organisation shifts in ways that are difficult to track and harder to reverse.

It is also important to consider the human element behind all of this. Put simply, if employees do not understand how to use AI responsibly, what data can be shared or how to respond when a tool becomes unavailable, then governance exists only on paper and policy documents.

Why Governance Enables Better AI Adoption                         

Stronger AI governance is often resisted by organizations if they worried about it getting in the way of innovation, but the evidence points the other way. Those which are best positioned to adopt AI quickly and responsibly tend to build the governance infrastructure first – a process which involves the enactment of clear policies, risk management processes, human oversight and contingency planning.

Our data backs this up. Despite the scale of the challenge, 95% of respondents to our survey say they are investing in AI governance and policy enforcement. This represents a major shift in how the industry thinks about the relationship between governance and adoption.

Frameworks such as ISO 42001, which provides a structured approach to AI management and governance, are valuable in this context as they offer organizations a way to move beyond ad hoc responses to a defined, continuously reviewed set of controls. The Anthropic incident illustrates why the ‘continuously reviewed’ part matters, because the conditions under which a tool was originally approved can change.

When it comes to AI governance, it shouldn’t be seen as a one-time exercise. Effective AI governance demands ongoing monitoring and a willingness to update risk assessments as the technology, regulatory landscape and the geopolitical environment evolve.

The Board Conversation that Needs to Happen

The Anthropic incident is a useful prompt for a conversation that many boards have not yet had. AI risk is business risk, spanning operational resilience, supply chain security, third-party exposure and business continuity. It belongs at the board level and requires the same quality of analysis that boards apply to other critical dependencies.

In practice, this is about understanding which AI providers the organization relies on, what the business impact of losing access would be, and whether contingency arrangements exist. It also means evaluating AI adoption through the same lens as cloud migration or any other significant third-party dependency, with resilience, diversification and exit planning built in from the start.

The Anthropic-style incident may well take longer to resolve and involve a provider with less leverage to negotiate, or arise from a regulatory trigger rather than a security one. If and when this happens, organizations that treat governance as a boardroom priority will be better placed to respond.