A Tool You Don't Own

The Notice

The facts are short. On 9 June, Anthropic released Claude Fable 5, its most capable public model, at no extra cost across its paid tiers. On 13 June the US government issued an export-control directive citing national security and ordered Anthropic to block access by any foreign national, inside or outside the United States, including its own foreign-national staff. To comply, Anthropic disabled the model worldwide. Every other model kept working. Fable, for us, was gone.

This is not a complaint about a vendor. Anthropic did not choose to drop its customers, it complied with a government order it has publicly disputed, and a commercial contract does not outlast an export-control directive anyway. That is the part that matters. The decision was not ours, not the vendor's, and not appealable by either of us, and it took effect overnight from a jurisdiction we have no standing in.

In our DORA note we put two items in the vendor file and moved on: concentration risk under Article 29, and an exit strategy under Article 28. This is the event that tested both.

Lesson 1: The loss was small; the dependency it exposed was not

Four days of access, then nothing, and it cost us nothing because nothing depended on it. What is worth noticing is how it ended. No notice period, no price signal, no negotiation, and a rule written around a category ("any foreign national") that contains every non-US firm by definition. A model you do not run is one someone else can switch off, on their timetable, for their reasons.

Price sits in the same category. Fable shipped at ten dollars per million input tokens and fifty per million output, set by one company with few competitors at the top end, and nothing guarantees that number holds. The frontier vendors are American and sit under American law and politics. For a European regulated firm that is a standing exposure, not a one-off.

Lesson 2: Concentration risk is the real subject, with or without DORA

Article 29 asks you to weigh concentration risk before you lean on a provider, and names how hard the provider is to replace as a specific factor. That is simply the question "what happens when this provider goes away," asked early. Strip the regulation out and the risk is identical. Anyone who routes a process through one vendor's model inherits that vendor's uptime, its pricing power, and its government's foreign policy. DORA does not create the exposure, it makes you write it down. Over-reliance on a single company, or a single model, is dangerous on its own terms.

There is a deeper version of the same risk, and it is about data, not access. Build the work inside one ecosystem, with the documents, the context, the embeddings, and the workflows all living in the provider's stack, and losing the model stops being an outage. It becomes data loss. We structure it the other way around. Our data architecture sits underneath and stays ours; the model is a layer that applies on top of it and reads from it. Swap the model and the data does not move. A provider supplies capability, never custody.

Lesson 3: Match the tool to the task, and no single tool can strand you

We do not adopt a model and push everything through it. Each model is a tool with a job. Fable was good for some of the heavy work; for plenty else a smaller, cheaper, or local model was already the better fit. You do not reach for a hammer to fell a tree, and you do not route a routine translation through a model built for multi-day reasoning.

Because every workflow already picks its tool deliberately, through one internal interface, losing a tool means reaching for the next one that fits, not rebuilding the workshop. The floor underneath is the part no order reaches: open-weight models on hardware we own, DeepSeek V4-Flash for the heavy coding work and Qwen3.6 for the wider firm. A model running on a card in our own racks cannot be withdrawn, repriced, or throttled by anyone outside the building.

This is not a frontier-versus-local argument. We use the strongest tool for each task, the frontier API where it genuinely wins, the local model where sovereignty or cost or latency does. The point is that the choice is ours and reversible, made daily rather than locked in once. It is the DORA exit strategy made operational instead of written, and on 13 June it held.

The Same Conclusion

Within hours of the shutdown the wider conversation turned to running models you cannot be cut off from. We had got there earlier, which is why the order meant an afternoon of reconfiguration for us rather than a scramble. DORA asks you to assume your providers can fail and to be ready when they do. Good engineering asks the same thing for reasons of its own. They happen to agree.