Why governance and visibility are the real defense against AI sovereignty risks

In June, Anthropic released two powerful AI models to the public. However, the US government intervened, ordering the company to block access for all users outside the country due to national security concerns. Unable to monitor user locations, Anthropic ultimately shut down access to the models entirely. Two and a half weeks later, the controls were reinstated, but one model remained restricted to a select few US organizations.

This sequence of suspend, restore, and partial restriction highlights the unpredictable nature of AI access controlled by governments rather than businesses. Security leaders must now plan around this reality, as access to AI tools can change on a government's schedule with little notice. The issue lies in the concentration of critical AI capability among a few providers, whose positions can shift abruptly due to commercial, policy, or regulatory changes.

Export-control regimes for frontier AI are still evolving, and several governments have accelerated their own AI investments instead of waiting for potential issues to arise. Building resilience involves knowing where AI is embedded within the business, understanding which processes and teams rely on the tools, and having contingency plans ready for sudden changes.

While independent validation of AI safety is crucial, initiatives like the International Network of AI Safety Institutes should strive for greater independence from government influence. The core lesson is to build visibility into AI technologies across the organization, including answering four key questions about every AI tool in use: where the model sits, what data it accesses, who has access, and how changes in vendor policy, regulation, or export controls could impact the business.

Without this visibility, organizations lack the ability to secure, govern, and build resilience around their AI assets, leaving them vulnerable to rapid disruptions and uncertainties.