AI Vendor Sovereignty
- The LLM-provider choice is now two decisions: visibility in the models buyers use (external) and control over the models you process with (internal).
- On 12 June 2026 a single US directive suspended Anthropic's Fable 5 and Mythos 5 for every customer worldwide within hours — no transition, no appeal.
- Jurisdiction follows the provider, not the data: AWS Bedrock access was revoked at the same time, so EU data residency does not address vendor-control risk.
- Treat AI providers as suppliers: document which workflows depend on which provider, and know whether you would notice within an hour if one disappeared.
Consensus definition
AI vendor sovereignty is the question of who controls the AI capability an organization depends on — and under whose jurisdiction. Until mid-2026 the implicit answer in DACH and broader Europe was "whichever model performs best," which in practice meant US providers. On 12 June 2026 the US Department of Commerce ordered Anthropic to suspend all access to its Fable 5 and Mythos 5 models by any foreign national — whether inside or outside the United States, including foreign-national Anthropic employees. Anthropic received the directive at 17:21 ET and complied within hours, disabling the models for every customer worldwide, because the control could only be implemented by removing access entirely1. Fable 5 had launched publicly just three days earlier, on 9 June, as the first generally available model of its most capable family2 — so enterprises that began integration over the weekend had a window of under 72 hours. The relevant point is not whether the order was justified — Anthropic disputes it, noting the cited capability is widely available from other models including OpenAI's GPT-5.5 and is used every day by the defenders who keep systems safe1. The point is that one letter from one agency in one jurisdiction can suspend frontier AI capability for European enterprises within hours, with no transition period, appeal, or contractual recourse. The risk was not previously hypothetical — it was unremarked. It now has a date.
rhinegold operator refinement
Rhinegold's reframe: the LLM-provider choice splits cleanly along the direction of information flow, and it is two independent decisions, not one. The external axis is visibility — when a buying committee opens ChatGPT, Perplexity, Gemini or Claude to research a vendor, they use what they use, and as of mid-2026 that is overwhelmingly US-built models. This is not a choice the enterprise gets to make; it is a fact about the market it sells into, and it is why Generative Engine Optimization is necessarily about US LLMs. The internal axis is processing — when the enterprise runs retrieval over its own documents or embeds an assistant in an internal workflow, the provider choice is fully its own, and the constraints are different: GDPR and DORA residency, supplier concentration, continuity of access, and now extraterritorial export control. Treating these as one decision conflates problems of different shape: "we use ChatGPT" leaves the internal axis exposed; "only EU providers" leaves the external axis blind. Both axes need an explicit position.
Operational use
Use this frame when AI-provider dependency is being treated as a single performance decision. The internal-axis exercise is concrete: document which workflows depend on which provider, then answer three questions on paper — (1) which workflows are time-critical enough that a 72-hour interruption causes material harm; (2) for each, is the dependency on a specific model, a specific provider, or a specific capability; (3) for capability-driven dependencies, what is the cost of a warm fallback to a European or open-weight alternative. Vendor concentration is now an AI-procurement question, not only a SaaS-procurement one — and standard supplier-risk frameworks already cover it; the gap is usually that AI providers were never treated as suppliers in the same sense as the ERP or CRM vendor.
Measurement boundary
This is an operating frame, not a metric — it yields a position, not a score. Two honest limits. First, the two-axis split is the editorial contribution here; the underlying facts (US-LLM dominance in consumer search, EU-provider growth in regulated enterprise verticals) are established, but the framing is proposed, and the relative weight of the two axes will shift as European providers close the capability gap. Second, European providers are not equivalent to US frontier models on raw capability — on current evidence they are not, and pretending otherwise would mislead. The sovereignty argument applies to the internal axis, where the enterprise controls the choice; it does not retroactively change which LLMs buyers use on the external axis.
Distinct from
From data residency (GDPR/DORA): residency governs where data sits; vendor sovereignty governs who controls the model and under whose law — 12 June showed the two are independent, because EU-hosted access was revoked anyway. From Generative Engine Optimization: GEO is the external axis (being visible in the LLMs buyers use); vendor sovereignty adds the internal axis (which providers you depend on for your own processing) — the same provider question seen from opposite ends of the information flow. EU data residency does not address vendor-control risk.
Observed pattern in practice
Common mistakes
- Treating provider choice as one decision — a single "we use ChatGPT" answer leaves the internal processing axis exposed; an "only EU providers" answer leaves the external visibility axis blind.
- Assuming EU data residency solves vendor risk — the AWS Bedrock revocation shows it does not.
- Letting the sovereignty conversation become a reason to disengage from generative-engine visibility; the external axis is a fact about the buyer's tools, not a choice.
- Not treating AI providers as suppliers — leaving them outside the vendor-concentration framework that already governs ERP and CRM.
Where consensus is missing
The two-axis frame is an operator reference proposed here, not an industry standard. Open: whether further directives of similar scope follow; the trajectory of European-provider capability; and whether enterprise vendor-risk frameworks formally absorb AI providers as a category. The 72-hour fallback heuristic is a plausible operating rule, not an empirically calibrated standard.
Sources & deeper reading
- 1Anthropic — "Statement on the US government directive to suspend access to Fable 5 and Mythos 5" (12 June 2026): directive received 17:21 ET; "any foreign national … including foreign national Anthropic employees"; capability "widely available from other models (including OpenAI's GPT-5.5)"
- 2Anthropic — "Introducing Claude Fable 5 and Claude Mythos 5" (9 June 2026): Fable 5 launched publicly as the first generally available model of its most capable family — three days before the suspension
- 3AWS — "Claude Fable 5 on AWS" update note: "To support compliance with the US Government export control directive, Anthropic has asked AWS to revoke access to Claude Fable 5 and Claude Mythos 5 for all users."