Blog · Suppliers · Resilience
When your AI vendor's model disappears overnight: continuity planning for AI suppliers
12 September 2026 · 4 min read · By LeadAI
Most AI risk plans look at what a model might do wrong. This summer showed a different risk: a model you depend on can simply stop being available. Nobody in your organisation has to make a mistake for that to happen.
What happened
Anthropic released Claude Fable 5 on 9 June 2026. On 12 June, the US Department of Commerce issued an export-control directive requiring access to Fable 5 and its more capable sibling Mythos 5 to be suspended for foreign nationals worldwide. Because the order took effect at once and users could not be verified by nationality in real time, Anthropic suspended both models for everyone. The controls were lifted on 30 June, and access returned on 1 July, a gap of about 19 days. Access through major cloud platforms followed shortly afterwards. Anthropic published its own account at anthropic.com/news/fable-mythos-access.
For organisations that had built the model into production workflows, access disappeared with little warning. Some commentators pointed out that even once access returned, certainty did not.
This is not a story about one vendor. Any AI provider can face a regulatory order, a security incident, an outage, a change of terms, a price rise, a model retirement or a change of ownership. The lesson is that export controls and other regulation can now reach through a vendor's own access controls and affect your operations.
The question to ask
If the model behind this system were unavailable tomorrow morning, what would we do, and how long would it take?
If the honest answer is "we are not sure", you have a continuity gap.
An eight-point checklist
| Check | What to do |
|---|---|
| 1. Know your dependencies | For every AI system, record the provider, model, version and route (direct API, cloud marketplace or embedded in another product). |
| 2. Tier by impact | Mark systems as critical, important or convenient. Plan most carefully for critical ones, such as anything customer-facing or time-sensitive. |
| 3. Test a fallback | A named alternative is not enough. Run it on real tasks. Different models behave differently, so repeat your quality, safety and bias checks before relying on it. |
| 4. Read the contract | Look for notice of suspension, notice of model changes and retirements, continuity commitments, data return and exit terms. |
| 5. Keep assets portable | Prompts, test sets, retrieval data and configuration should be stored in your own systems, in formats you can move. |
| 6. Decide who decides | Name who can order a switch, who informs customers and who informs regulators. Decide before the incident. |
| 7. Watch the signals | Assign someone to follow vendor notices, status pages and regulatory news for each critical provider. |
| 8. Rehearse | Run a short exercise at least once a year. Switch a non-critical system to its fallback and record what broke. |
Be honest about the fallback
Switching models can change accuracy, tone, safety behaviour and cost. If you promise customers certain levels of quality or human oversight, check that the fallback still meets those promises. Claims you cannot support after a switch are a risk of their own. This is the same logic behind regulators' growing interest in what organisations say about their AI, which we cover in our note on the FTC investigation into AI agents.
Where ISO/IEC 42001 fits
ISO/IEC 42001 expects you to manage the risks of AI systems across their life cycle, including those that depend on third parties. It asks you to understand your suppliers, define responsibilities, plan and control operations, and keep evidence. A supplier continuity plan is exactly that kind of evidence.
Two practical steps make it easier:
- Add provider, model and version fields to your AI inventory. Our guide to building an AI inventory shows the basics.
- Link each critical system to its fallback and its test date. When an auditor, customer or regulator asks "what if this fails?", the answer is already on record.
Start small
You do not need a full programme to begin. This week, list your five most important AI systems, write down which model and provider each depends on, and mark which ones have a tested fallback. The gaps will tell you where to spend your time.
If you would like help seeing where you stand, take the free AI Readiness Check or explore the LeadAI Assure journey.
This article gives general information and is not legal advice or a substitute for ISO/IEC 42001:2023 or professional advice. The events described are summarised from public reporting and the vendor's own statement.
Sources
- Anthropic, access to Claude Fable 5 and Mythos 5: https://www.anthropic.com/news/fable-mythos-access
- UC Today, Anthropic restores Fable 5 and Mythos: https://www.uctoday.com/security-compliance-risk/anthropic-restores-fable-5-and-mythos-what-enterprises-need-to-know/
- CASRAI, the first AI export-control action: https://www.casrai.org/news/anthropic-fable-mythos-export-control-suspension
- MarketScale, what the shutdown taught enterprises about AI as infrastructure: https://marketscale.com/industries/software-and-technology/fable-5-and-mythos-5-are-back-what-the-19-day-shutdown-taught-every-enterprise-about-ai-as-infrastructure