IT sovereignty isn’t one problem: it’s two, and most public conversation conflates them.
The first lens is physical: where data and infrastructure actually sit. For the most sensitive categories — defence, health, intelligence — storing data domestically is treated as the baseline. But physical location alone doesn’t protect that data from actors outside a country’s borders.
The second lens is control: who operates the infrastructure, and who do they ultimately answer to. This is the harder question. Infrastructure sitting in an Australian data centre but owned and operated by a US multinational — Microsoft, Amazon, Google, Anthropic — remains under that parent company’s authority, and by extension, the US government’s. The parent company can revoke access at its own discretion, or under instruction from Washington.
That’s no longer hypothetical.
Anthropic’s Model Suspension
On Friday, 12 June 2026, Anthropic received a letter from the US Commerce Department’s Bureau of Industry and Security. Signed under the authority of Commerce Secretary Howard Lutnick, it directed the company to suspend access to two of its newest models — Claude Fable 5 and Claude Mythos 5 — for any foreign national anywhere, including Anthropic’s own foreign-national staff.
Anthropic had no practical way to identify a user’s nationality in real time across a global base of hundreds of millions of accounts. So it didn’t try to segment this access at the risk of getting this wrong.
Because of this, it pulled both models entirely for every customer on every platform: the direct API, AWS Bedrock, Microsoft Foundry (and by extension GitHub Copilot, which runs on it).
Any system with a hardcoded call to those two model identifiers started failing the moment the switch flipped — with no warning, no graceful degradation.
The stated cause, according to Anthropic’s own account, was a narrow jailbreak technique that could surface some of the cybersecurity capabilities the company had deliberately restricted in Fable 5’s public release.
Anthropic pushed back hard on the proportionality of the response, stating publicly that it believed the same technique works against other publicly available models — including OpenAI’s GPT-5.5 — which face no comparable restriction.
Fair call by the US Government, or politics at play?
Reporting since the event suggests the White House does not currently intend to extend this kind of action to other AI companies.
That selectivity matters.
Some coverage has tied the directive to a deteriorating relationship between Anthropic and the administration dating back to February 2026, when failed contract negotiations over military use of Claude reportedly led to federal agencies being directed to stop using Anthropic’s technology.
If it holds up, the clean story of “any model judged objectively risky enough gets switched off” isn’t quite right.
The messier, more accurate version is closer to: a company with a strained relationship with its home government had a tool pulled under a national-security rationale that, by the company’s own telling, doesn’t clearly distinguish it from an untouched competitor’s product.
That’s a harder risk to model and hedge against than a predictable capability threshold.
This is the more important lesson here.
Was anyone actually relying on these models?
It’s worth being precise here.
Mythos 5 was genuinely restricted. Distributed to a small, vetted partner base inherited from the earlier Mythos Preview program, reportedly around 150 organisations across finance, software, and healthcare, granted access specifically for production-relevant uses like cybersecurity defence and critical-infrastructure monitoring. That’s a narrow population, but a real one, doing real operational work.
Fable 5 was widely distributed, even if only briefly. It only became generally available on 8 June (four days before the suspension) but launched immediately across the Claude API, AWS, Microsoft Foundry, GitHub Copilot, and every Claude subscription tier. Plenty of teams were almost certainly trialling it in production-adjacent workflows within days of release. What limited the damage wasn’t a lack of exposure: it was a lack of time. Four days isn’t long enough to test and deploy on new AI models, however fast AI adoption has become.
That distinction matters for what comes next: the contained fallout from this event was a function of lack of time that restricted adoption, not of the underlying technology being weak.
Could the plug be pulled for other models like Sonnet or Haiku?
Legally, yes.
The authority being invoked — Commerce’s national-security export-control power — isn’t written to apply only to frontier-labelled models by name; it’s a general power applied, in this instance, to whichever model the government judged posed a risk. Legal and policy commentary on the action has noted the decision wasn’t based on any published testing process or agreed capability threshold. By most accounts, it was ad hoc.
There’s a countervailing signal too: a separate AI executive order from 2 June directs Commerce, Treasury, and Defense to build a classified benchmarking process within 60 days, specifically to define what counts as a “covered frontier model” for actions like this one.
If that threshold lands above where Sonnet and Haiku sit, it would functionally protect them. But only for now.
Capability thresholds move, and a future Sonnet-class model could plausibly carry capabilities that today only exist in the Mythos tier.
The protection these models have right now is relative “not currently the most capable model implicated in a specific risk” not a structural exemption tied to the model’s name.
If a similar capability ever reached a workhorse-tier model, the calculus changes completely. Sonnet and Haiku-class models are the default production layer across the economy — coding agents, customer support, document processing, internal copilots — embedded not just in companies that call the API directly, but in every SaaS product quietly built on top of it.
A four-day-old model like Fable going dark is a mere inconvenience.
A foundational, multi-year-embedded model going dark with no warning is more like a complete supply-chain shock.
What could these scenarios look like?
Scenario 1: US hard-line stance on AI access on National Security grounds
The classified benchmarking process due under the 2 June executive order lands with a broad definition of “covered frontier model”.
Scope: Catches not just Anthropic’s most capable models, but equivalent-tier models from OpenAI, Google, and others, across multiple vendors at once. Unlike the Fable/Mythos action, which left every other Claude model running, this scenario assumes the restriction reaches the existing production layer: Sonnet, Haiku, GPT-class, Gemini-class models.
Impact: This is close to the most severe outcome for one specific reason: the mitigation businesses can deploy today, multi-vendor diversification, stops working the moment a restriction applies industry-wide rather than to a single company.
Mitigations: What would actually cushion the blow is whatever open-weight, self-hosted capacity already exists on Australian soil — right now, that capacity is thin. The sovereign-cloud initiatives currently underway are still early-stage, and most Australian businesses running AI in production have built around one or two API-based vendors rather than a genuine self-hosted fallback.
This scenario is the strongest case for treating open-weight self-hosting as infrastructure to build now, not a contingency to figure out later.
Scenario 2: AI access as a sanctions lever
AI access becomes one lever in a broader dispute unrelated to AI itself — a trade disagreement, a diplomatic rupture, a divergence over a security commitment. The US response includes restricting AI services to Australia specifically.
Scope: AI capabilities provided by US hyperscalers and US-headquartered providers. However, these sanctions may not just stop at AI but may cover more traditional SaaS services such as Stripe, accounting software and cloud infrastructure.
Impact: If this played out, the disruption would land closer to an economic shock than a technical outage that would hit broadly and immediately.
Mitigations: Similar to scenario 1. However, targeted restrictions in this manner have historically tended to accelerate a country’s push toward alternative-source capability — but that’s a multi-year response to an event that would land in days.
Scenario 3: A vendor’s own commercial withdrawal
Anthropic decides, on its own initiative rather than under government direction, that the Australian market isn’t worth a future compliance burden — a standoff in the spirit of Meta’s dispute with the Australian government over the News Media Bargaining Code, but applied to AI-specific regulation instead.
It’s the most ordinary from a business-risk perspective: a commercial decision rather than a national-security directive, which means it responds to normal levers — contract negotiation, regulatory adjustment, competitive pressure from vendors with every incentive to capture an abandoned market.
Scope: Specific vendors (Anthropic in this case) rather than broad AI access. Though other vendors providing similar services may follow suit quickly.
Impact:Â It would still disrupt any Australian business that had built critical workflows specifically around Claude.
Mitigations: The mitigation here is closer to standard vendor-risk management than to sovereignty policy: multi-vendor architecture protects against this scenario almost completely.
Can Australia realistically build its own models?
Not at the frontier level, and it’s worth being honest about why rather than leaving it open.
Frontier training now costs hundreds of millions of dollars in compute alone, requires cluster-months on tens of thousands of specialised GPUs, and draws on a talent pool concentrated in a handful of labs.
That scale is currently sustained only by the US and China. Even well-funded national efforts in the EU, Japan, and the Gulf states are modest by comparison.
A useful reference point: India’s Sarvam model was trained on a few thousand GPUs over a few months under the IndiaAI Mission. This is a credible national effort, but nowhere near frontier-competitive, from a market far larger and with far deeper compute commitment than Australia’s.
CSIRO’s Data61 is the obvious candidate to test this against, and the honest answer is layered. Data61 is genuinely substantial — roughly 1,000 staff and affiliates, one of the larger AI and data science research bodies globally, with real depth in applied AI, robotics, and cybersecurity.
Its recently launched Vetra platform, built for sovereign edge-AI computing in robotics and physical systems, is a good example of where its strength actually sits.
But that strength is applied and infrastructure-adjacent, not foundation-model training at scale.
CSIRO’s own foundation models report, led by Director Elanor Huntington, makes essentially this case directly: sovereign AI capability matters, reliance on foreign models carries genuine security and reliability risk, but the realistic path for Australia is fine-tuning existing models and building public-sector-specific applications on sovereign infrastructure, not training a frontier competitor from scratch.
Of roughly 125 foundation models that exist globally, 73% come from the US and 15% from China; the remainder is split across the rest of the world combined.
That’s the honest scale problem.
What are the realistic middle-ground options for establishing sovereign AI?
Sovereignty isn’t one thing: it splits into four layers:
- Data sovereignty (where information sits, under whose law),
- Compute sovereignty (who operates the infrastructure),
- Model sovereignty (independence from any single vendor), and
- Policy sovereignty (who sets the rules).
Frontier-model independence is only one layer, and arguably the least achievable one for a country Australia’s size. The other three are where the real options sit:
Compute sovereignty
Building and operating in-country data centres and GPU clusters, even while running other vendors’ models on them.
This is where most current Australian activity actually sits: the National Reconstruction Fund’s $1 billion Critical Technologies Fund has already backed this directly, including a $200 million investment in Macquarie Technology Group specifically to keep critical digital infrastructure and data securely onshore, alongside a SambaNova–SouthernCrossAI partnership building what’s billed as Australia’s first sovereign AI cloud.
Open-weight self-hosting
Running models like Llama, Mistral, or Qwen on domestically controlled infrastructure. Once weights are downloaded, there’s no remote kill switch. This won’t match frontier capability, but it can’t be revoked by a foreign directive either.
Multi-vendor diversification
Not single-sourcing critical workflows from one lab, so one export action removes an option rather than all capability.
Negotiated, treaty-based access
AUKUS and Five Eyes are the obvious route, comparable to UAE securing negotiated co-production and security-partnership access to US technology.
The caveat worth being blunt about: alliance membership has a documented history of export-licensing friction even between close partners. The actual Fable/Mythos directive carved out no exception for allies, or even for foreign nationals working inside US companies. This has to be actively negotiated into something contractual — not assumed to follow automatically from alliance status.
What’s actually happening in Australian policy right now?
There’s more here than an “is anyone even asking this” framing suggests — it’s just not asking the right question yet.
The National AI Plan includes an active compute-mapping workstream to assess Australia’s infrastructure and guide investment. The National Reconstruction Fund is putting real money into sovereign cloud and infrastructure.
These are genuine, funded sovereignty conversations. It’s however mostly framed around economic resilience and compute capacity.
What doesn’t appear in current public policy is sovereign control: prevention of a foreign government using export control law as a lever against a vendor, that Australia’s economy has come to depend on.
The infrastructure conversation is happening. The access-denial conversation isn’t — at least not publicly, and not yet.
What businesses can do without waiting for Canberra
Policy will move at policy speed. Individual businesses don’t have to wait for it.
The practical mitigation isn’t really about predicting which model tier gets hit next, it’s architectural:
- Don’t hardcode critical workflows to a single model from a single vendor in a single jurisdiction.
- Build fallback routing across providers.
- Where the workload allows it, keep an open-weight option running on infrastructure you control, even as a lower-capability fallback. The same way organisations keep a manual process documented for when the primary system is down.
None of this requires a government decision. It requires treating model dependency the way mature organisations already treat cloud-provider dependency: as a risk to be actively managed, not a default to be assumed.
The open question
Australia has a compute-sovereignty conversation, and it’s reasonably mature.
It does not yet have an access-sovereignty conversation. One that takes seriously the fact that a foreign government can, with a written letter, switch off a capability an entire economy depends on, for reasons that don’t have to be consistent, public, or predictable.
Until that conversation starts, every business and government agency running critical workflows on a single foreign vendor’s API is operating on borrowed certainty.
