The terms of access can change

In 2024, Washington was pressing the Netherlands to restrict ASML’s servicing of chipmaking equipment in China. Chinese customers already owned the machines. The question was whether the Dutch manufacturer would still be allowed to help keep them productive.¹

ASML supplies lithography systems used to produce the microscopic patterns on chips. Keeping them productive involves much more than taking delivery. Its engineers plan maintenance around customers' production schedules. Spare parts are held near factories, and software helps identify where performance is falling short. The customer acquires a machine, but production continues to depend on a relationship.²

Restrictions had already limited which machines could be sold to China. Washington wanted them to reach servicing as well. In September 2024, the Dutch government expanded its licensing regime to cover additional equipment and specified service inputs. Applications would be considered individually; this was not a blanket ban on maintaining every ASML machine in China. But the manufacturer's agreement to provide particular support could not by itself establish that it could be supplied.¹

Chinese chipmakers still owned the machines, and ASML still had the expertise to maintain them. Permission to provide that support depended on decisions beyond either company.

Britain had encountered a different version of that problem four years earlier. In January 2020, it allowed Huawei a restricted role in its 5G networks. Huawei was already considered a high-risk vendor. Britain had nevertheless decided that a limited presence, supported by technical scrutiny, was a risk it could manage.³

In May, US restrictions reached the manufacture of Huawei-designed chips using controlled American technology, including production outside the United States. Huawei would have to find alternatives. The prospect of redesigned equipment undermined the basis on which Britain had assessed its security. The National Cyber Security Centre could no longer offer the same assurance about future supplies.⁴

By July, the government had reversed its position: no new Huawei 5G purchases after the end of 2020, and removal from 5G networks by the end of 2027. Digital Secretary Oliver Dowden estimated that the January and July decisions together would delay the rollout by two to three years and cost up to £2 billion.³ Installed equipment had not suddenly stopped working. The future supply and assurance behind the investment had changed.

Companion case: Huawei: the future was part of the purchase

The case begins in Australia in 2019, before Britain's reversal, when TPG abandoned a network rollout after its expected upgrade path was blocked. It follows what operators had invested in beyond the equipment and why changing suppliers, or even Huawei's recovery, could not simply give them back the choices they had lost.

The UK gave operators years to remove installed equipment. A company relying on a digital service can have much less time to respond. In July 2025, the European Union sanctioned Indian refiner Nayara Energy. Microsoft subsequently suspended services to the company. Nayara went to the Delhi High Court, arguing that paid licences had not prevented it from losing access to services and its own data. Microsoft restored the services days later.⁵

Nayara itself was sanctioned. The dispute concerned how that decision affected its digital services: a European measure had reached an Indian company through its American technology supplier. A commercial agreement between the two businesses did not settle what would happen.

What changes when AI becomes part of the work?

These types of dependencies did not begin with AI. But as organisations build AI into their operations, they are making new commitments to technologies, suppliers and services whose continued availability they do not control. The model is the most visible component. Beneath and around it sit processors and memory, semiconductor fabrication and equipment, cloud infrastructure, energy, networks, software and services.⁶

What organisations want from that system is increasingly the work itself: investigating a software problem, analysing a customer's circumstances, developing a product or carrying out a sequence of tasks. The attraction is more than a quicker interface. Work that was too costly, slow or scarce can become practical. A team can attempt something it could not previously justify, or promise a service it could not previously deliver.

The dependency grows with the opportunity. If AI helps an employee prepare an occasional first draft, losing it may be an inconvenience. If a company builds its service capacity around AI doing part of the work, losing access challenges the delivery promise. The same interruption can have very different consequences depending on what the organisation has built around the capability.

Fable and Mythos make those conditions unusually visible. In June 2026, Anthropic released two products based on the same underlying model. Fable 5 was for general use, with stronger safeguards around sensitive tasks. Mythos 5 made more of the capability available to vetted users. The difference was not simply what the model could do. It was what a particular user was allowed to obtain from it.⁷

Three days later, both were suspended. Anthropic said a US export-control directive restricted access by foreign nationals, including its own employees. It had no reliable way to verify nationality in real time, so a restriction on particular people became a withdrawal for everyone.⁸

For a company adopting the technology, the boundary could run through its own team. Legion LegalTech, a US company, challenged the restriction over its effects on its Canadian engineers. Later arrangements permitted access by non-US nationals working for approved organisations. Fable returned globally on 1 July after the model-specific controls were lifted.⁹

This was a short interruption of newly released products. It does not establish that businesses had already become unable to operate without them. It does establish a distinction that matters before they do: the organisation buying access and the people expected to use it may occupy different positions under the rules.

Permission to buy the capability does not necessarily settle who can do the work.

For a multinational business, staffing a project is then more than a question of finding people with the right expertise. The intended team may cross employers, jurisdictions and contractual relationships. A customer approval, a person's identity and permission for the intended use answer different questions. An arrangement that works for employees in one entity may not cover a contractor or delivery partner on the same project. The terms have to establish that; the commercial account alone cannot.

The boundary can also move without the service disappearing. When Anthropic restored Fable, it described stronger safeguards that sent certain requests to another model. It acknowledged that the changes also caught more benign coding and debugging requests.¹⁰ A customer could regain access and still find that some legitimate work was handled differently.

For the organisation, that makes continued usability more specific than an account remaining active. The relevant question is whether the people doing the work can still obtain the capability on which the work depends. Availability, permitted use and useful performance have to meet in the actual task.

There is a substantial benefit to preserve. Project Glasswing gave selected defenders early access to Mythos so they could find and repair weaknesses before attackers obtained comparable capability. A repair to widely used software can protect organisations that never receive the model themselves.¹¹ The opportunity lies both in what an organisation can do directly and in improvements made by the suppliers and specialists on which it relies.

Those benefits are also why access is contested. Capability useful for defence can be useful for attack. The supplier's safeguards, government restrictions and the customer's intended work meet in the same service. The risk is shared. The race is not. examines whether intervention can govern the wider danger. For the organisation using the service, an intervention can change its ability to deliver even when the wider threat remains.

Companion case: Fable and Mythos: who gets the head start?

A defensive head start became a dispute over who could use the capability. The case follows the interruption and return of access, the distinction between an eligible organisation and eligible people, and what changes when the provider no longer operates the model.

Keeping the capability involves a choice of responsibilities

A hosted model is a service the company continues to call on. The provider operates it, maintains safeguards and can respond to new threats. It also retains a practical means of changing or withdrawing access. Nayara shows that this continuing control is not new. With AI, the decision can reach the analysis or action being performed within the customer's own work.

Running a model independently changes that relationship. Open weights, the trained model's numerical parameters made available for others to run, can allow an adopter to operate a copy without asking the originator to serve each request. OpenAI's documentation for its gpt-oss models states that it cannot revoke access to released copies or subsequently impose additional safeguards on them.¹²

That does not make an open-weight model a substitute for every hosted capability. Nor does it remove legal, licensing, computing or infrastructure dependencies. The adopter takes on more responsibility for running, evaluating and securing the system. The choice concerns which useful capability it can sustain, and which work it is prepared to undertake to sustain it.

The historical record also cautions against treating international dependence as something simply to remove. In 2025, US restrictions on chip-design software supplied to China were lifted after about five weeks, amid wider negotiations that also involved Chinese rare-earth controls. Different countries held leverage in different parts of the system.¹³

For Ukraine after Russia's full-scale invasion, moving government data and operations into cloud infrastructure elsewhere in Europe helped protect them from attacks on infrastructure at home. Foreign providers became part of the resilience response.¹⁴ Dependence can create exposure, bargaining power or protection; a supplier's nationality does not tell the whole story.

An organisation therefore cannot judge its AI position simply by where the model was developed or where its data is held. It needs to understand the arrangement that makes the work possible. Two AI services may rely on the same underlying model. A locally operated model still needs equipment, power and people. A provider's continued service may depend on permissions that neither it nor its customer can guarantee.

As the company builds around the arrangement, continued access becomes part of the economics and capacity of the business.

Huawei's customers had invested in an expected future. Organisations adopting AI are doing the same, often through services that remain under someone else's continuing control. The task is to see what is becoming dependent while there is still room to shape the arrangement, not only when a changed rule makes the dependency visible.

Which part of the operating capability we are building could have its terms changed somewhere else?

A second question follows as those dependencies deepen:

If they did, would we know where the consequence would travel next?

Connected works

Some assembly required explains hosted AI services, operating a model, and the licences and dependencies involved in keeping the work running.

Sovereignty in a world of layered dependencies examines the choices countries are making about what to build, what to share and which dependencies to accept.

What the company knows follows what happens inside the organisation as AI takes on more of its work: whose knowledge shapes decisions, whose priorities prevail and whether the organisation keeps learning.

Board Considerations: Deciding before the terms are settled

Themes and questions for board and senior executive discussion, drawing on this Signal and related QURKI work.

Notes

Footnotes

1. From 2019, the Netherlands effectively prevented ASML from exporting its most advanced extreme ultraviolet (EUV) lithography systems to China. In 2023, Dutch controls extended to specified advanced deep ultraviolet (DUV) equipment. The September 2024 expansion brought additional DUV equipment within the Dutch licensing regime. Reuters, Targeting Chinese chips, US to push Dutch on ASML service contracts, 4 April 2024; Government of the Netherlands, The Netherlands expands export control measure for advanced semiconductor manufacturing equipment, 6 September 2024; Reuters, ASML needs licence to service some equipment in China, Dutch government says, 10 September 2024. The September controls concerned specified DUV systems and case-by-case licensing, not a blanket prohibition on servicing all ASML equipment in China. The September 2024 regulation and explanatory annex, particularly entries 3B801.f.5–6, 3D805–6 and 3E805–6, specify controlled equipment, software and technology; specially designed parts and accessories are also covered. Existing licences remained valid for their stated duration. ↩ ↩²

2. ASML, Customer support, sections on continuous support, parts, performance and training. The company describes its service model, including maintenance planned around production and spare parts held close to customer systems. ASML also trains customers’ engineers to maintain and operate the systems. ↩

3. UK Government, January 2020 telecoms decision, 28 January; Huawei to be removed from UK 5G networks by 2027, 14 July; Oliver Dowden’s statement to Parliament, 14 July. January policy excluded high-risk vendors from core functions and sensitive locations and capped their presence in access networks at 35%. July’s stated rationale combined the revised technical assessment, industry implications and wider geostrategic considerations. The estimated two-to-three-year delay and cost up to £2 billion were cumulative forecasts for the January and July decisions, not July alone or measured final costs. The announced removal deadline was the end of 2027. ↩ ↩²

4. NCSC, May 2020 sanctions analysis, 14 July 2020, paragraphs 9–11, 19–26 and 35–38. Existing equipment remained covered; current maintenance was unaffected. Future restrictions remained possible. The government’s removal timetable was distinct. ↩

5. Council of the European Union, 18th package of sanctions against Russia, 18 July 2025; Reuters, EU-sanctioned Indian refiner Nayara takes Microsoft to court over outage, 28 July 2025; Reuters, Microsoft restores services to Russia-backed Nayara Energy, 30 July 2025, syndicated by Investing.com and MarketScreener respectively. Nayara alleged loss of access in its court challenge. Restoration of the service did not resolve the legal merits of that dispute. ↩

6. ASML’s lithography systems sit deep inside the production of advanced semiconductors on which AI depends. The current memory build-out makes that especially visible. High-bandwidth memory (HBM), the fast memory used alongside AI accelerators, is built from advanced dynamic random-access memory (DRAM). Newer DRAM generations require increasingly sophisticated lithography, including greater use of EUV. ASML said in July 2026 that demand for HBM and other advanced memory was driving significant DRAM capacity expansion and that it expected memory-related system sales to grow by more than 75 per cent in 2026. ASML, Q2 2026 investor call transcript, 15 July 2026; SK hynix, SK hynix Introduces Industry's First Commercial High NA EUV, 3 September 2025; Micron, fiscal Q3 2026 prepared remarks, 24 June 2026, p. 6; Samsung Electronics, Samsung Electronics and ASML Expand Strategic Collaboration for Next-Generation Semiconductor Manufacturing, 8 September 2026. These sources establish ASML's increasing role in advanced DRAM production. They do not imply that the 2024 Chinese DUV servicing controls affected current HBM production. ↩

7. Anthropic, Claude Fable 5 and Claude Mythos 5, 9 June 2026. The company describes a shared underlying model with different safeguards and access conditions. These are its product and capability claims. ↩

8. Anthropic, Statement on the US government directive to suspend access to Fable 5 and Mythos 5, 12 June 2026; Redeploying Fable 5, 30 June, updated 1 July. The directive's scope and the verification difficulty are Anthropic's account, not the underlying government letter. Other Anthropic models remained available. ↩

9. Reuters, Legal tech firm sues US over order limiting foreign access to top-tier Anthropic models, 23 June 2026; Legal tech firm ends lawsuit after US restores access to Anthropic models, 6 July 2026; American Bar Association, June 2026 in Brief: Business Regulation & Regulated Industries. The business effects were Legion’s allegations. The account of access arrangements is reported, not the underlying government letter. Anthropic’s redeployment statement, updated 1 July 2026, records Fable’s return. The shared case distinguishes organisational eligibility, individual permissions and later identity verification. ↩

10. Anthropic, Redeploying Fable 5, sections on the timeline, safeguard updates and cybersecurity safeguards. Anthropic describes an additional classifier, fallback to Opus 4.8 and increased flagging of benign coding/debugging requests. The statement describes product behaviour after restoration, including effects on legitimate requests. ↩

11. Anthropic, Project Glasswing, 7 April 2026. The programme's stated purpose was to give defenders time to identify and repair vulnerabilities before comparable capability became more widely available. ↩

12. OpenAI, gpt-oss-120b & gpt-oss-20b Model Card, 5 August 2025, web introduction. OpenAI describes its inability to revoke access or impose later mitigations on released copies, and the additional safeguards some operators need. This establishes a difference in continuing control, not equivalence with Mythos or exemption from applicable law. ↩

13. Synopsys statements of 29 May and 2 July 2025 on the US Bureau of Industry and Security (BIS) restriction and its rescission; Reuters, As trade war truce with China holds, US lifts curbs for chip design software and ethane, 3 July 2025. The restrictions and their removal formed part of wider trade negotiations involving several products and supply chains. ↩

14. Microsoft, Defending Ukraine: Early Lessons from the Cyber War, 22 June 2022; Extending our vital technology support for Ukraine, 3 November 2022. The example distinguishes conflict exposure from deliberate use of a technology dependency as leverage. ↩