The event to study is the specific one. On June 12, 2026, US export controls were applied to Claude Fable 5 and Claude Mythos 5. Anthropic suspended access for all users - because real-time nationality verification was not possible, the suspension was total, global, and gated-tiers included. The controls lifted on June 30, 2026. Fable 5 returned globally from July 1; Mythos 5, the gated-tier sibling under Project Glasswing, was restored to some US organizations after the June 26 government approvals. Nineteen days, mid-flight, with the model in production at buyers who had routed it as a first-choice path.
The event matters because it is the first instance of a risk class that was theoretical before: the model off-switch. Not an outage (the provider is healthy, the model is healthy, the request is refused). Not a deprecation (scheduled, notice, replacement). A directive-driven suspension: externally imposed, total, on a timescale of weeks, with no SLA and no per-customer exception. The class now has one observed instance, and the instance is enough to size the question the contracts were not written for.
The risk class, separated from the two it is not
The routing design has to treat the off-switch as its own failure mode, because the two it resembles handle differently:
- An outage is provider-internal, short (minutes to hours), random, and covered by the SLA credit structure. The failover is the warm second provider, and the recovery is the provider's, not yours.
- A deprecation is provider-decided, scheduled (a 30-day class notice), directional (there is a replacement), and planned-for. The response is the migration, and the window is the notice period.
- The off-switch is externally imposed, long (days to weeks, observed: 19), total (all users, no per-customer carve-out at the first suspension), and not covered by the SLA's "failure" definition, because the provider's system is up - it is refusing on a compliance basis. The recovery is the regulator's, and the regulator is not in your contract.
The three have different durations, different recoveries, and different owners. The routing and the contract have to answer all three, and the standard vendor-risk register answers the first two and is silent on the third.
The contract question, itemized
The 19-day event sizes four contract gaps, and the gaps are the clauses:
- The "down" definition. The SLA's downtime window is measured against the provider's health checks, and a compliance suspension is a request-refusal, not a health-check failure. The clause to add: a directive-driven suspension is a service-unavailable event for credit and for the failover trigger, at the duration actually experienced.
- The force-majeure carve-out. The standard force-majeure covers the provider's inability to perform; the off-switch is the provider's ability-to-perform-impaired-by-directive, which is a different event, and the standard wording does not cleanly cover it. The clause to add: an external directive that suspends a routed model is a named event, with the buyer's remedies (the failover, the credit, the re-route) stated, not implied.
- The model-substitution right. When a routed model is suspended, the buyer's right to substitute a replacement model (at a stated price delta, at the buyer's quality bar) is the operational clause, and it is the one the 19 days priced. The substitution is not a "replacement" in the deprecation sense - it is an emergency re-route, at the suspension's duration, at the buyer's cost until the suspended model returns.
- The access-state notice. The gated tiers' access state (the Daybreak and Glasswing structure) can change without the model's rate card changing. The clause to add: a change in the access state of a routed model - gated, suspended, deprecating - is a notice event, with a stated window, so the buyer's re-route is reacting to a notice and not to a 404.
The routing answer
The routing answer is the failover design, with the off-switch added as a third trigger alongside the outage and the deprecation:
- The trigger set is three, not two. Outage (the health signal), deprecation (the notice), and suspension (the access-state change or the refusal pattern). The third is the one the standard design does not watch, and the refusal pattern (a gated or suspended model returning a compliance refusal, not a 5xx) is the signal that is visible and easy to miss.
- The substitution target is a qualified second, not the next-best. The off-switch's duration (weeks) is the duration the substitution has to hold, and a 30-day-class migration is not a 3-week hold. The qualified-second-provider design (a model class with a quality bar already met, a path already warm) is the hedge, and the failover-hidden-costs post is the price of keeping the second warm.
- The budget is the carry cost, sized to the 19 days. The carry cost of the qualified second (the warm-path spend, the dual-validation run) is the premium, and the premium is sized against the observed duration of the observed event, because the event is the only data, and the data is 19 days.
What to do
- Add the directive-driven suspension to the vendor-risk register as its own event, with the 19-day duration as the sizing number, and re-run the register against your routed models, per provider.
- Close the four contract gaps at the next renewal: the down-definition, the force-majeure carve-out, the substitution right, and the access-state notice. The gaps are the clauses the event made visible, and the event is on the record.
- Watch the access state of every routed model (the open / gated / suspended / deprecating field in the catalog) as a failover trigger, so the suspension is a signal and not a discovery.
- For the gated tiers specifically, the off-switch is a higher-severity event than the open tier's, because the gated tier has a second access path (the Glasswing-style approval) that a suspension can close, and the substitution for a gated model is a re-approval, not a re-route - the longest recovery in the class.