Last Friday, the President of the United States ordered every federal agency to stop using Anthropic’s Claude AI immediately. Hours later, the US military — which relied on Claude for intelligence analysis and operational planning — launched strikes that made the ban operationally impossible.

The ban was walked back to a six-month phaseout before the weekend was over. Not because anyone changed their mind about the politics. Because the military literally couldn’t operate without it.

That’s the story everyone’s covering. But the story that matters to you is different: if the most powerful organisation on earth can’t switch AI providers overnight, what makes you think your business can?

How we got here

The details matter less than the pattern. Anthropic had a $200 million contract with the Pentagon that included specific restrictions: no autonomous weapons, no mass surveillance (the kind of governance guardrails every AI deployment needs). When the military used Claude in ways that crossed those lines, Anthropic pushed back. The government pushed harder. Anthropic held firm. The government banned them.

I’m not interested in who was right. I’m interested in what happened next.

What happened next was chaos. The military needed a six-month transition period because Claude was embedded in intelligence workflows, battlefield simulations, and operational planning. Systems built around one AI provider couldn’t be rewired over a weekend, even with a direct presidential order.

Pay attention to that part.

When did AI become infrastructure?

Every technology has a moment where it shifts from “tool we use” to “infrastructure we depend on.” Email crossed that line decades ago. Cloud computing crossed it about ten years ago. AI crossed it sometime in the last eighteen months, and most businesses didn’t notice.

Think about how your organisation uses AI right now. Not the headline stuff — not the chatbot on your website or the content generation you could do manually if you had to. Think about the processes that have quietly reshaped themselves around a specific AI provider.

The customer service team that’s built escalation workflows around GPT-4’s output format. The development team whose entire code review process assumes Copilot. The marketing department that’s trained for six months on Claude’s specific capabilities and limitations. The finance team running analysis through models they’ve spent months prompt-engineering to get right.

Or consider the millions of businesses using Microsoft Copilot — not because they evaluated it against alternatives, but because it came bundled with their Microsoft 365 licence. Nobody made a strategic decision to adopt it. It just appeared in the toolbar one day, people started using it, and now workflows depend on it — a pattern I explored in the acceleration trap.

That’s not adoption. That’s drift. And it’s happening everywhere.

Dependencies that grow organically are the most dangerous kind, because nobody made a conscious decision to become dependent. And the governance problem runs deeper than vendor risk — agents will ruthlessly optimise whatever metrics you give them, including the ones you didn't intend.

Three kinds of lock-in

Traditional vendor lock-in is contractual. You signed a three-year deal, there’s an exit penalty, you know what you’re in for. AI vendor lock-in is different. It’s technical, operational, and cognitive — and it builds without anyone signing anything.

Technical lock-in happens at the code level. Your integrations use provider-specific APIs. Your prompts are optimised for one model’s behaviour. If you’ve fine-tuned anything, that work doesn’t transfer. Your vector databases are built around one provider’s embedding space. Switching means rebuilding, not reconfiguring.

Operational lock-in is the process problem. Your team has built workflows, decision trees, and quality benchmarks around a specific AI’s capabilities. Swapping providers means every process that touches AI needs redesigning and retesting.

Cognitive lock-in is the least obvious. Your people have developed intuitions about what works. They know how to phrase requests, where to push, when to override — the kind of context engineering that takes months to develop. That knowledge — months of accumulated understanding — resets to zero with a new provider.

The Pentagon discovered all three in a single weekend. The rest of us just haven’t had our weekend yet.

This isn’t theoretical

Huawei went from the world’s largest smartphone manufacturer to losing 75% of its market outside China after government restrictions. Kaspersky went from 15% US market share to less than 5%. TikTok has been in a state of perpetual uncertainty for six years.

Those were foreign companies caught in geopolitical crossfire. Anthropic is an American company, headquartered in San Francisco, and it still got blacklisted.

The lesson isn’t that governments are unpredictable. It’s that the reasons your AI provider might disappear are far more varied than you’ve imagined. Political disputes. Acquisition. Bankruptcy. Policy changes. Safety incidents. A pricing restructure that makes your use case uneconomical. A pivot that leaves your industry underserved.

You don’t need a presidential executive order to lose your AI provider. You just need any one of a dozen things that happen to technology companies every year.

The boring fix

The fix isn’t complicated. It’s the same principle that drives every resilience strategy: don’t build critical infrastructure on a single point of failure.

Build an abstraction layer. Put something between your code and your AI provider. Tools like LiteLLM and Portkey act as gateways — your applications talk to them, they talk to whichever provider you choose. Switching providers becomes a configuration change, not a rewrite. One organisation documented a 30% cost reduction just from being able to route requests to the best provider for each task.

Test your second option. Having a backup provider on paper is worthless if you’ve never actually used it. Run a percentage of your workload through an alternative. Learn where the differences are before you need to know urgently.

Keep your prompts portable. The more you rely on one model’s specific quirks, the harder migration becomes. Write prompts that express what you want clearly rather than exploiting one model’s particular tendencies. The best prompts work well everywhere.

Map your dependencies. Most organisations have no idea how deep their AI integrations run. Spend an afternoon mapping every process, tool, and workflow that touches AI. You’ll be surprised. The Pentagon was.

Negotiate your exit. If you’re on an enterprise contract, get data portability and migration assistance written in. If your provider won’t discuss exit terms, that tells you something important about how they view the relationship.

None of this is rocket science. But then neither is keeping a spare tyre in your car, and plenty of people drive without one until they’re stuck on the hard shoulder at midnight.

The Anthropic story will be remembered for the politics. The consumer revolt, the App Store drama, the employees signing open letters. That’s compelling, but it’s a different article.

But the business lesson is simpler and more durable: AI has become infrastructure, and most organisations are running critical operations on infrastructure they don’t control, can’t replace quickly, and haven’t tested alternatives.

The US military — with unlimited resources and six months’ notice — described switching AI providers as a challenge requiring “seamless transition.” Your business, with a fraction of those resources and probably zero notice, would face something considerably worse.

The question isn’t whether this will happen to your AI provider. The question is whether you’ll have a plan when it does.