How hard an AI system is to remove is becoming the true measure of how much authority it holds. The Pentagon needed roughly eight months to take one vendor's AI model out of its core intelligence platform, and New York City is drafting shutoff-switch rules because the big AI labs could not tell a hearing room how they measure the chance of a catastrophe. Utah is letting a startup prescribe medicine using AI, with human oversight that loosens only as evidence builds up. Microsoft is selling "sovereignty," which is another way of saying the right to walk away. Each of these comes down to whether you can check, limit, and reverse what an AI system does once it is built into your operations.
What changed since yesterday's preview is the testimony.
Senior representatives of Anthropic, OpenAI, Google, and Meta testified under oath at a hearing that lasted several hours, with about 30 council members questioning them on topics from job losses to protections for artists, as the Council introduced 10 pieces of legislation. The representatives stressed their commitment to safety but could not guarantee that their AI models will always follow safety guardrails or that their companies would accept legal responsibility for any resulting harm. SpaceXAI, the only company called that did not attend, had been subpoenaed (ordered to appear) on September 28. USA Today Asked by Speaker Julie Menin how the companies measure the chance of a catastrophe, OpenAI's Morgan Dwyer said, "I don't know. I also don't think it matters whether it's 1% or 10% or 20% chance that something catastrophic will go wrong. None of these levels is remotely acceptable." Menin replied that she was "incredulous at that answer" and called it "flippant, at best." USA Today She later said, "I'm going to take it then that neither of the four of you, no company here, can quantify the risk of something cataclysmic happening," calling the answers "troubling at best." Of the 10 bills, USA Today describes a whistleblower program paying up to 25% of money recovered and a requirement for a "kill switch" in any AI system used in the city. Outside witnesses included former Google DeepMind researcher Alex Turner, who warned that "we are racing to build and grow our own adversary here at home, which is misaligned AI," and former Anthropic researcher Jacob Coxon, who testified that humanity losing control "is more likely than not" on the current path. CNBC
The headline is that no witness for the four labs offered a number, and the Speaker treated that gap as the finding. A regulator who cannot get a probability from the vendor will write the rules around the controls of the company using the AI, which is where the kill switch and the reporting deadlines come from. For your company the relevant question is smaller and answerable: for each AI system you run, what is the worst plausible failure, what would it cost, and who could stop it within an hour. Write that down for each system. A documented estimate, even a rough one, puts you ahead of the position the labs took in the room.
A Defense Department representative told the BBC that the Pentagon "has discontinued the use of Anthropic products," following the department's February decision to label Anthropic a potential supply-chain risk to national security.
The BBC reports that the Pentagon had urged Anthropic to remove safety limits from its Claude AI model and that Anthropic declined, citing concerns about mass surveillance and autonomous weapons. Anthropic has challenged the label in court and did not respond when asked for comment on the announcement. BBC Sources told the BBC that Claude was still in use as recently as last week for research, analysis, and intelligence work, including activities related to Iran, even though Defense Secretary Pete Hegseth had indicated the military would stop working with the company by the end of August. Claude had been built into Palantir's Maven Smart System, the Pentagon's main platform for organizing intelligence data, and the department has contracts with Google, xAI, and OpenAI. A senior analyst and former U.S. defense official quoted by the BBC said, "the fact that it took the Pentagon until now to eliminate all use of Claude from the system suggests that these tools are not easily interchangeable," adding, "once integrated, the removal process can be complicated." BBC
The dispute itself is contested, and the lasting lesson is about the cost of switching. An AI model that reaches the data platform your analysts use every day takes months to remove even when leadership orders it and a replacement is under contract. Most companies have written no exit plan for any AI vendor. Do it now: for each model built into a workflow, document where it is called, what depends on its answers, how long a swap would take, and which alternative has been tested. If the answer for any critical workflow is longer than a quarter, treat that as concentration risk, in the same category as relying on a single supplier for a key part.
An AI model that sits inside the system of record stops being a tool and becomes infrastructure, which is how an AI vendor gains lasting power over its customer. The Pentagon's responsibility for deciding what its systems may be used for collided with a supplier's own usage limits, and its remedy was a slow replacement of one built-in model with others. The lesson is to avoid depending on a single AI vendor by keeping your data, tests, and workflow logic outside any one model.
Nolla Health launched Nolla Derm, an app for Utah residents 18 or older with mild-to-moderate acne that analyzes a face scan and can write a prescription on its own, for $4.99 a month.
Nolla says it is the first in the country to issue first-time prescriptions by AI rather than renewals, and that it will send users to a physician if the AI cannot "confidently select a treatment." Oversight is staged: two physicians approve each prescription for the first 100 patients, physicians then review prescriptions after they are issued for up to 500 patients, and afterward they review a sample of at least 10% every month plus every case involving a problem or side effect. Bloomberg reported that the AI can currently prescribe eight skin treatments. The Verge The pilot runs inside Utah's AI "sandbox," a program in which the state's Office of Artificial Intelligence Policy can waive regulations, including those on the practice of medicine, for companies tested under supervision. STAT reports that, responding to critics, the state will require third-party audits of company claims as it expands the sandbox. STAT
This is the first working model of how autonomy can be earned through evidence: a fixed number of fully supervised cases, a larger group reviewed after the fact, then regular sampling with required hand-offs to a person. The numbers are specific and checkable. You can borrow the structure for any AI agent that touches money, customers, or regulated advice. Define the supervised volume, the review sample rate, the triggers that send a case to a human, and the outside party who audits the claims, then publish them internally before launch. Compared with the New York hearing, this is what a real answer to the question "how do you know it is safe" looks like.
Microsoft published a sovereign AI framework with NVIDIA on October 5, defining sovereign AI as "the design, deployment, and operation of AI workloads under defined controls for data, access, governance, infrastructure, and operations." The framework rests on four principles: control, choice, flexibility, and resilience.
Microsoft offers Sovereign Public Cloud and Sovereign Private Cloud options, the latter built on Azure Local and Foundry Local with connected, sometimes connected, and fully disconnected setups, along with NVIDIA Confidential Computing and NVIDIA AI Enterprise. The post is Microsoft's own thought leadership and describes its offering, not independent findings. Microsoft Microsoft says the requirements of each workload should drive decisions on where data can be processed, who holds administrator access, what must keep running if connectivity is cut, and how easily models or infrastructure must be changed. NVIDIA's Dave Salvator said organizations need "accelerated computing, software, and model choice that can follow those workloads across cloud, data center, and edge environments." Microsoft
Read the four principles as a vendor-supplied checklist for the exit-plan work the Pentagon story says you need. The questions Microsoft lists, who has administrator access, what must continue offline, how easily models can be swapped, are the right ones whichever vendor you choose. Sort your workloads into those that must run under local control, those that can use public cloud, and those that need to keep working with no connection, then score each candidate platform, including Microsoft's, against that grid. Expect sovereignty tiers to carry a price premium, and ask what you give up in model choice to get them.
Palmer's "AI May Not Speak in 1st-Person" (September 29) covers Florida Attorney General James Uthmeier's 39-page motion in Highlands County circuit court seeking to bar ChatGPT from Florida minors, ban it from referring to itself with first-person language, and stop OpenAI from developing any model "without independent third-party guardrails and approval" while the state's June lawsuit proceeds.
Shelly Palmer Palmer contrasts an industry-wide slowdown, which the labs have sought, with a court order against one company, in one state, on one attorney general's timeline, and notes that OpenAI has paused training its most capable models for the second time since July. The practical point for business leaders is that restrictions can arrive through a single state's consumer-protection law, with little warning, which is why the exit and shutdown plans in today's other stories matter.
Add a question to every AI investment review: how long would it take to stop this system, and how long to replace it.
The Pentagon's eight months and New York's kill-switch bills show that reversibility is now a board-level property of an AI program. Set a target, such as the ability to switch any critical process to a tested alternative within 90 days, and fund it.
Exit and control are becoming products.
Sovereign cloud tiers, tools that work with any AI model, independent auditors, and staged-autonomy frameworks are all being priced as ways to reduce dependence. The labs' refusal to put a number on risk pushes regulators toward rules for the companies that use AI, so expect requirements to attach to anyone who puts AI into service in a regulated city, state, or industry, whichever vendor supplied the model.
Adopt a staged-autonomy standard for AI agents: supervised volume, sampled review, defined hand-off triggers, and a named auditor, modeled on the Utah pilot's numbers.
Pair it with a vendor exit runbook that lists every built-in model, what depends on it, and the tested replacement. Assign an owner for each.
Put a price on the exit.
For each critical AI vendor, estimate the cost and duration of a forced replacement and carry it as a contingent exposure. Compare the extra cost of sovereign and private-cloud options against that figure, since the premium is cheaper than an eight-month extraction under pressure.
Keep your prompts, tests, data connections, and workflow logic in your own tracked systems and call models through a common layer, so a swap changes a setting instead of the architecture.
Maintain a standing test suite that can score a candidate replacement on your own tasks within days. Build and test a human-operated shutdown for every AI system in use.
Ask management for three items: each critical AI system's worst plausible failure with a cost estimate, the time to replace its vendor, and the supervision schedule under which the system acts alone.
The testimony in New York showed that a company unable to answer these questions in public is exposed in public.
Today's stories show that authority over AI systems is being measured by how hard they are to stop, replace, and supervise. A hearing room could not extract a risk number from four labs, a defense department took months to remove one model from one platform, and a state regulator is letting a startup earn autonomy in stages. The assumption this breaks is that adopting an AI system is a one-way convenience decision. The choice this forces is whether you will design the ability to reverse and the stages of supervision into your AI program now, or discover their absence when a regulator, a supplier dispute, or a court order demands them.
If your most important AI vendor became unavailable next quarter, how long would your business take to run without it, and who would you call first?
**Build the harness. Price the outcomes. Redesign the org.**