A cloud assistant has a switch, and you do not hold it. The switch is thrown by an outage, by a rate limit, by a deprecation notice or by a policy change. Each is routine for the vendor. Each stops your team at the same moment, with the same message on the screen.
3 September 2026: three vendors, one morning
On Thursday 3 September 2026, Axios reported that OpenAI’s ChatGPT, Anthropic’s Claude and xAI’s Grok were “all down Thursday morning”, and noted that “it’s unusual for all three to go down at once, especially as the world increasingly relies on AI models.” Computerworld put durations on it: Claude for about four hours from 7:37 a.m. ET, Grok for about three and a half hours, ChatGPT for about two hours from around 11 a.m. ET.
The analyst Carmi Levy told Computerworld that organisations were left “uncomfortably exposed” and that “too many organizations are about to learn some hard lessons about not having a backup plan in place.” The article’s headline drew the conclusion for enterprises: they “need a backup plan”.
Read that morning from a bank’s operations floor. Every workflow that called an AI model paused. Nobody in the building could do anything about it, and nobody in the building knew when it would end. The status page belonged to someone else.
13 February 2026: the model was retired
An outage ends. A retirement does not. OpenAI’s help centre records that “as of February 13, 2026, ChatGPT retired the following models: GPT-4o, GPT-4.1, GPT-4.1 mini, OpenAI o4-mini”, and GPT-5 with them. On 11 March 2026 the GPT-5.1 family followed. On the API side, the deprecations page lists the chatgpt-4o-latest snapshot removed on 17 February 2026, and a gpt-5.4-cyber model scheduled for removal on 1 October 2026.
None of this is bad practice. A vendor that ships better models must retire old ones. But every prompt your team tuned, every test your compliance function approved and every training session you ran was against a model that no longer exists. The replacement behaves differently, and you validate it again on the vendor’s timetable, not yours.
An outage is the vendor’s bad day. A retirement is the vendor’s good day. Your team is stopped by both.
What a regulated buyer has to write down
- DORA treats the AI vendor as an ICT third-party provider. The register of information wants to know what happens when the provider stops, and the exit plan has to be, in the regulation’s words, “sufficiently tested”. A cloud assistant’s exit plan is a second cloud assistant, which shares the same switch.
- A hospital’s clinical letters and a court’s registry work do not pause because a status page in California is yellow. The process either has a local fallback or it has a queue of people waiting.
- Nothing forces you off the cloud. The honest statement is narrower: whoever holds the switch decides your availability, and you should know who that is before the morning it matters.
With Bastion
What Bastion changes
Bastion runs the model inside your building. There is no vendor outage between a desk and the server room, and the model changes only when you accept a refresh. The exit plan ships with the box: your documents, your index and your logs leave in open formats, and the model weights are open weights.
The limit, stated first: a box can fail too. It is one machine, and one machine has a power supply and a disk. Bastion ships a spare power supply with every unit and rents, so a failure is a whole-unit swap on our account. It is a different switch, not the absence of one, and you hold it.
On the record
- 1
- 2
- 3
- 4