Rented Model Risk.
The AI your firm runs on can be switched off by people you will never speak to. Most firms think they bought a tool. They rented a seat.
A leading AI lab released its most capable models. Three days later they were gone.
Not deprecated with six months' notice. Not raised in price. Gone — worldwide, for every customer, on roughly ninety minutes' warning, by government order. Sessions that were running simply ended. Work stopped mid-task. The firms that had built a process around that capability had no say in the decision and no notice before it landed.
The cause did not matter to any of them. A safety bypass someone else published. A competitor's phone call. A letter from Washington. None of it was something the customer did. None of it was something the customer could appeal.
And here is the part worth sitting with. It was not a failure. The system worked exactly as designed. That is the problem.
Two questions, and firms only ask one.
Most firms ask one question about their AI: where does the data go? It is the right question. It is also only half of one.
There is a second question. Most firms do not ask it until the answer costs them something. Where does the decision happen?
Not where the data rests. Where the model runs when it reads a file and produces an answer someone will act on. These are two different places. Two different sets of terms. Two different kinds of failure.
A firm can have airtight data residency and still control nothing about how its AI behaves, or whether it keeps working tomorrow. The gap between the two is where the risk lives. In June 2026, that gap stopped being theoretical.
What rented model risk is.
When your AI runs on someone else's infrastructure, under someone else's terms, you are not a customer of a tool. You are a tenant. The capability is real, the convenience is real, the invoice is real — but the thing you depend on lives in a building you do not own, and the lease can be ended by a landlord you have never met, for reasons you will never be shown.
That is rented model risk: the exposure you carry when the capability your operation runs on can be revoked by a party outside your control, at a time not of your choosing.
It is not the same as a vendor going down. An outage ends. This is structural. The right to keep using the thing was never yours. You were renting it, one session at a time, and the terms of the rental include a clause no one reads until it is invoked: this can be taken away.
Here is what the vendors will not say.
The companies selling rented AI have no reason to raise this, because it is the one thing they structurally cannot fix. Their entire model is access to a capability they hold and you borrow. Telling you the borrowing is the risk would be telling you not to buy.
So the conversation goes everywhere else. Is the model accurate. Is the data encrypted. Does the vendor hold the right certifications. Real questions, all of them. And all of them assume the system will still be there — that the thing you built your process on keeps running because you are paying for it.
That assumption is the exposure. The most disciplined governance program ever written is worth nothing if the governed system can be shut off by someone outside your building. You can hold every certification on the wall and still be a tenant.
It is also a proof problem.
Rented model risk has a quieter cost than the shutoff. It shows up the day an auditor or an underwriter asks the question every regulated firm eventually hears: prove what your AI did.
When the model runs on someone else's infrastructure, you can describe what it was supposed to do. You can produce the policy, the configuration, the vendor's compliance documents. What you usually cannot produce is what actually happened at the moment of decision — the specific input, the specific output, the human who stood behind it, sealed when it occurred instead of reconstructed afterward for the auditor.
If the decision happens off-site, so does the evidence. You are left attesting to a system you do not hold. Where it runs and what it did are not two separate problems. They are the same problem, and renting answers neither.
Own the stack. Hold the switch.
The answer is not complicated. It is just rarely offered, because the vendors selling access cannot offer it.
Run the models on hardware you own. Keep the decision where you can see it. When the AI reads a file and produces an answer, that happens inside your environment, on your machine, under your authority — not on a server in another state run by a company whose terms can change, whose government can intervene, and whose other customers can trigger consequences you inherit.
If the model runs where you are, no phone call and no directive takes it away from you. The kill switch is in your hand. And because the decision happens where you are, the evidence is generated and held where you are too — born at the moment of action, sealed in place, yours to produce when someone asks.
Owned infrastructure closes both gaps in one move. The capability cannot be revoked, because it runs where you are. The proof cannot go missing, because it lives where the decision was made. Your stack. Your hardware. Your record.
A model went dark this month and the firms running on it found out they were tenants. The lease was always there. They just never read the clause that said it could end.