Reactive AI Regulation Timeline: U.S. Export Controls vs. China's Model-Access Deliberations (Jan–Jul 2026)

Executive Summary

Between January and July 2026, the United States and China each moved from indirect, hardware-focused AI controls toward direct, ad hoc interventions on commercial AI models themselves — a shift with no settled legal or administrative framework in either country. The U.S. episode centers on a June 12 Bureau of Industry and Security (BIS) "Is Informed" letter ordering Anthropic to cut off foreign-national access to its newest models, Claude Fable 5 and Mythos 5, which Anthropic could not execute selectively and instead resolved by disabling both models for every customer on earth for roughly two weeks (Reuters, CSIS). China's response has been to accelerate its own long-running "decoupling" posture on hardware and personnel while now, as of early July, actively deliberating whether to restrict outbound access to its own top models — including popular open-weight releases from Alibaba, ByteDance, and Z.ai — a mirror-image sovereignty move triggered in part by the U.S. action (Reuters). In both countries, the operative instrument has been an informal directive or closed-door ministerial meeting rather than public rulemaking, leaving enterprises, foreign employees, and developers to absorb the compliance risk with no published criteria to plan against. A third track has since emerged: by early July, the European Union moved from passive contact with Anthropic to a formally adopted "Action Plan on Cybersecurity and Artificial Intelligence," while Ukraine, the UK, and Austria took national sovereignty-driven steps of their own, and OpenAI's disclosure of existing government cyber-defense partnerships across eight countries revealed that informal allied-access arrangements were already running ahead of any public G7 framework (European Commission, OpenAI).

Timeline of Events

Date	Event	Jurisdiction	Primary Rationale
Jan 2025 (context)	Biden-era "AI Diffusion Framework" creates ECCN 4E091 for closed model weights trained above 10^26 operations; later not enforced after a May 2025 Trump administration policy shift (Note)	U.S.	National security / non-proliferation
Nov 5, 2025	China orders state-funded data centers to use only domestic AI chips, retroactive to in-progress builds (Reuters)	China	Decoupling / self-sufficiency
Jan 13–15, 2026	Commerce codifies a case-by-case H200 licensing framework with a 25% chip tariff and volume cap; ECCN 4E091 "security requirements" take effect	U.S.	National security (hardware)
Feb 2, 2026	China formalizes generative-AI compliance duties (Zhipu and peers must gatekeep content against "core socialist values") (NYT)	China	Information control
Feb 23–24, 2026	U.S. officials say DeepSeek trained a new model on banned Nvidia Blackwell chips, alleging evasion of export markers (Reuters)	U.S./China	National security (hardware evasion)
Apr 21, 2026	Beijing tightens rules to stop AI startups (e.g., Manus) from relocating funding or headquarters abroad (Washington Post)	China	Decoupling / talent retention
Apr 23, 2026	White House OSTP memo accuses China of "industrial-scale" distillation of U.S. frontier models; urges chip-export tightening (Nextgov/FCW); House Foreign Affairs Committee advances export-control bills (Bloomberg)	U.S.	National security / IP protection
Jun 2, 2026	Trump signs executive order creating a voluntary "protected frontier model" regime: developers may submit covered models to the government up to 30 days before release to trusted partners (TechCrunch)	U.S.	National security (pre-emptive review)
Jun 9, 2026	Anthropic launches Claude Fable 5 and Mythos 5	U.S.	—
Jun 12, 2026, 5:21pm ET	BIS "Is Informed" letter, signed by Commerce Secretary Howard Lutnick, orders Anthropic to bar all foreign nationals worldwide — including its own foreign-national staff — from Fable 5 and Mythos 5, citing a reported jailbreak and unspecified national-security concerns (Volkov Law, Digg/full letter)	U.S.	Jailbreak risk framed as national security
Jun 13, 2026	Anthropic disables both models for all customers globally (~240 million users) because it cannot verify nationality in real time; EU Commission opens contact with Anthropic (Al Jazeera, Reuters)	U.S./Global	Compliance impossibility
Jun 15–17, 2026	Allied governments (Canada, EU) call the shutoff a "sovereignty" wake-up call; G7 meets on a "trusted partner" AI-access framework while China touts open, "non-monopolistic" cooperation at a parallel forum (Eastern Herald, CNBC)	Global	Sovereignty / decoupling
Jun 21, 2026	Trump publicly downplays the national-security threat, but the BIS order remains formally in force and both models stay dark (Supercomputing News)	U.S.	Political vs. legal disconnect
Jun 22, 2026	China's Commerce and Finance Ministries blacklist 56 U.S. firms (rare-earth miners, drone makers, defense contractors) in apparent retaliation for a Pentagon entity-list update (AI Weekly)	China	Retaliatory decoupling
Jun 25–26, 2026	OpenAI limits its GPT-5.6 (Sol/Terra/Luna) preview to ~20 government-approved partners at the administration's request; BIS eases Mythos 5 controls for ~100 vetted U.S. companies and agencies (CISA, NSA) under Anthropic's "Project Glasswing," while Fable 5 stays offline (TechCrunch, Mayer Brown)	U.S.	Ad hoc, criteria-free access tiering
Jun 28, 2026	Legion LegalTech sues in D.C. federal court to vacate the BIS directive — the first judicial challenge to a model-level export control, brought by a U.S. firm on behalf of its own Canadian developers (Singularity.Kiwi)	U.S.	Legal accountability gap
Jun 30, 2026	Lutnick sends a second letter — addressed to co-founder Tom Brown rather than CEO Dario Amodei — withdrawing the export-control requirement in exchange for proactive threat-sharing commitments (Fox Business)	U.S.	Negotiated resolution, no formal rule
Jun 28, 2026	Austria asks the European Commission to explore hosting Anthropic's models on EU soil, becoming the first member state to publicly float EU-based hosting as a sovereignty fix (EURACTIV/Policy Center)	EU	Sovereignty / hosting resilience
Jul 1, 2026	Fable 5 restored globally with a new nationality-verification screener; Mythos 5 access expands gradually via Glasswing but remains withheld from the general public	U.S.	Partial restoration
Jul 2, 2026	Peterson Institute (PIIE) concludes the shutdown episode functions as "a gift to China's AI ecosystem," accelerating global adoption of open-weight Chinese models that governments cannot switch off (PIIE)	Global	Strategic self-harm
Jul 6, 2026	Alibaba bars its own employees from using Anthropic's Claude tools, citing a "distillation attack" accusation (CNBC)	China	Retaliatory decoupling / IP protection
Jul 6, 2026	Legion LegalTech voluntarily dismisses its D.C. federal lawsuit against the BIS directive after the underlying export-control requirement was rescinded, closing the first (and so far only) judicial challenge without a ruling on the merits	U.S.	Litigation mooted by settlement
Jul 7, 2026	European Commission formally adopts an "Action Plan on Cybersecurity and Artificial Intelligence" (COM(2026) 577), committing to build independent EU capacity to evaluate frontier models, a structured-access blueprint with ENISA, an AI-cybersecurity "Grand Challenge," and new enforcement powers taking effect Aug 2, 2026 (European Commission)	EU	Institutional response to shutdown / sovereignty
Jul 7, 2026	Ukraine's Ministry of Digital Transformation says it will only procure AI systems that can be hosted on-premise or within Ukrainian infrastructure, citing the Fable 5/Mythos 5 shutdown as the direct trigger (Kyiv Independent)	Ukraine	Sovereignty / continuity of access
Jul 7, 2026	UK MPs press the government for a national AI-sovereignty plan, citing the Anthropic shutdown as evidence the UK is exposed to unilateral U.S. export decisions (The Register)	UK	Sovereignty
Jul 7–9, 2026	Reuters reports China's Ministry of Commerce has held a month of closed meetings with Alibaba, ByteDance, and Z.ai on restricting overseas access to China's most advanced models — closed and open-weight — including criminalizing IP leaks and limiting startup investors (Reuters, Reuters)	China	National security / decoupling
Jul 8, 2026	OpenAI publicly launches GPT-5.6 following its government-requested delay (Reuters)	U.S.	Resolution of ad hoc review
Jul 8, 2026	OpenAI publicly discloses existing "Trusted Access for Cyber" partnerships giving government cyber-defense bodies in Australia, Canada, Japan, South Korea, France, Germany, Poland, and the Netherlands, plus the EU's ENISA, privileged access to its models — the first public confirmation of a G7-adjacent trusted-partner network operating in parallel to the ad hoc BIS process (OpenAI)	U.S./G7/EU	Formalizing allied access outside BIS
Jul 8, 2026	China's National Vulnerability Database (CNNVD/NVDB) issues a public advisory that certain versions of Anthropic's Claude Code (v2.1.91–2.1.196) contain a "backdoor" transmitting user location and device-identity data to remote servers, recommending immediate uninstall or upgrade (The Register, Reuters)	China	Inbound security review of a U.S. AI tool
Jul 10, 2026	Alibaba instructs employees to stop using Claude Code specifically, distinct from and in addition to its July 6 broader Claude ban, citing the CNNVD backdoor warning (Livemint/AFP)	China	Retaliatory decoupling / security

The BIS Order Against Anthropic: Mechanism and Rationale

The June 12 directive was not a published regulation but an individualized "Is Informed" letter under Section 4817(b)(1) of the Export Control Reform Act (ECRA) and Section 744.22(b) of the Export Administration Regulations (EAR) — provisions previously reserved for hardware and dual-use technology, applied here for the first time to a live commercial software endpoint (Mayer Brown). The stated rationale blended two threads that Commerce never fully disentangled: a national security claim invoking military-intelligence end-use risk under the EAR's "deemed export" doctrine, and a narrower jailbreak-risk claim that a third party (reportedly Amazon researchers) had found a way to coax Mythos 5 into analyzing and patching vulnerabilities in a submitted codebase (Bloomberg). Anthropic's own contestation filing later characterized this "jailbreak" as functionally indistinguishable from an ordinary code-review prompt already available on rival models, including OpenAI's GPT-5.5, undercutting the national-security framing after the fact (AI Weekly). Reuters and other outlets add a decoupling layer: officials reportedly linked the underlying concern to a China-affiliated actor accessing the model, aligning the order with the administration's broader distillation-prevention push from April (DEV Community).

Affected Parties

• Enterprise users: Roughly 240 million global active users lost access to Fable 5/Mythos 5 within hours; enterprise deployments built exclusively on Fable 5 were disrupted for 13 days before partial restoration (Eden AI). Even the U.S. National Security Agency reportedly lost access as an unintended casualty of the blanket shutdown (PIIE).

• Foreign nationals: The order applied to any non-U.S.-citizen or non-permanent-resident regardless of location, including Anthropic's own foreign-born employees and researchers such as Andrej Karpathy, and extended to allied nationals in the EU, UK, Canada, Australia, and New Zealand — nations with no formal exemption despite Five Eyes-style alliances (Eastern Herald).

• Third-party litigants: Legion LegalTech, a U.S. company with Canadian-based developers, became the first plaintiff to challenge the order in court, framing it as harming a domestic firm to enforce a foreign-national restriction (Singularity.Kiwi).

The Compliance Guidance Gap

Multiple legal analyses converge on the same finding: Commerce issued a binding directive through a private letter with a matter of hours' notice, no Federal Register notice, no public rulemaking or comment period, no named threat actor, and no released text of the letter itself (CSIS, LinkedIn/Volkov analysis). There is no Entity List designation, no license-denial record, and no adjudicative process — meaning affected companies have no established path to know in advance which capabilities trigger review, no published threshold analogous to the (dormant) ECCN 4E091 compute threshold, and no durable safe harbor once restored. The June 26 "trusted partner" carve-out for Mythos 5 and OpenAI's customer-by-customer GPT-5.6 approvals were likewise granted without published criteria, meaning market access now depends on an unreviewable government judgment call rather than a compliance checklist enterprises can build against (Digital Applied). PIIE's July 2 analysis explicitly calls on the administration to replace this "ad hoc de facto regime" with a provisional model-access framework, warning that credibility erodes further with each unexplained reversal (PIIE).

China's Deliberations on Model Access

China's posture has moved in the opposite direction — from restricting inbound foreign technology toward now weighing restrictions on outbound access to its own leading models. Reuters reports the Ministry of Commerce has spent the past month meeting with Alibaba, ByteDance, and Z.ai to discuss curbing overseas access to top-tier Chinese models, including still-unreleased ones, with proposals extending to popular open-weight releases such as Qwen, Doubao, and GLM (Reuters). A legal-scholar panel summarized in a Supreme People's Court journal proposes a tiered system: a light filing requirement for basic open-source tools, formal security reviews for more advanced technologies, and an outright domestic-use lockdown for the most sensitive frontier models (Reuters). Two additional measures under discussion — criminalizing leaks or theft of proprietary AI technology under China's national security law, and restricting which investors may fund domestic AI startups — mirror the decoupling logic already visible in Beijing's April crackdown on startups relocating capital or headquarters abroad (Washington Post). Officials have "decided nothing yet," and any curbs may apply only to future models with no announced timeline (The Next Web).

The proximate trigger is explicitly the U.S. episode: Chinese officials are described as fearing the same dynamic Washington just demonstrated — foreign dependence on models a rival government can switch off — playing out in reverse for China's own open-weight ecosystem, which had become a default hedge for developers worldwide precisely because it couldn't be revoked (Forbes). At the corporate level, Alibaba pre-empted any formal government rule by unilaterally barring its own staff from using Anthropic's Claude tools on July 6, citing a "distillation attack" accusation — a private-sector decoupling move that predates and may be shaping the ministry-level deliberations (CNBC).

Affected Parties

• Enterprise users: Startups and enterprises worldwide — including in the U.S. — that had shifted workloads to cheaper Chinese open-weight models (DeepSeek, Qwen) as a hedge against the American shutdown now face a symmetric risk of losing that access if Beijing formalizes the curbs (Forbes).

• Domestic developers/investors: Alibaba, ByteDance, and Z.ai are direct parties to the Commerce Ministry consultations and would bear compliance costs for a filing/review/lockdown tiering system; the investor-restriction proposal would also directly affect the venture and sovereign-fund backers of Chinese AI startups (Reuters).

• Foreign nationals/governments: Non-Chinese researchers and firms integrating open-weight Chinese models into products would be the direct targets of any access restriction, inverting the foreign-national framing used in the U.S. order.

The Compliance Guidance Gap

China's process mirrors Washington's in its opacity: consultations are closed-door ministerial meetings, not public consultations; the scope, mechanism for restricting inherently duplicable open-weight files, and effective date are all explicitly undetermined; and Reuters notes officials "could not learn how the curbs would work" for models that are, by design, already downloaded and running on servers worldwide (The Next Web). As in the U.S. case, private companies (Alibaba) are moving ahead of any codified rule, creating a compliance environment where corporate risk-aversion outpaces — and effectively substitutes for — formal government guidance. A related but analytically distinct thread emerged on July 8: China's National Vulnerability Database (CNNVD/NVDB) publicly warned that specific builds of Anthropic's Claude Code contained a "backdoor" exfiltrating location and device-identity data, prompting Alibaba to bar internal use of that specific tool from July 10 — a security-inspection action against a U.S. product that runs in parallel to, but should not be conflated with, the still-undecided outbound access-restriction deliberations described above (The Register). No independent security firm outside China had corroborated the specific "backdoor" characterization as of this writing, and some commentators note the timing — arriving one day after Reuters' "curbing overseas access" report — is consistent with the advisory doubling as a retaliatory signal rather than a purely technical finding.

EU/G7 Response

What began in mid-June as passive information-gathering — the European Commission "keeping in contact" with Anthropic and G7 leaders discussing a "trusted partner" concept without adopting one — hardened into concrete institutional action within three weeks. On July 7, the European Commission formally adopted an Action Plan on Cybersecurity and Artificial Intelligence (COM(2026) 577), which commits the EU to building independent in-house capacity to evaluate frontier AI models rather than relying solely on vendor disclosures, establishes a structured-access blueprint developed with ENISA for how EU public bodies and critical infrastructure operators obtain assured model access, launches an AI-cybersecurity "Grand Challenge" to stimulate a European alternative ecosystem, and sets enforcement powers to begin taking effect August 2, 2026 (European Commission). The Action Plan is the EU's first formal regulatory response to the Fable 5/Mythos 5 shutdown, moving well past the June 16 posture of simply staying "in contact" with Anthropic (Reuters).

Member states and allied governments moved in parallel and, in some cases, ahead of Brussels. Austria asked the Commission on June 28 to explore hosting Anthropic's models on EU soil — the first public proposal to address the sovereignty problem through EU-based infrastructure rather than policy alone (Policy Center for the New South). Ukraine's Ministry of Digital Transformation announced on July 7 that it will only procure AI systems it can host on-premise or within domestic infrastructure, explicitly citing the Fable 5/Mythos 5 episode as the reason it can no longer rely on externally hosted, remotely revocable models (Kyiv Independent). UK MPs likewise pressed the government the same week for a national AI-sovereignty plan, pointing to the shutdown as proof that a single U.S. regulatory letter can unilaterally sever an allied country's access to critical AI infrastructure (The Register).

A separate development complicates the picture: on July 8, OpenAI publicly disclosed that it already operates "Trusted Access for Cyber" partnerships giving government cyber-defense agencies in Australia, Canada, Japan, South Korea, France, Germany, Poland, and the Netherlands, plus the EU's own ENISA, privileged model access for defensive security work (OpenAI). This is the first concrete evidence that a G7-adjacent trusted-partner access network already exists in practice — operating quietly alongside, rather than as a replacement for, the ad hoc BIS process that produced the Anthropic shutdown. It suggests the June 17 G7 summit discussion of a formal "trusted partner" framework may be catching up to arrangements individual labs had already begun building bilaterally, rather than the G7 creating the framework from scratch. As of this writing, no G7-wide framework has been jointly adopted or published; the EU's Action Plan, Austria's hosting proposal, and Ukraine's and the UK's national responses remain distinct national/bloc-level initiatives rather than a coordinated G7 instrument, and the (Policy Center) account of the June 17 Évian summit notes that frontier-lab executives (including Anthropic's, OpenAI's, and Google DeepMind's leadership) participated directly in the G7 policy discussions — an unusual level of industry involvement in what is nominally an intergovernmental process, and one that underscores how much of the actual access-brokering (as with OpenAI's disclosed partnerships) is happening through direct lab-to-government deals rather than treaty-level coordination.

Affected Parties

• EU institutions and member states: The European Commission takes on new evaluation and enforcement responsibilities under the Action Plan starting August 2, 2026; Austria, as the first state to propose EU-based hosting, would bear early infrastructure and cost burdens if the Commission pursues it (European Commission).

• Non-EU allied governments: Ukraine and the UK are recalibrating procurement and sovereignty policy specifically because of the U.S. shutdown, despite neither being a direct party to the original BIS letter (Kyiv Independent, The Register).

• G7 cyber-defense agencies: Australia, Canada, Japan, South Korea, France, Germany, Poland, and the Netherlands already hold privileged OpenAI access under Trusted Access for Cyber, positioning them differently from allied governments (e.g., the UK, per its own MPs' complaints) that appear to lack an equivalent disclosed arrangement (OpenAI).

The Compliance Guidance Gap

The EU's Action Plan is the first of the three tracks in this dashboard to produce a published, dated regulatory instrument rather than an informal letter or closed-door meeting — but it still leaves the near-term gap unresolved: enforcement powers do not begin until August 2, 2026, the ENISA structured-access blueprint is described as a work in progress rather than a finished standard, and neither Austria's hosting request nor Ukraine's and the UK's national responses have concrete implementation timelines. Meanwhile, OpenAI's Trusted Access for Cyber disclosure reveals that substantive allied access arrangements have been running without public framework or oversight, meaning the G7 "trusted partner" concept discussed at the June 17 summit may already be operating informally and unevenly across member states — some (the disclosed eight countries plus ENISA) with privileged access, others (per UK MPs' public complaints) without it — while no public criteria exist for which allied governments qualify.

Comparative Analysis: U.S. vs. China Regulatory Posture

Dimension

United States (BIS/Anthropic episode)

China (Ministry of Commerce deliberations)

Dimension	United States (BIS/Anthropic episode)	China (Ministry of Commerce deliberations)
Trigger	Alleged jailbreak of Mythos 5 enabling code-vulnerability analysis, reported by a rival lab (Bloomberg)	The June 12 U.S. shutdown itself, plus accumulated distillation/IP-leak concerns (Forbes)
Stated rationale	National security (military-intelligence end-use, deemed export doctrine), layered with jailbreak/cyber-risk framing	National security (IP theft as a security-law offense), layered with decoupling/sovereignty framing
Underlying rationale	Distillation/decoupling concern about China-linked access, per Reuters/Semafor reporting (Eastern Herald)	Fear of reciprocal foreign dependence and loss of strategic/IP advantage in open-weight models
Legal instrument	Private "Is Informed" letter under ECRA/EAR — no rulemaking, no Federal Register notice (Mayer Brown)	Closed-door Ministry of Commerce meetings and a legal-scholar tiered-system proposal — no published rule (Reuters)
Affected parties	Foreign nationals globally (including domestic firms' foreign staff and allied citizens); ~240M global users; enterprise/agency customers, including NSA	Foreign enterprises and researchers relying on Chinese open-weight models; domestic AI startups' foreign investors
Federal/central compliance guidance	None published; no criteria for "trusted partner" status; no license pathway for existing deployed models (PIIE)	None published; scope, mechanism, and timeline for restricting open-weight files explicitly unresolved (The Next Web)
Private-sector response	Anthropic negotiated a bespoke settlement (Glasswing program, threat-sharing) rather than litigating; a third party (Legion LegalTech) sued instead	Alibaba unilaterally banned Anthropic tools for staff ahead of any government rule (CNBC)
Retaliatory linkage	Triggered China's blacklisting of 56 U.S. firms in adjacent sectors (rare earths, drones, defense) (AI Weekly)	Directly reactive to, and modeled on, the U.S. action
Net strategic effect (per outside analysts)	Accelerated global adoption of un-revocable Chinese open-weight models, undermining the policy's own goal (PIIE)	Would remove China's key competitive advantage (open, unrevokable distribution) if implemented broadly

Note: A third track — the EU/G7 response — does not fit neatly into this bilateral U.S.-China comparison because it is reactive to the U.S. episode rather than an independent regulatory posture. As of July 8, it is also the only track to have produced a published, dated regulatory instrument (the EU's Action Plan on Cybersecurity and Artificial Intelligence) rather than an informal letter or closed-door meeting — though its enforcement powers do not begin until August 2, 2026. See the dedicated EU/G7 Response section above.

Escalating Friction: State Directives vs. Developer Autonomy

In the United States, the friction plays out as a struggle between a government asserting unilateral, criteria-free control over a deployed commercial product and developers who had, until June, operated in a comparatively permissive environment shaped by the Trump administration's May 2025 rollback of the Biden-era AI Diffusion Rule (Note). Anthropic's own June 17 framing — that it had asked for regulation and "Washington went much further" — captures the core tension: the company sought a predictable compliance regime and instead received an unreviewable executive directive with 90 minutes' notice (CNBC). The subsequent OpenAI GPT-5.6 delay, executed under the voluntary-in-name-only June 2 executive order, shows the friction generalizing across the industry: "voluntary" pre-release review has functioned as a de facto licensing regime that a former White House adviser himself criticized as producing "heavy-handed restrictions" (TechCrunch). The Legion LegalTech lawsuit — voluntarily dismissed July 6 once the underlying export-control requirement was rescinded, so it closed without a substantive ruling — and mounting legal commentary (Volkov Law, Mayer Brown, CSA) nonetheless signaled that the private sector was willing to test the limits of executive authority in court because no administrative channel exists to contest these directives (Singularity.Kiwi).

In China, the friction is structurally different but converging on the same pattern: the state is not yet issuing binding orders but is negotiating directly with Alibaba, ByteDance, and Z.ai over how much autonomy those firms retain to distribute models internationally — companies that built global market share specifically through the open-weight, unrevokable distribution model the state may now curb (Reuters). Alibaba's pre-emptive, unilateral ban on Anthropic tools for its own staff — extended July 10 to specifically cover Claude Code after China's CNNVD backdoor warning — shows a Chinese developer choosing self-restriction over waiting for state guidance, the mirror image of Anthropic's negotiated settlement in the U.S. case. Both countries are converging on the same structural weakness: national-security authority is being exercised through private letters or closed meetings rather than durable rule, so developers on both sides of the Pacific are absorbing decisions they cannot appeal, predict, or fully comply with, while regulators in both capitals treat the resulting market disruption as an acceptable cost of asserting sovereign control over frontier AI.

The EU/G7 track shows the clearest sign of the ad hoc pattern beginning to institutionalize. Where the EU spent the first month after the shutdown merely "in contact" with Anthropic, it moved by July 7 to a published Action Plan with a dated enforcement start — the first of the three tracks to convert reactive concern into a formal, if still incomplete, regulatory instrument (European Commission). At the same time, OpenAI's disclosure of pre-existing Trusted Access for Cyber partnerships with eight G7-adjacent governments and ENISA reveals that meaningful allied access arrangements were already running informally, without public criteria, well before any government framework caught up to them — meaning the compliance-guidance gap identified in the U.S. and China tracks has a transatlantic analogue: allied governments and their agencies cannot yet point to a published standard for which countries get privileged, durable AI access and which do not (OpenAI).