Kill switch and local LLMs: what French parliamentary report No. 3054 changes

On 12 June 2026, the US government ordered Anthropic to suspend foreign access to its latest AI models: the remote shutdown of a digital service, the kill switch, had just happened. A few weeks later, a commission of inquiry of the French National Assembly published a report that describes this dependency risk and proposes an answer for SMEs, an open-source tax credit.

By QDNA · Published 19 July 2026 · 8 min read

A parliamentary report documents digital dependency

The commission of inquiry into digital dependencies, chaired by Philippe Latombe with Cyrielle Chatelain as rapporteur, held forty-five hearings and heard one hundred and twelve people. Its report puts figures on the situation. American vendors account for close to 80% of software purchases by French public administrations, according to the UGAP purchasing body. European companies buy 264 billion euros of software and cloud services from American providers every year. Of the one and a half billion euros of French public spending going to non-European vendors, the rapporteur estimates that one billion can be substituted today with existing solutions.

Building on these findings, the report makes eighteen recommendations, quick fixes that can be applied rapidly, and twenty-nine proposals, which aim at a longer-term change of model. The rest of this article focuses on the two points that directly affect a company using AI: the finding that the remote shutdown of a service has become real, and the proposal of tax support for open source aimed at SMEs.

The kill switch is no longer a hypothesis

The report devotes an entire section to the threat of digital services being cut off. It materialised during the commission's work: on 12 June 2026, the US government required Anthropic to suspend access to its Mythos 5 and Fable 5 models for any foreign national, including the company's own foreign employees, and the suspension took effect. The commission's chairman summed it up in session: the kill switch is no longer just a hypothesis but a reality.

The report also documents individual targeting. French judge Nicolas Guillou, a magistrate at the International Criminal Court, saw his digital services and means of payment shut down one after another once he was placed on an American sanctions list, with no judicial recourse. His testimony before the commission describes a daily life that became, in his words, a laboratory of lost sovereignty.

What a shutdown interrupts inside a company

An external AI API creates a flow dependency: every request crosses the network to the provider, and the service exists only as long as the provider answers. When a company plugs its business assistants, its code generation or its agentic workflows into a remote API, a decision taken in another country can stop those uses overnight. Neither the contract nor the location of the data protects against this risk: the shutdown comes from upstream, at the model provider level, as our page on the Anthropic APIs shows.

This risk differs from the compliance debate. A company can have a solid data processing agreement and compliant transfer clauses, and still lose access to the service. The report also recommends that companies assess their exposure to a general shutdown, in the same way as their security risks.

The local LLM as continuity insurance

An open model downloaded onto the company's servers changes the nature of the dependency. The model weights become a local asset: once installed, they run without any connection to the provider, and no external decision can interrupt inference. The dependency is limited to the moment of download. Today's open models cover text generation, code and document analysis at a level sufficient for most internal uses, and the on-premises versus API cost comparison shows that sustained usage pays off the hardware.

Local does not rule out hybrid. An architecture with a semantic router keeps sensitive content and critical uses on the local model, and lets ordinary traffic overflow to an external API as long as it answers. Service continuity then rests on the local foundation, and the external API becomes a convenience. Practical deployment is covered in our guide to installing a local LLM in the enterprise, and hardware is chosen by load tier.

Proposal No. 16: an open-source tax credit for SMEs

The report does not stop at the diagnosis. Its proposal No. 16 creates a tax support scheme, modelled on the French innovation tax credit, for companies with fewer than 250 employees. The proposed eligible expenses cover four items:

• the integration of open-source solutions;
• user training and support;
• self-hosting of servers, or contracting with a European operator shielded from extraterritorial laws, for the first five years;
• the deployment of AI tools that comply with the OSAID 1.0 definition of open source, hosted on sovereign infrastructure.

These four items describe the scope of a local LLM project: the hardware and its integration, team training, operation inside the company's walls and genuinely open models.

A word on that OSAID reference. The Open Source AI Definition, published as version 1.0 in October 2024 by the Open Source Initiative, the organisation that has been the authority on the definition of open source since 1998, sets the conditions an AI system must meet to call itself open source: the freedom to use it for any purpose, to study it, to modify it and to share it, with sufficient access to its components, meaning the model weights, the code and a detailed description of the training data. The report recommends enforcing this definition, including through the courts, which would rule out so-called open models whose licences restrict commercial use or access to components.

One caveat applies: the report of a commission of inquiry has no force of law. The proposal must be taken up in legislation, for example a finance bill, before it applies. A company preparing an open-source project nevertheless has an interest in documenting its expenses now: if the scheme is voted, the file already exists.

Data transfers are wobbling at the same time

The report adds a legal signal. Following a US Supreme Court decision of 29 June 2026, which validates the political takeover of independent federal agencies, the rapporteur considers that the foundations of the Data Privacy Framework, the mechanism that legalises transfers of personal data to the United States, are now void. The report urges companies to stop basing their contracts on this framework. For a company processing personal data with an external AI, legal risk therefore adds to shutdown risk. Our article on generative AI and the GDPR details how local hosting restores control.

How to prepare without waiting for the law

Four actions depend on no vote:

• map the company's AI uses and identify those whose sudden interruption would block a team or a process;
• classify the flows: whatever touches sensitive data or critical processes belongs on a local model, the rest can stay on an API;
• run a pilot on a server sized for the trial, with an OSAID-compliant open model, to measure quality on your real cases;
• document integration, training and hosting expenses: they form the file for the future tax credit if proposal No. 16 goes through.

A sovereign AI platform brings these choices together in one architecture: controlled hardware, open models, controlled access. The parliamentary report gives it a political framework and, perhaps tomorrow, a tax framework.

References

• Report No. 3054, commission of inquiry into digital dependencies, French National Assembly, 8 July 2026
• Anthropic, announcement on access to the Fable and Mythos models
• Open Source Initiative, Open Source AI Definition (OSAID)
• European Commission, proposal for a Cloud and AI Development Act