When AI developers become extensions of the state, who decides which intelligence we may access—and what we may use it for?
Long before artificial intelligence became part of everyday life, a small moment in an early computer game offered an unexpectedly appropriate warning.
In 1983, the ZX Spectrum adventure game Valhalla allowed players to type commands rather than merely move a character around the screen. Like many players, I discovered that the game also understood certain words that were not part of the intended adventure.
Type a swear word and a small character would march onto the screen, strike your character and display the message:
“Mary is not amused.”
The line referred to Mary Whitehouse, a British campaigner who had become synonymous with moral censorship. My memory had turned it into “Mary doesn’t like it,” but the meaning remained the same: an unseen moral authority had judged your words and sent someone to correct your behaviour.
It was a harmless joke in a computer game.
But imagine a modern equivalent:
“This request cannot be completed because your government does not permit this use of advanced AI.”
At first, we might think only of obvious security risks: malware, biological weapons, attacks on critical infrastructure or military applications.
But where does the boundary stop?
Imagine asking an AI to develop a marketing strategy for a European software company entering the American market—and receiving a refusal because assisting foreign competition is considered contrary to American economic interests.
Imagine requesting an analysis that criticises a government policy and discovering that the most capable reasoning modes are unavailable for that subject.
Imagine that your prompts are not merely refused but recorded, classified and connected to your verified identity. A novelist explores disturbing fictional material. A cybersecurity researcher investigates malicious code. A political scientist studies extremism. A company evaluates how to compete with a strategically important American corporation.
Are these people writers, researchers and entrepreneurs—or risks to be scored?
These examples are deliberately exaggerated. There is no evidence that today’s AI systems are refusing ordinary foreign market-entry plans on national-interest grounds or turning legal private writing into immigration records.
But exaggeration can be useful. It allows us to stress-test the principles and infrastructure we are creating.
Because the pieces required for such a future are no longer imaginary:
- AI services can inspect and classify prompts.
- Access can be linked to a verified person, organisation, location or nationality.
- Different users can receive different models, tools and capability levels.
- Providers may retain records for safety, security and legal compliance.
- Governments can compel restrictions or request information through legal processes.
- Increasingly capable systems are becoming essential economic infrastructure.
The question is therefore not whether the most dystopian scenario is happening today.
The question is whether we are building an infrastructure through which it could happen tomorrow.
Three schools of AI control
I increasingly see three broad schools competing to determine the future of artificial intelligence.
The State School
In the State School, AI is treated as strategic national infrastructure.
Governments decide which systems may be developed, which capabilities may be released, which organisations may receive them and which countries or nationalities may be excluded. The justification may be national security, public safety, economic competitiveness or technological sovereignty.
Some state involvement is unavoidable and necessary. Frontier AI can create genuine risks. Democratic governments have a legitimate responsibility to protect citizens, infrastructure and national security.
But the State School becomes dangerous when protection turns into allocation: when the state does not merely regulate harmful conduct, but decides who is entitled to intelligence itself.
The Developer School
In the Developer School, the companies that build AI systems control their distribution.
Developers establish prices, subscriptions, acceptable-use rules, safety measures and release schedules. Competition is expected to prevent excessive control: users who dislike one provider can supposedly move to another.
This school was never a truly free market. A handful of developers control extraordinarily powerful systems, and switching providers can be difficult once organisations have integrated their models, tools, data and workflows.
Nevertheless, there is an important distinction between a company deciding how to commercialise its own product and a government deciding which customers that company may serve.
The User School
The User School starts with a different principle: people, businesses and communities should have meaningful agency over the systems on which they increasingly depend.
That does not mean unrestricted access to every dangerous capability. It means rights, transparency, portability, interoperability, proportional safeguards and realistic alternatives.
Users should know:
- which model they are actually receiving;
- why functionality has been restricted;
- what information is retained;
- whether their prompts are being classified;
- whether decisions are based on behaviour, geography, nationality or political criteria;
- and how to challenge an incorrect or discriminatory decision.
The User School treats access to AI not merely as a product feature but as an emerging question of autonomy, economic participation and civil rights.
When the State School consumes the Developer School
Recent events suggest that the boundary between the first two schools may be collapsing.
The US government directed Anthropic to suspend access to Fable 5 and Mythos 5 for any foreign national, including foreign employees working inside Anthropic. Because the company could not reliably enforce that restriction throughout its systems, it disabled the models for all customers.
OpenAI has now begun GPT-5.6 with a small group of trusted partners whose participation was shared with the US government. OpenAI says it believes in broad access and intends general availability in the coming weeks, but it also acknowledges that the initial restriction occurred at the government’s request.
The White House framework calls this cooperation voluntary. It also says that nothing in the executive order should create mandatory government licensing or preclearance for model releases. Yet the same order instructs developers to collaborate with the federal government in selecting trusted partners for early access.
That produces an uncomfortable question:
How voluntary is cooperation when refusing may expose a company to export restrictions, loss of government contracts, regulatory action or an order similar to the one imposed on Anthropic?
There does not need to be an explicit command for state pressure to be effective.
A developer may remain privately owned. It may continue operating its website, setting subscription prices and sending invoices. But if the state determines which models may be released and which customers may receive them, the Developer School has effectively been absorbed into the State School.
The company still builds and sells the intelligence.
The state increasingly decides who may have it.
Safety regulation or economic allocation?
There is a defensible argument for confidential government evaluation of genuinely dangerous capabilities before release.
Cybersecurity, biological research and military applications cannot be treated casually. A short, clearly defined evaluation period, governed by law and independent oversight, may be prudent.
But that is different from government officials selecting commercial customers.
It is also different from treating every foreign citizen as an equivalent threat, regardless of whether that person lives in an adversarial state or a closely allied democracy.
Once early access provides a measurable productivity advantage, the selection of “trusted partners” becomes an economic decision as well as a security decision.
Who benefits?
Likely beneficiaries include:
- large corporations with established government relationships;
- defence and intelligence contractors;
- critical-infrastructure organisations chosen by the state;
- domestic companies that receive earlier access than foreign competitors;
- incumbent technology providers with the resources to meet complex approval requirements;
- and governments themselves, which gain privileged access to capabilities before much of the market.
Who loses?
Potentially:
- startups without political or institutional connections;
- small and medium-sized businesses;
- independent developers and researchers;
- foreign companies in allied countries;
- consumers who receive weaker or delayed systems;
- and the AI developers themselves, whose international credibility and commercial freedom are damaged.
A temporary security precaution can therefore quietly become industrial policy.
The end of the open AI market?
The AI market has never been entirely open.
The leading models are proprietary. Compute is concentrated. Cloud infrastructure is controlled by a handful of companies. Subscription plans already create different levels of access.
But a market can still be relatively free when providers compete to serve customers under transparent rules.
It ceases to resemble a free market when a government can decide:
- which provider may release a product;
- which customers receive the strongest version;
- which countries must wait;
- which capabilities are withheld;
- and which organisations are considered sufficiently trustworthy.
At that point, price and quality are no longer the only forces determining access. Political proximity, nationality, strategic importance and government approval become part of the product entitlement.
The market does not disappear completely. It becomes a managed market, with intelligence allocated through a mixture of commercial contracts and state discretion.
The most dangerous aspect may be that this change is not announced as the end of the free market.
It arrives as a temporary exception.
Then another exception.
Then a trusted-access programme.
Then an identity-verification requirement.
Then a permanent distinction between domestic, allied and foreign users.
Eventually, the exceptional arrangement becomes the architecture.
The hidden dangers
- Function creep
A system introduced to detect catastrophic cyber misuse may later be used to monitor lesser security concerns, economic activities, political speech or reputational risks.
Data gathered for one legitimate purpose can gradually be repurposed for another.
- Political favouritism
There is no public evidence that access to these models is currently being awarded according to political loyalty.
But an opaque approval system creates the machinery through which this could happen.
Good governance should not depend on assuming that every present and future administration will act impartially. It should make favouritism difficult, visible and appealable.
- Economic discrimination
Domestic companies could receive the strongest systems earlier than foreign competitors, providing a state-created commercial advantage.
Even a delay of several weeks can matter when frontier models accelerate software development, scientific research, product design and market analysis.
- Silent capability differences
Discrimination may not appear as an explicit refusal.
Different groups could quietly receive lower reasoning limits, weaker tools, reduced context windows, more aggressive filtering or older model snapshots.
Without transparency, users may not even know they are receiving a second-tier service.
- Dependency and sudden withdrawal
Organisations can invest heavily in an AI provider—training employees, building integrations and structuring essential processes—only to discover that access can be withdrawn through a political decision unrelated to their own behaviour.
That makes American AI services less attractive as dependable global infrastructure.
- Surveillance by proxy
Governments do not need to build their own universal prompt-monitoring system if private providers already identify users, inspect content, retain security records and operate the necessary enforcement mechanisms.
The state can require the developer to perform the monitoring.
The developer can then say it is complying with the law, while the government can say the implementation belongs to the company.
The user is trapped between two institutions, neither of which accepts full responsibility.
- Confusing thought with action
Prompts do not reliably reveal identity or intent.
A novelist is not the villain being described. A researcher studying malware is not necessarily an attacker. A person asking about an ideology is not necessarily its supporter.
Systems that convert questions, fiction or intellectual exploration into permanent personal-risk classifications would undermine freedom of inquiry and create countless false positives.
- A global technological divide
If frontier AI is distributed according to national hierarchy, the world may develop multiple intelligence classes:
- government and defence access;
- privileged domestic corporate access;
- allied access;
- public commercial access;
- restricted foreign access;
- and no access.
This would deepen inequality not only between countries, but between large institutions and ordinary citizens.
What responsible governance should require
The answer is not to remove all safeguards or deny that frontier AI presents serious risks.
The answer is to govern both the technology and those who govern access to it.
Any restriction on broadly useful AI capabilities should have:
- a clear legal foundation;
- narrowly defined and demonstrable objectives;
- transparent eligibility criteria;
- independent democratic oversight;
- proportionality between the risk and the restriction;
- equal treatment of trusted allied countries;
- published distinctions between safety testing and customer selection;
- meaningful appeal and correction mechanisms;
- strict purpose limitation for prompt and identity data;
- short and defined retention periods;
- protection against political and economic discrimination;
- and automatic expiry unless the restriction is publicly justified and renewed.
Users should also retain realistic alternatives: interoperability, data portability, open standards and the ability to deploy suitable systems locally or through different providers.
Without alternatives, “consent” becomes largely fictional.
Wrap up: Mary is no longer a joke
In Valhalla, Mary’s displeasure had no real consequences.
A dwarf appeared, struck your character, displayed a humorous message and disappeared. Your job, reputation, company and civil rights were unaffected.
The modern Mary could be very different.
She might determine which model you may use, what questions you may ask, which tools your company may access, whether your behaviour appears suspicious and whether your country is considered trustworthy.
She may not be called Mary.
She may appear as a safety classifier, an export-control rule, a regional availability message, a trusted-partner programme or a government request described as voluntary.
And she may never tell you precisely why she is not amused.
The current restrictions may still prove temporary. Fable 5 may return. GPT-5.6 may become broadly available. Most users may eventually receive the capabilities they expected.
But this discussion is no longer about two model releases.
It is about the precedent being established.
Do we want advanced intelligence to remain a product offered under transparent, democratically governed rules? Or will it become a strategic privilege allocated through opaque cooperation between states and a handful of powerful developers?
Who should decide which intelligence a lawful person or company may use?
Who watches those who make that decision?
And at what point does safeguarding society become controlling it?
We should raise these questions now—not because Mary has already taken complete control, but because once the infrastructure has been built, it may be much harder to take it away.
Mary may not like the questions.
We should ask them anyway.