Eight gates stand between a frontier lab and its next training run. Seven of them answer to some public lever, an export-control regime with jurisdiction over the layer or a public body that can in principle be held to account; the eighth, advanced packaging, answers to nothing. That intersection, a layer that can gate a run and is checked by no one, is the finding the instrument exists to surface, and it has exactly one member.
Underneath the eight gates sits a ledger of eleven leverage points, running materials to capital: EUV lithography, advanced logic foundry, EDA tooling, HBM memory, advanced packaging, the accelerator, scale-up and scale-out interconnect, cloud capacity, power and grid interconnection, and capital. Scale-up and scale-out are two entries and not one, because each is its own function in the training pipeline, with its own suppliers and its own switching path, and a lab can route around the one without touching the other. Slice the stack somewhere else and the count moves; the finding does not, since under any reasonable slicing at least one input no lab can route around in time answers to no public hook.
The veto criterion
The rule has two physical inputs and nothing blended: a blended index was the one failure mode the instrument was built around. A veto needs both inputs present at the same time. There must be a dominant or sole actor, and the lab must be unable to route around that actor before the horizon runs out, and the cost of routing around is switching cost times redeployment time. Market share never enters the verdict. It renders as context only, because a share-based criterion assumes the thing it is meant to test. A 100% share a lab can re-source in a quarter is no veto at all. What does count is whatever a lab cannot qualify around in time, whatever its share happens to be. Every veto-holder here happens to also be a near-monopoly (there is no clean low-share case on the stack), so the test that matters comes later. In the per-run falsification, NVIDIA’s commanding accelerator share fails to produce a veto over the labs that routed around it.
There are two horizons because the only thing on offer is the power to make a lab wait, and waiting is measured in time. Eighteen months is about stopping a run that is planned or already going; five years is about stopping a lab from building its own way out. The ledger reads each layer at both horizons, marking who holds it and whether that holder can make a run wait, first at eighteen months and again at five years, and against each it also records what checks the power, where anything does. One of these vetoes does not belong to a firm at all. Before a new frontier-scale site goes up, an ISO or RTO, the local utility, a state public-utility commission, FERC, and EPA each have to clear it. The ledger counts all of them as one gate, since the run gets halted whether one blocks it or five do, and tags the gate an institutional stack. A public body bound by process is a different animal from a private monopoly; the tag keeps the two from being added into the same number.
What the ledger reads
On the most-locked path (the default column: a lab that took the most committed route at every layer), eight of the eleven can gate a new run at eighteen months: EUV lithography, advanced foundry, EDA, HBM, advanced packaging, the accelerator, scale-up interconnect, and power. Six of those eight sit under export-control law, and the grid stack is itself a set of public bodies; advanced packaging, TSMC’s CoWoS, is the one that answers to nothing. That gap is in the December 2024 export-control rule, which put advanced-packaging equipment on the controlled list and left the packaging service off it. So no export regime reaches how TSMC allocates CoWoS capacity among its Western customers. No competition authority has opened a proceeding on the layer either, and the holder is not a public body. Elsewhere the pattern holds and you can see its shape: the Foreign Direct Product Rule and the January 2025 foundry due-diligence rule over fabrication, the December 2024 bandwidth-density threshold (above 2 GB/s/mm²) over HBM, the 3A090/4A090 controls and the 2023 Total-Processing-Performance metric over accelerators. Packaging is where the pattern breaks.
Push the horizon out to five years and the count drops to two. ASML ships every EUV scanner in existence, Nikon and Canon ship nothing but DUV, and for a Western lab there is no commercial alternative at any horizon, so EUV lithography holds. EDA holds for the same kind of reason: every leading-edge accelerator was designed on Synopsys, Cadence, or Siemens tooling, NVIDIA’s merchant GPUs as much as Google’s TPU or AWS’s Trainium, and at the leading edge there is no production full-flow alternative. Those two are the permanent locks. Everything else either erodes or never bound in the first place. HBM is the one that erodes: its veto is projected gone by five years as the three-supplier market matures, an inference from the supply-shortage horizon rather than a sourced forecast, and the ledger says as much.
The off-switch misreading
Eight gates reads like an off-switch. The single most important thing to say about it is that it is not one. The eighteen-month count is a barrier to entry, the gates a lab has to get through to stand up its next run. A run already training gets past exactly one of them, power, because every lab I track either self-generates (xAI’s Memphis site runs on on-site gas turbines) or pre-positioned self-arranged capacity (Google, Anthropic). The silicon already sitting in its racks it cannot get past; the chips, the memory, and the packaging gate the next run, not the one that is running. Resolved per run, what still binds an energized run is seven gates for xAI’s Colossus, five for Google’s Gemini, five for Anthropic’s Claude. Never zero. The only thing telling the labs apart is which gates they have already cleared.
The falsification test
Vertical integration is the case that would sink this method, if any case does, and it is the reason NVIDIA earns a per-run test rather than a blanket veto. NVIDIA is the name everyone reaches for first in this discourse. Google trains Gemini on its own TPUs over a proprietary interconnect (ICI), with zero NVIDIA anywhere in the training path. Anthropic says it trains and runs Claude across AWS Trainium, Google TPUs, and NVIDIA GPUs, with more than a million Trainium2 chips in production. For both of those runs the accelerator and scale-up cells come back NO. The merchant-GPU veto holds only for the labs that committed to CUDA, where getting bespoke kernels off it is a job counted in quarters and not weeks, and it is gone for the labs that already routed around it.
Accountability, on its own axis
The accountability column asks one thing only: suppose this holder abused its position, what could check it, in principle, on any timescale? It never asks whether a lab can route around the holder in time, because that already belongs to the veto. So a rival no lab can reach inside eighteen months still scores a veto of YES carrying a competition hook, a fact about reach and not about who can be held to account. The reader’s fight is with the rule behind each hook, which is right there to read.
Each layer takes the single strongest hook off a fixed order, export control first, then antitrust, then public body, then competition, then none, set per layer against a written rule and audited by hand rather than computed. EDA shows why concentration alone does not land a layer in the alarm set: it is concentrated to the point of universality, yet BIS has asserted and exercised jurisdiction over it, with China-sales licensing on the three vendors in May 2025 and a $95 million enforcement penalty against Cadence that July for exports to NUDT and Phytium; the licensing requirement was rescinded the same July under the US-China framework, while the exercised enforcement order stands.
The export-control hooks point sideways. What the regimes govern is diversion, who a fab is allowed to fabricate for and where advanced memory is allowed to ship, not what a domestic lab is allowed to buy. That makes the lever a partial one, and a real one even so, which is why it still outranks a bare market check.
What the instrument refuses to do
Two numbers on the surface have nothing behind them, no primary source and no secondary one: how long it takes to port a leading-edge accelerator off TSMC onto another foundry, and the customer-level requalification time at a different packager. Both carry a needs-verification marker where an estimate would otherwise sit. The eighteen-month verdicts above them lean on neither number; those rest on capacity you can observe, with leading-edge nodes reported booked through 2026 and NVIDIA reported holding more than half of CoWoS capacity through 2027. The two missing figures would bite only at the five-year line, which is the whole reason both layers read UNCERTAIN there and not YES or NO. An earlier inter-foundry figure that went around, 18 to 36 months, was unsourced inference, and it was retired rather than dressed up as data.
Frontier training already runs over Ethernet. Meta built its Llama 3 cluster on RoCE over Arista 7800 hardware, and xAI’s Colossus runs Spectrum-X Ethernet across more than 200,000 GPUs, so scale-out interconnect never binds. Neither does cloud capacity, where the top labs are multi-vendor by design, nor capital, where the biggest rounds are syndicates and no frontier-class lab turned up single-funder-gated. All three sit in the ledger on purpose: a veto count that found a veto everywhere would only be measuring its own assumptions.
Read this caveat before the others. The count measures who controls AI’s inputs, which actors can make a frontier lab wait and for how long. It does not measure power. You need input-control to have leverage, but having it does not get you all the way there: somebody who can stall your training run still cannot tell you what to train, and a layer holding no veto can still push outcomes around through price, queue priority, or the standing relationship that decides who gets served first when there is not enough to go around. Getting from who can stop a run to who actually holds power is an argument, and the ledger leaves it open to fight about at the one joint that matters, since every tag carries its trigger and rejecting a rule moves the verdict with it. Argue the rule, not the number.
Per-claim sources
The contract behind the live instrument records per-value source, authority tier, vintage, and verification notes, including the two values it declines to assert; rows above with no pinned URL reflect the contract’s own recorded state rather than a dropped link. The live page renders the same provenance interactively, and the methodology page documents the authority-tier definitions this table uses.
Cite this note
@misc{scrutica_who_can_stop_a_frontier_ai_run_2026,
author = {Gringras, David},
title = {Who can stop a frontier AI run, and who checks them},
year = {2026},
month = jun,
howpublished = {Scrutica Analysis},
note = {Dated note, published 2026-06-05; corrections logged at https://scrutica.com/corrections},
url = {https://scrutica.com/analysis/who-can-stop-a-frontier-ai-run}
}Gringras, D. (2026, June 5). Who can stop a frontier AI run, and who checks them. Scrutica Analysis. https://scrutica.com/analysis/who-can-stop-a-frontier-ai-run
This URL is stable and the note is dated: its substance changes only through the public corrections process. If a claim here is later found wrong, the disclosure lands at /corrections with what was shown, the corrected value, and the root cause; the note then links the correction at the affected passage.