In January 2026, ARX published the cognitive lock-in problem: memory generated inside an AI vendor’s system belongs, practically speaking, to the vendor until the user takes a deliberate architectural step to extract it, and in the absence of any interoperability infrastructure that step requires an improvised workaround whose existence confirms the gap it was designed to bridge. Within 90 days, the 2 largest AI platforms on the planet shipped exactly that kind of workaround, independently, within weeks of each other, using the same mechanism, and in doing so produced the clearest public evidence the infrastructure thesis has ever received.
On March 2, Anthropic released a memory import tool for Claude. On March 26, Google followed with switching tools for Gemini. Both work identically. The user pastes a prompt into their current chatbot. The chatbot outputs a summary of everything it has accumulated about the user, preferences, projects, communication style, recurring context, the full archive of learned personalization that months or years of interaction have deposited into the vendor’s system. The user copies that output and pastes it into the new platform. Google added a ZIP upload for full chat histories, capped at 5GB. Anthropic processes the import within 24 hours.
I want to take the engineering specifics seriously, because what they reveal matters more than the product announcements themselves.
Neither company built a standard. Neither built a protocol. Neither built a portability layer that the other can implement, that enterprises can rely on across their AI stack, or that regulators can reference when they need to verify that institutional knowledge has been preserved across a vendor transition. Both built prompts. Both built prompts because a prompt is the only tool available in a landscape where the infrastructure for cognitive portability does not exist. The most safety-conscious AI lab and the most widely distributed AI platform on earth arrived at the same solution, which is a copy-paste workflow, which tells you everything you need to know about the state of the infrastructure underneath them.
The consumer framing is accurate. A person switching from ChatGPT to Claude or Gemini no longer has to re-explain who they are. That is a genuine reduction in friction, and it matters for the millions of users making that choice. It is also the thinnest surface of a problem the consumer tools were not designed to solve and cannot address at the scale where the consequences are institutional rather than personal.
What Institutions Are For
Institutions exist to provide continuity that individuals cannot. An organization that persists knowledge beyond the tenure of any single employee, that maintains accountability chains across leadership transitions, that carries forward the reasoning behind its decisions so the next team inherits context rather than starting from zero, is performing the function that justifies institutional structure in the first place. This is not an abstraction. It is the operational definition of what distinguishes an institution from a group of people who happen to share an org chart.
The characteristic feature of institutional failure, as Arendt understood it, is that it does not announce itself. The institution does not collapse. It continues to operate. The meetings continue. The org chart is maintained. The quarterly reviews are filed. What disappears is the capacity to remember why a decision was made, what the alternatives were, what the previous team learned from the last time this situation arose, and whether the reasoning that produced the current policy still holds. The institution becomes, by degrees, an organization that processes inputs and produces outputs without retaining the connective tissue of meaning that would allow anyone inside it to know whether its outputs are consistent with its own history, its stated commitments, or the accumulated learning of the people who built its competence before the current team arrived. That kind of failure accumulates procedurally. It is recognized in retrospect as having been obvious. In real time it is invisible to everyone operating inside the system it is happening to.
AI has created the conditions for exactly this kind of failure, at a velocity and scale that makes the absence of infrastructure for handling it existentially consequential rather than merely inconvenient. Institutions are generating knowledge they cannot persist, decisions they cannot audit, and accountability chains they cannot reconstruct.
The data on this has moved past speculation into something closer to established operational fact. Netskope’s Cloud and Threat Report for 2026 found that 47% of employees using generative AI at work do so through personal, unmanaged accounts, that prompt volume sent to generative AI tools inside organizations grew 6x in a single year, from an average of 3,000 prompts per month to 18,000, and that organizations now detect an average of 223 data policy violations per month tied to AI usage, a number that exceeds 2,100 incidents monthly among the highest-risk organizations. IBM research found that 80% of American office workers use AI professionally, and only 22% rely exclusively on tools their employer provisioned. Gartner reports that 68% of employees use unauthorized AI tools at work, up from 41% in 2023, and that only 34% of all AI tool usage happens through approved enterprise accounts.
These numbers describe a condition, not a behavior problem. Every one of those interactions generates learned context, refined reasoning, accumulated institutional knowledge deposited into vendor systems that sit outside the organization’s security perimeter, governance structure, and retrieval capability, the kind of knowledge that experienced employees build into AI systems through months of refinement and that evaporates entirely when those employees leave or the vendor relationship changes. The consumer memory import tools address the individual version of this condition. They let a person carry preferences from one chatbot to another. They do not move provenance. They do not move audit trails. They do not move the chain of custody that connects a piece of organizational learning to the employee who generated it, the customer interaction that produced it, and the decision it informed. They cannot, because they were not designed to, because the architecture capable of doing so does not yet exist in production anywhere.
The Regulatory Convergence
The regulatory bodies have arrived at the same conclusion from the opposite direction.
On February 19, 2026, the U.S. Treasury released the Financial Services AI Risk Management Framework, carrying 230 control objectives mapped across the AI lifecycle, developed in coordination with more than 100 financial institutions, the Financial Services Sector Coordinating Council, and the Cyber Risk Institute. The framework adapts the NIST AI Risk Management Framework to the operational, regulatory, and consumer protection requirements of financial services, and it represents the most significant federal action on AI governance in the sector since the original NIST AI RMF shipped in January 2023.
The FS AI RMF is not a policy statement. It is an operational architecture standard. It requires institutions to demonstrate what their AI systems knew at the point of a given decision, from what sources that knowledge derived, under whose authority the system was operating, and whether the controls governing that system were enforceable at runtime rather than aspirational at the policy level. Lowenstein Sandler characterized the framework as a remediation blueprint for a sector carrying accumulated governance debt from infrastructure never designed for AI velocity. That characterization is precise. The framework functions as a federal acknowledgment that the infrastructure capable of meeting these obligations at scale, across the multi-model environments where financial institutions actually operate, does not currently exist.
The European Union’s AI Act reinforces the same operational posture from a sovereignty angle. Post-Davos 2026, the conversation across the Atlantic has shifted from data location to governability, from where digital systems store information to whether those systems are explainable, interruptible, portable, auditable, and legally coherent under the conditions where they actually run. Deloitte’s 2026 State of AI in the Enterprise report found that enterprises where senior leadership actively shapes AI governance achieve significantly greater business value, and that legacy data architectures cannot power real-time, autonomous AI. These findings converge on a single architectural claim: the enterprise AI stack as currently constructed cannot satisfy the obligations the regulatory environment is now imposing on it.
What these obligations require operationally is a memory layer that persists across sessions, across model transitions, and across the personnel changes that are inevitable in any organization operating at scale, with provenance tracking sufficient to satisfy a regulatory examination. That is the enterprise-grade version of what Anthropic and Google shipped for individual users. And the distance between a copy-paste prompt and that requirement is the distance between a workaround and an architecture.
The Shape of the Gap
The pattern is now visible from multiple directions simultaneously, and the fact that every direction points to the same structural absence is what makes this moment worth writing about carefully.
The AI labs are building consumer switching tools because users feel the lock-in viscerally when they try to change providers and the labs need to lower switching costs to compete on capability rather than captivity. The regulators are building governance frameworks because institutions cannot explain what their AI systems know or how they arrived at a given output, and the absence of that capability is incompatible with the supervisory examination process. Enterprises are discovering that the majority of their AI usage is invisible to the organization, that the knowledge their workforce is building into AI systems every day is accumulating in places no one monitors, governs, or has standing to retrieve. Every solution currently deployed addresses one surface of this problem while leaving the structural condition underneath it intact.
The gap is architectural. The market has been building AI applications on top of stateless infrastructure, where every session resets, every model transition severs continuity, and every vendor boundary creates an extraction problem that someone resolves with a workaround. The governance frameworks, the switching tools, the shadow AI statistics, and the growing regulatory urgency are all expressions of the same root condition: there is no persistent, governed, infrastructure-neutral runtime layer that maintains cognitive state across the boundaries where the enterprise actually operates.
The consumer labs proved the problem exists by shipping features to address it. The regulatory bodies proved the problem has compliance consequences by publishing frameworks that assume infrastructure capable of satisfying them. The enterprise data proved the problem operates at a scale no manual workflow, no copy-paste prompt, and no single-vendor solution can govern.
No one has built the layer yet. That is not a market observation. It is an architectural fact. The consumer tools move preferences across vendor boundaries. The governance frameworks describe what controls should exist across model boundaries. The enterprise security tools detect that data is crossing boundaries it should not cross. Each of these operates at one surface of the problem. None of them provides the persistent, governed, mathematically verifiable substrate that would allow an institution to maintain cognitive continuity as a property of its own infrastructure rather than a feature of whichever vendor it happens to rely on today.
Where This Goes
I identified this gap before the market converged on it. I filed the provisional patent in January 2026, the same month the cognitive lock-in thesis was published, covering a proprietary architecture for certified cognitive state transfer across AI models. I have spent every week since then building the runtime infrastructure, the microservices, the fidelity measurement layer, the provenance tracking, the encryption and governance stack that together constitute the engineering answer to the problem Anthropic and Google just acknowledged with a prompt. The Vector Translation Matrix provides mathematical guarantees that cognitive state persists across model transitions with measurable fidelity. That is the foundation.
What sits on top of that foundation is what the market is now asking for without having arrived at the language for it yet: a Stateful Runtime Environment for enterprise AI. Infrastructure-neutral. Operating across cloud providers, across model vendors, across organizational boundaries, and across the regulatory jurisdictions that govern how institutional memory must be handled. The layer that makes the 230 Treasury controls enforceable at runtime rather than aspirational at the policy level. The layer that turns cognitive portability from a prompt-based workaround into a governed, auditable, mathematically verifiable architectural property of the system.
The question is no longer whether cognitive lock-in is real. Anthropic proved it in March. Google confirmed it 24 days later. The question is who builds the infrastructure layer that resolves it at the scale where institutions actually operate, where the knowledge at stake belongs to the organization rather than the individual, and where the cost of losing it is not a line item anyone will find in a quarterly report but the slow, procedural disappearance of the connective tissue that made the institution capable of acting on its own history, a condition that does not require negligence to produce because the architecture itself guarantees it in the absence of an alternative.
The alternative is what ARX is building. And the window for building it is not a market window or a fundraising window. It is the window between the moment the problem became undeniable and the moment the institutions living inside it stop being able to recognize what they have lost.
Previous in the series:
- The $40 Billion Blind Spot
- Cognitive Lock-In: The Hidden Tax on Enterprise AI
- What Is Cognitive Fidelity?
- The Missing Layer: Models, Markets, and NVIDIA Inception
- The Market Is Catching Up: GOVERN and the Category That Was Always Coming
- The Architecture Cannot Keep the Promise
- Treasury Just Told Every Bank in America to Govern Their AI
- The Infrastructure Is Converging. So Is the Thesis.
ARX is building the stateful runtime layer for enterprise AI — governance, institutional memory, and cognitive portability across providers, models, and regulatory jurisdictions. Learn more at arxqm.com.