AI Vendor Concentration Risk Assessment

Why concentration risk is distinct from vendor due diligence

Vendor due diligence (PRC-001) assesses whether a specific vendor is an acceptable partner. Concentration risk assessment addresses a different question: what happens if an acceptable vendor becomes unavailable, regardless of the reason?

The risk is not limited to vendor insolvency or service outage. The June 2026 U.S. export control directive requiring Anthropic to suspend Fable 5 and Mythos 5 for foreign nationals demonstrated that government action can make a specific model unavailable across an entire customer base overnight, with no advance notice and no defined restoration timeline. Organizations that had built critical workflows on these models faced operational disruption that their existing incident response plans, designed for technical failures and vendor outages with SLAs, were not equipped to handle.

Concentration risk at the model layer is particularly acute because:

• Many enterprise AI products are built on a small number of underlying model providers (Anthropic, OpenAI, Google DeepMind). A vendor that appears distinct may use the same underlying model as other vendors in the portfolio.
• Switching costs are real: re-evaluation, re-tuning, and re-testing of a different model for an established workflow takes time the organization may not have in an emergency.
• Regulatory risk is directional: the U.S. export control directive is unlikely to be the last government action affecting AI model access. Organizations with significant concentration should treat geopolitical AI access risk as a named category, not a tail event.

Assessing concentration

For each production AI workflow, document:

• Primary vendor and model.
• Underlying model provider (if the vendor's product is built on a third-party model).
• Business criticality: what is the impact of a 24-hour, 72-hour, and 30-day disruption?
• Qualified alternative: is there another model or vendor that could substitute? Has it been evaluated?
• Switching time: how long would it take to switch to the alternative? What re-testing is required?

Calculate concentration metrics:

• What fraction of critical workflows depend on a single vendor?
• What fraction depend on models from a single underlying model provider?
• What is the aggregate revenue or operational exposure if the top vendor were unavailable for 30 days?

Contingency planning for high-concentration dependencies

For every dependency classified as high-concentration and high-criticality:

1. Identify and qualify at least one alternative. The alternative should be assessed under the same criteria as the primary vendor (PRC-001, PRC-003). Do not defer this until disruption occurs.

2. Document the switching procedure. What steps are required to redirect the workflow to the alternative? Who authorizes the switch? How long does it take?

3. Test the contingency. At minimum, verify the alternative model can handle the relevant workflows in a staging environment. For the highest-criticality workflows, run a live pilot on the alternative.

4. Maintain currency. Alternatives go stale: models are deprecated, vendors change terms, and organizational workflows change. Re-verify alternatives annually.