AI vendor dependency is becoming a resilience risk | Daily Reports Online
Now that AI has quickly become embedded in global enterprise operations, it has the ability to impact everything from data analysis to decision-making and even security.
Most conversations, however, focus on AI capability, power, productivity, and accuracy, but leave out one major issue.
While everyone is focused on what happens as AI is implemented, very few are asking what happens when access to AI capability suddenly disappears.
Latest Videos FromTechRadar
Director of Security & Regulatory Services at Origina.
A prominent example of this is the debate around Anthropic restoring access to its Fable and Mythos AI models, which primarily revolved around compliance timelines and export control mechanics.
Yet, few have questioned why so many organizations discovered that one external decision, out of their control, removed a business-critical capability seemingly overnight. In short, AI access disruptions are a symptom of a much larger operational resilience issue, and expose an overlooked governance gap around dependency.
As organizations integrate AI deeper into their business operations, they need to shift their focus from exploring whether AI is secure enough right now to start asking whether their organizations can even continue operating if or when those very AI services become unavailable.
Security does not equal resilience
These little discussed topics bring up an important point that security and resilience are not synonymous.
Security prevents and protects systems from compromise. This keeps attackers from gaining access, reduces the number of vulnerabilities, and defends against malicious entities – all crucial elements of security operations. Resilience is the ability to continue business operations when systems, services, or data become unavailable, regardless of the cause.
We tend to associate resilience with situations such as cyberattacks or IT infrastructure failures. AI has changed the threat landscape for organizations, how they work with AI, and protect themselves from it. Organizations must now increasingly plan for disrupted access to critical tools and functions caused by geopolitical decisions, regulations, or changes made by technology providers themselves.
A service doesn’t have to be hacked to become unavailable. A policy decision on the other side of the world can have the exact same operational effect. We saw exactly that with Anthropic.
With this in mind, resilience has to be built into how the enterprise operates and include any new AI infrastructure, so business continuity is ensured even through policy interference.
AI Creates a New Kind of Vendor Dependency
Where traditional software dependency usually involves a single or small amount of vendors, enterprise AI often depends on an interconnected ecosystem that organizations do not own or control. Every additional layer in the AI ecosystem represents a dependency, and therefore a potential point of failure.
This creates four risk factors that leadership needs to be mindful of:
Data sovereignty: Enterprise data may be processed under legal jurisdictions the organization doesn’t control, with limited visibility into who can access it or whether it feeds future model training
Model sovereignty: Organizations often have little to no control over model availability, feature capabilities and changes, or access decisions, leaving them exposed if a provider suddenly decides to restrict access or withdraw capabilities.
Infrastructure dependency: Much of today’s enterprise AI ecosystem relies on a small handful of cloud providers operating under specific national jurisdictions.
AI supply chain risks: An interconnected system of foundation models, cloud platforms, and software vendors means disruption at even one layer can quickly cascade across the wider technology stack.
These factors increasingly depend on geopolitics rather than technology.
AI Governance is a Boardroom Issue
The reality is that a vendor contract alone cannot guarantee uninterrupted access to the tools and platforms that an enterprise has invested in. But governance frameworks haven’t truly evolved to account for this issue. Only newly emerging frameworks like NIS2 and DORA recognize that resilience must go beyond fending off cybersecurity threats.
Best practice for an organization as they approach vendor contracts and governance frameworks of their own is to understand where dependencies lie across suppliers and develop contingency plans that allow them to operate smoothly through eras of disruption.
Whether the dependency is within an AI platform, ITSM solution, a CRM, or another business critical technology, organizations should assess how they would continue operating if access changed overnight. AI should be subjected to the same scrutiny as any other critical third-party vendors.
Begin Resilience Frameworks Before the Next Disruption
On top of this, boards should be cautious about accepting AI capability claims at face value. Organizations should require evidence that vendor claims deliver measurable outcomes.
While AI can quickly identify an overwhelming amount of potential vulnerabilities, discovery alone does not improve resilience. Human expertise here remains essential to validate findings, prioritize fixes based on order of immediate business impact and ensure resources are focused where true risk exists.
The biggest lesson from recent AI disruption is how many organizations have underestimated their dependence on technologies they don’t have assured control over. And with renewed conversation from U.S. legislators around a potential AI “kill switch,” this has to be top of mind.
Business leaders must recognize that with all the opportunity AI unlocks, the risk of vendor dependency is close to follow. If I were head of technology at a major enterprise today, I would ensure teams across the entire technology and security departments understand where critical AI capabilities originate, the dependencies that exist across the supply chain, and how operations can remain resilient if access changed overnight.
Ultimately, the future of successful enterprise AI use will be determined by organizations baking governance and resilience strategies into business plans so that through commercial, political, and operational disruptions, business can continue as securely as usual.
Our rankings of the best cloud backup platforms.
This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.
The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here:
