For Heads-of · Practitioner
Vendor exit strategy and concentration management
A documented, costed exit plan and an actively managed concentration limit for any critical AI vendor dependency.
- directive
- third-party
- vendor-risk
- policy
What it does
Maintains a costed, tested exit plan for each material AI vendor, and tracks concentration risk across the vendor portfolio rather than assessing each vendor relationship in isolation.
Where it fits
Mitigates vendor-concentration-and-exit-strategy-gap and gives sub-outsourcing-visibility-gap somewhere to escalate to once discovered.
Risks this mitigates
The risks this control addresses, ranked by effectiveness.
Sub-outsourcing visibility gap
An AI vendor sub-contracts part of the service without the originating organisation having visibility or contractual control over that layer.
Vendor concentration and exit strategy gap
The organisation is dependent on a single AI model or vendor for a critical function with no viable exit plan or alternative provider identified.
Framework and clause references
| Framework | Clause | Title |
|---|---|---|
| SS2/21: Outsourcing and Third-Party Risk Management | Chapter 10 | Business continuity and exit plans |