Risk · R-132 · Third-Party & Supply Chain

Model deprecation and forced migration

A provider withdraws a model version on its own timetable, forcing the organisation to migrate to a different model before it has tested the replacement.

Severity
Medium
Audience
Heads-of · Practitioner
Frameworks
Article 28 · MANAGE 3 · Chapter 10
Responsible AI domain
Reviewed
2026-11-11

What it is

Hosted models have short lives. Providers retire versions regularly, sometimes with a few months' notice, and the replacement is a different model with different behaviour. Every system built on the retiring version has to be moved, retested and reapproved by the provider's date, whatever else the organisation had planned. The risk is that the migration is rushed, or that the date passes and the system stops. It is the forced counterpart of unannounced upstream model change: here the change is announced and cannot be declined.

How it happens

  • Nobody tracks the retirement dates of the models in use.
  • The system has no test suite with which to qualify a replacement.
  • Fine-tuned models and tuned prompts do not carry over.
  • Several systems must migrate at once.

Why it matters

A hurried migration skips validation, so the replacement goes live with unknown behaviour. A missed date is an outage. Repeated migrations consume the capacity that was meant for other work.

Warning signs

  • The inventory does not record model versions or their end dates.
  • Deprecation notices reach nobody responsible.
  • Past migrations were completed in the final week.
  • No budget or time is planned for model migration.

Mitigating controls

Primary controls

Ongoing AI vendor monitoring Detective
Tracks deprecation notices so migration is planned. Each AI supplier's performance, incidents, model changes, terms and financial and operational standing are reviewed on a cycle set by how material the supplier is.

Supporting controls

Evaluation suite and regression testing Detective
Provides the tests that make a migration safe. A maintained set of test cases with expected results is run on every change to model, prompt, data or tools, and the results are compared with the approved baseline.
Vendor exit strategy and concentration management Directive
The exit plan covers replacing a withdrawn model. Each material AI supplier has a documented, costed and tested exit plan, and dependence on each provider is measured across the organisation and held within limits.

Framework and clause references

FrameworkClauseTitle
Digital Operational Resilience Act (DORA)Article 28General principles on ICT third-party risk Exit strategies.
NIST AI Risk Management Framework (AI RMF 1.0)MANAGE 3Risks from third-party entities are managed Third-party risk.
SS2/21: Outsourcing and Third-Party Risk ManagementChapter 10Business continuity and exit plans Continuity and exit.

Sources

SS2/21: Outsourcing and Third-Party Risk Management Bank of England PRA · official text

Related terms

How to cite

Axiom Verity (2026). Model deprecation and forced migration. Reference Library, R-132. https://axiom-verity.com/risks/model-deprecation-and-forced-migration. Reviewed 2026-11-11.