Risk · R-132 · Third-Party & Supply Chain
Model deprecation and forced migration
A provider withdraws a model version on its own timetable, forcing the organisation to migrate to a different model before it has tested the replacement.
- Severity
- Medium
- Audience
- Heads-of · Practitioner
- Frameworks
- Article 28 · MANAGE 3 · Chapter 10
- Responsible AI domain
- Lifecycle stage
- Reviewed
- 2026-11-11
What it is
Hosted models have short lives. Providers retire versions regularly, sometimes with a few months' notice, and the replacement is a different model with different behaviour. Every system built on the retiring version has to be moved, retested and reapproved by the provider's date, whatever else the organisation had planned. The risk is that the migration is rushed, or that the date passes and the system stops. It is the forced counterpart of unannounced upstream model change: here the change is announced and cannot be declined.
How it happens
- Nobody tracks the retirement dates of the models in use.
- The system has no test suite with which to qualify a replacement.
- Fine-tuned models and tuned prompts do not carry over.
- Several systems must migrate at once.
Why it matters
A hurried migration skips validation, so the replacement goes live with unknown behaviour. A missed date is an outage. Repeated migrations consume the capacity that was meant for other work.
Warning signs
- The inventory does not record model versions or their end dates.
- Deprecation notices reach nobody responsible.
- Past migrations were completed in the final week.
- No budget or time is planned for model migration.
Mitigating controls
Primary controls
- Ongoing AI vendor monitoring Detective
- Tracks deprecation notices so migration is planned. Each AI supplier's performance, incidents, model changes, terms and financial and operational standing are reviewed on a cycle set by how material the supplier is.
Supporting controls
- Evaluation suite and regression testing Detective
- Provides the tests that make a migration safe. A maintained set of test cases with expected results is run on every change to model, prompt, data or tools, and the results are compared with the approved baseline.
- Vendor exit strategy and concentration management Directive
- The exit plan covers replacing a withdrawn model. Each material AI supplier has a documented, costed and tested exit plan, and dependence on each provider is measured across the organisation and held within limits.
Framework and clause references
| Framework | Clause | Title |
|---|---|---|
| Digital Operational Resilience Act (DORA) | Article 28 | General principles on ICT third-party risk Exit strategies. |
| NIST AI Risk Management Framework (AI RMF 1.0) | MANAGE 3 | Risks from third-party entities are managed Third-party risk. |
| SS2/21: Outsourcing and Third-Party Risk Management | Chapter 10 | Business continuity and exit plans Continuity and exit. |
Sources
- SS2/21: Outsourcing and Third-Party Risk Management Bank of England PRA · official text
- NIST AI Risk Management Framework (AI RMF 1.0) NIST · framework
Related terms
How to cite
Axiom Verity (2026). Model deprecation and forced migration. Reference Library, R-132. https://axiom-verity.com/risks/model-deprecation-and-forced-migration. Reviewed 2026-11-11.
Found an error or a better source? Report a correction.