Risk · R-165 · Systemic & Societal
Model monoculture and herding
Many organisations rely on the same few models, providers and data, so they make the same errors, react in the same way and fail at the same time.
- Severity
- High
- Audience
- Board · Heads-of
- Frameworks
- Robustness · Principle 5 · CTP Designation
- Responsible AI domain
- Lifecycle stage
- Reviewed
- 2026-11-11
What it is
A small number of providers supply the most capable models, and many firms build on them. Organisations that use the same model inherit the same blind spots and biases, and tend to reach the same conclusions from the same inputs. In good times this goes unnoticed. Under stress it can amplify: lenders tighten together, traders sell together, fraud systems block the same customers, and an outage or a flawed update at one provider reaches everyone at once. For a single organisation the risk has two sides. It is exposed to a shared failure it cannot prevent, and its own choices add to the concentration. Its own dependence is covered in vendor concentration and exit strategy gap.
How it happens
- The best-performing model is the obvious choice for everyone.
- Suppliers of different products are built on the same underlying model.
- Firms train on the same public and vendor data.
- Risk models across a sector are validated against one another's outputs.
Why it matters
Diversity of judgement is part of what keeps markets and systems stable. Where it is lost, errors are correlated and shocks are larger. Financial authorities treat concentration in a few technology providers as a matter of stability, which is the purpose of the UK's critical third parties regime. An organisation's own resilience planning is unsound if it assumes that others will be unaffected when it is.
Warning signs
- The organisation's key models and those of its peers come from the same provider.
- Scenario tests assume a provider failure affects the organisation alone.
- Several suppliers, examined closely, depend on one model.
- Model outputs across the sector move together more than fundamentals explain.
Who owns it
The board and the chief risk officer own the organisation's view of systemic exposure. The executive accountable for third-party risk measures concentration. The resilience function tests shared-failure scenarios.
In practice
Most mid-sized lenders in a market adopt the same vendor's affordability model. A change in how it treats irregular income leads all of them to decline the same group of self-employed applicants in the same month. No single lender's monitoring shows anything unusual. The same pattern generalises to any market in which many participants delegate a judgement to one source.
Mitigating controls
Primary controls
- Vendor exit strategy and concentration management Directive
- Tracks concentration on shared models and maintains alternatives. Each material AI supplier has a documented, costed and tested exit plan, and dependence on each provider is measured across the organisation and held within limits.
Supporting controls
- AI failure scenario testing Detective
- Exercises a common-mode failure. Severe but plausible AI failure scenarios are exercised against impact tolerances on a set cycle, and the lessons are acted on.
- AI risk reporting to the board Detective
- Reports concentration to the board. Key risk indicators, incidents, exceptions and the state of the inventory are reported to the board or its committee on a set cycle, in a form that supports challenge.
Framework and clause references
| Framework | Clause | Title |
|---|---|---|
| OECD AI Principles | Robustness | Robustness, security and safety Systemic robustness. |
| SS1/23: Model Risk Management Principles for Banks | Principle 5 | Model risk mitigants Aggregate model risk. |
| UK Critical Third Parties Regime | CTP Designation | Critical third party designation and oversight Concentration in shared providers. |
Sources
- SS1/23: Model Risk Management Principles for Banks Bank of England PRA · official text
- UK Critical Third Parties Regime Bank of England / PRA / FCA · official text
- OECD AI Principles OECD · official text
Related terms
How to cite
Axiom Verity (2026). Model monoculture and herding. Reference Library, R-165. https://axiom-verity.com/risks/model-monoculture-and-herding. Reviewed 2026-11-11.
Found an error or a better source? Report a correction.