For Heads-of · Practitioner
Vendor concentration and exit strategy gap
The organisation is dependent on a single AI model or vendor for a critical function with no viable exit plan or alternative provider identified.
- high
- third-party
- vendor-concentration
- operational-resilience
How it happens
A critical function is built around a single AI model provider's API, and no one has costed or tested what it would take to switch providers or bring the capability in-house if that vendor became unavailable or unacceptable.
Why it matters
Concentration risk doesn't announce itself until the vendor changes terms, suffers an outage, or is acquired, at which point the absence of an exit plan turns a vendor problem into an operational crisis.
Mitigating controls
The controls that address this risk, ranked by effectiveness.
Framework and clause references
| Framework | Clause | Title |
|---|---|---|
| UK Critical Third Parties Regime | CTP Designation | Critical third party designation and oversight |
| SS2/21: Outsourcing and Third-Party Risk Management | Chapter 10 | Business continuity and exit plans |
Related resources
The external sources behind this risk, from the Resources library.