Third-party model concentration risk
When much of the industry runs on the same few foundation models, one provider's change moves everyone at once. One risk from the wider taxonomy.
What it is
Most AI is bought, not built. And much of the industry now depends on the same small number of foundation models and providers. Concentration risk is the systemic version of ordinary third-party risk: when many firms rely on the same model, a single provider's outage, price change, unannounced model update or decision to withdraw a model does not affect one firm, it affects all of them at the same time. The dependency that looks manageable at the level of one firm looks different once you account for how many others share it.
Why it matters in finance
Two edges. At the firm level, a provider's change can shift the behaviour of your systems without you choosing it, and a firm that cannot switch is exposed to its vendor's decisions on price, availability and model behaviour. At the system level, shared dependence is a financial-stability concern, which is why the Financial Stability Board and others have flagged concentration in AI and the underlying cloud and model providers.
What catches it
Treat the model as a critical third party, not a convenient tool. Hold bought AI to the same standard as built AI: contract terms for change notification, data egress and audit rights; compensatory testing on your own data and metrics; and a golden set that detects a vendor model updating without notice. Where the use is material, build an exit or a fallback, a second provider or a simpler in-house option, so the firm is not locked to one supplier it cannot leave.
What to ask
Which providers and models is the firm dependent on, and how concentrated is that dependence? What happens if one changes its model, its price or its terms? Could the firm switch, and how quickly? How would you even detect an unannounced vendor update?
Related on this site: governing third-party AI, third-party AI risk, in full, supervising third-party AI, the AIRG to FSB crosswalk, and the guide for risk and control functions.
In an ebook: AI Risk Management for Risk and Compliance.
One risk from the wider set. See the full AI risks in finance taxonomy.