Vendor Concentration Risk
Consensus definition
Vendor concentration risk is the threat of disruption, lost capability or constrained options that arises from heavy reliance on one or a few suppliers. Applied to AI it spans dependence on a single model provider, a single inference/cloud layer, or a narrow hardware oligopoly. Regulators have long codified the supply-chain version: the EU's Digital Operational Resilience Act (DORA) requires financial entities to assess, before contracting, whether an ICT provider is "not easily substitutable"1. The Financial Stability Board extended the logic to generative AI in October 2025, naming dependence on a few key suppliers as a vulnerability to weigh on criticality, concentration, substitutability and systemic relevance2, and consulted on responsible-AI third-party practices in June 20263. The concretising event: on 12 June 2026 a US export-control directive citing national-security authorities barred access by any foreign national — inside or outside the United States, the provider's own staff included — forcing Anthropic to disable Fable 5 and Mythos 5 for all customers worldwide4. Access returned only on 1 July, after the Department of Commerce lifted the controls: Fable 5 globally and back on Amazon Bedrock, Mythos 5 to a set of US organisations only56. Nineteen days — and neither the withdrawal nor the restoration sat with the customer.
rhinegold operator refinement
Rhinegold's reframe: treat AI providers as suppliers inside the vendor-risk programme you already run — not as commodity utilities. Map which workflows depend on which provider and at which tier (model, inference, tooling), and apply the DORA substitutability test: if the provider were unavailable tomorrow with no notice — as on 12 June 2026 — could operations continue, and at what cost? Jurisdiction is now a material risk dimension alongside service level and financial stability. Note what the June episode did not settle: the restoration was as unilateral as the withdrawal, and it arrived through the same channel. A resolved outage does not retire the exposure — it demonstrates it.
Operational use
Use it in third-party-risk assessment, due-diligence questionnaires and continuity planning when onboarding or reviewing AI providers — informing multi-provider architecture, contractual exit clauses, and which workflows must not sit on a single frontier model. Feeds board-level technology-risk reporting under DORA and equivalents.Two tiers are routinely missed. The distribution tier: an answer surface such as Microsoft Copilot bundles model, cloud and workplace software into one supplier relationship, so a dependency that looks diversified at the model layer is not. And the substitution tier: naming a fallback is not having one — Mistral is a genuine EU-jurisdiction option, but only for a workflow that has actually been run on it.
Measurement boundary
Concentration risk is an exposure metric, not an outcome metric: it describes dependency structure before a disruption, not the revenue or quality hit during one — and the duration of any past outage says little about the next one, since the same mechanism can produce a day or a quarter. Substitutability assessments go stale as model capabilities diverge, and cross-firm systemic concentration (many firms on one provider) is invisible to any single-firm dashboard.Exposure is also uneven across surfaces: because answer engines draw on different models and sources (platform divergence), one provider going dark removes visibility on some and leaves others untouched.
Distinct from
From AI vendor sovereignty: that is the broader two-axis decision (visibility and control); concentration risk is one input — it asks "how many alternatives exist and how fast could we switch?", sovereignty asks "under whose control and jurisdiction does capability ultimately sit?". From the sovereign AI / EU model stack: that answers the jurisdictional vector with a specific architecture; concentration risk is about dependency structure regardless of jurisdiction — a single EU provider concentrates risk just as a single US one does.From GEO: that asks whether you are found and cited; concentration risk asks whether the capability you depend on stays available at all — orthogonal axes, easily conflated when a provider outage takes visibility down with it.
Common mistakes
- Treating AI providers as utilities (like electricity) rather than suppliers under third-party-risk governance — overlooking that access can be revoked by government directive, not only by provider failure.
- Assessing concentration only at the model layer while every model runs through one cloud's inference endpoints — still highly concentrated.
- Equating "multi-provider" with low risk without testing that the secondary provider is genuinely production-capable for the critical workflow; an untested fallback is not a mitigation.
- Assuming EU-based operations are insulated from US export-control events — the 12 June 2026 directive applied globally, including to the provider's own non-US staff.
- Reading a resolved incident as a closed risk: access came back on 1 July through the same channel that removed it, and partially — the dependency structure is unchanged.
Sources & deeper reading
- 4Anthropic — statement on the US government directive to suspend access to Fable 5 and Mythos 5 (12 June 2026)
- 5Anthropic — "Redeploying Claude Fable 5" (30 June 2026; Commerce Department lifts the controls, global access from 1 July, Mythos 5 to US organisations only)
- 6Amazon — "Claude Fable 5 from Anthropic back on Amazon Bedrock with stronger guardrails" (available again from 1 July 2026)