Ask most technology leaders whether they know their organisation’s biggest single point of failure, and they’ll usually point to a legacy system, a key supplier, or one irreplaceable member of staff. Ask them whether that point of failure might now be an AI vendor they signed up with eighteen months ago for a pilot project, and the answer tends to be a pause, followed by “I’d need to check.”
That pause is the finding. IBM surveyed 1,000 senior executives across 16 countries for a study published in June, and found that 91% admit they don’t fully understand their organisation’s dependencies across AI vendors, models and infrastructure. It’s worth saying plainly that IBM sells AI governance tools, so this data comes from a company with a commercial interest in the answer. The number is still worth taking seriously, because it matches something I see constantly in client environments: AI adoption moved fast enough that the dependency mapping never caught up.
The stakes aren’t abstract. The same survey found 81% of respondents say a week-long outage from their primary AI vendor would cause severe or critical disruption. And 71% say switching that vendor would be difficult if they had to.
Three ways this actually happens
This isn’t a hypothetical risk waiting to materialise. Three genuinely different failure modes have already played out this year, and any one of them could hit an organisation with no warning.
In August, OpenAI paused reinforcement learning training on its newest models and put its largest planned frontier training run on hold, after preliminary evidence suggested one upcoming model might cross a critical safety threshold in its own internal framework. That model was later formally confirmed as the first to cross that line. The pause was entirely OpenAI’s own call, made for good reasons, and it delayed capability that some customers had been planning around.
In June, Anthropic had to suspend access to two of its models worldwide, for every user, after a US export control order targeting foreign nationals came into effect. Because there was no way to verify nationality in real time, the only option was to switch both models off entirely until the controls lifted three weeks later. That’s a regulatory and geopolitical decision, made by a government, that had nothing to do with anyone’s contract or usage.
And in September, a regional Microsoft Azure outage took ChatGPT, Claude and Grok offline within the same ninety-minute window, because all three were running on the same underlying cloud infrastructure in that region. Google’s Gemini, running on Google’s own infrastructure, stayed up throughout. Three different AI providers, one shared point of failure nobody had priced in.
A safety decision, a government order, and a cloud outage. None of these is the kind of risk a standard vendor contract review catches, and none of them required the AI vendor itself to do anything wrong.
Regulators are already ahead of most boards on this
If this still feels like tomorrow’s problem, the regulatory picture says otherwise. The EU named nineteen critical technology providers subject to direct regulatory oversight of concentration risk back in November, including major cloud and AI infrastructure providers. The UK followed in July, formally designating four providers, AWS, Google Cloud, Microsoft and Oracle, under its own Critical Third Parties regime. A UK parliamentary committee has already recommended that AI providers specifically be added to that list by the end of this year.
Regulators don’t tend to build oversight regimes for risks that turn out to be minor. When they start naming specific providers as systemically important, that’s usually a sign the underlying risk was already real, and boards are catching up rather than getting ahead of it.
What actually closes the gap
None of this means abandoning AI vendors or building everything in house, which is rarely realistic and often more expensive than the risk it’s meant to solve. It means being able to answer three questions with confidence rather than a pause.
What would we lose, specifically, if our primary AI vendor was unavailable for a week. What would it actually cost, in time and money, to switch to an alternative if we had to. And is there anything running on that vendor today that we’d genuinely regret depending on this heavily, with hindsight.
Most organisations I’ve worked with can answer detailed questions about their cloud provider’s SLA. Far fewer can answer the equivalent questions about the AI vendor sitting underneath an increasing share of their actual decisions. That gap is closing, whether boards choose to close it deliberately or have it closed for them by the next outage, government order, or safety pause.
Sources: IBM Institute for Business Value with Oxford Economics, The Calculus of AI Sovereignty (1,000 executives, 16 countries; published 17 June 2026). OpenAI, “Pacing model development in an era of cyber-critical capabilities” (18 August 2026). Anthropic export control suspension and restoration (12 June to 1 July 2026). Microsoft Azure East US service disruption (3 September 2026). European Supervisory Authorities, first critical ICT third-party provider designations (18 November 2025). HM Treasury, UK Critical Third Parties designations (effective 13 July 2026).