Now more than ever, artificial intelligence (AI) continues to be integrated into many business operations worldwide and has the ability to impact many areas of a business. Companies use it for many things such as analyzing data, making decisions, and supporting security.
Most companies focus more on what AI can do and what they can get from its use, how powerful it is, and how it can improve productivity dramatically.
But a major issue has usually been left out and mostly overlooked: what happens if we suddenly lose access to the AI services that many companies now depend on?
The Trigger: Over Reliance to AI
The issue in over reliance to AI became noticeable after Anthropic restricted access to some of its AI models due to compliance and export-control requirements.
The concern was not only about why access was restricted. The bigger concern was that many organizations realized that a decision made by an outside company could instantly remove an AI capability that had already become crucial to their overall operations.
This shows that AI access disruptions are not only a technology problem, but also an operational resilience and governance problem.
To many companies that are becoming more dependent on AI, they do not just need to know how secure their AI tools are, but also what they will do and how their operations will continue if the AI services they heavily rely on suddenly become unavailable.
Security Does Not Always Mean Resilience
Security focuses on how to protect systems from attacks, unauthorized access, system vulnerabilities, and other threats.
Resilience, however, focuses on how the business can continue operating when a system, service, or data becomes unavailable.
Most organizations think that resilience usually applies to situations like cyberattacks or IT system failures. But AI services can also be disrupted even if nobody hacks them.
An example of this can be due to government regulations, geopolitical decisions, or simply changes made by the technology provider.
Because of these situations, companies need to include AI services when doing their business continuity and resilience planning. They should consider what would happen if one AI provider suddenly changes its policies, restricts access, or suddenly stops providing part of an AI service.
Growing Vendor Dependency on AI
The difference between traditional software and AI is that traditional software may involve one or a few vendors. However, AI can be more complicated because it usually depends on several connected providers.
Most companies may depend on an AI model provider, a cloud provider that hosts the AI model service, other platforms that are connected and working with the AI model, and vendors that support the overall AI system.
For each layer, it creates another dependency. If one part of the system changes or becomes disrupted, other parts can be affected as well.
The four major risks identified are:
- Data sovereignty – Company data may be processed in countries or legal jurisdictions that the company does not have full control over. This can create questions about who can have access to the data and how company data may be used.
- Model sovereignty – Companies do not have full control over the AI model itself, meaning any changes in features, availability, or access can make an impact on the operations of the company that uses it.
- Infrastructure dependency – Most AI services depend on a small number of major cloud providers, creating another layer of dependency on those providers and the jurisdictions where they operate.
- AI supply-chain risk – AI systems can involve many connected providers, such as model developers, cloud companies, and software vendors. One disruption in one layer can affect the rest of the system.
This just shows that the availability of AI is not just a technical problem but can also be affected by geopolitical and regulatory decisions.
Organizations should reconsider how their dependency on AI will roll out throughout their organization during the development of their AI governance framework. A contract with an AI vendor does not guarantee that they will always have access to its services.
Companies should always consider what would happen if a particular vendor suddenly became unavailable. The company should include this in their contingency plans and consider how the company will continue operating. AI should receive the same level of attention when it becomes crucial to business operations.
Moreover, organizations should not just believe AI vendors blindly and that their AI tools can solve security or risk problems.
AI may identify possible vulnerabilities quickly, but human judgment is still needed to determine which problems are important, how to prioritize them, and decide where resources should be used.
The bigger lesson here is that companies are realizing how dependent they have become on technologies they do not fully control. And as AI becomes more deeply integrated into business operations, organizations must understand where their critical AI capabilities come from and what other systems and vendors they depend on.
Companies need to build governance and resilience into their business plans, so they can continue operating even when commercial, political, regulatory, or technological disruptions affect their AI services.
