Foundation-Model Concentration Risk: A New Item for the Board Risk Register

Executive Summary

Boards underwriting AI strategies should pay close attention to a quiet but consequential exposure: concentration on a small number of foundation-model providers. This article explains why concentration risk is now a board issue and what governance responses are available short of vertical integration.

Context

Most enterprise AI today is built on a small set of foundation models. Those models are improving rapidly, but their providers also change prices, terms of service, content policies and model availability with limited notice. Organizations that have rebuilt customer-facing experiences around a single model can find their service quality, cost base and policy posture shifting on someone else's schedule.

Key Issues

• Single-provider lock-in across multiple business processes.
• Limited transparency into training data, evaluation methods and incident history.
• Geopolitical and export-control exposure on foundation-model access.
• Cost trajectories that can change materially between contract cycles.

Strategic Implications

Concentration risk is a board-level risk because the failure mode is enterprise-level. A unilateral pricing change or content-policy shift can disrupt revenue, service and compliance simultaneously.

Governance Considerations

• Treat foundation-model providers as critical suppliers with corresponding due diligence.
• Require an abstraction layer between application code and any single model provider where feasible.
• Maintain at least one tested alternative provider for high-impact use cases.

Practical Recommendations

• Add AI supplier concentration to the enterprise risk register and report it to the board annually.
• Negotiate transparency, evaluation and incident-notification clauses into vendor contracts.
• Stress-test the organization's AI dependency by simulating a 30-day loss of the primary provider.

Conclusion

Concentration risk is governable, but only if the board names it. Treating foundation-model providers as commodity SaaS underestimates the strategic dependency. Naming the exposure is the first step to managing it.