A firm doing its third-party risk properly might feel reassured by variety. It uses a dozen different AI-enabled tools from a dozen different vendors - no single supplier it depends on too heavily, risk spread across the board. That reassurance can be an illusion. Underneath those twelve vendors there may be only two or three companies actually providing the models, and the diversity the firm thinks it has evaporates one tier down.
This is concentration risk, and it is the fourth-party problem's harder consequence. It is not about any one vendor failing. It is about what happens when the thing a whole sector quietly shares decides to fail at once.
Why using more vendors doesn't diversify it
Start with the assumption concentration risk breaks. In ordinary supply-chain thinking, spreading across many suppliers reduces risk - if one fails, the others carry on. That logic depends on the suppliers being genuinely independent. With AI, they often are not.
If ten of your vendors run their AI features on the same foundation model, they are not ten independent dependencies. There are ten routes to a single one. A flaw in that model, a security issue in how it is served, a change that degrades its output, a decision to withdraw it - any of these reaches all ten of your tools at once, no matter how carefully you diversified at the vendor level.
Switching from one affected vendor to another can leave you exactly where you started, if the replacement runs on the same model underneath.
This is what makes concentration risk different from ordinary vendor risk. You cannot manage it by choosing better vendors, because the exposure is not at the vendor layer. It is below it, in a market that has concentrated around a small number of providers.
How concentrated it actually is
The concentration is not hypothetical. A small number of foundation-model providers account for the large majority of the market - by some estimates, roughly three providers make up around 80% of it.
For a sector where many firms are building on the same handful of models, that means the sector as a whole has acquired a shared dependency that no individual firm chose and none can see from its own position.
That last point is what makes it insidious. From inside one firm, the dependency is invisible: you see your vendors, not what they run on, and certainly not what everyone else's vendors run on. The concentration is a property of the market, not of your vendor list - which is precisely why it does not show up in a vendor-by-vendor risk assessment, however thorough.
Why regulators are treating this as systemic
Supervisors have noticed, and the direction of travel is clear: AI-provider concentration is being treated not just as a firm-level risk but as a systemic one.
DORA already reaches towards this by treating ICT third parties as a supervised category, with a specific tier for critical ICT third-party providers whose failure could affect many financial entities at once. The logic is the same one that drove the earlier concern about cloud concentration: when enough of the system depends on the same few providers, the failure of one stops being one firm's problem and becomes everyone's.
A model provider that sits beneath a large share of the sector's AI is, in resilience terms, exactly the kind of shared point of failure the critical-third-party framing exists to address.
For an individual firm the implication is uncomfortable but important: some of your AI concentration risk is not yours to fix. It is a market-structure problem regulators are addressing at the system level. What remains yours is knowing your own exposure to it.
What a firm can actually do
You cannot un-concentrate the market. But you are not helpless, and the useful responses are concrete.
The first is to know your exposure - which of your critical functions ultimately depend on which model providers, so that when a provider has an incident, you know immediately which parts of your business are affected rather than discovering it in real time. This is the fourth-party map put to a specific use: not just seeing the chain, but knowing your concentration within it.
The second is to plan for the failure modes concentration creates, which are not only outages. A model can be deprecated or withdrawn, its terms or acceptable-use policy can change, its output can shift after an update.
Each of these can hit every function running on that model at once, and each calls for a different kind of contingency than "the vendor went down."
The third is substitutability - knowing, for a critical dependency, whether a genuine alternative exists on a different model, and what switching would cost in practice. Sometimes there is no equivalent, and that is itself a finding worth having on the record before the day you need it.
I will be honest about the ceiling on this. A single firm cannot solve concentration risk; the concentration is real, structural, and largely outside any one firm's control. What a firm can do is refuse to be surprised by it - to know, before an upstream provider has a bad day, exactly how much of its own operation is riding on that provider.
The firms that will handle the next big model-provider incident well are not the ones that avoided concentration, because almost nobody did. They are the ones that knew precisely where they were concentrated.
Frequently asked questions
What is AI concentration risk?
Montro's definition: AI concentration risk is the systemic exposure that arises when many organisations, or many of one organisation's own tools - depend on the same small number of underlying AI providers. If a widely-used foundation model fails, is withdrawn, or changes, the effects are felt simultaneously across everything built on it. It is distinct from ordinary vendor risk because it sits below the vendor layer, in a market that has concentrated around a few model providers.
Can you reduce AI concentration risk by using more vendors?
Not necessarily. Using multiple vendors only diversifies risk if those vendors are genuinely independent, and if they all run their AI features on the same underlying foundation model, they are not.
A flaw, outage, withdrawal or change in that shared model reaches all of them at once, and switching between affected vendors can leave the exposure unchanged. Diversifying at the vendor layer does not diversify a dependency that lives one tier below it.
How does DORA address AI provider concentration?
DORA treats ICT third parties as a supervised category and creates a specific tier for critical ICT third-party providers, recognising that the failure of a heavily-relied-upon provider can affect many financial entities simultaneously.
This is the same reasoning applied earlier to cloud concentration, and it is why regulators increasingly treat dependence on a small number of AI providers as a systemic issue, not only a firm-level one.
What can a firm do about concentration risk it cannot control?
Know its own exposure. A firm cannot un-concentrate the market, but it can map which of its critical functions depend on which model providers, plan for the specific failure modes concentration creates; outage, deprecation, withdrawal, terms changes - and assess whether genuine substitutes exist on different models. The goal is not to eliminate the concentration, which is largely structural, but to avoid being surprised by it when an upstream provider has a bad day.
).jpeg)
