As organizations advance their artificial intelligence initiatives from basic generative AI tools to complex networks of AI agents capable of reasoning, decision-making, and executing tasks across various critical business functions, the risks associated with ineffective AI deployment are escalating. A recent study by IBM highlights these vulnerabilities and the associated financial implications, emphasizing the urgent need for organizations to reassess their strategies.

According to the study, a significant number of CEOs reported that AI was responsible for making 25% of corporate operational decisions. However, this number is anticipated to almost double by the year 2030, reaching an expected 48%. This evolution raises substantial operational challenges for Chief Information Officers (CIOs), who are tasked with gaining a comprehensive understanding of AI’s role across their organizations. Unfortunately, many find themselves grappling with difficulties in gathering and managing the relevant data.

IBM’s Institute for Business Value surveyed 1,000 senior executives who are responsible for AI, data, technology, and related capabilities across 17 industries and 16 geographical regions. The findings reveal that a staggering 91% of these leaders lack a complete understanding of their organization’s dependencies on AI vendors, models, and infrastructure. This lack of clarity is causing concern among executives, as transitions away from current vendors are proving to be more challenging than anticipated.

The difficulty in switching vendors is underscored by the fact that 71% of respondents indicated that changing their primary AI vendor would be a complex process. Among those who attempted such a change in the last two years, 75% faced significant challenges, often related to data portability, model re-validation, compliance, and technical lock-in. Conor Mlacak, CIO of Staples Canada, articulated this challenge by stating, “Vendor lock-in creates imbalance. Once you’re locked in, you lose leverage.”

IBM’s findings suggest that traditional expectations of vendor contracts—complete with predictable terms and predictable updates—are being upended in the AI landscape. Currently, organizations are facing vendor dependency that extends beyond standard operational concerns. Instead, it touches on how AI models can be altered or withdrawn unilaterally by vendors, which could lead to unforeseen operational challenges and cost implications for organizations. Executives have noted numerous changes over the past two years, including price increases, usage restrictions, alterations in data-handling practices, and service performance deterioration.

The financial ramifications are evident. Executives reported facing an average of six AI-related operational disruptions over the previous two years, predominantly due to vendor service issues. Moreover, the consequences of extended outages can be dire; for instance, a seven-day service interruption with a primary AI vendor would represent a severe or critical situation for 81% of those surveyed. A recent incident where Anthropic’s Fable 5 model experienced over 18 days of unavailability due to U.S. government export controls serves as a cautionary tale for both organizations and vendors alike.

In response to this volatility, CIOs are increasingly adopting the concept of AI sovereignty and flexible technological architectures as strategies to mitigate risk. IBM has found that organizations capable of maintaining a tighter control over their AI operations are able to preserve, on average, 55% more operating profit from disruptions caused by AI than those with a more fragmented approach. This heightened financial oversight and strategic flexibility creates a strong case for adaptability in vendor relationships.

One particularly revealing aspect of the study showed how the geographical separation of AI services from operational data could drastically increase costs. Organizations that deploy AI solutions distanced from their data entail an expenditure estimated at 2.8 times higher in processing fees. This inefficiency translates to concrete financial metrics; for a corporation generating $20 billion in annual revenue, such misalignment could lead to approximately $50 million in unnecessary expenditures each year.

However, achieving this flexibility is not without its challenges. According to IBM, executives estimate an average of 145 days is required to transition AI training and operational data to a different environment. Furthermore, 57% of the respondents indicated that replacing a core AI model would require substantial decoupling or even a complete system overhaul. Despite these daunting figures, 72% of executives expressed a willingness to endure a 20% increase in costs to maintain a diversified vendor landscape that enhances strategic flexibility.

To address these issues, IBM proposes a structured, three-tiered approach for technology leaders managing their AI systems. The first tier encompasses mission-critical applications like fraud detection systems and proprietary algorithms, all areas where the ramifications of failure far exceed the costs of maintaining alternative options. The second tier includes significant capabilities—such as customer service automation and HR analytics—where some level of dependency on vendors may be acceptable, but certain safeguards like contractual exit rights should be standard. The third tier, reserved for commodity services, allows for deliberate vendor lock-in but requires meaningful governance to avoid unintentional dependencies.

Interestingly, IBM discovered that many organizations have already adopted a practice of utilizing multiple AI vendors, with 28% of respondents reporting the use of four or more. However, this diversification appears to stem more from organizational fragmentation and geographic complexities than from a well-thought-out strategy.

CIOs looking to take charge of their AI systems would benefit from thoroughly mapping their entire dependency chain, especially regarding tier-one systems. This includes identifying open-source options and conducting a comprehensive inventory of areas where dependencies exist. In a proactive approach, organizations should validate their extraction strategies, test model-swap pipelines, and implement failover mechanisms into their infrastructure when feasible.

For each tier-one system, businesses should establish and regularly update tested alternative solutions for data, models, and runtime capabilities, alongside migration plans capable of addressing potential disruptions. Sergio Sánchez Gallego, CTIO of Telefónica España, summed up the importance of adaptive architecture by stating, “Our architecture must be flexible enough to evolve, allowing us to swap components or adopt new technologies without starting from scratch.” This adaptability will prove vital as organizations navigate the complex landscape of AI and its associated challenges.