Rehearse Losing Your AI Supplier

Begin with a short map of the service, not an exhaustive inventory of every AI tool. Identify the provider doing the work, where essential information is held, how staff gain access and which other services the fallback requires. Ask the proposed alternative the same questions. Two different brands may not provide two independent recovery paths.

The Financial Stability Board has identified third-party dependencies and concentration as AI-related vulnerabilities, while noting significant monitoring gaps. Its work is an international policy reference, not a licence to declare every supplier relationship unsafe. The lesson is to investigate the dependency beneath the product label before counting it as diversified. ²

A useful fallback might be another supplier, a smaller local system or a carefully limited manual process. None should be assumed superior in advance. A second provider that staff cannot access, that lacks the necessary records or that struggles with the customer's language may add procurement work without adding continuity.

For financial entities within its scope, the EU's Digital Operational Resilience Act has applied since 17 January 2025. Article 28(8) requires exit strategies for technology services supporting critical or important functions, with documented plans that are sufficiently tested and periodically reviewed. Applicability depends on the entity and arrangement; this is not an obligation imposed on every business using a chatbot. ³

In the UK, the PRA's current outsourcing statement expects continuity and exit planning for material outsourcing arrangements. Its November 2024 version is current; the March 2026 revision is listed as taking effect in March 2027. Treat a future-effective document differently from today's supervisory expectations. ⁴

Singapore's agentic-AI framework offers governance guidance, not a cross-border prudential rule. Map the sector, entity and service before deciding which obligations apply. ⁶

Changing the provider or infrastructure may also change the result. A new arXiv study examines how the same language model and prompt can produce different outputs across graphics processors, and reports a method to improve reproducibility on specified hardware. It is a bounded technical preprint, not a measurement of enterprise failover failures. The executive implication is narrower: verify the work after a change instead of equating a successful connection with a successful replacement. ⁷

Supplier products are also evolving. Anthropic's 22 September Opus release describes changes to capabilities and integration behaviour. Those are the supplier's claims, not an independent comparison or a reason to recommend that product. They illustrate why a recovery procedure tied to one model version can age even while the commercial relationship remains unchanged. ⁸

Use a small set of representative tasks to check the alternative. Include an ordinary case, an ambiguous case and one that should be stopped or referred to a person. Assess whether staff can recognise the limits. The fallback does not need to reproduce every sentence; it needs to deliver an acceptable service within the boundaries management has approved.

Choose one service and define what must continue, what can wait and who may decide. An illustrative customer-service team might prioritise urgent enquiries while holding complex cases for qualified staff. This is a proposed exercise, not a reported customer deployment. Use representative material in a controlled setting; do not interrupt a live service merely to prove a point.

Measure the time to recognise the loss, activate the alternative and complete the priority work. Record missing records, unavailable permissions, additional review and the queue that accumulates. Include the people cost. A manual fallback that needs twice the available staffing is a funding decision, not a completed control.

Agree the conditions for returning to normal service as well as leaving it. Who reconciles work completed during the interruption? Who checks that no case was duplicated or lost? Who can stop the fallback if quality deteriorates? The exercise is useful when it changes an operating decision, even if its first result is that the planned rollout must remain smaller.

The operating question travels further than any one legal regime. North American buyers should examine their own sector rules and contracts rather than import DORA wholesale. European and UK firms need the correct entity-level scope. Across Asia-Pacific, test the actual languages and service locations in the proposed alternative.

For operations in African, Middle Eastern and Latin American markets, check connectivity, local supplier availability, information-transfer restrictions and the people available to run a reduced service. Do not assume either that local provision is adequate or that an overseas alternative is accessible. These are due-diligence questions, not claims that entire regions share the same infrastructure or law.

At renewal, ask the business owner to show what the rehearsal changed: a better alternative, retained access to essential records, extra capacity or a narrower rollout. A supplier can remain the best primary choice while the organisation reduces its dependence on uninterrupted access. The goal is not to buy two of everything. It is to know which work will continue, who will deliver it and what that promise costs.