Review Concentration Risk

Concentration risk is exposure created when important operations, data, capability, or supply depend heavily on a small number of providers, models, regions, platforms, or other shared resources.

Several teams may appear to use different products while depending on the same cloud, model provider, chip supply, or identity service underneath.

A single outage, policy change, compromise, price shift, or capacity limit can affect many supposedly independent operations at once.

Multiple departments buy separate AI applications that all rely on the same underlying model API and fail during one provider outage.

Concentration risk is not visible from vendor count alone. Different vendors can share the same lower-layer dependency.

Different products can still share one point of failure.

* [[layered-sovereignty|Layered Sovereignty]] * [[vendor-lock-in|Vendor Lock-In]] * [[bottleneck|Bottleneck]] * [[operational-slack|Operational Slack]] * [[build-vs-buy|Build vs. Buy]]

* [Basel Committee on Banking Supervision, Principles for the Sound Management of Third-Party Risk](https://www.bis.org/bcbs/publ/d605.htm) — authoritative treatment of dependency and concentration risk involving a single or limited number of providers. * [NIST AI 600-1, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile](https://doi.org/10.6028/NIST.AI.600-1) — AI-specific value-chain, component, and third-party dependency risk guidance.

* Trace hidden shared dependencies with [[layered-sovereignty|Layered Sovereignty]].