Moody's calls AI vendor dependence a systemic risk

A ratings agency just wrote down the thing we keep telling operators over coffee: if a handful of companies supply everyone's AI, they set the price and they own your uptime. Moody's said it about banks. The argument does not care how big you are, and AI vendor dependence is a risk you can actually design around.

What actually happened

Moody's "Bank of the Future" analysis, published in late July 2026 and covered this weekend in a Guardian report, found that "the reliance of most financial firms on a relatively small set of foundation AI model and cloud computing providers risks creating a systemic dependency."

Two specific failure modes get named. Operationally, "a model outage at one major provider could potentially spread quickly across customers and sectors" — correlated downtime, because everyone bought from the same three vendors. Commercially, Moody's flags vendor dependence risk: "a set of dominant AI model and infrastructure providers could, over time, exert control over the price of AI services." The report also expects regulators to look harder at third-party AI concentration as adoption deepens.

The readiness picture underneath is worse than the headline. Moody's separate banking research from June found only 35% of banks investing in AI governance frameworks, 80% held back by fragmented data and legacy infrastructure, and only 12% confident they can use their own data to act quickly. These are institutions with compliance departments.

Moody's own list of mitigations is short and unglamorous: keep control of your own data, use your leverage in technology contract negotiations, use open-source models, and form partnerships.

Why AI vendor concentration matters for your business

If you run a 12-person operation, you have less negotiating leverage than JPMorgan and the exact same exposure. When a frontier provider has an outage, your support triage, your product descriptions, and your invoice parsing all stop at once — not because your systems failed, but because they share a dependency you never mapped.

We wrote in July about two labs taking 43% of all startup funding and what that concentration does to pricing. Moody's is describing the operational half of the same problem, and it's arriving with the credibility of a firm that gets paid to be right about downside.

Three things worth doing this quarter, all boring:

Map the dependency. List every tool in your business that calls an AI API, then list the underlying model behind each. Most operators find four or five vendors resolve to two labs. That's your real concentration number, not the one on your vendor list.

Keep a fallback path that you have actually tested. A second provider configured but never exercised is not a fallback. Run a workflow through it once a quarter. Open weights are the strongest version of this — a model like Meta's Muse Glimmer running on your own hardware can't be repriced or deprecated out from under you.

Own your data layer. Moody's put this first for a reason. If your customer records, product data, and transaction history live in systems you control, switching model vendors is a config change. If they live inside a vendor's platform, it's a migration project you'll postpone until the renewal quote arrives.

Sources: Guardian report via AOL, Moody's.