2026-07-28 · Article
The Single Vendor Trap: Testing An AI Exit Before You Need One
Every organisation has an AI vendor it could not replace this quarter if it had to. Very few have written down which one, or what it would cost to try.
Name the AI vendor your organisation could not replace inside ninety days.
Most executives can answer that in under five seconds, which tells you the knowledge exists. It is almost never written down, almost never priced, and almost never reviewed by the people whose job is to review exactly this class of dependency.
That gap between what everybody knows and what anybody has documented is the whole subject of this article, and it is the last of the four exposures this series set out to make answerable without predicting anything.
Concentration is not a market view
The previous three articles dealt with numbers that were misread, prices that are subsidised, and pilots that never end. All of them share a property: they get worse if you have one supplier and better if you have a credible second.
This is ordinary supplier risk. Your organisation already applies it to banking, insurance, logistics and payroll. Nobody needs to be persuaded that a single point of failure in payments is a board matter. AI has escaped that framing for three years, largely because it arrived as an experiment and was procured like stationery.
It is not an experiment now. If a model change degrades your customer-service quality, or a price change makes a workflow uneconomic, or a vendor deprecates the model your prompts were tuned against, that is an operational event with a revenue number attached.
The tell: circular financing
There is a specific pattern worth watching, because it makes concentration risk harder to see.
On 28 July, Nvidia's share price fell about 5 per cent, losing it the title of world's most valuable listed company to Apple, after the Wall Street Journal reported it was in talks to provide around 250 billion dollars to OpenAI for a data-centre project. The BBC contacted both companies. Neither commented.
Treat that figure with the care the first article recommended: it is a reported negotiation, unconfirmed by either party, and if you see it quoted in September as settled fact you will know exactly what happened to it in the interval.
The structure, though, is the point. A chip vendor funding a model vendor to buy chips is not unusual in a capital-intensive industry, and it is not evidence of wrongdoing. It does mean that "we use two different AI suppliers" can be less diversification than it appears, once you trace who is funding whom, whose data centres the inference actually runs in, and which single vendor's hardware sits underneath both of your supposedly independent options.
Diversification you have not traced to the physical layer is a diagram, not a control.
The good news is that switching demonstrably works
This series has not argued that anyone is trapped, and the evidence says otherwise.
Coinbase reduced its AI spending by nearly half by moving to GLM 5.2 and Kimi 2.7, with token consumption rising over the same period. The automation firm Lindy migrated all of its traffic from Anthropic's Claude to DeepSeek. Across the market, US firms routed more than 30 per cent of their OpenRouter tokens to Chinese open models every week from February, up from 4.5 per cent in the first half of 2025.
Those organisations were able to move because their systems were built to move: model access behind an interface, prompts and evaluations version-controlled, and a measurable definition of acceptable output that could be run against a candidate. None of that is exotic engineering. All of it has to exist before you need it, which is the entire difficulty.
And, as article 2 noted, a move made purely on price can trade a cost exposure for a data-governance one. Where inference happens and what POPIA requires of that transfer are questions to answer before a migration, not during an incident.
What an exit test actually proves
Boards ask for exit plans and receive documents. A document is not a test.
The only evidence that a dependency is exitable is a rehearsal: an actual workload, actually run against an actual alternative, with the output actually compared. Everything else is a claim by the people who built the dependency that the dependency is fine.
This should sound familiar, because it is the same standard applied to disaster recovery, where the industry learned the lesson the hard way over about twenty years. An untested failover is not a failover. It is a paragraph.
The artefact: the AI Vendor Exit Test
Run this annually per material AI vendor, and after any pricing or model change. It produces a date and a number. Both belong in the risk register.
The named dependency. Which vendor, which specific models, and which business processes stop or degrade if it becomes unavailable or uneconomic. Name the processes, not the systems: "quotations" and "first-line support", not "the API layer".
The traced supply chain. For each alternative, record whose infrastructure it runs on, whose hardware sits underneath, and any funding relationship between them. Count alternatives that rest on a shared physical dependency as a single option.
The rehearsal record. Record the date a real workload was last run against an alternative, the measured quality difference, and the individual who signed off on the comparison. If no rehearsal has been run, record "not tested".
Time and cost to switch, with the compliance position attached. Record the working days to migrate the named processes, the estimated cost, and the data-governance position for the alternative, including where inference occurs and the POPIA transfer basis relied on.
How we hold ourselves to this
Our own tooling routes model calls through an internal interface rather than calling a vendor SDK directly, specifically so that a model can be changed without changing the systems that depend on it. That was not foresight about a bubble. It was an ordinary architectural preference that turned out to be a governance control.
We are honest about the limit of it. Routing is not the same as rehearsal, and an interface only proves you can change the call, not that the replacement is good enough. Our own exit rehearsals are annual, and the last one moved a real workload and measured the difference, which is the only version of this exercise that counts.
For the record
This series has deliberately refused to tell you whether there is a bubble. That refusal was the point.
Every question worth asking about your AI programme resolves without a market view. What do the vendor's accounts actually say. What is the price when it is not subsidised. Which initiatives are alive and which are merely unclosed. What happens if the supplier underneath all of it changes terms.
Four questions, four one-page tools, no forecast required. A board that can answer them is in the same position whether the market triples or halves, which is the only kind of readiness that is worth anything, because it does not depend on being right about the future.
The organisations that will struggle are not the ones that bet on AI. They are the ones that made a series of individually sensible decisions, each approved by someone competent, and never wrote down what they had collectively assumed. That has never been a technology failure. It is the oldest governance failure there is, wearing a new vocabulary.
Sources: BBC News, "Chip stocks slide in US and Asia as AI jitters rattle investors," 28 July 2026, reporting Nvidia's decline of approximately 5 per cent and loss of most-valuable-listed-company status to Apple, following a Wall Street Journal report that Nvidia was in talks to provide approximately 250 billion US dollars to OpenAI for a data-centre project (unconfirmed; the BBC reported contacting both companies, neither of which commented); enterprise migration and routing data as reported July 2026, including Coinbase reducing AI spend by nearly 50 per cent via GLM 5.2 and Kimi 2.7 with token consumption rising, Lindy migrating all traffic from Anthropic Claude to DeepSeek, and OpenRouter data showing US firms routing more than 30 per cent of tokens weekly to Chinese open models from 8 February 2026 against 4.5 per cent in the first half of 2025; Protection of Personal Information Act 4 of 2013 (POPIA), section 72 (transborder information flows) and condition 7 (security safeguards); King V Code on Corporate Governance, IoDSA, Principle 10 (data, information and technology governance; oversight proportionate to risk); ISO/IEC 42001 Annex A.10 (third-party and supplier relationships).
Book the two-hour diagnostic