Over the past eighteen months, I’ve spent a great deal of time speaking with enterprise organisations, software vendors, procurement teams, lawyers, operational resilience professionals and technology leaders about artificial intelligence.
The conversation around AI has changed.
Not long ago, organisations wanted to understand what AI could do, how quickly it could be deployed, and where it could create value.
Today, they’re asking different questions.
“What happens if this AI supplier fails?”
“How do we recover if the platform disappears?”
“What exactly are we becoming dependent upon?”
Organisations aren’t becoming less interested in AI. They’re becoming more realistic about the risks that come with it.
We’ve Been Here Before
This isn’t the first time technology has transformed third-party risk.
Twenty years ago, enterprise software typically lived inside an organisation’s own data centre. If something went wrong, the customer retained control.
Cloud computing changed that. Applications moved into supplier-managed environments, delivering flexibility and scalability, but also creating new dependencies. If a supplier suffered a major outage, became insolvent or withdrew support, customers had far less control.
Artificial intelligence represents the next evolution.
Today’s AI applications often depend on foundation models, cloud providers, APIs, datasets, orchestration platforms, model weights and other third-party AI services.
The technology stack has become more sophisticated, and so has the risk.
The Risk Profile Has Changed
Traditional software continuity focused on source code, documentation and deployment.
Modern AI raises new questions.
What happens if the underlying model provider changes pricing?
What happens if a vendor switches foundation models?
Who owns the fine-tuned model?
Can the training data be recovered?
Can the solution continue operating if one critical AI service becomes unavailable?
These are no longer theoretical questions. They’re increasingly appearing in procurement exercises, supplier due diligence and board-level discussions.
Innovation Doesn’t Remove Commercial Risk
One misconception I still encounter is that successful AI companies are somehow insulated from commercial risk because of the enormous investment flowing into the sector.
History tells us otherwise.
Argo AI was one of the world’s best-funded autonomous vehicle companies, backed by Ford and Volkswagen. In 2022, funding was withdrawn and the company shut down. Customers and partners suddenly lost access to cloud-hosted AI models, mapping platforms, simulation environments and engineering expertise, while Ford recorded a $2.7 billion impairment.
The lesson wasn’t simply that an AI company failed.
It was that organisations had become deeply dependent on a rapidly evolving technology ecosystem that many had underestimated.
Failure Isn’t Always Insolvency
Supplier risk is expanding beyond financial failure.
Products can be discontinued. Partnerships can end. Strategic priorities can change.
Earlier this year, OpenAI’s decision to discontinue its AI video-generation application, Sora, while winding down a significant content partnership with Disney, demonstrated how customers can suddenly find themselves reassessing business-critical initiatives through no fault of their own.
Supplier risk is no longer just about insolvency.
It’s also about strategic change.
Regulators Are Raising Expectations
Regulators are changing the conversation too.
Whether through DORA, the EU AI Act, APRA CPS230, the PRA’s operational resilience framework, NIS2 or similar guidance, organisations are increasingly expected to understand technology dependencies, assess critical suppliers and maintain credible exit and recovery strategies.
Responsibility no longer sits solely with the software vendor. It sits with the organisation adopting the technology.
Continuity Planning Is Evolving
The organisations managing AI most successfully aren’t slowing innovation.
They’re strengthening governance around it.
They’re identifying business-critical AI suppliers, documenting dependencies and developing realistic recovery strategies before problems arise.
That is also changing the role of continuity solutions.
Traditional Software Escrow remains important, but many cloud-hosted AI platforms require broader protection. Depending on the architecture, organisations may also need SaaS Escrow, Recovery Escrow, Access Continuity or Managed SaaS Continuity solutions that protect not only source code, but also deployment environments, cloud infrastructure, AI assets, databases and verification processes.
Increasingly, continuity isn’t about protecting a single application.
It’s about protecting an entire operational ecosystem.
Where the Market Is Heading
If there’s one consistent trend I’ve noticed over the last year, it’s that organisations are becoming significantly more sophisticated in how they assess AI suppliers.
They’re asking better questions, involving legal and operational resilience teams earlier, and assessing supplier dependencies before AI becomes embedded within critical business processes.
That’s a healthy development.
AI offers extraordinary opportunities, but like every major technology shift before it, successful adoption depends not only on understanding what the technology can do, but also what happens if it unexpectedly changes, disappears or can no longer be supported.
The organisations that will gain the greatest long-term value from AI won’t necessarily be those that adopt it the fastest.
They’ll be the organisations that combine innovation with robust governance, effective supplier management and practical continuity planning.
About The Escrow Company
The Escrow Company is a global software escrow provider with USA headquarters in Atlanta, Georgia, and offices in the United Kingdom and Australia, delivering international coverage across North America, Europe and Asia-Pacific.
We have invested heavily in innovation to modernize software escrow for the cloud and AI era. Providing a comprehensive range of SaaS continuity and software escrow solutions designed to reduce risks when working with third party vendors or partners who host applications on AWS, Microsoft Azure, Oracle and Google and Oracle cloud.
We support enterprise, government and regulated organizations worldwide, including major law firms, banks, insurers, technology companies and public-sector bodies, helping them safeguard critical software, data and improve operational resilience.
Web: www.escrowcompany.co
