Enterprise buyers evaluating AI vendor risk generally focus on the vendor directly in front of them: their stability, their roadmap, their contractual terms. A second layer of risk sits one step upstream and gets far less scrutiny - the smaller number of foundation model, cloud, and infrastructure providers that the buyer's chosen vendor itself depends on.
Why this second layer matters
A well-run, financially healthy AI vendor can still be exposed to disruption if the foundation model or cloud infrastructure it's built on changes terms, raises prices, or experiences an outage - risk that's entirely outside the vendor's own control but that flows directly through to the buyer's experience. Evaluating only the vendor's own health misses this transmitted risk.
Why concentration at the upstream layer makes this worse
As the number of viable foundation model and AI infrastructure providers has consolidated around a small number of well-capitalized players, many otherwise-differentiated vendors have converged on dependency on the same small set of upstream providers - meaning a buyer's supposedly diversified vendor portfolio may share a single point of upstream failure without the buyer realizing it.
What better diligence looks like
Beyond evaluating a vendor's own financial health and roadmap, sophisticated buyers are increasingly asking what foundation model and infrastructure providers a vendor depends on, and checking whether their broader AI vendor portfolio is more concentrated on a single upstream point of failure than it appears from the vendor names alone.
Why this is worth the extra diligence step
A portfolio of AI vendors that looks diversified on paper but shares a common upstream dependency offers less real risk reduction than it appears to. Understanding that dependency structure is a more complete picture of concentration risk than looking at vendor names alone ever provides.