The technology update was three slides. The CEO delivered the last one with a smile: "AI now handles 40% of our customer volume. That makes us the most cost-efficient player in the market. We're on strategy, with a great partner."
The board noted it. The Chair said well done. All directors appeared to be pleased with this milestone. The agenda moved on.
Nobody asked about the dependency on the so-called "partner".
The news was good. On the numbers the board was watching, the company was doing well. But management's framing hid a governance concern: when did we approve the dependency on a single outside provider, and when did this board or its committees look at it in all its dimensions?
How AI providers actually operate
It helps to understand what the large AI providers are trying to do, because it shapes the risk you carry.
A handful of firms supply the foundation models that most AI tools run on. Their strategy is simple, and it's working. Make the tools easy to adopt and hard to leave. Let usage grow. Over time, the customer builds a dependency - one transaction at a time - without ever deciding to. The switching cost does the rest.
It's their business model, and it's a sound one. But it means the dependency isn't an accident. It's the intended result of how these companies grow. The provider wins when you can't easily walk away.
Silence became a decision
The board didn't vote to depend on one provider. They didn't approve a dependency strategy.
Here's what did happen. Management ran pilots, which went live. Each expansion sat inside their efficiency mandate. The cost curve was moving the right way. At no point did any single step look like a governance question. The efficiency numbers backed the strategy. The CEO had a good story to tell. And so, silence became a decision.
The board's silence was encouraged by management's framing. Discovering the dependency would have been a governance achievement. But, when nobody set a threshold for AI provider dependency - by spend, by volume, by share of a revenue-affecting function - that call defaults to management. And management, working under an efficiency mandate, and being rewarded for it, will keep integrating until something stops it.
Your job is to ask before the dependency forms
This is where the individual director earns their fees.
The independence of a non-executive director is evident when short-term good news leads to a question about the long-term best interests of the company. That challenge is typical of how good governance works. Everyone understands and respects it. It enables deeper conversations, better engagement and better decisions.
It's the mechanism by which the board sees what management's incentives keep it from seeing. Very few executives working to an efficiency target will naturally raise a concentration risk they built through sensible decisions. Will the CEO point out the governance issue in their own good-news slide? Will the Chair ask it? In many cases the question has to come from the independent directors.
And the time to ask it is before the dependency forms, not after. Once 40% of your volume runs on one provider, your options have already narrowed. The board that asks "what happens if this provider changes the terms?" while the number is still 5% has real choices. The board that asks when it is more significant is asking about a potential problem it could have prevented.
AI is more embedded than an alternative parts supplier. You can renegotiate a logistics contract. Swapping out an AI model that's wired into a high percentage of your customer interactions is a different order of difficulty - the model now understands your business, its memory is impressive, your systems are built around its agents, and the fallback you assumed exists may never have been tested. The dependency is deeper, and it forms faster and quieter, than the ones directors are used to watching.
Watch for what the report doesn't say
Here's the harder skill. The dependency in that boardroom didn't appear in a report as a risk. It appeared as good news. The 40% figure was presented as an achievement, and it was one.
A management report tells you what management is measuring. It rarely tells you what management isn't. The concentration risk, the untested fallback, the terms you don't control - none of that shows up on the efficiency slide.
So part of the job is reading for the gap. When an update sounds like unqualified good news, that's often the moment to ask what isn't on the page.
The question is "what does this report not tell me?"
Two exposures you now own as a director
Operational continuity
Here's the mechanism worth understanding. Access to an AI model can be pulled for reasons that have nothing to do with your own behaviour - a dispute between providers, a change of terms, a geopolitical decision, a strategic pivot. The governance-grade question is whether the relationship protects your company if something neither of you controls changes the terms.
If 40% of customer volume runs on one provider, and the answer to "what's the tested fallback?" is a pause in the room - that's a governance question that should have been asked sooner.
Regulatory liability
You may already be carrying a duty nobody has told you about. Bocconi law professors Passador and Montagnani, writing in the Oxford Business Law Blog, have named two new director-level duties in the EU AI Act: AI due care and AI loyalty oversight. The second one matters most here. AI loyalty oversight asks directors to check that a vendor's AI systems serve the company's purposes, not the vendor's commercial interests. Their point is direct: a vendor's model may be built to serve the vendor's goals, which don't always match yours.
This isn't a compliance box. It's a fiduciary duty. And it applies to every director on every board where AI vendor relationships have become operationally significant - which, at 40% of customer volume, yours clearly has. The board that took that update and moved on didn't just miss a risk. It may have walked past a duty.
Why management is focused on efficiency - and why that's a remuneration question
Ask why management kept integrating, and the answer is usually sitting in the management incentive plan.
Most incentive structures reward efficiency gains. AI automation is one of the most effective efficiency levers available right now. Every time a team hits a cost target using AI, the incentive framework confirms it was the right move. The bonus is earned. The annual appraisal reads well.
What the incentive framework might not measure is the concentration risk that came with the gain. There's no downside for building a dependency on one provider. No measure of provider diversification. No clawback for creating a fallback gap that only shows up two years after the bonus was paid.
Think about what that means. The board has built an incentive framework that rewards the creation of a problem that hasn't been anticipated. Every efficiency gain that deepens provider concentration is paid out as good performance. The executive who built 40% dependency on one provider, and hit their numbers doing it, got a positive signal at every step. The risk that emerged appears nowhere on their scorecard.
The failure isn't in the decisions. It's in the design of the system that rewarded them without measuring what they left behind.
Which raises a direct question for the board: do our remuneration policies need to be revised? If the incentive plan carries no downside for concentrated AI dependency, and no measure of the risk built alongside the gain, then the board isn't just failing to govern the risk - it's paying to create it. This doesn't need a full redesign of executive pay. It needs the Remco Chair to ask one question: what are we measuring, and what are we missing?
The savings that got you to 40% might not last
There's a financial angle underneath all this that boards should press on, because it can quietly undo the business case.
Most AI models are priced by the token - you pay for what you use. That means your cost scales with usage in a way a fixed-price contract doesn't. As adoption grows, so does the cost, and providers have already begun moving prices upward as the market matures.
And the token price is only the visible part. Several other costs tend to sit outside the financial model that reported the savings:
Price increases on token-based pricing, which the model may have assumed were flat. Rising volume, which multiplies the per-token cost as more of the business runs on the tool. The cost of building and testing a fallback - which, if it was never budgeted, means the resilience simply isn't there. Integration and rework costs as models change, deprecate, or behave differently after an update. The pricing leverage the provider holds once you're deeply integrated and switching is hard.
Put those together and a real question emerges: were the savings that justified reaching 40% ever sustainable, or were they a snapshot of a moment that's already passing?
The efficiency gain that looked settled when the management bonus was paid may look very different once the full cost of the dependency is on the page.
That's not a reason to walk away from AI. It's a reason to make sure the number in the update reflects the cost of the dependency, not just the cost of the tokens.
Language / Clarity / Confidence
This edition exists so you can walk into your next board meeting with the language, the clarity, and the confidence to ask about provider dependency - even when the update sounds like good news.
Language. Two terms give you the vocabulary to name what the good-news framing hides. Concentration risk names the exposure in words your risk register already understands: a single point of failure that arrived through efficiency decisions, not risk decisions. AI loyalty oversight names the duty you may already carry - to check that your vendor's AI serves your company's purposes, not the vendor's. When the CEO reports 40% and says "great partner," you now have the words for the conversation that needs to follow.
Clarity. The clarity here is a reframe. The dependency question isn't technical - it's a governance design question. The board in that room didn't lack AI expertise. It lacked a threshold. Moving from "that sounds like good news" to "when did we evaluate this as a material relationship, and what's the tested fallback?" isn't a technical shift. It's a clarity shift, and you can make it in the next meeting where an AI update appears.
Confidence. You don't need to challenge the efficiency logic to ask the stress-test question. You're not questioning whether the integration was right - it probably was. You're asking what the tested fallback is if the relationship changes for reasons outside your control. That question doesn't need technical expertise. It needs the confidence to ask it in a room where the news is good and nobody else is asking. That's what independent directors are for.
Boardroom Takeaway
The question that should come out of this edition is a stress test, not a status update:
"If our main AI model provider became unavailable tomorrow - through outage, policy change, commercial dispute, or deprecation - what's the operational impact in hours, and what's the tested fallback?"
The word "tested" is key. A documented contingency plan and a tested one are different things.
That's the starting point. The board that asks this question for the first time this quarter is doing its job. The board that doesn't ask it because the update sounded like good news isn't. And the board that asks it while the number is still small, before the dependency sets in, is doing the most valuable thing of all.
If you're a CFO reading this, or someone who sits close to these decisions without yet sitting in the boardroom: the dependency question isn't just a board-level one. It impacts your cost model, your vendor contracts, and your resilience planning. The 40% figure isn't exceptional - it's where a lot of organisations are quietly arriving. And the cost level that made the case for getting there might not be sustainable once volume and prices climb.
The question worth asking now, before it becomes material, is whether you, or anyone on your board, has their arms around this challenge.
Until next time,
- Paul