What Happens When Your Organisation Can’t Operate Without Someone Else’s Model?
This week’s AI headlines focused on growth. OpenAI announced plans to pursue a public listing, following similar moves across the market as the race to secure investment and scale accelerates. The signal is clear: AI is no longer an emerging technology category – it is becoming foundational infrastructure.
At the same time, conversations across the managed services market are revealing a different reality.
At a recent MSP event in France, providers spoke candidly about customer demand for AI and the pressure to move quickly, while admitting many operating models are still being tested internally before they are considered mature enough for broad deployment.
Those two signals matter more together than they do individually, because while investment is accelerating and adoption pressure is increasing, resilience planning is struggling to keep pace.
For years, organisations have worked to reduce operational dependency.
Multi-cloud strategies emerged to reduce concentration risk. Resilience programmes focused on recovery. Security teams strengthened supplier assurance, business continuity and operational visibility.
Now AI is quietly creating a new category of dependency.
Not because organisations are building AI platforms themselves but because they are embedding external models into everyday operations.
Copilots are drafting communications. Service desks are handling customer interactions. Security teams are using AI to triage alerts. Developers are generating production code. Knowledge workers are increasingly relying on AI-generated outputs to make decisions faster.
And in many cases, these capabilities are being delivered by a remarkably small number of providers. The conversation around AI has largely focused on adoption, productivity and governance.
The resilience conversation has barely started.
The hidden concentration risk
Every technology era creates centralisation (cloud concentrated infrastructure, SaaS concentrated applications etc.) but AI may concentrate decision support.
When multiple business functions rely on a small number of foundation models, outages, degraded performance, commercial changes or security incidents stop being isolated technology events and start becoming operational disruption.
This is not an argument against AI; it is a reminder that resilience principles still apply.
The question is no longer whether organisations will adopt AI, but rather are they introducing dependency faster than they are introducing resilience?
AI resilience is different from AI security
Security leaders already understand supplier risk, but AI introduces a different set of operational questions.
- Can teams recognise when AI outputs become unreliable?
- Do critical workflows continue if AI services become unavailable?
- Can decisions still be made when automated assistance disappears?
- Who owns the decision to revert to manual processes?
Traditional resilience planning often assumes systems fail visibly. AI creates the possibility of something more subtle: systems remain available while confidence in outputs degrades.
That distinction matters because an unavailable service is disruptive. A trusted service delivering poor outcomes is much harder to detect.
The challenge nobody planned for: invisible dependency
Dependency rarely arrives through a single strategic decision.
- One team adopts a copilot.
- Another introduces AI-assisted ticket triage.
- A vendor quietly embeds AI functionality into an existing platform.
- A business process becomes faster. Then essential. Then difficult to operate without.
Before long, organisations discover they are dependent on capabilities they never formally identified as critical.
That is not a technology problem. It is a governance and resilience problem.
Three questions every CIO and CISO should ask this quarter
- Which business services now rely on AI to operate?
- What is our fallback if those services become unavailable or unreliable?
- Where have we introduced AI faster than we have introduced resilience controls?
These questions are unlikely to slow innovation but they may prevent resilience debt accumulating faster than organisations realise. It’s worth considering that the next generation of resilience planning may not be about recovering your systems, it may be about operating when somebody else’s intelligence layer disappears.
Organisations are still navigating AI resilience in real time. If you’d like to discuss any of the issues raised in this insight piece, please feel free to get in touch with us.
If you found this article of interest, please don’t forget to sign up for our NEWSLETTER for the latest industry news and insights delivered direct to your mailbox.
Image/Photo by Levart_Photographer on Unsplash
Comments are closed.