Vendor Risk & Exit Strategies
Your AI system depends on external APIs that can go down, deprecate models, change pricing, or alter terms of service. Learn to assess vendor risk, build abstraction layers, implement multi-provider failover, and plan exit strategies before you need them.
Quick Reference
- →Every LLM provider dependency is a single point of failure — plan for outages before they happen
- →Model deprecation is guaranteed: providers retire models every 6-12 months, breaking your system if you pinned to a specific version
- →Pricing changes can blow your budget overnight — build cost monitoring with alerts
- →Lock-in vectors: proprietary fine-tunes, custom embeddings, provider-specific features (assistants API, etc.)
- →Abstraction layers (LangChain, LiteLLM, or custom) let you swap providers without rewriting application code
- →Always have a tested fallback path: if your primary provider goes down at 3 AM, does your system still work?
Vendor Risk Categories
AI vendor risk is broader than traditional SaaS vendor risk. Beyond the usual uptime and pricing concerns, you face model deprecation (your fine-tuned model stops existing), capability changes (a model update changes behavior), and regulatory risk (provider's data practices violate regulations you are subject to). Understanding each risk category helps you plan mitigation.
| Risk Category | Likelihood | Impact | Example |
|---|---|---|---|
| API outage | Medium (quarterly) | High — feature down | OpenAI had 5+ major outages in 2024-2025 |
| Rate limiting | High (frequent) | Medium — degraded service | Sudden traffic spike hits your tier limits |
| Model deprecation | Certain (annual) | High — breaking change | GPT-4o superseded by GPT-5.4, Gemini 1.5 shut down, Claude 3.5 now legacy |
| Pricing increase | Medium (annual) | Medium-High — budget impact | OpenAI raised GPT-4 prices 20% in early 2024 |
| Behavior change | High (with updates) | Medium — quality regression | Model update changes tone, accuracy, or format of outputs |
| Terms of service change | Low | Critical — legal/compliance | Provider starts using API data for training (opt-in → opt-out) |
| Provider shutdown | Very Low | Critical — total dependency loss | Small AI providers have shut down or been acquired |
| Regulatory action | Low | High — forced migration | Provider banned in your operating region |
Every major provider has deprecated models: OpenAI deprecated GPT-3.5, GPT-4 variants, and code-davinci. Anthropic deprecated Claude 1, 2, and 3 series. Google deprecated PaLM, Gemini 1.5, and Gemini 2.0 Flash. If your system pins to a specific model version, you WILL need to migrate within 3-6 months of the deprecation announcement. Plan for this.