Your AI Stack Has a Single Point of Failure

By Craig S. Cody, CPA, Certified Tax Coach.

AI can make your agency faster.

It can also make your agency more fragile.

Both are true at the same time. Most owners are only tracking the first one.

What Did Moody's Actually Warn About AI Dependency?

On August 9, Moody's warned that the financial sector's race to adopt AI has left big banks dependent on a small group of Silicon Valley providers.

The rating agency's list of risks is short and specific. An outage at one major provider could spread quickly across customers and across sectors. Regulators are expected to sharpen their focus on operational resilience and third-party concentration inside the AI model stack. And a dominant group of model and infrastructure providers could, over time, exert control over the price of AI services. The Guardian's reporting notes that last one is sharpened by the pressure on loss-making generative AI companies, OpenAI and Anthropic among them, to start delivering returns to investors.

Moody's still expects AI to lower costs and lift revenue across the City and Wall Street. It also expects much of that benefit to get competed away, because everyone is chasing the same advantage at the same time.

That second part is the sentence agency owners should sit with. The efficiency is real. The advantage is temporary. The dependency is permanent until you do something about it. That efficiency also carries a bill that shows up in your margin, which is a separate problem from the one in this article.

Why Does This Land Harder On Agencies Than On The Banks?

Read the mitigating factors, not just the warning. Moody's gave banks three reasons not to panic.

They keep control of their proprietary data. They have decades of experience negotiating technology contracts down. And some are moving to open-source models and strategic partnerships to offset the dependency.

Now run all three against a 20-person agency.

Proprietary data. A bank's core records sit in systems the bank owns. An agency's client history, your creative archive, your attribution data and your campaign performance are sitting inside somebody else's platform, under somebody else's terms of service.

Contract leverage. Lloyds Banking Group is putting £13bn behind an AI strategy. A customer at that size gets a phone call before a price change. You get an email.

Alternatives. Standing up an open-source model or negotiating a strategic partnership takes engineering hours and a legal budget. That is a large-company answer to a large-company problem, and it is not available to a shop of fifteen people with two operations staff.

Adoption is not the differentiator either. That same reporting cites a UK Treasury select committee finding from January that more than 75% of City companies already use AI. Everybody has the tools. What separates firms now is whether they can survive one of those tools changing on them. The upside of adoption is capacity rather than headcount cuts. The downside is the dependency that comes with it.

Where Is The Dependency Already Sitting In Your Agency?

For an agency, it is sitting in the model provider, cloud storage, the CRM, the media measurement stack, and the automation layer that quietly stitches the other four together.

The question is not whether those vendors are good. Most of them are excellent, which is exactly why you bought them.

The question is what happens if one of them changes price, policy, access, or availability.

Those are four different events, and only one of them is an outage. An outage you notice in ten minutes. A pricing change you notice at renewal. A policy change that makes your workflow non-compliant, or an access change that cuts an integration, you may not notice until a client asks why the report is late.

What Six Questions Should You Ask About Every Critical Workflow?

For each workflow you could not run the business without, you should have 6 answers written down.

1. Who is the primary provider?
2. What data do they hold?
3. Can we export it cleanly?
4. What is the backup workflow?
5. How long would switching take?
6. Who owns the outage decision?

Questions three and five are the ones that cost real money, and they are the two people skip.

"Can we export it cleanly" is not a question you answer by reading the marketing page. It is a question you answer by running the export and opening the file. A CSV dump that loses your tags, your history, or the relationships between records is not portability. It is a receipt.

"How long would switching take" needs a number of days, not the word "quickly." If the honest answer is three weeks with your delivery team pulled off client work, then you now know what that vendor relationship is actually worth, and you can price the risk instead of feeling it.

Question six matters more than it looks. When a provider goes down mid-campaign, somebody has to decide whether you wait it out or fall back to the manual process. If nobody owns that call, you spend the first two hours of the outage deciding who decides. It is the same gap that shows up when an AI tool spends your money and nobody approved it.

What Does This Look Like In Practice?

When you work with over 70 agencies every month, year after year, you see the same order of events. The tool gets adopted because it works. The workflow reshapes itself around the tool. Nobody writes down what the tool now holds. And the export question gets asked for the first time on the day somebody wants to leave, which is the worst possible day to ask it.

There is a second-order cost here that shows up on a balance sheet, not just in an outage. If you are building the agency toward a sale, an operating stack with no documented exit path is a diligence finding. A buyer is purchasing your ability to keep delivering, and a workflow that only exists inside a vendor account you cannot move is a discount, not an asset. It lands in the same place as every other thing a buyer cannot verify.

Where Should You Start On Monday?

Do not map the whole stack. You will not finish it.

Pick the single workflow that would hurt most if it stopped this week. Answer the six questions on one page. Actually run the export in question three.

If you cannot answer three and five, you have just found your project for the quarter, and it is a cheaper project this quarter than next.

AI efficiency is valuable. Efficiency that depends on one vendor with no exit path is concentration risk wearing a nicer name.

Build speed. Keep options.

Frequently Asked Questions

What is AI concentration risk for an agency?

AI concentration risk is the exposure you take on when a workflow you cannot run the business without depends on a single provider you cannot quickly replace. It is not only the risk of an outage. It also covers a price change at renewal, a policy change that makes your workflow non-compliant, and an access change that quietly cuts an integration. Most agencies track only the outage case, which is the one that is easiest to notice and the least expensive of the four.

Why is AI vendor dependency riskier for a small agency than for a bank?

Moody's credits banks with three mitigating factors, and all three fail at agency scale. Banks keep their core records in systems they own, while an agency's client history, creative archive and attribution data sit inside somebody else's platform under somebody else's terms of service. Banks have decades of experience negotiating technology contracts, and a customer spending at Lloyds Banking Group's scale gets a phone call before a price change while a 20-person agency gets an email. And standing up an open-source model or a strategic partnership takes engineering hours and a legal budget that a shop of fifteen people with two operations staff does not have.

Which vendors create the most AI dependency in an agency?

For most agencies the dependency sits in five places: the model provider, cloud storage, the CRM, the media measurement stack, and the automation layer that stitches the other four together. That last one is the most commonly missed, because it was usually built by one person over time rather than bought in a single decision, so nobody has written down what it touches.

How do I test whether my agency can actually leave an AI vendor?

Run the export and open the file. Reading the vendor's marketing page is not a test. A CSV dump that loses your tags, your history, or the relationships between records is not portability, it is a receipt. Then put a number of days on how long switching would take, including the delivery team hours it would consume. If the honest answer is three weeks with people pulled off client work, you now know what that vendor relationship is actually worth and can price the risk instead of feeling it.

Does AI vendor dependency affect what my agency is worth?

Yes. If you are building toward a sale, an operating stack with no documented exit path is a diligence finding. A buyer is purchasing your ability to keep delivering, so a workflow that exists only inside a vendor account you cannot move reads as a discount rather than an asset. It sits in the same category as anything else on your books a buyer cannot independently verify.

Craig S. Cody is a CPA, Certified Tax Coach, and retired NYPD Lieutenant. His firm works with more than 70 marketing and advertising agency owners every month, helping them keep more of what they make through proactive tax planning.

This article is general education, not advice for your specific situation. Confirm your own facts with your advisor before acting.