AI Dependency Is Becoming a Bank Risk
Moody's has put a credit label on what bank risk committees have been slow to write down: the rush into AI has concentrated operational dependency in a handful of loss-making suppliers. Adoption is now a question of control and negotiating position, not capability.
Moody’s has put its finger on something banks have been slow to confront: the rush into AI has created heavy dependence on a small group of suppliers that are still losing money. The issue is no longer just whether AI works. It is who controls the infrastructure banks are building around it.
Concentration Creates a New Kind of Risk
In research reported on 9 and 10 August 2026, Moody’s warned that financial firms’ reliance on a small number of foundation-model and cloud providers creates a “systemic dependency.” If one major provider goes down, many institutions could lose access to the same technology at the same time.
That is a different risk from a traditional bank outage. It is a shared dependency that sits largely outside the banks’ control.
There is also a commercial risk. Providers such as OpenAI and Anthropic remain under pressure to become profitable. If they raise prices, banks that have built AI into core workflows may have limited room to negotiate.
Dependency Is an Architecture Decision
The answer is not necessarily to slow AI adoption. It is to avoid becoming locked into one provider.
Banks should treat model portability as a design requirement: keep applications, prompts and evaluations provider-neutral, maintain a tested fallback, and negotiate price protections and exit terms before a vendor becomes deeply embedded.
For sensitive workloads, private or on-premises inference can provide another layer of control.
The broader lesson is simple: AI adoption is moving faster than AI governance. Banks that measure their switching costs and maintain alternatives will keep more negotiating power as the market evolves.
The key question is no longer simply which model performs best?
It is how much would it cost to stop using it?
The institution that knows the answer is negotiating. The one that does not is being negotiated with.