We are witness firsthand as artificial intelligence has quietly crossed the boundary from an experimental productivity booster to a critical operational dependency. This sounds scary and admittedly a lot like Terminator, but it is a reality we are coming to terms with.
Regional enterprises are rapidly integrating foundation models into their core decision-making pipelines. However, this deep integration introduces an unprecedented tier of vulnerability. When these models experience external outages or reach usage limits, entire workflows stall. Yet, an even more insidious threat is taking root. The true risk no longer lies solely in sudden system crashes. Instead, it is found in the subtle degradation of output quality and the hidden autonomous agents buried deep within third-party software stacks.
To survive this shift, organisations must stop treating AI as an infallible black box and start engineering for structural resilience. This requires a transition away from single-vendor reliance towards building interchangeable data pipelines that can withstand sudden regulatory freezes. The recent compliance-driven disruptions surrounding Anthropic’s Mythos and Fable models clearly demonstrate that outsourcing core intelligence to external providers carries massive macro risks. Moving forward, true enterprise differentiation will not stem from merely accessing a better model. It will come from how a company secures its proprietary data, enforces continuous verification, and aggressively protects the operational intuition of its human workforce.
You might be inetrested in why Jasie Fon from Ping Identity believes that structural friction is now a critical board mandate for agentic AI in Southeast Asia
We sit down with Ed Keisling who is the Chief AI Officer at Progress Software, to unpack the realities of algorithmic dependency. In this conversation, we explore how business leaders can defend against silent model drift, the necessity of mapping hidden vendor risks, and why treating model access as a variable rather than a guarantee is the ultimate test of corporate resilience.
How can business leaders identify the exact moment their organisation crosses the line from merely using AI to increase productivity to becoming operationally dependent on it for survival?
AI is becoming a foundational part of how modern enterprises operate. As with any transformative technology, it’s natural to see growing dependency. We’ve seen this before with cloud, data platforms and automation. The difference with AI is the speed and depth at which it integrates into decision-making and execution.
We are already seeing this today in business with the reliance on the foundation models. When they experience outages or when people reach their budget, productivity is heavily impacted.
The goal isn’t to avoid dependency but to manage it deliberately. The organisations that do this well are the ones that build safeguards early. Failover strategies, clear governance frameworks, transparency into how AI systems operate and strong human oversight at critical points. They treat AI not as a black box, but as a system that must be understood, monitored and continuously improved.
How can enterprises mitigate the systemic macro risk of relying on infrastructure they do not own or control?
This is an old problem in a new context. Enterprises have long relied on infrastructure they don’t control, from cloud platforms to payment networks and telecom providers. The risk has always been there. What’s different with AI is the lack of transparency. When a cloud service goes down, it’s visible. When an upstream model changes, the impact is subtler. You may only notice a gradual drift in output quality without a clear signal of what changed or why.
To manage that, organisations need to focus on three areas. First, build a real understanding of your dependency graph, the live, evolving picture, including every point where third-party models or agents are embedded into workflows.
Second, design for redundancy where it matters. Even if you never intend to switch providers, the discipline of having an alternative forces you to uncover hidden coupling and operational assumptions you wouldn’t otherwise see.
Third, treat vendor relationships as part of your engineering strategy. Contracts and SLAs need to address how changes are introduced, how models evolve and what happens when performance degrades. If those scenarios aren’t explicitly defined, then you’re not protected against the risks that matter.
A total system crash is obvious, but how should organisations detect and defend against “silent updates” or model drift, where the AI stays online, but its output quality silently degrades?
This is the risk that should concern organisations more than outages. Outages get fixed quickly because they’re visible, escalation is immediate, and response is coordinated. Drift is different. The system is technically up, dashboards are green, and yet the quality of the output is quietly eroding underneath.
The only effective defence is continuous verification against a known baseline. That means running a fixed, representative set of test cases against your AI systems regularly and tracking how those outputs evolve over time, just as you would track latency or error rates in traditional infrastructure. This type of monitoring can also be embedded into the AI solutions themselves; for instance, many RAG solutions can monitor things like answer relevance, context relevance and roundedness in near real time.
The gap today is that most organisations monitor availability, not quality. They know whether the system responds, but not whether the response is still good. Human oversight is still needed.
As global compliance frameworks tighten around data privacy and copyright, how can companies protect themselves from a sudden, legally mandated freeze of a core model they depend on?
As regulatory frameworks around AI mature, a model your business depends on may become unavailable overnight due to a compliance ruling or legal action. In fact, we just saw this with Anthropic and their Mythos and Fable models. The way to protect against that isn’t to predict exactly which model will be affected but to prepare for that from the start and to build interchangeable pipelines. Relying on a single vendor today also has the additional risk that they could raise prices to where your workflows no longer make economic sense. You want to maintain some leverage.
This really comes down to control and flexibility. You want to avoid being tightly coupled to a single model because the moment you can’t switch, you’ve lost control of a critical part of your stack. Your differentiation will never come from the model itself because better models will raise the floor for everyone. Your value must come from your data and logic and how you leverage AI with them. And finally, you must treat this as both a technical and business problem. That means clear contracts, clear expectations around change and a real continuity plan with tested alternatives.
At the end of the day, the mindset shift is simple: treat model access as a variable, not a guarantee. The organisations that do that well will be far more resilient when the market or regulatory environment shifts.
When a critical AI system fails, what does a viable manual fallback pattern look like for a modern workforce that may have already lost its baseline operational intuition?
AI doesn’t replace human expertise. At the end of the day, your company’s operational intuition _is_ what makes your organisation unique so it must be protected at all costs. Teams need to understand the logic behind how decisions are being made and be closely coupled with any agentic systems that are developed. These agentic systems will reflect your company and your approach to AI and will incur reputational damage if they are not managed well.
Organisations should establish apprenticeship programs to train the next generation of their workforce. The goal is to ensure that even with AI in the loop, the organisation remains accountable, capable and in control.
How can organisations map and audit the hidden risk of AI dependency introduced when their everyday third-party SaaS vendors quietly embed unvetted autonomous agents into their own software stacks?
This is probably the least visible risk on the list because it doesn’t show up as your AI but as somebody else’s. It gets embedded into tools you already trust, and your exposure can change without any deliberate decision on your side.
Organisations need to extend their vendor risk processes to explicitly cover this and to do it continuously. The agent that didn’t exist in a vendor’s product last quarter may be active today. That means asking different questions – what autonomous capabilities are in place, what data those agents can access, and what happens if the underlying model changes. If procurement and security teams are still asking SaaS vendors the same questions they asked five years ago, they’re not actually seeing the risk they’re trying to manage.