Concept dictionary
Concentration Risk
Concentration risk is exposure created when important operations, data, capability, or supply depend heavily on a small number of providers, models, regions, platforms, or other shared resources.
- Review state
- Reviewed in POC
- Freshness
- Current
- Version
- 2
Also called
- Concentration Risk
- Vendor Concentration Risk
Remember it this wayDifferent products can still share one point of failure.
In plain language
Several teams may appear to use different products while depending on the same cloud, model provider, chip supply, or identity service underneath.
Why it matters
A single outage, policy change, compromise, price shift, or capacity limit can affect many supposedly independent operations at once.
Example
Multiple departments buy separate AI applications that all rely on the same underlying model API and fail during one provider outage.
Common misconception
Concentration risk is not visible from vendor count alone. Different vendors can share the same lower-layer dependency.
Related terms
Sources
- Basel Committee on Banking Supervision, Principles for the Sound Management of Third-Party Riskauthoritative treatment of dependency and concentration risk involving a single or limited number of providers.
- NIST AI 600-1, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence ProfileAI-specific value-chain, component, and third-party dependency risk guidance.
Learn more
- Trace hidden shared dependencies with [[layered-sovereignty|Layered Sovereignty]].