What can IT pros do if an AI vendor disappears?

If a third-party vendor for AI or other mission-critical software were to collapse, what should a business do?

Sahil Agarwal, field AI security fellow at Anaconda and co-founder and CEO of Enkrypt AI, told IT Brew that, given the number of organizations depending on third-party vendors for AI models, businesses “need to think about how they are looking at that risk.”

For example, if an AI lab suddenly goes out of business or suffers a catastrophic hack, its clients may not have much time before workflows dependent on that lab’s products begin to degrade. Ideally, Agarwal said, those clients could “switch in a matter of seconds to a new frontier lab or a new vendor.”

To offset the risk of outsourcing to a single vendor, Agarwal suggested that organizations rely on multiple vendors, and consider resiliency plans in the event of an outage.

Know before you vend. Agarwal pointed to the Crowdstrike outages as an example of where one company’s issues had an enormous ripple effect on multiple organizations.

“I think that taught everyone a lesson as to who owns that [infrastructure],” Agarwal said. “It’s mostly about: Are you willing to put your business on the line based on someone else’s infrastructure?”

One much-publicized instance of vendor collapse followed the Los Angeles Unified School District (LAUSD) rollout of “Ed,” an AI chatbot intended to modernize the district and support both students and parents, in March 20243; by July of that year, the edtech company that built the chatbot, AllHere Education, had furloughed most of its staff, and the bot was turned off. LAUSD said it stopped all dealings with the company, which collapsed, and its CEO was charged by the DOJ with defrauding investors..

Jud Dressler, director of Resilience’s Risk Operations Center, told IT Brew that the Ed incident shows that vendor evaluation extends beyond cybersecurity to whether that vendor can continue to deliver a service.

“We should be looking at the criticality of the data, the criticality of that service to our overall operations or mission, and then make sure that we build in those proper controls,” Dressler said.

Planning for the worst. Estela Lauricella-Thota, senior director of technology transformation at Cognizant, told IT Brew that IT professionals could consider implementing backups in case a vendor suddenly goes offline unexpectedly.

Having a business continuity plan in place can help with recovery efforts, she added. This can look like having workflows and processes with defined criticality as well as service level agreements (SLA), or a type of agreement for the expected service between providers and customers, for each part of the process.

“Especially when you have workflows that are critical, that’s why you define the workflows, you define the criticality, you put that continuity plan, test it out, and then you are pretty much ready for any major incident,” Lauricella-Thota said.