AI tools that started as experiments are now load-bearing — and most contracts don’t protect you if the vendor pulls them.
A Zapier survey of 500 executives found 74% would be disrupted by losing their primary AI vendor, and only 6% could absorb it without interruption. OpenAI’s preview-tier policy allows as little as two weeks’ notice; Sora was shut down in April 2026 with under a month.
The same informal adoption path that creates shadow AI also creates vendor concentration risk: tools that entered as experiments quietly became infrastructure. A Zapier survey of 500 U.S. executives, summarized in a May 2026 analysis, found that 74% said losing their primary AI vendor would disrupt operations, and only 6% could absorb the loss without interruption.
The deprecation side is not hypothetical. OpenAI’s own deprecation policy states that preview-tier models can be retired with as little as two weeks’ notice, and that they should not be used for business-critical workloads unless you can migrate fast. In April 2026, Sora was shut down with under a month of effective notice. Even mature API features now turn over on five-to-six-month cycles.
The governance questions nobody is asking
Where is AI load-bearing in your business? What does the contract say about discontinuation? Foundation-model API terms are thin on these protections compared with traditional enterprise software. For an MSP, vendor concentration now belongs in the same risk register as cloud-provider dependency.