# Your AI Vendor Just Became a Supply-Chain Risk > Source: > Published: 2026-09-26 01:01:32+00:00 # Your AI Vendor Just Became a Supply-Chain Risk A U.S. appeals court this week upheld a designation of a major AI company as a *supply-chain risk*. Read that phrase slowly. Not "a competitor." Not "a safety concern." A **supply-chain risk** — the same category you'd apply to a factory that might stop shipping, or a chip fab in a contested region. Sitting next to that headline were two more. A national government is building its own Microsoft alternative on NixOS. A writer published a long farewell to Google. And a data-center operator is on the hook to pay investors even for a site with no electricity. These are not separate stories. They're one story: **the layers your business stands on are now someone else's risk register — and their decisions show up in your P&L.** ## If you sell across borders, you already outsource the stack A modern cross-border seller runs on borrowed ground. Your model calls go to an API. Your storefront sits on a platform. Your ads, payments, and logistics run through services you don't control. Your customer support, product descriptions, and translations are increasingly generated by a vendor whose pricing, terms, and availability can change on a Tuesday. That's fine — until it isn't. The cost isn't the outage. It's the *week you spend discovering* the dependency you never drew. Ask three questions, honestly: - **Concentration:** How many critical functions route through a single vendor? If one API key could freeze your listings, your support, and your marketing at once, you don't have a stack. You have a single point of failure wearing a logo. - **Substitutability:** If your model vendor doubled prices or revoked access tomorrow, how long until you're running again? If the answer is "we'd have to rewrite everything," you're not a customer. You're a tenant. - **Continuity:** What does day one of an outage, ban, or policy change actually look like? A plan you've never rehearsed is a wish. ## Abstract the layer you don't control You can't control your vendors. You can control how tightly you're married to any one of them. - **Put a seam between your product and the model.** Call models through your own thin abstraction, not from a hundred hard-coded spots. Swapping providers should be a config change, not a migration. The teams that survive a vendor shock are the ones who kept the door unlocked. - **Own the assets that are actually yours.** Your prompts, your evaluation set, your customer data, your tone-of-voice rules — these are your IP. If they live inside a vendor's console, they're collateral. Keep them in your repo. - **Keep a fallback warm.** A second provider you've actually tested beats a contract clause you've only read. Route 1% of live traffic to it so the failover path is real when you need it. - **Watch terms and pricing like you watch competitor prices.** Vendor ToS and pricing pages change quietly. Put them on the same dashboard as your conversion rate. The change that hurts you rarely announces itself. ## Treat a ban like a business-continuity event Platform bans and account restrictions are not trivia for a cross-border seller — they're operational risks, and they belong in your continuity plan next to "supplier goes dark" and "shipping lane closes." - **Diversify the storefront.** One marketplace is one landlord. Own an email list and a second channel you can actually reach customers on. - **Back up the account, not just the data.** Export product data, customer records, and ad history on a schedule. If your account vanishes, your business shouldn't vanish with it. - **Document the recovery path.** Who logs in, who appeals, who talks to customers, who flips the fallback — before it happens, not at 2 a.m. ## The line worth holding This series has argued that you should keep the human on the irreversible decisions, and that an autonomous agent is a hand you must contain. This is the same lesson one level up: **the vendors under you are hands too — and their reach becomes your risk.** You don't need to run everything yourself. You need to know exactly where your business stops being yours, and to build the seams, backups, and fallbacks that make that boundary survivable. The court called it a supply-chain risk. Your job is to make sure it isn't *your* single point of failure.