The Observation

Only a handful of companies are truly foundational AI innovators. They own the base models and the platform economics, everyone else builds on top. The pattern we are now seeing repeatedly is what might be called platform predation of the middle-ware layer, every time a capability becomes commercially viable, the foundation model providers absorb it into the base offering.

Prompt engineering became a discipline, then system prompts got better and it faded. RAG architectures spawned an industry, then context windows expanded to hundreds of thousands of tokens. Orchestration tools created workflow businesses, then function calling and tool-use protocols emerged natively in the platforms. Each wave created companies that were killed in a heartbeat. The middle-ware graveyard is growing fast.

F1 teams know this feeling. The 2022 regulation reset wiped out an entire era of competitive advantage overnight. The 2026 overhaul, with new power units, a new aerodynamic philosophy and active aero is doing it again. In F1, no technical concept outlasts the rule book. The question is whether you are ready when it changes.

The strategic question for any business building on AI follows the same logic, where does your value sit relative to the absorption horizon? If your differentiator is a technical capability the platforms could trivially replicate, you are renting time. If it is domain-specific data, regulatory expertise or deep customer relationships, you are safer.

What This Means for Data Privacy

This matters for data privacy teams because the AI vendor landscape is now fundamentally unstable. The tool your organisation adopted six months ago may not exist in six months' time, or may have been absorbed into a larger platform with entirely different data processing terms, sub-processors and jurisdictional arrangements.

We frequently see organisations treating AI tool assessments as one-off exercises, a DPIA completed at procurement and never revisited. A one-off DPIA at procurement is like signing off a car's design for a regulation era and assuming it will still be compliant when the rules change. The cycle always comes around. Given the pace of platform consolidation, it is worth considering whether a living register of AI processors with regular review triggers might be more appropriate. When a tool gets acquired or its functionality gets absorbed into a larger platform, that is a material change in processing and may warrant reassessment under your existing framework.