The Observation

Most businesses will not build AI, they will apply it. The market is bifurcating into a tiny number of AI infrastructure companies, the builders and a vast number of application companies, the appliers, with almost nothing viable in between.

Most teams do not own the circuit. They show up and race on it. That is not a problem until the circuit owner changes the layout, sells the venue, or decides to run their own team. The middle layer of fine-tuning shops, prompt marketplaces, and AI implementation consultancies is the segment most exposed to the platform predation described earlier. This matters because it shapes how organisations should think about their vendor relationships and supply chain risk.

What This Means for Data Privacy

Your organisation is almost certainly an applier, not a builder. That means your AI supply chain risk assessment needs to go at least two layers deep: who built the model, who fine-tuned it, who hosts it, and what data flows where at each stage. Knowing whose circuit you are racing on means understanding not just your immediate supplier but who holds the concession.

It may be worth reviewing whether your processor due diligence questionnaire has been updated to cover AI-specific concerns: model provenance, training data practices, and sub-processor chains that are particular to AI vendors. We frequently encounter situations where a vendor's answer of "we use OpenAI" or "we use Anthropic" is treated as sufficient. In practice, "we use OpenAI" is the name of the circuit. It is not a description of the track conditions, which is the starting point of a set of questions about data flows, retention, and jurisdictional arrangements that need working through.