What if our main supplier changes the deal?

When I retired, I hired a team of about sixteen AI assistants. They write my newsletters, run my FerryIntel and AIIntel sites, keep my decision records and check each other's work. It's been one of the most enjoyable projects of my life. But every one of those assistants runs on a single platform from a single supplier.

Any director will recognise that problem straight away. If one supplier carries your whole operation, you have a business continuity risk, however good that supplier is. I want to be clear that this isn't a complaint about mine. I have no inside knowledge of its plans or pricing. The question is the one I'd ask in any boardroom: what if it went away tomorrow, or changed its cost model further than we could follow?

Here's what we noticed, what we planned, and what we've actually done.

What we noticed

The first sign wasn't a crisis. It was the meter. The platform gives me a weekly allowance of usage. Heavy jobs and recurring checks consume the allowance, leaving less capacity for other work. I now watch that usage alongside the subscription cost.

The second thing we noticed was how much of the business sits "inside" the assistants. They remember my decisions, my preferences and my routines. If that memory lived only on the platform, losing the platform would mean losing the institutional knowledge as well, and not just the workers.

There was a smaller lesson too. Continuity planning also needs to cover temporary loss of access to the tools we use.

What we planned

We made three plans. I'm calling them plans because they aren't finished.

First, we'll make the simple jobs independent of the AI. I've approved a list of routines that could become plain scripts. These are regular jobs that don't really need an AI to think. The aim is to make those jobs less dependent on the platform; that will need testing.

Second, we'll measure every assistant's worth. I've approved a regular "report card" for the bots. The review should help us judge whether each one is worth what it uses.

Third, we'll pace big work around the budget. Recently I decided to hold all new builds until the usage allowance resets: no new sites, no new features, no previews. Everyday work I'd already approved carries on. It's a temporary pause on new development.

What we executed

These steps are in place, though not all are tested yet.

Documentation sits outside the platform. We keep core business documentation outside the AI platform. That is a starting point for continuity, not proof that another person or tool could restore operations; we still need to test that.

Hosting and code are separately controlled. We control our website hosting and code repository independently of the AI platform.

Subscriber-data recovery is part of the plan. Our continuity planning includes the privacy and security requirements for subscriber-data recovery.

Spending is watched. One assistant checks how fast we're using the allowance each week, and another reviews routines for waste. I also have a standing rule: no new recurring jobs without my approval. Every automatic job uses capacity, and someone should sign off on it.

The authority stays human. Publication, sending and spending require my explicit approval. Decision records preserve that approval; they do not create it. Emails are prepared as drafts for me to send.

None of this is clever. These are principles I'm working towards, the same discipline any well-run organisation applies to an outsourced provider: own your data, document your decisions, and know your exit route.

When dependency exceeds our risk appetite

I've come to believe a board should decide its risk appetite first, and only then decide where the technology sits. The same goes here. Depending on one supplier isn't wrong in itself. What matters is choosing how much dependence we're willing to accept, and knowing when we've gone past it.

I've thought about what would tell me we'd crossed that line. One sign would be a change in the supplier's cost or terms that we couldn't absorb. Another would be losing access for longer than the business could tolerate. A third would be when too much of the business only works through the one platform. These are my principles, not tested trigger points, and I haven't put numbers on them.

If we did cross the line, for my operation I would first consider pausing new dependencies, then assess which jobs could safely move and what alternatives were workable. Any move would need testing. That's why we started the groundwork above, even though some of it is still untested.

Questions boards could consider

1. If our main AI supplier stopped tomorrow, what would keep running? And what would stop?
2. Where do our records, code and customer lists actually live? Could we take them elsewhere?
3. Do we know our running cost each week, and who's watching it?
4. Which tasks really need AI? Could some run as simple, cheaper software?
5. Are decisions recorded somewhere we control, with a human approving them?
6. Have we set our risk appetite for dependence on a single AI supplier, and would we know if we'd exceeded it?
7. What would make us change suppliers, and have we tested how we'd do it?

Closing

My assistants are wonderful, but they're a supplier, not the business. The business is the decisions, the records, the relationships and the judgement, and those need to stay with the people accountable for them. That's true for a small operation, and it's true for any board.

General commentary only. Not tailored to your circumstances and not a substitute for legal or other professional advice.