Set the model sourcing posture and concentration limit

In plain terms

Decide build, buy or multi-provider, and how much dependence on one provider is acceptable. Without a posture the estate consolidates by convenience and the organization acquires a strategic dependency it never chose.

What is being judged

Two things that are usually conflated.

The posture. Where models come from, by class of use. Most organizations arrive at a mixed position: commercial models for general capability, self-hosted for sensitive data, occasionally in-house for something genuinely differentiating. The judgment is which use goes where, and the honest version states what the organization will not build.

The concentration limit. The share of production systems that may depend on a single provider. This is the number that makes the posture enforceable, and it is what triggers the Layer 4 aggregate exposure assessment.

Measure concentration by systems, not by spend. A cheap provider serving twenty systems is a larger dependency than an expensive one serving two, and a spend-based measure hides exactly that case.

What this decision does not cover

It does not admit any specific model, which is L2-02, or contract for one, which is L4-VEN-01. It does not accept the current exposure position, which is L4-RSK-06.

When it fires

On event. When the Layer 4 aggregate exposure assessment reports concentration above the stated limit. On admission of a model from a provider not currently in the estate. On a provider event affecting the estate.

On cycle. Annually, or on an aggregate exposure finding.

What you need before deciding

The aggregate exposure assessment, with concentration measured by system count. Which uses are genuinely differentiating, which is usually fewer than claimed. Switching cost per provider, including prompt and evaluation rework rather than only contract terms. Data residency and sovereignty constraints from Layer 4.

How this goes wrong

Concentration by default: no posture, every team picks what was easiest, and they converge. The Layer 6 anti-pattern. A limit nobody measures against: a stated concentration ceiling with no assessment producing the figure, which is a policy with no instrument. Posture as procurement preference: a stated preference with no limit and no trigger, which changes nothing about what teams actually do.

Related decisions

Loop L4-RSK-06 aggregate exposure. The assessment triggers this decision; this decision sets the limit that triggers the assessment. Intentional.

Downstream L2-02 model admission, L4-VEN-01 licensing, L2-03 technology selection.

Upstream L6-01 strategy.

Instrument references

COBIT APO10 managed vendors addresses vendor risk per relationship. None addresses concentration across an AI estate, which is the aggregate half of crosswalk gap 7.