IBM Study Reveals Widespread Underestimation of AI Dependencies Among Companies

Companies across Europe, the Middle East, and Africa (EMEA), including Germany, are significantly underestimating their reliance on specific AI providers, models, and infrastructure, according to a new study by IBM. While discussions around AI sovereignty are prevalent, the practical understanding and management of these dependencies remain critically low, leading to substantial operational risks.

The study found that only 10% of companies in the EMEA region have a good grasp of their interconnectedness across various AI vendors, models, and infrastructure components. In Germany, this figure is slightly higher at 13%. This lack of clarity means that many organizations, while aware of their reliance on certain AI services, are ill-equipped to dissolve or secure these dependencies, especially when considering a change in primary providers or models.

Provider Switching Challenges

A stark indicator of this dependency is the difficulty companies face when contemplating a shift in their AI ecosystem. A significant 73% of surveyed executives in EMEA reported that switching their primary AI provider or model would be a challenging endeavor. In Germany, 65% of respondents expressed similar concerns. This highlights a potential for vendor lock-in, where the cost and complexity of migration deter companies from exploring alternatives, even if beneficial.

Data Residency and Sovereignty Concerns

The issue of data residency and sovereignty also presents a considerable hurdle. Across EMEA, 70% of respondents find it difficult to maintain compliance with data residency and sovereignty requirements across different geographical regions. This figure is mirrored in Germany, where 70% of participants also reported these challenges. As AI models become more deeply integrated into business processes, ensuring data remains within specific jurisdictions and under organizational control becomes increasingly complex.

Defining AI Sovereignty

IBM’s study clarifies that AI sovereignty should not be interpreted as complete independence. Instead, it is defined as the capability to regain control when necessary. This involves making dependencies visible, managing them effectively, and ensuring that components remain interchangeable. This principle applies across the entire AI stack, encompassing data, models, infrastructure, and applications. Unlike traditional enterprise systems where dependencies might end at infrastructure or applications, AI dependencies extend to the model layer and ongoing services, which the study identifies as the primary source of risk.

Critical Impact of AI Provider Outages

The potential consequences of AI service disruptions are profound. A substantial 81% of respondents in EMEA and 85% in Germany indicated that an outage of their primary AI provider lasting over seven days would have severe or critical repercussions. Over the past two years, companies in EMEA have reported an average of seven AI-related operational disruptions, while German firms reported six. In EMEA, provider services were the most common cause, whereas in Germany, technical issues were cited more frequently. This indicates that AI failures can stem from both traditional infrastructure problems and direct issues at the provider and model levels.

Multi-Vendor Strategies and Their Realities

Many organizations are adopting a multi-vendor approach to their AI environments, with 73% of surveyed companies describing their setup as intentionally multi-vendor. However, IBM notes that this diversity is often not the result of a deliberate strategy. Instead, it frequently arises from organizational segmentation, regional mandates, and legacy IT decisions. Independent decisions by specific business units (72%), geographical necessities (75%), and legacy complexity (63%) are cited as key drivers. The study emphasizes that multiple vendors only enhance operational freedom if the AI environment is actively managed. Without common standards for data, models, and security, complexity inevitably increases.

Willingness to Pay for Flexibility

The study also revealed a significant willingness among businesses to invest in strategic flexibility. In EMEA, 71% of respondents are prepared to accept up to a 20% cost increase for maintaining strategic flexibility in their AI operations. This sentiment is even stronger in Germany, where 79% of businesses are willing to pay more for this advantage. This indicates a clear recognition of the long-term value of agility in the face of evolving AI technologies and potential vendor shifts.

Selective Sovereignty as a Solution

In response to these challenges, the study advocates for the concept of “selective sovereignty.” This approach does not advocate for a complete withdrawal from proprietary environments but rather for targeted control over business-critical AI components. IBM suggests a three-tiered classification for AI systems: business-critical systems, important but non-differentiating functions, and commodity services. For Tier-1 systems, which are truly critical, the focus should be on rapid data migration, interchangeable models, and tested failover pathways. For less critical functions, managing dependencies and clearly defining contractual and architectural boundaries suffice. For simple commodity services, a stronger vendor commitment can be economically sensible.

The study highlights that companies with the most advanced control functions are protected against AI-related disruptions by 55% more operating profit. However, globally, only 7% of surveyed organizations have achieved this level of control.

Data and Model Migration Complexities

Migrating data and models remains a significant bottleneck. On average, it takes 145 days to move AI training and operational data to a different environment. Globally, 68% of respondents find adhering to data residency and sovereignty requirements across regions difficult, translating into a practical migration problem rather than a theoretical compliance issue. The inability to cleanly export, replicate, or retain data locally ties companies to their provider’s architecture.

Similarly, model migration is complex. 57% of respondents state that replacing a core model would require significant decoupling or a complete rebuild. A model change often impacts not only the model itself but also prompting, fine-tuning, RAG pipelines, evaluation, security filters, and monitoring, turning a seemingly small swap into a major architectural undertaking.

Infrastructure Relocation Challenges

Even infrastructure relocation presents considerable delays. 56% of respondents report that it would take at least six months to shift core AI systems and applications to another provider. For IT departments, this means that genuine sovereignty is not achieved through a single product or contract but through portability, clear interfaces, and tested fallback scenarios. Organizations that fail to establish these fundamentals risk being in a defensive position when faced with price changes, model deprecations, or usage restrictions.

Key Facts

This study underscores a critical gap between the discourse on AI sovereignty and the practical capabilities of businesses to manage their AI-driven operations independently. For ReviewArticle readers, this means that while adopting AI offers immense potential, a thorough understanding and proactive management of dependencies are crucial to avoid unforeseen costs, operational disruptions, and limitations on strategic flexibility. The findings suggest that a deliberate strategy for managing data, models, and infrastructure portability is essential for long-term success and resilience in the AI era.

Source: Heise KI, “Firmen unterschätzen ihre KI-Abhängigkeiten massiv”, https://www.heise.de/news/Firmen-unterschaetzen-ihre-KI-Abhaengigkeiten-massiv-11337683.html?wt_mc=rss.red.ho.themen.k%C3%BCnstliche+intelligenz.beitrag.beitrag