On 8 October, 38 of the UK’s largest banks and financial market infrastructure operators took part in a Bank of England-led exercise to test how the financial sector would respond to a global cloud services disruption.
Twelve days later, a power-related outage in Google Cloud’s London region disrupted services across financial institutions and other organisations.
Revolut, Lloyds and HSBC were among the banks affected, while the disruption also affected the video platform used for remote court hearings.
The exercise hadn’t predicted the incident and the actual outage was not on the scale of the scenario being tested. Regardless, the timing was striking.
It illustrated why the resilience of shared technology infrastructure has become a concern for the financial sector as a whole, rather than simply a matter for individual firms and their technology suppliers.
Earlier this year, our Key Business Concerns for 2026 report identified infrastructural monopolies as one of ten areas deserving particular attention.
Throughout November, we’re revisiting three of those concerns, looking at what subsequent developments tell us about the risks involved.
We start with technology concentration, where the issue now extends beyond cloud infrastructure to include AI model providers and, increasingly, the political and regulatory decisions that can affect access to their services.
Different services, shared dependencies
For financial institutions, the advantages of using large technology providers are considerable.
Cloud infrastructure offers capacity, specialist expertise, and capabilities that many organisations would find difficult or expensive to develop independently.
The same is increasingly true of AI. Rather than building and maintaining their own models, firms can access powerful capabilities through external providers and incorporate them into existing applications and business processes.
But the number of firms using these technologies is growing much faster than the number of organisations providing the underlying infrastructure.
The scale of that concentration is becoming clearer.
In its October 2026 survey of AI adoption in UK financial services, the Bank of England and FCA found that the three largest cloud and compute providers accounted for 79% of the cloud and compute hosting relationships reported by participating firms.
The three largest AI model and API hosting providers accounted for 54% of the model and API hosting relationships reported.
Interestingly, the three largest cloud providers were also among the five largest providers of AI model and API hosting services.
These figures relate to the providers identified by survey respondents, rather than the entire market, but they demonstrate how concentrated the services supporting financial institutions have become.
The report also found that third-party implementations accounted for 53% of the AI systems firms classified as highly material, compared with 35% in the 2024 survey.
External AI services are increasingly involved in activities that organisations themselves consider significant.
This creates a problem that isn’t necessarily obvious from a firm’s list of suppliers.
For example, an organisation might use different vendors for customer services, data analysis, operational processes and AI applications. Each may have its own contract, service arrangements and risk assessment.
Yet several of those services could depend on the same underlying cloud infrastructure, or on AI capabilities provided by another shared supplier.
The organisation may appear to have diversified its technology relationships while remaining exposed to a relatively small number of providers.
And if one of those providers experiences a serious disruption, the consequences may extend across several business functions simultaneously.
When access depends on more than technology
Concentration also introduces risks that have little to do with technical failure.
Access to a critical technology service may be affected by government decisions, contractual disputes or changes in the geopolitical environment.
The events surrounding Anthropic in the United States provide an interesting example.
In February, President Donald Trump directed federal agencies to stop using Anthropic’s technology following a dispute between the company and the Pentagon over the permitted military uses of its AI models.
The dispute continued through subsequent legal challenges. In August, a federal judge ruled that aspects of the government’s action against Anthropic were unlawful.
A separate appeals court decision in September went in the Pentagon’s favour, allowing restrictions on Anthropic’s use in Defense Department systems to continue.
These decisions concerned different legal routes used by the government to restrict Anthropic, rather than a general prohibition on businesses using its models.
Nevertheless, the dispute demonstrates how access to an established AI provider can become entangled in questions of government policy, contractual rights and national security.
The treatment of Chinese AI models provides another example.
In October, the US Department of Homeland Security published an order requiring federal civilian agencies to exclude DeepSeek products from procurement and remove them from their IT systems. The restrictions also extended to certain third-party products incorporating DeepSeek implementations.
Again, this was not a blanket ban on commercial use. But it illustrates how geopolitical and security considerations can influence which technologies organisations are permitted to use.
For financial institutions operating internationally, or supplying services to organisations subject to particular restrictions, these developments introduce questions beyond conventional technology resilience.
What happens if a model embedded in an important business process becomes unavailable to a particular customer, jurisdiction or activity?
Could an alternative be introduced without affecting performance, controls or regulatory compliance?
And how much notice would the organisation realistically have to make that change?
Unlike a conventional outage, a restriction on access might not affect every customer or service. Its consequences could depend on where an organisation operates, who it serves and the contracts under which the technology is provided.
That makes the exposure more complicated to assess.
Knowing your suppliers isn’t the same as understanding your dependencies
Most financial institutions already have arrangements for managing third-party risk.
They assess suppliers, review service agreements, monitor performance and maintain business continuity plans.
The challenge is whether those arrangements provide a sufficiently complete picture of the dependencies beneath the services being purchased.
The Bank of England and FCA’s latest AI survey offers another revealing finding.
Of the 169 distinct cloud and compute provider relationships reported by participating firms in the survey, 37% were assessed as both highly critical and difficult to substitute.
Yet only 35% of that highly critical, hard-to-substitute group had tested exit plans, and that gap matters.
Having an alternative provider identified is not necessarily the same as being able to move an important service to that provider within an acceptable timeframe.
Data may need to be migrated. Applications may rely on specific infrastructure or interfaces. Security arrangements, operational controls and dependencies on other systems may need to be reconfigured and tested.
Moving between AI models can introduce further complications, particularly where a model has already been integrated into decision-making processes or relied upon to produce outputs that have been validated against particular requirements.
There is also the question of whether apparent alternatives are genuinely independent.
Two suppliers may offer competing services while using the same underlying cloud infrastructure. Moving from one to the other would not necessarily eliminate the original concentration risk.
These issues become more significant when several important business services rely on the same provider, directly or indirectly.
A firm might have credible recovery arrangements for each service individually, yet still struggle if a common dependency affects several of them at once. Traditional supplier-by-supplier assessments can therefore leave gaps in the overall risk picture.
A risk that extends beyond individual organisations
Regulators have been responding to the systemic implications of technology concentration.
In July, HM Treasury designated Amazon Web Services, Google Cloud, Microsoft and Oracle entities as the UK’s first Critical Third Parties.
The Bank of England, PRA and FCA began overseeing the designated providers under a regime intended to strengthen the resilience of services considered important to the UK financial system.
Where many firms depend on the same providers, a failure at one organisation can have consequences that extend well beyond its own customers.
The October cloud disruption offered a timely illustration of that exposure.
However, the new oversight regime does not remove individual firms’ responsibility for managing their own third-party risks. Regulators have been explicit that existing outsourcing and operational resilience obligations continue to apply.
A firm may have limited influence over how a major cloud provider operates, how an AI developer changes its services or how governments regulate access to particular technologies.
It remains responsible for understanding the consequences for its own operations.
This requires more than identifying which suppliers are important.
It means understanding which business services depend on those suppliers, where dependencies overlap, how quickly alternatives could be implemented and whether the arrangements intended to maintain continuity would actually work.
It also means recognising that the nature of a dependency can change. A service that was relatively easy to replace when first introduced may become much harder to substitute once it has been integrated into multiple processes.
How much control does the organisation really have?
The concentration of cloud infrastructure and AI provision is unlikely to reverse quickly.
The scale, investment and expertise needed to operate these technologies create significant barriers to entry. For many financial institutions, using established external providers will remain the most practical approach.
The challenge is understanding what that growing dependence means in practice.
The events of recent months show that disruption can arise in different ways.
Infrastructure can fail, a shared provider can affect multiple firms simultaneously, and access to AI technologies can become subject to decisions taken far outside an organisation’s own operations.
Each creates a different challenge for resilience planning.
Financial institutions may be able to diversify their suppliers, strengthen contracts and improve contingency arrangements. But those measures are only as useful as the understanding of the underlying dependencies on which they are based.
An organisation can retain responsibility for a critical business service while having relatively little control over the technology on which that service depends.
The important question is whether its risk assessments, resilience arrangements and governance reflect that reality.
Stay up to date with the latest news and views from the world of governance, risk, audit and compliance >>>
