DECISION BRIEF 34 · AI STRATEGY & CAPITAL ALLOCATION
AI Procurement Strategy: Build Exit Rights Before You Scale
An AI procurement strategy should treat exit capacity as a design requirement, not a clause negotiated after dependency has formed. Before scaling a vendor, CEOs should require portable data, transferable controls, transparent economics, retained internal capability, and a tested route to switch or stop.
Evidence Signal
Only 21 of 36 OECD countries—58%—reported central support for procuring AI goods and services. The OECD warned that weak procurement guidance can leave organisations exposed to vendor lock-in, unclear accountability, weak transparency, unresolved data and IP rights, poor auditability, and missing exit arrangements. Scope: national governments; published 2026. Limitation: public-sector evidence does not directly measure private-company outcomes.
The decision question
The CEO must decide which dependencies are acceptable, which capabilities must remain portable, and what evidence is required before an AI supplier becomes embedded in a critical workflow. This is not a procurement-team decision alone. It changes strategic optionality, operating resilience, cost structure, data rights, and the organisation’s ability to govern its own decisions.
Point of view: the contract is part of the operating model
The conventional assumption is that vendor selection ends when functionality, security, and price are acceptable. That logic was already incomplete for cloud software. It is more dangerous for AI because performance can depend on a shifting stack of models, tools, data pipelines, agent identities, evaluation systems, and subcontractors.
AI changes the procurement decision in five ways. It makes usage costs more variable, model behaviour less deterministic, supplier chains more layered, data-derived assets more valuable, and workflow knowledge more likely to migrate into a vendor-controlled environment. A technically interoperable API does not guarantee that context, memory, evaluations, controls, or business rules can move with it.
The practical implication is clear: procurement terms determine future decision rights. If the enterprise cannot retrieve its data, reproduce its controls, understand price drivers, or operate a degraded alternative, the supplier is not merely providing technology. It is accumulating authority over the workflow.
Thought process: separate replaceable technology from retained capability
A good AI procurement strategy begins by mapping what must remain under enterprise control even when the model or vendor changes. The analysis should follow the complete workflow, not the software licence.
| Layer | Can be outsourced | Must remain governable |
|---|---|---|
| Model and infrastructure | Compute, foundation models, managed tooling | Approved alternatives, performance thresholds, switching triggers |
| Data and context | Processing and storage under agreed controls | Rights, provenance, export format, deletion evidence, derived assets |
| Workflow logic | Vendor implementation support | Decision rules, escalation paths, evaluation set, process documentation |
| Identity and access | Managed identity components | Task-scoped authority, revocation, audit logs, accountable sponsor |
| Economics | Usage-based services | Unit-cost visibility, caps, repricing triggers, total exit cost |
| People | Specialist delivery capacity | Domain knowledge, contract management, oversight, recovery capability |
Five CEO gates before scale
Scale only when the supplier relationship passes five gates together. A strong result in one gate does not compensate for a structural weakness in another.
- Outcome gate. The workflow proves a business result against a credible baseline, not only model accuracy or user enthusiasm.
- Portability gate. The enterprise can export relevant data, prompts, configurations, evaluations, logs, and derived artefacts in usable formats with defined time and cost.
- Control gate. The contract preserves audit rights, change notification, incident access, model and subprocessor transparency, and the power to suspend high-impact actions.
- Economics gate. Pricing exposes the units that drive cost, includes consumption guardrails, and models migration and dual-running expense—not just the first-year licence.
- Exit-readiness gate. A named owner, replacement path, knowledge-transfer package, and tested degraded mode exist before the dependency becomes critical.
What AI can augment—and what remains CEO judgment
AI can accelerate evidence collection, contract comparison, usage forecasting, control testing, and vendor-performance monitoring. It can identify inconsistent clauses, simulate consumption scenarios, and flag deviations from approved configurations. Those are augmentation opportunities.
AI cannot own the final trade-off between speed and strategic dependence. The CEO remains accountable for determining whether the workflow is important enough to require dual sourcing, whether a short-term advantage justifies switching cost, which failures are tolerable, and when organisational learning matters more than vendor convenience.
Decision rights
Make the allocation explicit before commercial negotiation begins.
- CEO decides: criticality tier, acceptable concentration, non-negotiable exit rights, and the capital-release gate.
- CFO delegates and instruments: unit economics, consumption caps, repricing exposure, and migration-cost scenarios.
- CIO/CTO delegates and instruments: architecture, portability, observability, fallback, and replacement testing.
- Legal, risk, security, and data leaders escalate: unresolved rights, opaque subprocessors, material model changes, audit limitations, and regulatory conflicts.
- Business owner stops: expansion when outcome evidence, adoption, or human accountability is weaker than the approved threshold.
The smallest credible 60-day test
Test exit capacity on one bounded workflow before expanding the contract. Do not wait for a renewal dispute to discover that portability was theoretical.
- Days 1–15: define the workflow baseline, dependency map, data rights, evaluation set, cost unit, and stop conditions.
- Days 16–35: operate the supplier solution with logging, human checkpoints, and a documented degraded mode.
- Days 36–50: export the required artefacts, reproduce the evaluation on an approved alternative or internal sandbox, and measure effort, loss, and downtime.
- Days 51–60: decide whether to scale, renegotiate, dual-source, redesign, or stop.
Success: the workflow improves its target outcome, export is complete and usable, alternative operation meets the minimum threshold, and total unit cost stays within the approved range. Failure: essential context or controls cannot move, material costs remain opaque, or human oversight cannot reconstruct the decision trail. Stop: the supplier refuses necessary audit or portability terms, changes a critical subprocessor without acceptable control, or the workflow cannot operate safely in degraded mode.
Evidence ledger
- OECD, Digital Government Outlook 2026: Adopting and governing AI in government — published 2026; procurement support, lock-in, accountability, rights, auditability, lifecycle and exit risks.
- US Government Accountability Office, Artificial Intelligence Acquisitions — 2026; portability, licensing, pricing transparency, testing, oversight, and vendor-lock-in terms.
- US General Services Administration, Buy AI — accessed 29 October 2026; problem definition, sandbox testing, data controls, cross-functional ownership, and cost monitoring.
- OECD, Agentic AI in organisations — 16 September 2026; bounded autonomy, checkpoints, layered controls, least privilege, and monitoring.
- Komdigi, Indonesia’s AI ethics and national roadmap discussion — 6 May 2026; Indonesian governance context. The reported instruments were still awaiting presidential enactment at publication, so this brief does not treat them as binding rules.
Continue reading
- Decision Brief 33: Sovereign AI Strategy
- Decision Brief 27: AI Operational Resilience
- Decision Brief 28: AI Agent Identity Governance
Discuss this decision. If your organisation is negotiating an AI platform, agentic workflow, or renewal, bring the dependency map and decision gate into the conversation.
Share: LinkedIn · X · Facebook · WhatsApp
Evidence reviewed: 29 October 2026. Geographic note: the procurement evidence is international and public-sector weighted; private enterprises should adapt the gates to their industry, jurisdiction, and risk profile.