A 14-person AI agency in Detroit built a real-time sentiment analysis product for a marketing analytics company. The product relied on an embedding model from a mid-size AI startup. The embedding model performed well, the product shipped, and the client was happy. Then the startup pivoted. They deprecated their embedding API with 45 days notice. The agency scrambled to find a replacement embedding model, discovered that the replacement produced different embedding dimensions that were incompatible with their vector database, and had to rebuild the entire embedding pipeline and re-embed 14 million documents. The migration took 11 weeks and cost $190,000 in engineering time and infrastructure costs. The client received degraded service for nearly three months.
The agency had no vendor governance. No vendor assessment before selection. No contractual protections for API deprecation. No contingency planning for vendor changes. No monitoring of vendor stability. The $190,000 migration was not a vendor failure — the vendor had every right to pivot their business. It was a governance failure — the agency did not manage the risk of depending on a single vendor without protections.
AI agencies depend on vendors for foundation models, cloud infrastructure, specialized tools, data services, and dozens of other components. Each vendor dependency is a risk vector. Vendor governance ensures you select vendors wisely, manage them actively, and protect your agency when vendor circumstances change.
Why AI Vendors Need Specific Governance
AI Vendors Are Younger and Less Stable
Many AI tool and service providers are startups. They pivot, get acquired, run out of funding, or change strategic direction. The AI vendor landscape is significantly less stable than the traditional enterprise software market.
AI Vendor Lock-In Is Deep
As covered in a previous article on vendor lock-in governance, AI vendor dependencies run deeper than traditional software dependencies. Changing a foundation model is not like changing a database driver — it can require rewriting prompts, re-evaluating outputs, retraining models, and rebuilding pipelines.
AI Vendor Performance Is Hard to Predict
Model capabilities, quality, and behavior change with each vendor update. A vendor that performs well today may degrade performance in their next release. Vendor governance needs to monitor ongoing quality, not just assess it at selection time.
AI Vendor Pricing Is Volatile
AI vendors are still finding their pricing models. Price changes of 2x to 5x have occurred multiple times in the market. Pricing model changes (tokens, requests, tiered pricing, committed capacity) add complexity.
AI Vendor Terms Are Evolving
AI vendor terms of service, usage policies, and data processing agreements are evolving rapidly. Changes in terms can affect how you build products, what data you can process, and what indemnification you receive.
The Vendor Governance Framework
Phase 1: Vendor Assessment and Selection
Before adopting any AI vendor, conduct a structured assessment.
Technical assessment:
- Capability evaluation — Does the vendor's product meet your technical requirements? Evaluate against specific use cases, not just marketing claims.
- Performance benchmarking — Test the vendor's product against your own benchmarks using your own data and use cases. Do not rely on vendor-published benchmarks.
- Integration complexity — How easy or difficult is integration? Are there standard APIs, SDKs, and documentation?
- Scalability — Can the vendor handle your expected scale? What are their published limits?
- Reliability — What is the vendor's historical uptime? Do they publish status pages and incident reports?
Business assessment:
- Financial stability — Is the vendor financially stable? For startups, assess funding status, burn rate, and revenue trajectory. For established companies, assess the commitment to the AI product line.
- Market position — Is the vendor a market leader, a viable competitor, or a niche player? Market position affects long-term viability.
- Customer base — Who else uses this vendor? A strong enterprise customer base suggests stability.
- Growth trajectory — Is the vendor growing? Stagnation may indicate future viability concerns.
- Acquisition risk — Could the vendor be acquired? What would acquisition mean for their product and pricing?
Legal and compliance assessment:
- Terms of service — Review terms thoroughly. Pay attention to data usage rights, liability limitations, and change provisions.
- Data processing agreement — Does the vendor offer a DPA that meets your regulatory requirements?
- Data handling — How does the vendor handle data you send through their service? Is data used for model training?
- Compliance certifications — Does the vendor have SOC 2, ISO 27001, HIPAA BAA, or other relevant certifications?
- Indemnification — Does the vendor indemnify for IP infringement, data breaches, or other risks?
Risk assessment:
- Lock-in risk — How difficult would it be to migrate away from this vendor? (Assess using the vendor lock-in framework)
- Dependency risk — How critical is this vendor to your operations? What happens if the vendor is unavailable?
- Pricing risk — How predictable is pricing? Has the vendor changed pricing significantly in the past?
- Deprecation risk — How likely is the vendor to deprecate the specific product or API you depend on?
Assessment documentation:
Create a vendor assessment scorecard that rates each dimension on a defined scale. Set minimum scores for vendor adoption. Document the assessment for audit and future reference.
Phase 2: Vendor Onboarding
Once a vendor is selected, onboard them into your governance framework.
Contractual setup:
- Negotiate and sign vendor agreements (master service agreement, data processing agreement, SLA)
- Ensure contractual protections for pricing stability, API stability, deprecation notice, and data portability
- Define performance metrics and SLA thresholds with meaningful remedies
- Include termination provisions with transition assistance obligations
- Address intellectual property rights for outputs generated using the vendor's service
Technical setup:
- Establish vendor accounts with appropriate access controls
- Configure cost monitoring and alerting for vendor services
- Implement vendor-specific monitoring for performance and availability
- Set up integration testing that verifies vendor service behavior
- Document vendor configurations and integration points
Operational setup:
- Assign a vendor relationship owner within your agency
- Establish communication channels with the vendor (support, account management)
- Configure vendor notifications (status updates, product announcements, pricing changes)
- Add the vendor to your vendor registry with all relevant metadata
Phase 3: Ongoing Vendor Management
Vendor governance does not end at selection. Active management ensures vendors continue to meet your needs.
Performance monitoring:
- Monitor vendor API performance (latency, error rates, availability) continuously
- Track vendor service quality against SLA commitments
- Monitor model quality (for foundation model vendors) — output quality can change with model updates
- Track cost trends and compare against budget and projections
- Report vendor performance metrics to stakeholders monthly
Relationship management:
- Conduct regular review meetings with key vendors (quarterly for critical vendors, semi-annually for others)
- Discuss performance, roadmap, pricing, and any concerns
- Share your roadmap with vendors so they can plan for your needs
- Escalate issues through defined escalation paths
- Maintain relationships with multiple contacts at the vendor (not just one point person)
Contract management:
- Track contract expiration and renewal dates
- Review terms and pricing at renewal against current market conditions
- Renegotiate terms that no longer reflect the market or your needs
- Monitor vendor compliance with contractual obligations
- Document any vendor term changes and assess their impact
Risk monitoring:
- Monitor vendor financial health through news, filings, and industry reports
- Track vendor personnel changes (CEO departures, mass layoffs signal instability)
- Monitor vendor product direction for alignment with your needs
- Assess vendor competitive position and market dynamics
- Update vendor risk assessments annually or when significant changes occur
Phase 4: Vendor Contingency Planning
For every critical vendor, maintain a contingency plan for vendor disruption.
Contingency plan elements:
- Alternative vendors — Identify and periodically evaluate alternative vendors for each critical dependency
- Migration playbook — Maintain documented procedures for migrating away from each critical vendor
- Migration timeline — Estimate the time required for migration under normal and emergency conditions
- Data portability — Ensure you can export all data from the vendor's service in usable formats
- Impact assessment — Document the impact of vendor disruption on each client engagement
- Communication plan — Define how you communicate vendor disruption to affected clients
- Testing cadence — Periodically test migration playbooks to ensure they remain current
Phase 5: Vendor Exit
When vendor relationships end — by your choice, the vendor's decision, or external circumstances — execute a governed exit process.
Exit process:
- Initiate transition planning at least 90 days before the planned exit (or immediately upon vendor-initiated deprecation)
- Execute migration playbook according to the documented procedures
- Validate migration through testing to ensure equivalent functionality with the replacement
- Coordinate with clients to manage any impact on their services
- Complete data migration to ensure no data is lost or orphaned
- Document lessons learned from the vendor relationship and exit process
- Update vendor registry with exit details and post-exit status
Vendor Governance for Client Engagements
When you select vendors for client projects, you bear responsibility for vendor governance on the client's behalf.
Client-facing vendor governance:
- Transparency — Disclose vendor dependencies to clients. Clients should know what third-party services power their AI products.
- Client approval — For critical vendor selections (especially foundation models), involve the client in the selection process. Some clients have approved vendor lists that must be respected.
- Compliance flow-through — Ensure vendor compliance certifications and data processing agreements satisfy the client's regulatory requirements.
- Risk communication — Communicate vendor risks to clients, including pricing volatility, deprecation risk, and lock-in implications.
- SLA alignment — Ensure your SLA commitments to clients are supported by your vendor SLAs. Do not commit to 99.9% uptime if your vendor only guarantees 99.5%.
- Exit planning — Include vendor contingency in the client engagement planning. Ensure the client knows what happens if a critical vendor becomes unavailable.
Vendor Governance Operating Model
Roles and Responsibilities
- Vendor governance lead — Oversees the vendor governance program, maintains the vendor registry, and ensures governance processes are followed
- Technical evaluators — Conduct technical assessments and benchmarking for vendor selection
- Legal/compliance reviewer — Reviews vendor contracts, terms, and compliance certifications
- Vendor relationship owners — Assigned for each critical vendor, responsible for ongoing relationship management
- Finance — Monitors vendor costs, manages budgets, and conducts cost analyses
Governance Cadence
- At selection — Full vendor assessment per the assessment framework
- At onboarding — Contractual, technical, and operational setup
- Monthly — Performance monitoring, cost tracking, issue resolution
- Quarterly — Vendor review meetings, risk assessment updates, contingency plan validation
- Annually — Comprehensive vendor portfolio review, contract renewals, governance process improvement
Vendor Registry
Maintain a centralized vendor registry containing:
- All active vendor relationships with key metadata
- Contract details and renewal dates
- Performance metrics and SLA compliance history
- Risk ratings and contingency plan status
- Relationship owner and key contacts
- Cost tracking and budget allocation
Your Next Step
Create a vendor inventory. List every third-party vendor and service that powers your AI operations — foundation model providers, cloud services, vector databases, MLOps tools, annotation services, monitoring tools, everything. For each vendor, assess: Do you have a contract? Do you know the terms? Is there a contingency plan? Who owns the relationship?
For vendors rated as critical — those whose disruption would significantly affect your operations or client delivery — conduct the full assessment outlined in this framework. Establish contingency plans for each. Assign relationship owners. Set up performance monitoring.
The Detroit agency's $190,000 migration cost was a vendor governance problem, not a vendor problem. A vendor assessment that evaluated deprecation risk, a contract that required adequate notice, and a contingency plan with a pre-qualified alternative would have reduced the migration cost by 80% and eliminated the three months of degraded client service. Build the governance before you need it.